Tuesday, October 19, 2010

Fujitsu LifeBook Shock Sensor on Linux

Some Fujitsu Lifebook laptops (for example A6030) come with a so called Shock Sensor technology. The technology is used to protect the hard disk in case of sudden impact to the laptop. Fujitsu provides a Windows Filter Driver, FJGSDisk.sys. They also have an application which uses this driver to read accelerometer values and draw a graph. This feature of the laptop is not supported on Linux– the hardware details of the accelerometer chip used and how the chip is wired to the motherboard, is not publicly available.

I have been spending some time trying to understand how this sensor works in Windows in the hope of enabling this feature on Linux. I used WinDbg over Firewire and monitored the calls to WIN32 kernel functions, WRITE_PORT_UCHAR and READ_PORT_UCHAR made by FJGSDisk.sys. The driver uses two different ports for reading from and writing to the accelerometer sensor. In addition each of the three axes seem to have a unique Id, including an additional Id which apparently is used to reset the axis. Details are in the table below--


WRITE_PORT 0xfd70
READ_PORT0xfd74
X_AXIS0xa6
Y_AXIS0xa7
Z_AXIS0xa8
RESET_AXIS? 0xa9

Reading accelerometer output for a particular axis involves writing the axis Id to the write port. This is followed by a read operation on the read port. On Linux this would translate to something like the following--

outb(X_AXIS, WRITE_PORT);
val = inb(READ_PORT);

I wrote a simple user space application which does the above, but inb always returns 0. Note that my application does call iopl(3) and is run as root. The failure to read any values from inb makes me think that the accelerometer hardware is not getting initialized on Linux. Interestingly, ports 0xfd70 and 0xfd74 also show up in the BIOS ACPI tables. It appears that the ACPI provides routines to read and write to these ports. Possibly digging into the ACPI DSDT will help. Will update the blog if I find something interesting.

In the meanwhile, here are some links to other webpages with reference to the Shock Sensor reverse engineering:

http://www.digriz.org.uk/debian/fujitsu/t2010

http://www.woodmann.com/forum/showthread.php?11772-Fujitsu-3D-Shock-Sensor-Application-Reversing