FreeCalypso > hg > freecalypso-reveng

comparison dsample-fw-disasm @ 207:d12a3207b1aa

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
D-Sample 20020917 firmware analysis
author Mychaela Falconia <falcon@ivan.Harhan.ORG>
date Fri, 01 Jan 2016 23:24:05 +0000
parents
children 7b679943b57d
comparison
equal deleted inserted replaced
206:11761eaf712c 207:d12a3207b1aa
1 ; The present work is a disassembly analysis of the 20020917 firmware image
2 ; read out of our vintage D-Sample C05 board.
3
4 0: ea0004e7 b 0x13a4
5 4: ea003ffd b 0x10000
6 8: ea003ffd b 0x10004
7 c: ea003ffd b 0x10008
8 10: ea003ffd b 0x1000c
9 14: ea003ffd b 0x10010
10 18: ea003ffd b 0x10014
11 1c: ea003ffd b 0x10018
12
13 ; constant pool before _INT_Bootloader_Start matches TCS211
14 1378: fffffb00
15 137c: 02a102a1
16 1380: 028302a1
17 1384: 00c00281
18 1388: 002a0040
19 138c: fffffd00
20 1390: ffff9800
21 1394: fffffb10
22 1398: ffffff08
23 139c: 20061081
24 13a0: 00000800
25
26 _INT_Bootloader_Start: ; code fully matches TCS211
27 13a4: e51f101c ldr r1, =0xffff9800 ; via 0x1390
28 13a8: e15f21b2 ldrh r2, =0x2006 ; via 0x139e
29 13ac: e1c120b0 strh r2, [r1]
30 13b0: e5912000 ldr r2, [r1]
31 13b4: e2022001 and r2, r2, #1
32 13b8: e3520001 cmp r2, #1
33 13bc: 0afffffb beq 0x13b0
34 13c0: e51f103c ldr r1, =0xfffffd00 ; via 0x138c
35 13c4: e15f23b0 ldrh r2, =0x1081 ; via 0x139c
36 13c8: e1c120b0 strh r2, [r1]
37 13cc: e51f1040 ldr r1, =0xfffffb10 ; via 0x1394
38 13d0: e15f23b8 ldrh r2, =0x800 ; via 0x13a0
39 13d4: e1d100b0 ldrh r0, [r1]
40 13d8: e1800002 orr r0, r0, r2
41 13dc: e1c100b0 strh r0, [r1]
42 13e0: e51f1050 ldr r1, =0xffffff08 ; via 0x1398
43 13e4: e15f24ba ldrh r2, =0x0 ; via 0x13a2
44 13e8: e1c120b0 strh r2, [r1]
45 13ec: e51f107c ldr r1, =0xfffffb00 ; via 0x1378
46 13f0: e15f27bc ldrh r2, =0x2a1 ; via 0x137c
47 13f4: e1c120b0 strh r2, [r1]
48 13f8: e15f28b2 ldrh r2, =0x2a1 ; via 0x137e
49 13fc: e1c120b2 strh r2, [r1, #2]
50 1400: e15f28b8 ldrh r2, =0x2a1 ; via 0x1380
51 1404: e1c120b4 strh r2, [r1, #4]
52 1408: e15f28be ldrh r2, =0x283 ; via 0x1382
53 140c: e1c120b6 strh r2, [r1, #6]
54 1410: e15f29b4 ldrh r2, =0x281 ; via 0x1384
55 1414: e1c120ba strh r2, [r1, #10] ; 0xa
56 1418: e15f29ba ldrh r2, =0xc0 ; via 0x1386
57 141c: e1c120bc strh r2, [r1, #12] ; 0xc
58 1420: e15f2ab0 ldrh r2, =0x40 ; via 0x1388
59 1424: e1c120b8 strh r2, [r1, #8]
60 1428: e15f2ab6 ldrh r2, =0x2a ; via 0x138a
61 142c: e1c120be strh r2, [r1, #14] ; 0xe
62 1430: e59f0020 ldr r0, =0x107921c ; via 0x1458
63 1434: e3a01b01 mov r1, #1024 ; 0x400
64 1438: e2411004 sub r1, r1, #4
65 143c: e0802001 add r2, r0, r1
66 1440: e3c22003 bic r2, r2, #3
67 1444: e1a0d002 mov sp, r2
68 1448: e92d100f stmdb sp!, {r0, r1, r2, r3, r12}
69 144c: eb000046 bl 0x156c
70 1450: e8bd100f ldmia sp!, {r0, r1, r2, r3, r12}
71 1454: ea003afd b 0x10050
72 1458: 0107921c
73
74 _sta_select_application: (ARM->Thumb veneer)
75 156c: e92d4000 stmdb sp!, {lr}
76 1570: e28fe001 add lr, pc, #1
77 1574: e12fff1e bx lr
78 1578: f7ff fd63 bl 0x1042
79 157c: 4778 bx pc
80 157e: 46c0 nop (mov r8, r8)
81 1580: e8bd8000 ldmia sp!, {pc}
82
83 ; branch target addresses differ from TCS211
84 10000: ea0000bf b 0x10304
85 10004: ea0000c4 b 0x1031c
86 10008: ea0000c9 b 0x10334
87 1000c: ea0000ce b 0x1034c
88 10010: ea0000d3 b 0x10364
89 10014: ea0000b0 b 0x102dc
90 10018: ea0000b4 b 0x102f0
91
92 ; Constant pool
93 ; Difference between this version and TCS211: the newer TCS211 version
94 ; includes constants 0xFFFEF006 and 0x00000008 for the 8 MiB
95 ; memory bank setup. This difference must be responsible for the
96 ; 0x10050 vs. 0x10058 discrepancy.
97
98 1001c: 02a102a1
99 10020: 028302a1
100 10024: 02c00e85
101 10028: 002a0040
102 1002c: fffffb00
103 10030: fffffd00
104 10034: ffff9800
105 10038: fffffb10
106 1003c: ffffff08
107 10040: 20021081
108 10044: f7ff0800
109 10048: 00000000
110 1004c: 0001047c ; .cinit base
111
112 _INT_Initialize:
113 ; beginning matches TCS211
114 10050: e51f1024 ldr r1, =0xffff9800 ; via 0x10034
115 10054: e15f21ba ldrh r2, =0x2002 ; via 0x10042
116 10058: e1c120b0 strh r2, [r1]
117 1005c: e5912000 ldr r2, [r1]
118 10060: e2022001 and r2, r2, #1
119 10064: e3520001 cmp r2, #1
120 10068: 0afffffb beq 0x1005c
121 1006c: e51f1044 ldr r1, =0xfffffd00 ; via 0x10030
122 10070: e15f23b8 ldrh r2, =0x1081 ; via 0x10040
123 10074: e1c120b0 strh r2, [r1]
124 10078: e51f1048 ldr r1, =0xfffffb10 ; via 0x10038
125 1007c: e15f23be ldrh r2, =0xf7ff ; via 0x10046
126 10080: e1d100b0 ldrh r0, [r1]
127 10084: e0000002 and r0, r0, r2
128 10088: e1c100b0 strh r0, [r1]
129 1008c: e51f1058 ldr r1, =0xffffff08 ; via 0x1003c
130 10090: e15f25b0 ldrh r2, =0x0 ; via 0x10048
131 10094: e1c120b0 strh r2, [r1]
132 10098: e51f1074 ldr r1, =0xfffffb00 ; via 0x1002c
133 1009c: e15f28b8 ldrh r2, =0x2a1 ; via 0x1001c
134 100a0: e1c120b0 strh r2, [r1]
135 100a4: e15f28be ldrh r2, =0x2a1 ; via 0x1001e
136 100a8: e1c120b2 strh r2, [r1, #2]
137 100ac: e15f29b4 ldrh r2, =0x2a1 ; via 0x10020
138 100b0: e1c120b4 strh r2, [r1, #4]
139 100b4: e15f29ba ldrh r2, =0x283 ; via 0x10022
140 100b8: e1c120b6 strh r2, [r1, #6]
141 100bc: e15f2ab0 ldrh r2, =0xe85 ; via 0x10024
142 100c0: e1c120ba strh r2, [r1, #10] ; 0xa
143 100c4: e15f2ab6 ldrh r2, =0x2c0 ; via 0x10026
144 100c8: e1c120bc strh r2, [r1, #12] ; 0xc
145 100cc: e15f2abc ldrh r2, =0x40 ; via 0x10028
146 100d0: e1c120b8 strh r2, [r1, #8]
147 100d4: e15f2bb2 ldrh r2, =0x2a ; via 0x1002a
148 100d8: e1c120be strh r2, [r1, #14] ; 0xe
149 ; TCS211 version does the 8 MiB memory bank setup at this point
150 100dc: e10f0000 mrs r0, CPSR
151 100e0: e3c0001f bic r0, r0, #31 ; 0x1f
152 100e4: e3800013 orr r0, r0, #19 ; 0x13
153 100e8: e38000c0 orr r0, r0, #192 ; 0xc0
154 100ec: e129f000 msr CPSR_fc, r0
155 ; bss clearing is done inline here, whereas TCS211 version calls _INT_memset
156 100f0: e59f0304 ldr r0, =0x1000cf4 ; via 0x103fc
157 100f4: e3a02000 mov r2, #0
158 100f8: e59f1300 ldr r1, =0x107921c ; via 0x10400
159 100fc: e4802004 str r2, [r0], #4
160 10100: e1500001 cmp r0, r1
161 10104: 1afffffc bne 0x100fc
162 10108: e59f02f4 ldr r0, =0x819450 ; via 0x10404
163 1010c: e3a02000 mov r2, #0
164 10110: e59f12f0 ldr r1, =0x83eda0 ; via 0x10408
165 10114: e4802004 str r2, [r0], #4
166 10118: e1500001 cmp r0, r1
167 1011c: 1afffffc bne 0x10114
168 ; setting _INT_Loaded_Flag?
169 ; code matches TCS211 0x10150 from this point onward
170 10120: e3a00001 mov r0, #1
171 10124: e59f12e4 ldr r1, =0x107916c ; via 0x10410
172 10128: e5810000 str r0, [r1]
173 ; stack setup matching 0x1015c in TCS211
174 1012c: e59f02d8 ldr r0, =0x1079308 ; via 0x1040c
175 10130: e3a01b01 mov r1, #1024 ; 0x400
176 10134: e2411004 sub r1, r1, #4
177 10138: e0802001 add r2, r0, r1
178 1013c: e1a0a000 mov r10, r0
179 10140: e59f32cc ldr r3, =0x83c148 ; via 0x10414
180 10144: e583a000 str r10, [r3]
181 10148: e1a0d002 mov sp, r2
182 1014c: e59f32c4 ldr r3, =0x83c26c ; via 0x10418
183 10150: e583d000 str sp, [r3]
184 10154: e3a01080 mov r1, #128 ; 0x80
185 10158: e0822001 add r2, r2, r1
186 1015c: e10f0000 mrs r0, CPSR
187 10160: e3c0001f bic r0, r0, #31 ; 0x1f
188 10164: e3800012 orr r0, r0, #18 ; 0x12
189 10168: e129f000 msr CPSR_fc, r0
190 1016c: e1a0d002 mov sp, r2
191 10170: e3a01c02 mov r1, #512 ; 0x200
192 10174: e0822001 add r2, r2, r1
193 10178: e10f0000 mrs r0, CPSR
194 1017c: e3c0001f bic r0, r0, #31 ; 0x1f
195 10180: e3800011 orr r0, r0, #17 ; 0x11
196 10184: e129f000 msr CPSR_fc, r0
197 10188: e1a0d002 mov sp, r2
198 1018c: e10f0000 mrs r0, CPSR
199 10190: e3c0001f bic r0, r0, #31 ; 0x1f
200 10194: e3800017 orr r0, r0, #23 ; 0x17
201 10198: e129f000 msr CPSR_fc, r0
202 1019c: e59fd288 ldr sp, =0x1079270 ; via 0x1042c
203 101a0: e10f0000 mrs r0, CPSR
204 101a4: e3c0001f bic r0, r0, #31 ; 0x1f
205 101a8: e380001b orr r0, r0, #27 ; 0x1b
206 101ac: e129f000 msr CPSR_fc, r0
207 101b0: e59fd274 ldr sp, =0x1079270 ; via 0x1042c
208 101b4: e10f0000 mrs r0, CPSR
209 101b8: e3c0001f bic r0, r0, #31 ; 0x1f
210 101bc: e3800013 orr r0, r0, #19 ; 0x13
211 101c0: e129f000 msr CPSR_fc, r0
212 101c4: e59f3250 ldr r3, =0x83c0b0 ; via 0x1041c
213 101c8: e2822004 add r2, r2, #4
214 101cc: e5832000 str r2, [r3]
215 101d0: e3a01b01 mov r1, #1024 ; 0x400
216 101d4: e3c11003 bic r1, r1, #3
217 101d8: e0822001 add r2, r2, r1
218 101dc: e59f323c ldr r3, =0x83c134 ; via 0x10420
219 101e0: e5831000 str r1, [r3]
220 101e4: e3a01002 mov r1, #2
221 101e8: e59f3234 ldr r3, =0x83c144 ; via 0x10424
222 101ec: e5831000 str r1, [r3]
223 101f0: e1a04002 mov r4, r2
224 101f4: eb09153c bl 0x2556ec ; _f_load_int_mem
225 101f8: e1a02004 mov r2, r4
226 101fc: e59f1210 ldr r1, =0x83c148 ; via 0x10414
227 10200: e5910000 ldr r0, [r1]
228 10204: e3a030fe mov r3, #254 ; 0xfe
229 10208: e5c03000 strb r3, [r0]
230 1020c: e5c03001 strb r3, [r0, #1]
231 10210: e5c03002 strb r3, [r0, #2]
232 10214: e5c03003 strb r3, [r0, #3]
233 10218: e4903004 ldr r3, [r0], #4
234 1021c: e4803004 str r3, [r0], #4
235 10220: e1500002 cmp r0, r2
236 10224: bafffffc blt 0x1021c
237 10228: e51f01e4 ldr r0, =0x1047c ; via 0x1004c
238 1022c: e3700001 cmn r0, #1
239 10230: 1b00007f blne 0x10434 ; _auto_init
240 10234: e59f01ec ldr r0, =0x1078744 ; via 0x10428
241 10238: ea09151f b 0x2556bc ; _INC_Initialize
242
243 ; $Init_Target:
244 2458f0: b570 push {r4, r5, r6, lr}
245 2458f2: b081 sub sp, #4
246 ; write 0x6000 into FFFE:F008 like TCS211
247 2458f4: 4d62 ldr r5, =0xfffef006 ; via 0x245a80
248 2458f6: 2003 mov r0, #3
249 2458f8: 0340 lsl r0, r0, #13
250 2458fa: 8068 strh r0, [r5, #2]
251 ; TM_DisableWatchdog() ?
252 2458fc: f006 fd03 bl 0x24c306
253 ; 8 MiB memory bank setup
254 245900: 2008 mov r0, #8
255 245902: 8829 ldrh r1, [r5, #0]
256 245904: 4308 orr r0, r1
257 245906: 8028 strh r0, [r5, #0]
258
259 ; CNTL_CLK (FFFF:FD02) register setup
260 ;
261 ; TCS211 does this:
262 ; CNTL_CLK |= 0x0005;
263 ; CNTL_CLK &= 0xFF3F;
264 ; CNTL_CLK |= 0x0080;
265 ; CNTL_CLK &= 0xFFDF;
266 ;
267 ; The present version does this:
268 ; CNTL_CLK = 0x0005;
269 ; CNTL_CLK &= 0xFF3F;
270 ; CNTL_CLK &= 0xFFDF;
271 ;
272 ; Difference 1: initial straight write vs. OR: it must be the effect
273 ; of the change in the definition of the CLKM_INITCNTL()
274 ; macro seen in the diff between MV100 and Sotovik versions.
275 ;
276 ; Difference 2: VTCXO_DIV2 bit setting for Clara (13 MHz) vs. Rita (26 MHz)
277
278 245908: 485e ldr r0, =0xfffffd02 ; via 0x245a84
279 24590a: 2105 mov r1, #5
280 24590c: 8001 strh r1, [r0, #0]
281 24590e: 495e ldr r1, =0xff3f ; via 0x245a88
282 245910: 8802 ldrh r2, [r0, #0]
283 245912: 4011 and r1, r2
284 245914: 8001 strh r1, [r0, #0]
285 245916: 495d ldr r1, =0xffdf ; via 0x245a8c
286 245918: 8802 ldrh r2, [r0, #0]
287 24591a: 4011 and r1, r2
288 24591c: 8001 strh r1, [r0, #0]
289
290 ; RHEA_CNTL_REG setup: this version writes 0x7F00, TCS211 writes 0xFF00
291 24591e: 4e5c ldr r6, =0xfffff900 ; via 0x245a90
292 245920: 207f mov r0, #127 ; 0x7f
293 245922: 0200 lsl r0, r0, #8
294 245924: 8030 strh r0, [r6, #0]
295
296 ; PLL setup: the code structure (sequence of steps) is the same as in TCS211,
297 ; but the PLL multiplier is set to 6 instead of 8. Thus the DSP runs at
298 ; 78 MHz and the ARM runs at 39 MHz.
299 245926: 4c5b ldr r4, =0xffff9800 ; via 0x245a94
300 245928: 485b ldr r0, =0xfff3 ; via 0x245a98
301 24592a: 8821 ldrh r1, [r4, #0]
302 24592c: 4008 and r0, r1
303 24592e: 8020 strh r0, [r4, #0]
304 245930: 8820 ldrh r0, [r4, #0]
305 245932: 8020 strh r0, [r4, #0]
306 245934: 4859 ldr r0, =0xf01f ; via 0x245a9c
307 245936: 8821 ldrh r1, [r4, #0]
308 245938: 4008 and r0, r1
309 24593a: 8020 strh r0, [r4, #0]
310 24593c: 2003 mov r0, #3
311 24593e: 0200 lsl r0, r0, #8
312 245940: 8821 ldrh r1, [r4, #0]
313 245942: 4308 orr r0, r1
314 245944: 8020 strh r0, [r4, #0]
315
316 ; ARM clock setup: divide by 2 like in TCS211
317 245946: 2000 mov r0, #0
318 245948: 2102 mov r1, #2
319 24594a: 2200 mov r2, #0
320 24594c: f007 fe00 bl 0x24d550
321
322 ; Memory timings: definitely peculiar
323 245950: 4953 ldr r1, =0xfffffb00 ; via 0x245aa0
324 245952: 20a5 mov r0, #165 ; 0xa5
325 245954: 8008 strh r0, [r1, #0]
326 245956: 8048 strh r0, [r1, #2]
327 245958: 20a2 mov r0, #162 ; 0xa2
328 24595a: 8088 strh r0, [r1, #4]
329 24595c: 2085 mov r0, #133 ; 0x85
330 24595e: 80c8 strh r0, [r1, #6]
331 245960: 2080 mov r0, #128 ; 0x80
332 245962: 8148 strh r0, [r1, #10] ; 0xa
333 245964: 200b mov r0, #11 ; 0xb
334 245966: 0180 lsl r0, r0, #6
335 245968: 8188 strh r0, [r1, #12] ; 0xc
336 24596a: 2040 mov r0, #64 ; 0x40
337 24596c: 8108 strh r0, [r1, #8]
338
339 ; FFFF:F902 and FFFF:F904 registers set up exactly the same as in TCS211
340 24596e: 2020 mov r0, #32 ; 0x20
341 245970: 8070 strh r0, [r6, #2]
342 245972: 2000 mov r0, #0
343 245974: 80b0 strh r0, [r6, #4]
344
345 ; PLL turn-on just like in TCS211
346 245976: 2010 mov r0, #16 ; 0x10
347 245978: 8821 ldrh r1, [r4, #0]
348 24597a: 4308 orr r0, r1
349 24597c: 8020 strh r0, [r4, #0]
350
351 ; remaining Target_Init() code not studied yet
352 24597e: 4849 ldr r0, =0xfffffa08 ; via 0x245aa4
353 245980: 4949 ldr r1, =0xffff ; via 0x245aa8
354 245982: 8001 strh r1, [r0, #0]
355 245984: 241f mov r4, #31 ; 0x1f
356 245986: 8044 strh r4, [r0, #2]
357 245988: 2103 mov r1, #3
358 24598a: 8181 strh r1, [r0, #12] ; 0xc
359 24598c: f005 fc28 bl 0x24b1e0
360 245990: 4846 ldr r0, =0xfffffc00 ; via 0x245aac
361 245992: 2124 mov r1, #36 ; 0x24
362 245994: 8001 strh r1, [r0, #0]
363 245996: 210d mov r1, #13 ; 0xd
364 245998: 8041 strh r1, [r0, #2]
365 24599a: 2300 mov r3, #0
366 24599c: 4844 ldr r0, =0xfffe2016 ; via 0x245ab0
367 24599e: 8003 strh r3, [r0, #0]
368 2459a0: 4844 ldr r0, =0xfffe2014 ; via 0x245ab4
369 2459a2: 2102 mov r1, #2
370 2459a4: 8001 strh r1, [r0, #0]
371 2459a6: 4844 ldr r0, =0xfffe2002 ; via 0x245ab8
372 2459a8: 2184 mov r1, #132 ; 0x84
373 2459aa: 8001 strh r1, [r0, #0]
374 2459ac: 4943 ldr r1, =0xfffe2000 ; via 0x245abc
375 2459ae: 4844 ldr r0, =0x3de0 ; via 0x245ac0
376 2459b0: 8008 strh r0, [r1, #0]
377 2459b2: 4a44 ldr r2, =0xfffe2022 ; via 0x245ac4
378 2459b4: 2009 mov r0, #9
379 2459b6: 8010 strh r0, [r2, #0]
380 2459b8: 4843 ldr r0, =0xfffe2020 ; via 0x245ac8
381 2459ba: 4a44 ldr r2, =0x45a ; via 0x245acc
382 2459bc: 8002 strh r2, [r0, #0]
383 2459be: 4844 ldr r0, =0xfffe201e ; via 0x245ad0
384 2459c0: 22b4 mov r2, #180 ; 0xb4
385 2459c2: 8002 strh r2, [r0, #0]
386 2459c4: 4843 ldr r0, =0xfffe201c ; via 0x245ad4
387 2459c6: 8004 strh r4, [r0, #0]
388 2459c8: 1c1c add r4, r3, #0
389 2459ca: 4843 ldr r0, =0xfffe2024 ; via 0x245ad8
390 2459cc: 8004 strh r4, [r0, #0]
391 2459ce: 4b43 ldr r3, =0xfffe2010 ; via 0x245adc
392 2459d0: 2002 mov r0, #2
393 2459d2: 881a ldrh r2, [r3, #0]
394 2459d4: 4310 orr r0, r2
395 2459d6: 8018 strh r0, [r3, #0]
396 2459d8: 4840 ldr r0, =0xfffe2010 ; via 0x245adc
397 2459da: 2304 mov r3, #4
398 2459dc: 8802 ldrh r2, [r0, #0]
399 2459de: 4313 orr r3, r2
400 2459e0: 8003 strh r3, [r0, #0]
401 2459e2: 2027 mov r0, #39 ; 0x27
402 2459e4: 80e8 strh r0, [r5, #6]
403 2459e6: 8a08 ldrh r0, [r1, #16] ; 0x10
404 2459e8: 0840 lsr r0, r0, #1
405 2459ea: d310 bcc 0x245a0e
406 2459ec: 8a08 ldrh r0, [r1, #16] ; 0x10
407 2459ee: 0400 lsl r0, r0, #16
408 2459f0: 0c40 lsr r0, r0, #17
409 2459f2: 0040 lsl r0, r0, #1
410 2459f4: 8208 strh r0, [r1, #16] ; 0x10
411 2459f6: 2001 mov r0, #1
412 2459f8: 9000 str r0, [sp, #0]
413 2459fa: e002 b 0x245a02
414 2459fc: 9800 ldr r0, [sp, #0]
415 2459fe: 3001 add r0, #1
416 245a00: 9000 str r0, [sp, #0]
417 245a02: 9800 ldr r0, [sp, #0]
418 245a04: 2832 cmp r0, #50 ; 0x32
419 245a06: d3f9 bcc 0x2459fc
420 245a08: 8a48 ldrh r0, [r1, #18] ; 0x12
421 245a0a: 2800 cmp r0, #0
422 245a0c: d0fc beq 0x245a08
423 245a0e: f006 fdbf bl 0x24c590
424 245a12: f006 fdc3 bl 0x24c59c
425 245a16: 2027 mov r0, #39 ; 0x27
426 245a18: 0500 lsl r0, r0, #20
427 245a1a: 8004 strh r4, [r0, #0]
428 245a1c: 2001 mov r0, #1
429 245a1e: f006 fc80 bl 0x24c322
430 245a22: 2002 mov r0, #2
431 245a24: f006 fc7d bl 0x24c322
432 245a28: b001 add sp, #4
433 245a2a: bd70 pop {r4, r5, r6, pc}
434
435 ; $Init_Drivers:
436 245a2c: b500 push {lr}
437 245a2e: f7ce f9b0 bl 0x213d92
438 245a32: f7af fb41 bl 0x1f50b8
439 245a36: f7da fd20 bl 0x22047a
440 245a3a: f755 fc4f bl 0x19b2dc
441 245a3e: bd00 pop {pc}
442
443 ; $Init_Serial_Flows:
444 245a40: b500 push {lr}
445 245a42: 4827 ldr r0, =0x10786fc ; via 0x245ae0
446 245a44: f795 f98e bl 0x1dad64
447 245a48: 2000 mov r0, #0
448 245a4a: 2102 mov r1, #2
449 245a4c: 2200 mov r2, #0
450 245a4e: f795 fbdc bl 0x1db20a
451 245a52: f795 fc51 bl 0x1db2f8
452 245a56: bd00 pop {pc}
453
454 ; $Init_Unmask_IT:
455 245a58: b500 push {lr}
456 245a5a: 2004 mov r0, #4
457 245a5c: f005 fc21 bl 0x24b2a2
458 245a60: 2012 mov r0, #18 ; 0x12
459 245a62: f005 fc1e bl 0x24b2a2
460 245a66: 2007 mov r0, #7
461 245a68: f005 fc1b bl 0x24b2a2
462 245a6c: 2008 mov r0, #8
463 245a6e: f005 fc18 bl 0x24b2a2
464 245a72: bd00 pop {pc}
465
466 ; The following BX LR instructions must be empty functions in the same init
467 ; module as the recognizable functions above, as they lie between the previous
468 ; code and its associated literal pool.
469 245a74: 4770 bx lr
470 245a76: 4770 bx lr
471 245a78: 4770 bx lr
472 245a7a: 4770 bx lr
473 245a7c: 4770 bx lr
474 245a7e: 4770 bx lr
475
476 ; Appears to the old Thumb implementation of f_load_int_mem(),
477 ; differs from TCS211 version which is ARM and appears to be assembly
478 250408: b5f0 push {r4, r5, r6, r7, lr}
479 25040a: 4640 mov r0, r8
480 25040c: 4649 mov r1, r9
481 25040e: 4652 mov r2, r10
482 250410: 465b mov r3, r11
483 250412: b40f push {r0, r1, r2, r3}
484 250414: 4f22 ldr r7, =0x1079168 ; via 0x2504a0
485 250416: 2000 mov r0, #0
486 250418: 8038 strh r0, [r7, #0]
487 25041a: 4922 ldr r1, =0x107916a ; via 0x2504a4
488 25041c: 4688 mov r8, r1
489 25041e: 8008 strh r0, [r1, #0]
490 250420: 4821 ldr r0, =0x800000 ; via 0x2504a8
491 250422: 4922 ldr r1, =0x81944c ; via 0x2504ac
492 250424: 1a09 sub r1, r1, r0
493 250426: 3904 sub r1, #4
494 250428: 468c mov r12, r1
495 25042a: 2104 mov r1, #4
496 25042c: 180e add r6, r1, r0
497 25042e: 1c30 add r0, r6, #0
498 250430: 4661 mov r1, r12
499 250432: f7ff ffe0 bl 0x2503f6
500 250436: 4c1e ldr r4, =0x83eda4 ; via 0x2504b0
501 250438: 481e ldr r0, =0x83f294 ; via 0x2504b4
502 25043a: 1b05 sub r5, r0, r4
503 25043c: 1c20 add r0, r4, #0
504 25043e: 1c29 add r1, r5, #0
505 250440: f7ff ffd9 bl 0x2503f6
506 250444: 481c ldr r0, =0x20508 ; via 0x2504b8
507 250446: 4681 mov r9, r0
508 250448: 4661 mov r1, r12
509 25044a: f7ff ffc7 bl 0x2503dc
510 25044e: 4682 mov r10, r0
511 250450: 8038 strh r0, [r7, #0]
512 250452: 481a ldr r0, =0x155e8 ; via 0x2504bc
513 250454: 4683 mov r11, r0
514 250456: 1c29 add r1, r5, #0
515 250458: f7ff ffc0 bl 0x2503dc
516 25045c: 4651 mov r1, r10
517 25045e: 1808 add r0, r1, r0
518 250460: 8038 strh r0, [r7, #0]
519 250462: 4648 mov r0, r9
520 250464: 4661 mov r1, r12
521 250466: 1c32 add r2, r6, #0
522 250468: f7ff ffae bl 0x2503c8
523 25046c: 4658 mov r0, r11
524 25046e: 1c29 add r1, r5, #0
525 250470: 1c22 add r2, r4, #0
526 250472: f7ff ffa9 bl 0x2503c8
527 250476: 1c30 add r0, r6, #0
528 250478: 4661 mov r1, r12
529 25047a: f7ff ffaf bl 0x2503dc
530 25047e: 1c06 add r6, r0, #0
531 250480: 4640 mov r0, r8
532 250482: 8006 strh r6, [r0, #0]
533 250484: 1c20 add r0, r4, #0
534 250486: 1c29 add r1, r5, #0
535 250488: f7ff ffa8 bl 0x2503dc
536 25048c: 1830 add r0, r6, r0
537 25048e: 4641 mov r1, r8
538 250490: 8008 strh r0, [r1, #0]
539 250492: bc0f pop {r0, r1, r2, r3}
540 250494: 4680 mov r8, r0
541 250496: 4689 mov r9, r1
542 250498: 4692 mov r10, r2
543 25049a: 469b mov r11, r3
544 25049c: bdf0 pop {r4, r5, r6, r7, pc}
545
546 ; $INC_Initialize:
547 254654: b530 push {r4, r5, lr}
548 254656: 1c05 add r5, r0, #0
549 254658: 4c13 ldr r4, =0x1079150 ; via 0x2546a8
550 25465a: 2001 mov r0, #1
551 25465c: 6020 str r0, [r4, #0]
552 25465e: f001 f9eb bl 0x255a38
553 254662: f001 f9ed bl 0x255a40
554 254666: f001 f9ad bl 0x2559c4
555 25466a: f000 fd45 bl 0x2550f8
556 25466e: f7fb ffa3 bl 0x2505b8
557 254672: f000 ff0d bl 0x255490
558 254676: f000 fedb bl 0x255430
559 25467a: f000 fef9 bl 0x255470
560 25467e: f000 fec7 bl 0x255410
561 254682: f000 ff25 bl 0x2554d0
562 254686: f000 fee3 bl 0x255450
563 25468a: f000 ff31 bl 0x2554f0
564 25468e: f7fe faef bl 0x252c70
565 254692: f000 ff0d bl 0x2554b0
566 254696: 1c28 add r0, r5, #0
567 254698: f000 fda5 bl 0x2551e6 ; app init
568 25469c: 2002 mov r0, #2
569 25469e: 6020 str r0, [r4, #0]
570 2546a0: f001 fefa bl 0x256498 ; $TCT_Schedule veneer
571 2546a4: bd30 pop {r4, r5, pc}
572
573 ; $Application_Initialize:
574 2551e6: b500 push {lr}
575 2551e8: f7f0 fb82 bl 0x2458f0 ; $Init_Target
576 2551ec: f7f0 fc1e bl 0x245a2c ; $Init_Drivers
577 2551f0: f001 fa82 bl 0x2566f8 ; $Cust_Init_Layer1
578 2551f4: f7f0 fc24 bl 0x245a40 ; $Init_Serial_Flows
579 2551f8: f7a0 fba6 bl 0x1f5948 ; $StartFrame
580 2551fc: f7f0 fc2c bl 0x245a58 ; $Init_Unmask_IT
581 255200: bd00 pop {pc}
582
583 2556a4: e58de004 str lr, [sp, #4]
584 2556a8: e28fe001 add lr, pc, #1
585 2556ac: e12fff1e bx lr
586 2556b0: f7e8 f8e6 bl 0x23d880
587 2556b4: 4778 bx pc
588 2556b6: 46c0 nop (mov r8, r8)
589 2556b8: e59df004 ldr pc, [sp, #4]
590
591 ; _INC_Initialize call veneer
592 2556bc: e92d4000 stmdb sp!, {lr}
593 2556c0: e28fe001 add lr, pc, #1
594 2556c4: e12fff1e bx lr
595 2556c8: f7fe ffc4 bl 0x254654
596 2556cc: 4778 bx pc
597 2556ce: 46c0 nop (mov r8, r8)
598 2556d0: e8bd8000 ldmia sp!, {pc}
599
600 2556d4: e92d4000 stmdb sp!, {lr}
601 2556d8: e28fe001 add lr, pc, #1
602 2556dc: e12fff1e bx lr
603 2556e0: f7e7 fb27 bl 0x23cd32
604 2556e4: 4778 bx pc
605 2556e6: 46c0 nop (mov r8, r8)
606 2556e8: e8bd8000 ldmia sp!, {pc}
607
608 ; _f_load_int_mem call veneer
609 2556ec: e92d4000 stmdb sp!, {lr}
610 2556f0: e28fe001 add lr, pc, #1
611 2556f4: e12fff1e bx lr
612 2556f8: f7fa fe86 bl 0x250408
613 2556fc: 4778 bx pc
614 2556fe: 46c0 nop (mov r8, r8)
615 255700: e8bd8000 ldmia sp!, {pc}
616
617 255704: e92d4000 stmdb sp!, {lr}
618 255708: e28fe001 add lr, pc, #1
619 25570c: e12fff1e bx lr
620 255710: f7ff fd69 bl 0x2551e6
621 255714: 4778 bx pc
622 255716: 46c0 nop (mov r8, r8)
623 255718: e8bd8000 ldmia sp!, {pc}
624
625 25571c: e92d4000 stmdb sp!, {lr}
626 255720: e28fe001 add lr, pc, #1
627 255724: e12fff1e bx lr
628 255728: f76e f932 bl 0x1c3990
629 25572c: 4778 bx pc
630 25572e: 46c0 nop (mov r8, r8)
631 255730: e8bd8000 ldmia sp!, {pc}
632
633 255734: e92d4000 stmdb sp!, {lr}
634 255738: e28fe001 add lr, pc, #1
635 25573c: e12fff1e bx lr
636 255740: f7a6 fe10 bl 0x1fc364
637 255744: 4778 bx pc
638 255746: 46c0 nop (mov r8, r8)
639 255748: e8bd8000 ldmia sp!, {pc}
640
641 25574c: e92d4000 stmdb sp!, {lr}
642 255750: e28fe001 add lr, pc, #1
643 255754: e12fff1e bx lr
644 255758: f6f4 fa10 bl 0x149b7c
645 25575c: 4778 bx pc
646 25575e: 46c0 nop (mov r8, r8)
647 255760: e8bd8000 ldmia sp!, {pc}
648
649 255764: e92d4000 stmdb sp!, {lr}
650 255768: e28fe001 add lr, pc, #1
651 25576c: e12fff1e bx lr
652 255770: f785 ff3b bl 0x1db5ea
653 255774: 4778 bx pc
654 255776: 46c0 nop (mov r8, r8)
655 255778: e8bd8000 ldmia sp!, {pc}
656
657 25577c: e92d4000 stmdb sp!, {lr}
658 255780: e28fe001 add lr, pc, #1
659 255784: e12fff1e bx lr
660 255788: f785 ff10 bl 0x1db5ac
661 25578c: 4778 bx pc
662 25578e: 46c0 nop (mov r8, r8)
663 255790: e8bd8000 ldmia sp!, {pc}