Editing Move Motion Controller

 

* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=281ul&SN=%94%46%8F%D8&LN=6&R1=*****&R2=***** 007WWCUL0522] June 29, 2010 ([[CECH-ZCM1J]])

* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=298ul&SN=%94%46%8F%D8&LN=7&R1=*****&R2=***** 007WWCUL0630] March 8, 2011 ([[CECH-ZCM1J]])

* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=275ul&SN=%94%46%8F%D8&LN=11&R1=*****&R2=***** 007WWCUL0489] March 30, 2010 ([[CECH-ZCM1J]] / [[CECH-ZCM1JD]])

 

* [http://sistemas.anatel.gov.br/sgch/HistoricoCertificado/Homologacao.asp?NumRFGCT=189210&idtHistoricoCert=85799 2090106223] 13/01/2012 ([[CECH-ZCM1M]])

*Note some components and testpoints (TP) are different between models.

=== STM32F103 VBT6 Y (ARM Cortex-M3 32bit@72MHz SRAM20Kb FLASH128Kb RISC Microcontroller) ===

 

The thing is, the shortened bootloader vectors (provided this is actually the bootloader code), does not contain any I2C or UART interrupt vectors, and only USB_LP_CAN_

RX0 vector seems to contain active code (as far as communication is concerned).

Seems like the CPU and Bluetooth module use some form of UART to communicate, is that correct ?

The first thing to look for is the base address of the BIN file in memory, and further what the memory map looks like. Kenn has already provided this info in his example project, but these can be extracted from the STM32 datasheet also. We know that the first byte of the BIN file maps to address 0x08000000 in memory. We know that internal SRAM start at 0x20000000.

Second thing is to locate the vectors table (see STM32 datasheet) and the reset vector, because it gives you the entry point of the firmware and other useful info. The vectors table is also relocatable in this case (register SBC_VTOR, STM32 programming manual page 134), so there may be multiple vectors tables (and there is).

The vectors table is actually a big jump table. I'm using the following trick to find other tables (be it vectors or switch / case jump tables). We know that addresses are 32 bit (ARM) and highest byte is always 0x08, so we can use a simple hex dump of the BIN file and search using the regular expression "08 .. .. .. 08" (dot meaning any single character). If you use a text editor with search results highlighting (vim for example), then jump tables just catch your eye. There are not so many of them. I used this technique to find the three vectors tables listed earlier. They're distinctive because of their first 32 bit word (0x20000400 which oughts to be the address of the stack top according to the STM32 datasheet).

The vectors table also provides you with pointers to interesting subroutines. If Bluetooth is what you're looking after, just follow IT vector number 39 (USART3) since we know thanks to Kenn that STM32 and Bluetooth chips communicate via UART number 3. Then try to figure out what the firmware should look like: when a Bluetooth output report is coming to the Move, an interrupt is generated in the STM32, the input report is fetched serially from the Bluetooth chip into some buffer (or ring buffer), and the buffer is parsed, either synchronously in the IT handler itself, or a message is sent from the IT handler to some lower priority task. Difficulty is to figure out the relevant tasks and to identify them in the disassembled code.

The jump tables trick can also be used to identify the code that parses Bluetooth output reports (faster). It's very likely that such a jump table is used to call a specific Bluetooth command handler for each Bluetooth command supported by the Move. In that case the jump table is a table of function pointers. The idea is to list the jump tables, then try to find one in the same region as the IT handler. The start address of the jump table should be present in some code that can be traced back to the IT handler. This provides info on how many Bluetooth commands are supported, which ones and eventually what they're doing (after a fair amount of disassembly, I admit).

 

**STM32 Arm-Cortex bootloader: http://www.micromouseonline.com/2009/05/08/stm32-arm-cortex-bootloader/?doing_wp_cron=1348086547.3716659545898437500000

**Sony bootloader: ''there are two sections in the beginning that are blanketed by empty flash: one from 0x00000 to 0x006B7 and the other from 0x00800 to 0x027BB. My guess is that the first section is the NVIC table and that the second is a bootloader''. calibration data stored at last 0x800 bytes starting from 0x0001F800 ? (from Kenn Sebesta blog)

 

 

First of all, please save your original firmware image. Even if you don't plan to ever use your Move as a game controller again, this is a good test if your JTAG connection works. It's also supposed that the firmware contains device specific calibration values. If you replace your original firmware with firmware from another Move, it may not work as expected. Newer Moves may have code protection enabled. You can easiely disable code protection via OpenOCD but this will erase flash and make it impossibe to save the original firmware.

 

 

**3x USART (bluetooth @ 230,400 baud,...)

**2x I²C (magnetometer,...)

! Pin # !! Name !! Type !! 5v tolerant !! colspan="6" | Firmware Function !! colspan="3" | Move Board TestPoints !! Notes

! colspan="4" | !! colspan="3" | ARM-Cortex !! Sony !! MoveCopter !! Others? !! YCON2_1.01 !! YCON2.5_1.03 !! Others ? !!

! colspan="4" | !! Main !! Alternate !! Remap !! colspan="7" |  

| 1 || PE2 || I/O || {{yes}} || PE2 || TRACECK || {{no}} || TRACECK || || || TP21 || || ||  

| 2 || PE3 || I/O || {{yes}} || PE3 || TRACED0 || {{no}} || TRACED0 || || || TP22 || || ||  

| 3 || PE4 || I/O || {{yes}} || PE4 || TRACED1 || {{no}} || TRACED1 || || || TP23 || || ||  

| 4 || PE5 || I/O || {{yes}} || PE5 || TRACED2 || {{no}} || TRACED2 || || || TP24 || || ||  

| 5 || PE6 || I/O || {{yes}} || PE6 || TRACED3 || {{no}} || TRACED3 || || || TP25 || || ||

| 7 || PC13-TAMPER-RTC || I/O || {{no}} || PC13 || TAMPER-RTC || {{no}} || || || || SW10 || || || Connected to {{padcircle}}

| 8 || PC14-OSC32_IN || I/O || {{no}} || PC14 || OSC32_IN || {{no}} || || || || SW11 || || || Connected to {{padcross}}

| 9 || PC15-OSC32_OUT || I/O || {{no}} || PC15 || OSC32_OUT || {{no}} || || || || SW12 || || || Connected to {{padtriangle}}

| 15 || PC0 || I/O || {{no}} || PC0 || ADC12_IN10 || {{no}} || ADC12_IN10 || || || Gyro_y || || || Gyroscope Y-channel input

| 16 || PC1 || I/O || {{no}} || PC1 || ADC12_IN11 || {{no}} || ADC12_IN11 || || || Gyro_x || || || Gyroscope X-channel input

| 17 || PC2 || I/O || {{no}} || PC2 || ADC12_IN12 || {{no}} || ADC12_IN12 || || || Gyro_z || || || Gyroscope Z-channel input

| 18 || PC3 || I/O || {{no}} || PC3 || ADC12_IN13 || {{no}} || ADC12_IN13 || || || Acc_y || || || Accelerometer Y-channel input

| 22 || V_DDA || S || || V_DDA || || || || || || || || ||  

| 23 || PA0-WKUP || I/O || {{no}} || PA0 || WKUP <br /> USART2_CTS <br /> ADC12_IN0 <br /> TIM2_CH1_ETR || {{no}} || WKUP || || || SW8 || || || Connected to {{padps}} Normally pulled to ground by 10kΩ

| 24 || PA1 || I/O || {{no}} || PA1 || USART2_RTS <br /> ADC12_IN1 <br /> TIM2_CH2 || {{no}} || ADC12_IN1 || || || Acc_x || || || Accelerometer X-channel input

| 25 || PA2 || I/O || {{no}} || PA2 || USART2_TX <br /> ADC12_IN2 <br /> TIM2_CH3 || {{no}} || || || || TP35 || || ||  

| 26 || PA3 || I/O || {{no}} || PA3 || USART2_RX <br /> ADC12_IN3 <br /> TIM2_CH4 || {{no}} || ADC12_IN2 || || || Acc_z || || || Accelerometer Z-channel input

| 28 || V_{DD_4} || S || || V_{DD_4} || || || || || || || || ||  

| 29 || PA4 || I/O || {{no}} || PA4 || SPI1_NSS <br /> USART2_CK <br /> ADC12_IN4 || {{no}} || || || || || || ||  

| 30 || PA5 || I/O || {{no}} || PA5 || SPI1_SCK <br /> ADC12_IN5 || {{no}} || || || || TP30 || || ||  

| 31 || PA6 || I/O || {{no}} || PA6 || SPI1_MISO <br /> ADC12_IN6 <br /> TIM3_CH1 || TIM1_BKIN || || || || || || ||  

| 32 || PA7 || I/O || {{no}} || PA7 || SPI1_MOSI <br /> ADC12_IN7 <br /> TIM3_CH2 || TIM1_CH1N || || || || || || ||  

| 33 || PC4 || I/O || {{no}} || PC4 || ADC12_IN14 || {{no}} || ADC12_IN14 || || || Gyro_7 || || || Gyroscope pin7. Constant 1.25V. Possibly a comparison feedback for the gyroscope?

| 34 || PC5 || I/O || {{no}} || PC5 || ADC12_IN15 || {{no}} || || || || || || ||  

| 35 || PB0 || I/O || {{no}} || PB0 || ADC12_IN8 <br /> TIM3_CH3 || TIM1_CH2N || || || || || || ||  

| 36 || PB1 || I/O || {{no}} || PB1 || ADC12_IN9 <br /> TIM3_CH4 || TIM1_CH3N || ADC12_IN9 || || || Joystick_9 || || || Connected to {{padtrigger}} analog trigger. J9_2(ANALOG_Z)

| 37 || PB2 || I/O || {{yes}} || PB2BOOT1 || {{no}} || {{no}} || || || || ||  

| 38 || PE7 || I/O || {{yes}} || PE7 || {{no}} || TIM1_ETR || || || || TP33 || || ||  

| 39 || PE8 || I/O || {{yes}} || PE8 || {{no}} || TIM1_CH1N || || || || || || ||  

| 40 || PE9 || I/O || {{yes}} || PE9 || {{no}} || TIM1_CH1 || || || || || || ||  

| 41 || PE10 || I/O || {{yes}} || PE10 || {{no}} || TIM1_CH2N || || || || EXT_3 || || || EXT connector Pin 3

| 42 || PE11 || I/O || {{yes}} || PE11 || {{no}} || TIM1_CH2 || || PPM <br /> telemetry || || EXT_4 || || || EXT connector Pin 4

| 43 || PE12 || I/O || {{yes}} || PE12 || {{no}} || TIM1_CH3N || Interrupt || || || Mag_14 || || || Magnetometer pin14. Interrupt to signal new sample ready

| 44 || PE13 || I/O || {{yes}} || PE13 || {{no}} || TIM1_CH3 || || || || || || ||  

| 45 || PE14 || I/O || {{yes}} || PE14 || {{no}} || TIM1_CH4 || || || || || || ||  

| 46 || PE15 || I/O || {{yes}} || PE15 || {{no}} || TIM1_BKIN|| || || || TP34 || || ||  

| 47 || PB10 || I/O || {{yes}} || PB10 || I2C2_SCL <br /> USART3_TX || TIM2_CH3 || I2C2_SCL || || || Mag_15 || || || Magnetometer pin15 clock

| 48 || PB11 || I/O || {{yes}} || PB11 || I2C2_SDA <br /> USART3_RX || TIM2_CH4 || I2C2_SDA || || || Mag_16 || || || Magnetometer pin16 data

| 50 || V_{DD_1} || S || || V_{DD_1} || || || || || || || || ||  

| 51 || PB12 || I/O || {{yes}} || PB12 || SPI2_NSS <br /> I2C2_SMBAl <br /> USART3_CK <br /> TIM1_BKIN || {{no}} || || || || || || ||  

| 52 || PB13 || I/O || {{yes}} || PB13 || SPI2_SCK <br /> USART3_CTS <br /> TIM1_CH1N || {{no}} || || || || || || ||  

| 53 || PB14 || I/O || {{yes}} || PB14 || SPI2_MISO <br /> USART3_RTS <br /> TIM1_CH2N || {{no}} || || || || || || ||  

| 54 || PB15 || I/O || {{yes}} || PB15 || SPI2_MOSI <br /> TIM1_CH3N || {{no}} || || || || || || ||  

| 55 || PD8 || I/O || {{yes}} || PD8 || {{no}} || USART3_TX || USART3_TX || || || BT_7 || || || Bluetooth pin7 transmitter

| 56 || PD9 || I/O || {{yes}} || PD9 || {{no}} || USART3_RX || USART3_RX || || || BT_6 || || || Bluetooth pin6 receiver

| 57 || PD10 || I/O || {{yes}} || PD10 || {{no}} || USART3_CK || || || || TP51 || || ||  

| 58 || PD11 || I/O || {{yes}} || PD11 || {{no}} || USART3_CTS || DIO || || || U6_6 || || || TPS63030 regulator enable

| 59 || PD12 || I/O || {{yes}} || PD12 || {{no}} || TIM4_CH1 <br /> USART3_RTS || || || || || || ||  

| 60 || PD13 || I/O || {{yes}} || PD13 || {{no}} || TIM4_CH2 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.

| 61 || PD14 || I/O || {{yes}} || PD14 || {{no}} || TIM4_CH3 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.

| 62 || PD15 || I/O || {{yes}} || PD15 || {{no}} || TIM4_CH4 || || Servo1 || || M- || || || Rumble Motor -

| 63 || PC6 || I/O || {{yes}} || PC6 || {{no}} || TIM3_CH1 || || Servo2 || || LED_R || || || Connected to LED_R

| 64 || PC7 || I/O || {{yes}} || PC7 || {{no}} || TIM3_CH2 || || Servo3 || || LED_G || || || Connected to LED_G

| 65 || PC8 || I/O || {{yes}} || PC8 || {{no}} || TIM3_CH3 || || Servo4 || || LED_B || || || Connected to LED_B

| 66 || PC9 || I/O || {{yes}} || PC9 || {{no}} || TIM3_CH4 || DIO || || || R_39 || || || 1.25V???

| 67 || PA8 || I/O || {{yes}} || PA8 || USART1_CK <br /> TIM1_CH1 <br /> MCO || {{no}} || DIO || || || BT_36 || || || Bluetooth pin36. Constant 85Hz PWM

| 68 || PA9 || I/O || {{yes}} || PA9 || USART1_TX <br /> TIM1_CH2 || {{no}} || DIO || || || BT_15 || || || Bluetooth pin15. Varying TTL signal

| 69 || PA10 || I/O || {{yes}} || PA10 || USART1_RX <br /> TIM1_CH3 || {{no}} || DIO || || || BT_14 || || || Bluetooth pin14. Very occasional, only really seen at startup. SPI chip select?

| 70 || PA11 || I/O || {{yes}} || PA11 || USART1_CTS <br /> CANRX <br /> USBDM <br /> TIM1_CH4 || {{no}} || USBDM || || || TP26 || || || Connected through 2.1Ωresistor

| 71 || PA12 || I/O || {{yes}} || PA12 || USART1_RTS <br /> CANTX <br /> USBDP <br /> TIM1_ETR || {{no}} || USBDP || || || TP27 || || || Connected through 2.1Ωresistor

| 72 || PA13 || I/O || {{yes}} || JTMS/SWDIO || {{no}} || PA13 || JTMS || || || TP56 || || || Can also be used for '''JTAG SWDIO''' debugging

| 75 || V_{DD_2} || S || || V_{DD_2} || || || || || || TP39 || || ||  

| 76 || PA14 || I/O || {{yes}} || JTCK/SWCLK || {{no}} || PA14 || JTCK || || || TP57 || || || Can also be used for '''JTAG SWCLK''' debugging

| 77 || PA15 || I/O || {{yes}} || JTDI || {{no}} || TIM2_CH1_ETR <br /> PA15 <br /> SPI1_NSS || JTDI || || || TP55 || || || Can also be used for '''JTAG JTDI''' debugging

| 78 || PC10 || I/O || {{yes}} || PC10 || {{no}} || USART3_TX || DIO || || || TP38 || || ||

| 79 || PC11 || I/O || {{yes}} || PC11 || {{no}} || USART3_RX || DIO || || || TP37 || || ||

| 80 || PC12 || I/O || {{yes}} || PC12 || {{no}} || USART3_CK || || || || || || ||  

| 81 || PD0 || I/O || {{yes}} || OSC_IN || {{no}} || CANRX || || || || || || ||  

| 82 || PD1 || I/O || {{yes}} || OSC_OUT || {{no}} || CANTX || || || || || || ||  

| 83 || PD2 || I/O || {{yes}} || PD2 || TIM3_ETR || {{no}} || || || || || || ||  

| 84 || PD3 || I/O || {{yes}} || PD3 || {{no}} || USART2_CTS || || || || || || ||  

| 85 || PD4 || I/O || {{yes}} || PD4 || {{no}} || USART2_RTS || || || || TP36 || || ||  

| 86 || PD5 || I/O || {{yes}} || PD5 || {{no}} || USART2_TX || || || || SW13 || || || Connected to {{padsquare}}

| 87 || PD6 || I/O || {{yes}} || PD6 || {{no}} || USART2_RX || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.

| 88 || PD7 || I/O || {{yes}} || PD7 || {{no}} || USART2_CK || DIO || || || || || || Reacts instantly to USB plug. Logic HI when USB plugged in, LO when not.

| 89 || PB3 || I/O || {{yes}} || JTDO || {{no}} || TIM2_CH2 <br /> PB3 <br /> TRACESWO <br /> SPI1_SCK || JTDO || || || TP58 || || || Can also be used for '''JTAG JTDO''' debugging

| 90 || PB4 || I/O || {{yes}} || JNTRST || {{no}} || TIM3_CH1 <br /> PB4 <br /> SPI1_MISO || JNTRST || || || TP59 || || || Can also be used for '''JTAG JNTRST''' debugging

| 91 || PB5 || I/O || {{no}} || PB5 || I2C1_SMBAl || TIM3_CH2 <br /> SPI1_MOSI || || || || || || ||  

| 92 || PB6 || I/O || {{yes}} || PB6 || I2C1_SCL <br /> TIM4_CH1 || USART1_TX || || USART1_TX || || EXT_5 || || || EXT connector Pin 5

| 93 || PB7 || I/O || {{yes}} || PB7 || I2C1_SDA <br /> TIM4_CH2 || USART1_RX || || USART1_RX || || EXT_6 || || || EXT connector Pin 6

| 94 || BOOT0 || I || ? || BOOT0 || {{no}} || {{no}} || || || || || || ||  

| 95 || PB8 || I/O || {{yes}} || PB8 || TIM4_CH3 || I2C1_SCL <br /> CANRX || || || || SW15 || || || Connected to {{padselect}}

| 96 || PB9 || I/O || {{yes}} || PB9 || TIM4_CH4 || I2C1_SDA <br /> CANTX || || || || SW14 || || || Connected to {{padstart}}

| 97 || PE0 || I/O || {{yes}} || PE0 || TIM4_ETR || {{no}} || || || || SW9 || || || Connected to {{padmove}}

| 100 || V_{DD_3} || S || || V_{DD_3} || || || || || || || || ||  

=== Kionix KXSC4 (3-Axis Accelerometer) ===

[[Image:Kionix KXSC4 perspective.gif|400px|thumb|right| Kionix KXSC4 <br /> 3-Axis Accelerometer]][[Image:Kionix KXSC4 application squematic.jpg|800px|thumb|right| Kionix KXSC4 <br /> application squematic]]

 

==== Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter) ====

U8?. Inside ALPS 503A BT module<br />

Marked in the plastic as "ext" and refered as "extension connector" in the [[Move Sharp Shooter]] and [[Move Racing Wheel]] "Instruction Manual.pdf"

**All the schematics and pinouts in "D-lite MoveCopter manual" and "Kenn Sebesta blog" related with this connector are taken directly from the main board (not from the external connector). The schematics explained in these pages are from an old model with different number of pins (some of them duplicated or displaced). There are at least 3 different board models where this pins are different, but in all models the lines are reordered at the "EXT connector" (and reduced to 8), all models has the same pinout externally explained here in wiki

 

 

 

 

===PSL1GHT and libmove & homebrew===

{{Peripherals}}<noinclude>[[Category:Main]]</noinclude>