SX110IS - howto start porting

[nomi_68k]

Hi, I'm a newbie of CHDK with some knowledge of assembly (but not ARM assembly  ).
I did the dump of the firmware of my SX110IS and I disassembled it with IDA, helped by some sigs and idc.
The problem is that I can't find in all the wiki a full and well structured tutorial on how to proceed with the porting of CHDK.

Can someone help me with a good link?

Until now I found the first two parameters for the porting of CHDK on this camera:

char *hook_raw_image_addr()
{
   //Found at ROM:FFE60B00
   //      ROM:FFE60B50                 LDR     R6, =0x10805040
   //      ...
   //      ROM:FFE60BA8                 MOV     R1, R6
   //      ROM:FFE60BAC                 ADR     R0, aCrawBuffP  ; "CRAW BUFF       %p"
   
   
   return (char*)0x10805040;
}

long hook_raw_size()
{
   //      Found at ROM:FFE60B00
   //      ROM:FFE60BB4                 LDR     R1, =0xEC04F0
   //      ROM:FFE60BB8                 ADR     R0, aCrawBuffSizeP ; "CRAW BUFF SIZE  %p"
   //      ROM:FFE60BBC                 BL      sub_FFCE7000
   
   return 0xEC04F0;
}

Thanks for any help.

=============
My camera info is:
--------------------------
Canon PowerShot SX110 IS
P-ID:3192   PAL D

Firmware Ver GM1.00B
NoError
Jun 25 2008   15:08:34
---------------------------
Adj Ver.009.006

IS Firm Ver. 3.00
IS Param Ver. 3.00
---------------------------

[ewavr]

long hook_raw_size()
{
 return 0xEC04F0;
}

14 bit RAW? 

[reyalp]

Hi, I'm a newbie of CHDK with some knowledge of assembly (but not ARM assembly  ).
I did the dump of the firmware of my SX110IS and I disassembled it with IDA, helped by some sigs and idc.
The problem is that I can't find in all the wiki a full and well structured tutorial on how to proceed with the porting of CHDK.

Can someone help me with a good link?

Nope. Assuming you've already found For Developers - CHDK Wiki no better link exists. Nor is one likely to appear, because step by step tutorials aren't a substitute for understanding.

If you cannot figure out what you need to do based on examining the current sources and pages found under For Developers - CHDK Wiki you need to study them further or give up. Basically, you have to make everything under loader and platform for your camera, as described in Adding support of a new camera. You can refer to existing ports to verify that you've correctly identified the corresponding things in your port, and to understand what those files do in the first place.  There is no short cut, you have to actually understand how CHDK works to make a successful port. The best place to get this understanding is from the source. That's a lot of work, but only a small part of the effort needed to get your port running.

This thread: How does CHDK start running may help you get started.

If you are unfamiliar with ARM architecture and assembler, refer to the excellent documentation available freely from ARM. There's links to the most pertinent documents in Developer Technical Documents. Assuming you have sufficient general understanding of assembler and computer architecture, you can easily teach yourself everything you need to know about ARM from there.

If you have specific questions about particular aspects CHDK, there are people here who will gladly answer them.

[PhyrePhoX]

you should also read the huge thread about the g9 porting (for example, there are more similar threads for different cameras)

[nomi_68k]

14 bit RAW? 

The SX100IS digicam has:
long hook_raw_size()
{
   return 0x9DCCE0;
}

It's a 8Mpixels, so .... 10 bit RAW???   

I don't know... 

[nomi_68k]

Nor is one likely to appear, because step by step tutorials aren't a substitute for understanding.

I hope to be able to explain my point without misunderstanding due to my bad english.
I know that you are right about the necessity to understand all the process. And I know that all GPL software are done by the efforts of volunteers with no obligation.
So I'm really grateful to all of you.
But.... hey boys.... this is the most hard way! 
In my perspective, a tutorial could be useful only to organize some little information as:
1) The list of functions that anyone must find into a disassembled firmware;
2) The list of hardware pointers (leds, keyboard,free RAM ecc..)

Anyway, why I can find only few IDA database (idb) of disassembled firmware? For example it will be useful for me to find the SX100IS firmware fully disassembled.

Thanks again and happy new year! 

[ewavr]

It's a 8Mpixels, so .... 10 bit RAW???   

Yes, 10 bit RAW for all CHDK ported cameras.

Anyway, why I can find only few IDA database (idb) of disassembled firmware?

Do it yourself in 10-20 minutes from dump using IDA scripts and signatures for CHDK (Loading dump to IDA - CHDK Wiki).

For example it will be useful for me to find the SX100IS firmware fully disassembled.

Maybe not only SX100, but also A650, A720 (it seems that these CHDK ports are complete and bug-free).

[nomi_68k]

Yes, 10 bit RAW for all CHDK ported cameras.

Sorry, I can't understand:
10 bits for every channel (R, G and B) for a total of 30 bits or a total of 10 bits?
In the second case is the sensor able to record 1024 colours only??   

Thanks

[fudgey]

10 bits for every channel (R, G and B) for a total of 30 bits or a total of 10 bits?
In the second case is the sensor able to record 1024 colours only??   

10 bits for each channel, but we don't have RGB pixels; it's a Bayer matrix: http://en.wikipedia.org/wiki/Bayer_filter.

And the sensor is analog, there's just usually too much noise in point&shoot cameras to bother using more than 10 bits (considering more bits require more processing power and memory i.e. time and money) so Canon doesn't even though the A/D converter in some schematic snippet was actually a 12-bit chip.

[reyalp]

In my perspective, a tutorial could be useful only to organize some little information as:
1) The list of functions that anyone must find into a disassembled firmware;
2) The list of hardware pointers (leds, keyboard,free RAM ecc..)

If you look through an existing ports platform/<camera>/sub/<firmware version>/*.S these things are pretty obvious. See also include/lowlevel.h and platform/generic/*, and be sure you understand Signature finder - CHDK Wiki
The list of addresses you want is right there, and unlike a tutorial, it's never out of date!

You need to understand these things anyway. If you don't have the time/skill/energy to understand this part of CHDK, you won't make a successful port.

Anyway, why I can find only few IDA database (idb) of disassembled firmware? For example it will be useful for me to find the SX100IS firmware fully disassembled.

For any camera with a dump available, load the bin, apply the vxworks or dryos FLIRT, run the idc scripts. I suggest doing this with all the reference firmwares, and whatever camera is most similar to your own. You can also work backwards from the sig_ref*.txt or stubs_entry.S/stubs_entry_2.s from any camera.

[nomi_68k]

I'm starting to understand some things. 
So thanks very much for all you guys that are helping me.

With the "blink_g7" program (a little modified  ) I can confirm the LED's address:

#define LED_AF      0xC02200C0 // AutoFocus
#define LED_BLUE  0xC02200C4 // printer button
#define LED_RED   0xC02200C8 // next to the play button, rather orange
#define LED_GRN   0xC02200CC // in the same position as above, but in green

I'have just modified the SX110IS section of the wiki with these informations.

[fe50]

@nomi_68k

Since the original DryOS CHDK.idc script does not run all sub scripts correctly, i use modified versions of the IDC scripts: ida-chdk-idc-dryos-singlerun.7z instead. The main script CHDK.idc runs all other scripts automatically, manual definition of the ROM_START address is not required anymore (MinEA() used instead).
This way you you can easily run all needed scripts with a single click...

[PhyrePhoX]

fe50 - this does not apply to vxworks i guess?

[fe50]

[PhyrePhoX]

this would explain why i couldnt find some things sometimes when i had a dryos firmware loaded in ida. nice.
well, feel free to take a look at the vxworks idc as well i still wonder why you refuse to code for chdk and just do the (also much needed) "dirty work" in the wiki - thanks a million!
yeah, i'm quite happy it snowed in berlin, though in a big city snow tends to get really ugly after a few days, and this is the case now