Talk:XGecu Protocol

From Proghq
Jump to navigation Jump to search

T48 0x24 command byte seems to be Adapter detection/DRM.
Here are the queries to the T48 for some adapters:

24 E0 28 00 00 00 00 00 01 00 00 00 .... F48_EX-1
24 E0 28 00 00 00 00 00 02 00 00 00 .... S44_EX-1
24 E0 28 00 00 00 00 00 08 00 00 00 .... F48_EX-2
24 E0 28 00 00 00 00 00 0B 00 00 00 .... F56_EX-A
24 E0 28 00 00 00 00 00 00 40 00 00 .... EMMC_ISP
24 E0 28 00 00 00 00 00 00 00 00 E1 .... BGA48-E001
24 E0 28 00 00 00 00 00 00 00 00 E2 .... BGA63_EX-1
24 E0 28 00 00 00 00 00 00 00 00 E3 .... BGA64-EX-A
24 E0 28 00 00 00 00 00 00 00 00 E4 .... BGA64-EX-B
24 E0 28 00 00 00 00 00 00 00 00 E5 .... BGA169/BGA153
24 E0 28 00 00 00 00 00 00 00 00 E6 .... BGA162
24 E0 28 00 00 00 00 00 00 00 00 E7 .... BGA221
24 E0 28 00 00 00 00 00 00 00 00 E8 .... BGA100_EX
24 E0 28 00 00 00 00 00 00 00 00 EC .... EMMC_SD


weird
-- with the emmc_isp un-plugged:, reading an IS21ES04G-JCLI(ISP)_1Bit
1 <--              UNKNOWN 24 F0 00 00 01 00 00 00 
1 <--              UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00 
1 --> RETURNS              24 D0 30 00 14 01 07 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
1 <--              UNKNOWN 24 F1 00 00 00 00 00 00 
1 <--             TRAN_END 04 01 00 00 00 00 00 00 

-- With the emmc_isp plugged-in and reading an IS21ES04G-JCLI(ISP)_1Bit
1 <--              UNKNOWN 24 F0 00 00 01 00 00 00
1 <--              UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00
1 --> RETURNS              24 00 30 00 14 01 07 FF 58 47 65 63 75 20 44 69 72 65 63 74 6C 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 A0 AD 
1 <--              UNKNOWN 24 F1 00 00 00 00 00 00 
1 <--           TRAN_START 03 31 00 81 01 05 A1 00 20 00 00 00 41 00 20 00 00 02 00 00 00 01 00 FF 03 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 08 20 00 00 00 00 41 
1 <--           GET_STATUS 39 31 00 81 01 05 A1 00 
1 --> RETURNS              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
1 <--                ERROR 21 04 00 00 00 00 00 00 
1 --> RETURNS              
1 <--             TRAN_END 04 01 00 00 

-- with the emmc_isp un-plugged again, transaction is starting:
1 <--              UNKNOWN 24 F0 00 00 01 00 00 00
1 <--              UNKNOWN 24 E0 28 00 00 00 00 00 00 40 00 00
1 --> RETURNS              24 00 00 00 00 00 00 00
1 <--              UNKNOWN 24 F1 00 00 00 00 00 00
1 <--           TRAN_START 03 31 00 81 01 05 A1 00 20 00 00 00 41 00 20 00 00 02 00 00 00 01 00 FF 03 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 08 20 00 00 00 00 41
1 <--           GET_STATUS 39 31 00 81 01 05 A1 00
1 --> RETURNS              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1 <--                ERROR 21 04 00 00 00 00 00 00
1 --> RETURNS              21 2A 00 00 00 00 00 00
1 <--             TRAN_END 04 01 00 00

0x3E (pin detect)

pin detect response in the form 3E00xxxx000000XXXXXXYYYYYY0000, where XXXXXX seems to be one row of pin state, and YYYYYY the other.

x x x x x x x x x x x x x x x x - - - -

U     FFFF00 FFFF00

x x x x x x x x x x x x x x x x - - - -


x x x x x x x x x x x x x x x x x - - -

U     FFFF80 FFFF00

x x x x x x x x x x x x x x x x - - - -


x x x x x x x x x x x x x x x x - - - -

U     FFFF0C FFFF00

x x x x x x x x x x x x x x x x - - x x


x x x x x x x x x x x x x x x x - - x x

U     FFFF30 FFFF00

x x x x x x x x x x x x x x x x - - - -



x x - - - - - - - - - - - - - - - - - -

U     000000 00C000

- - - - - - - - - - - - - - - - - - - -



- - x x - - - - - - - - - - - - - - - -

U     000000 003000

- - - - - - - - - - - - - - - - - - - -


- - - - - - - - - - - - - - - - - - - -

U     030000 000000

x x - - - - - - - - - - - - - - - - - -



- - - - - - - - - - - - - - - - - - - -

U     060000 000000

- x x - - - - - - - - - - - - - - - - -

(0x34) Was SET_DIR

The old SET_DIR command (0x34) on the T48 responds with 12 bytes:

34 00 18 00 00 00 00 00 00 00 00 00

Anyone any idea what this represents? Assigning some of ISP to GND/VCC/VPP does produce some non-zero values for the last 4 bytes but can't find a pattern. Calling pin reset or even end transaction doesn't reset the values in the reponse.