From ad7ab5552e41094bb8344e3e0fceef8c1dee90a7 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Sep 2015 14:13:22 +0100 Subject: fish --- docs/GT22L16A1Y V2.0-EN.pdf | Bin 0 -> 2986473 bytes reverse_engineering/accel.pl | 1 - reverse_engineering/bits.pl | 10 +- reverse_engineering/pinmap | 159 ++++++++++++++++++++++++ reverse_engineering/scani2c-4.pl | 252 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 418 insertions(+), 4 deletions(-) create mode 100644 docs/GT22L16A1Y V2.0-EN.pdf create mode 100644 reverse_engineering/pinmap create mode 100755 reverse_engineering/scani2c-4.pl diff --git a/docs/GT22L16A1Y V2.0-EN.pdf b/docs/GT22L16A1Y V2.0-EN.pdf new file mode 100644 index 0000000..8a96c15 Binary files /dev/null and b/docs/GT22L16A1Y V2.0-EN.pdf differ diff --git a/reverse_engineering/accel.pl b/reverse_engineering/accel.pl index ac17a0e..3fb3fd8 100755 --- a/reverse_engineering/accel.pl +++ b/reverse_engineering/accel.pl @@ -84,7 +84,6 @@ sub dir_clr($$) { my ( $ocd, $v ) = @_; write_reg( $ocd, 0x5000051c, $v ); } - sub io_set($$) { my ( $ocd, $v ) = @_; write_reg( $ocd, 0x50000508, $v ); diff --git a/reverse_engineering/bits.pl b/reverse_engineering/bits.pl index c6b3c7f..a5fda4f 100755 --- a/reverse_engineering/bits.pl +++ b/reverse_engineering/bits.pl @@ -126,15 +126,19 @@ my $ocd=open_ocd('127.0.0.1:4444' ); my $ov=-1; while (1) { -my $v=dir_get($ocd); +my $v=io_get($ocd); next if $v == $ov; $ov=$v; -printf "%04b %04b %04b %04b %04b %04b %04b %04b\n", - ($v >>28) &0xf, +printf "%b %b %b %b %04b %04b %04b %04b %04b %04b %04b %04b\n", + ($v >>20) &0x1, + ($v >>19) &0x1, + ($v >>18) &0x1, + ($v >>17) &0x1, + ($v >>24) &0xf, ($v >>20) &0xf, diff --git a/reverse_engineering/pinmap b/reverse_engineering/pinmap new file mode 100644 index 0000000..b7692e9 --- /dev/null +++ b/reverse_engineering/pinmap @@ -0,0 +1,159 @@ +GPIO: + +DIR: 43880000 +DIR: 42080000 + +OUT: 42083300 +IN: 42483398 + +P0.00 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.01 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.02 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.03 => 00030000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, SENSE LOW +P0.04 => 00030000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, SENSE LOW +P0.05 => 00000000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, NO SENSE +P0.06 => 00000000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, NO SENSE +P0.07 => 0003000c, INPUT, CONNECT INPUT, PULL UP, STANDARD DRIVE, NO SENSE +P0.08 => 0000060c, INPUT, CONNECT INPUT, PULL UP, OPEN DRAIN, NO SENSE +P0.09 => 0000060c, INPUT, CONNECT INPUT, PULL UP, OPEN DRAIN, NO SENSE +P0.10 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.11 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.12 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.13 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.14 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.15 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.16 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.17 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.18 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.19 => 00000003, OUTPUT, NO INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.20 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.21 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.22 => 0000000c, INPUT, CONNECT INPUT, PULL UP, STANDARD DRIVE, NO SENSE +P0.23 => 0000060c, INPUT, CONNECT INPUT, PULL UP, OPEN DRAIN, NO SENSE +P0.24 => 0000060c, INPUT, CONNECT INPUT, PULL UP, OPEN DRAIN, NO SENSE +P0.25 => 00000003, OUTPUT, NO INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.26 => 00000000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, NO SENSE +P0.27 => 00000000, INPUT, CONNECT INPUT, NO PULL, STANDARD DRIVE, NO SENSE +P0.28 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.29 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.30 => 00000003, OUTPUT, NO INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE +P0.31 => 00000004, INPUT, CONNECT INPUT, PULL DOWN, STANDARD DRIVE, NO SENSE + +P0.31 => IN +P0.30 => OUT screen reset +P0.29 => IN vibrator +P0.28 => IN + +P0.27 => IN +P0.26 => IN +P0.25 => OUT screen power on/off +P0.24 => BIDI SCL for OLED screen + +P0.23 => BIDI SDA for OLED screen +P0.22 => IN white LED +P0.21 => IN +P0.20 => IN G-chip + +P0.19 => OUT G-chip +P0.18 => IN G-chip +P0.17 => IN G-chip +P0.16 => ? + +P0.15 => LIS331 interrupt pin +P0.14 => +P0.13 => BIDI SCL for LIS331 +P0.12 => BIDI SDA for LIS331 + +P0.11 => 0 +P0.10 => 0 +P0.9 => BIDI SDA for AT24C256 +P0.8 => BIDI SCL for AT24C256 + + +P0.7 => 1 interrtupt from LIS331 ? +P0.6 => 0 +P0.5 => 0 +P0.4 => button + +P0.3 => button +P0.2 => 0 +P0.1 => 0 +P0.0 => 0 + + +SPI controllers both have psel of -1 and disabled +TWI controllers both have psel of -1 and disabled +UART disabled psel of -1 + +RTC0: INTEN COMPARE1 + EVENTEN COMPARE1 & COMPARE2 + COUNTER running + CC[0] 00c6706d + CC[1] 00c6703d + CC[2] 00000000 + +RTC1: INTEN COMPARE1 + EVENTEN COMPARE1 + COUNTER running + CC[0] 00c68000 + +RTC2: all zeros + + + + + COMPARE2 EVENTEN + + + + +GPIOTE all zeros + +?bitbanged? + +SET DIR register for 23,24 +(gdb) set {unsigned int}0x50000518=0x1800000 +(gdb) p/x {unsigned int}0x50000518 +$105 = 0x43880000 + +CLEAR out for 23,24 + +(gdb) set {unsigned int}0x5000050c=0x1800000 +(gdb) p/x {unsigned int}0x50000504 +$106 = 0x42083300 + +READ in + +(gdb) p/x {unsigned int}0x50000510 +$107 = 0x42483398 + +SET out for 23 +(gdb) set {unsigned int}0x50000508=0x0800000 +(gdb) p/x {unsigned int}0x50000504 +$108 = 0x42883300 +(gdb) p/x {unsigned int}0x50000510 +$109 = 0x42c83398 + +nothing else changes + + + +0x42483398 + + + +G chip + +8 7 6 5 + +. +1 2 3 4 + +1 -> GND +2 -> ? +3 -> P0.18 +4 -> P0.17 +5 -> pulled up +6 -> VCC +7 -> P0.19 +8 -> P0.20 diff --git a/reverse_engineering/scani2c-4.pl b/reverse_engineering/scani2c-4.pl new file mode 100755 index 0000000..40c9cc1 --- /dev/null +++ b/reverse_engineering/scani2c-4.pl @@ -0,0 +1,252 @@ +#!/usr/bin/env perl +use strict; + +use IO::Socket::INET; +use Data::Dumper; +#use IO::Socket::Timeout; +# +# + +$SIG{INT}=\&quit; +my $prompt= '> '; + +sub my_readline_worker($) +{ +my $sock=shift; +my $ret=""; +my $d=""; + +while (1) { +return $ret if $sock->read($d,1)!=1; + +next if $d eq "\n"; + +$ret.=$d; + +return $ret if $d eq "\r"; +return $ret if $ret =~ /> $/; + +} + + +} + +sub my_readline($) +{ +my $sock=shift; +my $ret=my_readline_worker($sock); +#print $ret."\n"; +return $ret; +} + + + + +sub wait_for_prompt($) +{ +my $ocd=shift; + +1 while (my_readline($ocd) ne $prompt); +} + + +sub open_ocd($) { +my $addr=shift; +my $sock = IO::Socket::INET->new( $addr); +wait_for_prompt($sock); + $sock->printf( "reset halt\n"); + wait_for_prompt($sock); +return $sock; +} + + +sub write_reg($$$) +{ +my ($ocd,$r,$v)=@_; + +$ocd->printf("mww 0x%08x 0x%08x\n",$r,$v); +wait_for_prompt($ocd); +} + +sub read_reg($$) +{ +my ($ocd,$r)=@_; +my $ret; + +$ocd->printf("mdw 0x%08x\n",$r); + +$ret=my_readline($ocd); +$ret=my_readline($ocd); + +wait_for_prompt($ocd); + + +$ret =~ s/[\r\n\s]//g; + + +if ($ret =~ /0x[0-9A-Fa-f]+:([0-9a-fA-F]+)/) { + return hex($1); +} + +return undef; +} + + + +sub dir_set($$) { +my ($ocd,$v)=@_; +write_reg($ocd,0x50000518,$v); +} + + +sub dir_clr($$) { +my ($ocd,$v)=@_; +write_reg($ocd,0x5000051c,$v); +} + +sub io_set($$) { +my ($ocd,$v)=@_; +write_reg($ocd,0x50000508,$v); +} + +sub io_clr($$) { +my ($ocd,$v)=@_; +write_reg($ocd,0x5000050c,$v); +} + +sub io_get($) { +my $ocd=shift; +return read_reg($ocd,0x50000510); +} + + +sub io_cnf($$$) { + my ( $ocd, $pin, $v ) = @_; + write_reg( $ocd, 0x50000700 + ($pin * 4), $v ); +} + + +my $SDABIT=1<<18; +my $SCLBIT=1<<17; + + + +sub i2c_set($$$) { +my ($ocd,$scl,$sda) =@_; +my $clr=0; +my $set=0; + + +if ($scl) { + $clr|=$SCLBIT; +} else { + $set|=$SCLBIT; +} + +if ($sda) { + $clr|=$SDABIT; +} else { + $set|=$SDABIT; +} + +dir_set($ocd,$set); +dir_clr($ocd,$clr); +} + + +sub i2c_get($) { +my $ocd=shift; + +return (io_get($ocd) & $SDABIT ) ? 1:0; +} + +sub i2c_start($) { +my $ocd=shift; + +i2c_set($ocd,1,1); +i2c_set($ocd,1,0); +i2c_set($ocd,0,0); +} + +sub i2c_stop($) { +my $ocd=shift; + +i2c_set($ocd,0,0); +i2c_set($ocd,1,0); +i2c_set($ocd,1,1); +} + + +sub i2c_sendbyte($$) +{ +my ($ocd,$byte) =@_; + +for ( my $c=0x80; $c; $c>>=1) +{ +my $v=($c & $byte) ? 1:0; + +print $v; + +i2c_set($ocd,0,$v); +i2c_set($ocd,1,$v); +i2c_set($ocd,0,$v); +} + +} + +sub i2c_startaddr($$) +{ +my ($ocd,$addr) =@_; +my $ret; + +i2c_start($ocd); +i2c_sendbyte($ocd,$addr); +print " "; + +i2c_set($ocd,0,1); +i2c_set($ocd,1,1); + +$ret=i2c_get($ocd); +i2c_set($ocd,0,1); + +print $ret; + +return $ret; + +} + +sub i2c_ping($$) +{ +my ($ocd,$addr) =@_; +my $ret; +$ret=i2c_startaddr($ocd,$addr); +i2c_stop($ocd); +return $ret; +} + + +my $ocd=open_ocd('127.0.0.1:4444' ); + + +io_cnf($ocd,18,0x60c); +io_cnf($ocd,17,0x60c); +io_clr($ocd,$SCLBIT | $SDABIT); + +i2c_start($ocd); +i2c_stop($ocd); + +for (my $a=0;$a<0x100;$a++) { +printf "a=0x%02x ",$a; +i2c_ping($ocd,$a); +i2c_start($ocd); +i2c_stop($ocd); +i2c_start($ocd); +i2c_stop($ocd); + +print "\n"; +} + + + + + -- cgit v1.2.3