FreeCalypso > hg > freecalypso-reveng

comparison pirelli/fw-disasm @ 254:f3f9dd04567e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
pirelli/fw-disasm: started proper analysis of pwr_cust code
author Mychaela Falconia <falcon@freecalypso.org>
date Mon, 25 Dec 2017 23:32:08 +0000
parents 6f9969cf55a1
children 0f5a24acde3a
comparison
equal deleted inserted replaced
253:6f9969cf55a1 254:f3f9dd04567e
735 32af8c: 2104 mov r1, #4 735 32af8c: 2104 mov r1, #4
736 32af8e: f0ce fb45 bl 0x3f961c ; $TMSE_Control_Timer 736 32af8e: f0ce fb45 bl 0x3f961c ; $TMSE_Control_Timer
737 32af92: b001 add sp, #4 737 32af92: b001 add sp, #4
738 32af94: bd00 pop {pc} 738 32af94: bd00 pop {pc}
739 739
740 ; pwr_cust module seems to start here
741
740 ; The following function takes a raw ADC VBAT measurement 742 ; The following function takes a raw ADC VBAT measurement
741 ; as input (R0) and returns the mV value per the calibration. 743 ; as input (R0) and returns the mV value per the calibration.
744 $pwr_adc_to_mvolt:
742 32dae8: 498b ldr r1, =0x801734 ; via 0x32dd18 745 32dae8: 498b ldr r1, =0x801734 ; via 0x32dd18
743 32daea: 880a ldrh r2, [r1, #0] 746 32daea: 880a ldrh r2, [r1, #0]
744 32daec: 4342 mul r2, r0 747 32daec: 4342 mul r2, r0
745 32daee: 0a90 lsr r0, r2, #10 748 32daee: 0a90 lsr r0, r2, #10
746 32daf0: 8a49 ldrh r1, [r1, #18] ; 0x12 749 32daf0: 8a49 ldrh r1, [r1, #18] ; 0x12
747 32daf2: 1808 add r0, r1, r0 750 32daf2: 1808 add r0, r1, r0
748 32daf4: 0400 lsl r0, r0, #16 751 32daf4: 0400 lsl r0, r0, #16
749 32daf6: 0c00 lsr r0, r0, #16 752 32daf6: 0c00 lsr r0, r0, #16
750 32daf8: 4770 bx lr 753 32daf8: 4770 bx lr
751 754
755 $pwr_adc_to_mA:
756 ; diff from MV100 version: this version subtracts i2v_madc_offset first
752 32dafa: b500 push {lr} 757 32dafa: b500 push {lr}
753 32dafc: 49c2 ldr r1, =0x1774e70 ; via 0x32de08 758 32dafc: 49c2 ldr r1, =0x1774e70 ; via 0x32de08
754 32dafe: 6809 ldr r1, [r1, #0] 759 32dafe: 6809 ldr r1, [r1, #0]
755 32db00: 8909 ldrh r1, [r1, #8] 760 32db00: 8909 ldrh r1, [r1, #8]
756 32db02: 4288 cmp r0, r1 761 32db02: 4288 cmp r0, r1
760 32db0a: 1a40 sub r0, r0, r1 765 32db0a: 1a40 sub r0, r0, r1
761 32db0c: 4983 ldr r1, =0x357 ; via 0x32dd1c 766 32db0c: 4983 ldr r1, =0x357 ; via 0x32dd1c
762 32db0e: 4348 mul r0, r1 767 32db0e: 4348 mul r0, r1
763 32db10: 217d mov r1, #125 ; 0x7d 768 32db10: 217d mov r1, #125 ; 0x7d
764 32db12: 00c9 lsl r1, r1, #3 769 32db12: 00c9 lsl r1, r1, #3
765 32db14: f0c9 fb8a bl 0x3f722c 770 32db14: f0c9 fb8a bl 0x3f722c ; I$DIV
766 32db18: 0408 lsl r0, r1, #16 771 32db18: 0408 lsl r0, r1, #16
767 32db1a: 0c00 lsr r0, r0, #16 772 32db1a: 0c00 lsr r0, r0, #16
768 32db1c: bd00 pop {pc} 773 32db1c: bd00 pop {pc}
769 774
775 $pwr_bat_temp_within_limits:
776 ; the limits are the same as in MV100 version: 0 to 50 deg C
777 ; 1st diff: if the byte var at offset 0x48 is set to 1, then
778 ; out-of-range T is ignored with a warning trace
779 ; 2nd diff: if T is out of range and no ignore-with-warning flag is set,
780 ; the return code is FALSE like in TI's original, but an additional code
781 ; indicating whether T is too high or too low is written into 16-bit var
782 ; at 0x1774b78
770 32db1e: b510 push {r4, lr} 783 32db1e: b510 push {r4, lr}
771 32db20: b082 sub sp, #8 784 32db20: b082 sub sp, #8
772 32db22: 1c04 add r4, r0, #0 785 32db22: 1c04 add r4, r0, #0
773 32db24: 48b9 ldr r0, =0xa0020 ; via 0x32de0c 786 32db24: 48b9 ldr r0, =0xa0020 ; via 0x32de0c
774 32db26: 9000 str r0, [sp, #0] 787 32db26: 9000 str r0, [sp, #0]
819 32db84: 2304 mov r3, #4 832 32db84: 2304 mov r3, #4
820 32db86: f0ad f855 bl 0x3dac34 833 32db86: f0ad f855 bl 0x3dac34
821 32db8a: 2000 mov r0, #0 834 32db8a: 2000 mov r0, #0
822 32db8c: b002 add sp, #8 835 32db8c: b002 add sp, #8
823 32db8e: bd10 pop {r4, pc} 836 32db8e: bd10 pop {r4, pc}
837
838 $pwr_madc_to_Celsius_conv:
839 ; MV100 version uses 10 uA and 50 uA test currents,
840 ; this version uses 30 uA and 80 uA instead
841 ; not analysed further
842 32db90: b5f0 push {r4, r5, r6, r7, lr}
843 32db92: b082 sub sp, #8
844 32db94: 2351 mov r3, #81 ; 0x51
845 32db96: 1ac0 sub r0, r0, r3
846 32db98: 2800 cmp r0, #0
847 32db9a: d008 beq 0x32dbae
848 32db9c: 3828 sub r0, #40 ; 0x28
849 32db9e: 2800 cmp r0, #0
850 32dba0: d001 beq 0x32dba6
851 32dba2: 2000 mov r0, #0
852 32dba4: e04a b 0x32dc3c
853 32dba6: 4ed2 ldr r6, =0x52e308 ; via 0x32def0
854 32dba8: 4dd2 ldr r5, =0x52e2e4 ; via 0x32def4
855 32dbaa: 200a mov r0, #10 ; 0xa
856 32dbac: e002 b 0x32dbb4
857 32dbae: 4ed2 ldr r6, =0x52e2f8 ; via 0x32def8
858 32dbb0: 4dd2 ldr r5, =0x52e2d4 ; via 0x32defc
859 32dbb2: 2008 mov r0, #8
860 32dbb4: 8833 ldrh r3, [r6, #0]
861 32dbb6: 4299 cmp r1, r3
862 32dbb8: dc05 bgt 0x32dbc6
863 32dbba: 0043 lsl r3, r0, #1
864 32dbbc: 18f3 add r3, r6, r3
865 32dbbe: 3b02 sub r3, #2
866 32dbc0: 881b ldrh r3, [r3, #0]
867 32dbc2: 4299 cmp r1, r3
868 32dbc4: da08 bge 0x32dbd8
869 32dbc6: 1c0a add r2, r1, #0
870 32dbc8: 4890 ldr r0, =0xa0020 ; via 0x32de0c
871 32dbca: 9000 str r0, [sp, #0]
872 32dbcc: a0c1 add r0, pc, #772 ; 0x304
873 32dbce: 211a mov r1, #26 ; 0x1a
874 32dbd0: 2305 mov r3, #5
875 32dbd2: f0ad f82f bl 0x3dac34
876 32dbd6: e7e4 b 0x32dba2
877 32dbd8: 2800 cmp r0, #0
878 32dbda: d00d beq 0x32dbf8
879 32dbdc: 2300 mov r3, #0
880 32dbde: 005c lsl r4, r3, #1
881 32dbe0: 19a7 add r7, r4, r6
882 32dbe2: 1ebf sub r7, r7, #2
883 32dbe4: 46bc mov r12, r7
884 32dbe6: 5b37 ldrh r7, [r6, r4]
885 32dbe8: 42b9 cmp r1, r7
886 32dbea: da0a bge 0x32dc02
887 32dbec: 1c5b add r3, r3, #1
888 32dbee: 061b lsl r3, r3, #24
889 32dbf0: 0e1b lsr r3, r3, #24
890 32dbf2: 3801 sub r0, #1
891 32dbf4: 2800 cmp r0, #0
892 32dbf6: d1f2 bne 0x32dbde
893 32dbf8: 49c1 ldr r1, =0x1774b80 ; via 0x32df00
894 32dbfa: 2001 mov r0, #1
895 32dbfc: 0280 lsl r0, r0, #10
896 32dbfe: 8008 strh r0, [r1, #0]
897 32dc00: e7cf b 0x32dba2
898 32dc02: 2b00 cmp r3, #0
899 32dc04: d014 beq 0x32dc30
900 32dc06: 886b ldrh r3, [r5, #2]
901 32dc08: 8828 ldrh r0, [r5, #0]
902 32dc0a: 1a18 sub r0, r3, r0
903 32dc0c: 0400 lsl r0, r0, #16
904 32dc0e: 0c00 lsr r0, r0, #16
905 32dc10: 1bc9 sub r1, r1, r7
906 32dc12: 0409 lsl r1, r1, #16
907 32dc14: 0c09 lsr r1, r1, #16
908 32dc16: 4348 mul r0, r1
909 32dc18: 4661 mov r1, r12
910 32dc1a: 8809 ldrh r1, [r1, #0]
911 32dc1c: 1bc9 sub r1, r1, r7
912 32dc1e: 0409 lsl r1, r1, #16
913 32dc20: 0c09 lsr r1, r1, #16
914 32dc22: f0c9 fb03 bl 0x3f722c
915 32dc26: 5b60 ldrh r0, [r4, r5]
916 32dc28: 1a40 sub r0, r0, r1
917 32dc2a: 0400 lsl r0, r0, #16
918 32dc2c: 1400 asr r0, r0, #16
919 32dc2e: e001 b 0x32dc34
920 32dc30: 2000 mov r0, #0
921 32dc32: 5e28 ldrsh r0, [r5, r0]
922 32dc34: 49b2 ldr r1, =0x1774b80 ; via 0x32df00
923 32dc36: 8010 strh r0, [r2, #0]
924 32dc38: 8008 strh r0, [r1, #0]
925 32dc3a: 2001 mov r0, #1
926 32dc3c: b002 add sp, #8
927 32dc3e: bdf0 pop {r4, r5, r6, r7, pc}
928
929 $pwr_get_battery_temperature:
930 32dc40: b500 push {lr}
931 ; setting BCICTL1 to THEN_80uA
932 32dc42: 2001 mov r0, #1
933 32dc44: 2138 mov r1, #56 ; 0x38
934 32dc46: 2279 mov r2, #121 ; 0x79
935 32dc48: f01b fae0 bl 0x34920c ; $ABB_Write_Register_on_page
936 ; setting pwr_env_ctrl_blk->timer0_state, same code as in MV100 version
937 32dc4c: 486e ldr r0, =0x1774e70 ; via 0x32de08
938 32dc4e: 6800 ldr r0, [r0, #0]
939 32dc50: 2103 mov r1, #3
940 32dc52: 6301 str r1, [r0, #48] ; 0x30
941 ; setting TIMER0 to 65 ticks (300 ms)
942 32dc54: 2000 mov r0, #0
943 32dc56: 2141 mov r1, #65 ; 0x41
944 32dc58: 2200 mov r2, #0
945 32dc5a: f7fd f90d bl 0x32ae78 ; $rvf_start_timer
946 32dc5e: bd00 pop {pc}
947
948 $pwr_bat_50uA_temp_test_timer_process:
949 32dc60: b510 push {r4, lr}
950 32dc62: b082 sub sp, #8
951 ; test if we are in CHARGE_STOPPED state
952 32dc64: 4868 ldr r0, =0x1774e70 ; via 0x32de08
953 32dc66: 6800 ldr r0, [r0, #0]
954 32dc68: 6840 ldr r0, [r0, #4]
955 32dc6a: 2800 cmp r0, #0
956 32dc6c: d105 bne 0x32dc7a
957 ; CHARGE_STOPPED state: write 1 (just MESBAT) into BCICTL1
958 32dc6e: 2001 mov r0, #1
959 32dc70: 2138 mov r1, #56 ; 0x38
960 32dc72: 2201 mov r2, #1
961 32dc74: f01b faca bl 0x34920c
962 32dc78: e04b b 0x32dd12 ; return
963 ; not in CHARGE_STOPPED state
964 32dc7a: f000 fb0b bl 0x32e294
965 32dc7e: 2800 cmp r0, #0
966 32dc80: d147 bne 0x32dd12 ; return
967 ; mystery function above must return 0 for normal path to continue
968 ; "TIMER0: Battery coarse temp test" trace emitted here
969 32dc82: 4862 ldr r0, =0xa0020 ; via 0x32de0c
970 32dc84: 9000 str r0, [sp, #0]
971 32dc86: a0d1 add r0, pc, #836 ; 0x344
972 32dc88: 2120 mov r1, #32 ; 0x20
973 32dc8a: 2200 mov r2, #0
974 32dc8c: 43d2 mvn r2, r2
975 32dc8e: 2302 mov r3, #2
976 32dc90: f0ac ffd0 bl 0x3dac34
977 ; pwr_env_ctrl_blk->bat_celsius_temp = (INT16)(0xFFFF);
978 32dc94: 4c5c ldr r4, =0x1774e70 ; via 0x32de08
979 32dc96: 6821 ldr r1, [r4, #0]
980 32dc98: 2000 mov r0, #0
981 32dc9a: 43c0 mvn r0, r0
982 32dc9c: 8708 strh r0, [r1, #56] ; 0x38
983 ; write 0 into ADIN2REG
984 32dc9e: 2001 mov r0, #1
985 32dca0: 2128 mov r1, #40 ; 0x28
986 32dca2: 2200 mov r2, #0
987 32dca4: f01b fab2 bl 0x34920c ; $ABB_Write_Register_on_page
988 ; delay 2 ticks
989 32dca8: 2002 mov r0, #2
990 32dcaa: f783 fdf8 bl 0x2b189e ; rvf_delay()
991 ; now read ADIN2REG
992 32dcae: 2001 mov r0, #1
993 32dcb0: 2128 mov r1, #40 ; 0x28
994 32dcb2: f01b fad2 bl 0x34925a ; $ABB_Read_Register_on_page
995 32dcb6: 1c01 add r1, r0, #0
996 32dcb8: 6822 ldr r2, [r4, #0]
997 32dcba: 3238 add r2, #56 ; 0x38
998 32dcbc: 2079 mov r0, #121 ; 0x79
999 32dcbe: f7ff ff67 bl 0x32db90 ; $pwr_madc_to_Celsius_conv
1000 32dcc2: 2800 cmp r0, #0
1001 32dcc4: d10d bne 0x32dce2
1002 ; outside of the "coarse" range
1003 ; set pwr_env_ctrl_blk->timer0_state to the "fine" code, same as in MV100
1004 32dcc6: 6821 ldr r1, [r4, #0]
1005 32dcc8: 2004 mov r0, #4
1006 32dcca: 6308 str r0, [r1, #48] ; 0x30
1007 ; set 30 uA current
1008 32dccc: 2001 mov r0, #1
1009 32dcce: 2138 mov r1, #56 ; 0x38
1010 32dcd0: 2251 mov r2, #81 ; 0x51
1011 32dcd2: f01b fa9b bl 0x34920c
1012 ; same 65 ticks (300 ms) as before
1013 32dcd6: 2000 mov r0, #0
1014 32dcd8: 2141 mov r1, #65 ; 0x41
1015 32dcda: 2200 mov r2, #0
1016 32dcdc: f7fd f8cc bl 0x32ae78
1017 32dce0: e017 b 0x32dd12 ; return
1018 ; T inside the "coarse" range
1019 ; write 1 (just MESBAT) into BCICTL1
1020 32dce2: 2001 mov r0, #1
1021 32dce4: 2138 mov r1, #56 ; 0x38
1022 32dce6: 2201 mov r2, #1
1023 32dce8: f01b fa90 bl 0x34920c
1024 ; dispatch by state
1025 32dcec: 6820 ldr r0, [r4, #0]
1026 32dcee: 6840 ldr r0, [r0, #4]
1027 32dcf0: 2802 cmp r0, #2
1028 32dcf2: d00c beq 0x32dd0e
1029 32dcf4: 2803 cmp r0, #3
1030 32dcf6: d007 beq 0x32dd08
1031 32dcf8: 2801 cmp r0, #1
1032 32dcfa: d002 beq 0x32dd02
1033 32dcfc: f083 fce0 bl 0x3b16c0 ; $pwr_get_bat_info
1034 32dd00: e007 b 0x32dd12
1035 32dd02: f7b4 fb2b bl 0x2e235c ; $pwr_calibration_process
1036 32dd06: e004 b 0x32dd12
1037 32dd08: f7b4 ff04 bl 0x2e2b14 ; $pwr_CV_charge_process
1038 32dd0c: e001 b 0x32dd12
1039 32dd0e: f7b4 fd93 bl 0x2e2838 ; $pwr_CI_charge_process
1040 32dd12: b002 add sp, #8
1041 32dd14: bd10 pop {r4, pc}
1042 32dd16: 46c0 nop (mov r8, r8)
824 1043
825 ; The following function computes the battery remaining % number 1044 ; The following function computes the battery remaining % number
826 ; from the battery mV passed in R0. It first increases the mV value 1045 ; from the battery mV passed in R0. It first increases the mV value
827 ; by a factor that depends on the system current draw (it appears 1046 ; by a factor that depends on the system current draw (it appears
828 ; that they are after the "true" battery voltage before the internal 1047 ; that they are after the "true" battery voltage before the internal
3781 00AA (170) 002D (45) 4000 00AA (170) 002D (45)
3782 00FA (250) 0050 (80) 4001 00FA (250) 0050 (80)
3783 4002
3784 0x17741e0: abb_sem 4003 0x17741e0: abb_sem
3785 4004
4005 0x1774b78: 16-bit var, gets -4 written into it if the battery T
4006 is too high, or -5 if it is too low
3786 0x1774b7c: 16-bit var battery voltage in mV 4007 0x1774b7c: 16-bit var battery voltage in mV
3787 4008
3788 0x1774ccc: 16-bit var initial battery % is stored here 4009 0x1774ccc: 16-bit var initial battery % is stored here
3789 4010
3790 0x1774cd0: 16-bit var, ABB_Read_Status() return value at the beginning 4011 0x1774cd0: 16-bit var, ABB_Read_Status() return value at the beginning