the sx20 porting thread

neszt

I must correct myself.

I got E31 message on LCD screen NOT E51. Ehh, i was too sleepy yesterday..

neszt

reyalp
Read fi2.inc.txt, and the thread I provided.

Ok, i found, thanks. I'll read.

neszt

RaduP
Wait, did you do the /loader/ stuff first? The reset code and things?

Uuups. I didn't touch anything in the resetcode/main.c. Will you please show your one? I would like to compare with your sd980 firmware. It is not in the svn yet.

RaduP

The SD980 code is not in the SVN yet because it's not ready. You can use the SX10 port as a reference for the reset/loader code, that's what I used, and it is pretty similar with SD980.

neszt

RaduP
The SD980 code is not in the SVN yet because it's not ready. You can use the SX10 port as a reference for the reset/loader code, that's what I used, and it is pretty similar with SD980.

well, the sx10 code is what i also used, and the code same in the three firmwares. The only thing, i do not understand is the jump vector:

// "LDR R0, =loc_FF810000\n"
"MOV R0, %0\n" // new jump-vector
"LDMFD SP!, {R4,LR}\n"
"BX R0\n"
: : "r"(dst_void) : "memory","r0","r1","r2","r3","r4");

What "%0" means?

RaduP

I had problems with that too, but I forgot what it means. I THINK it means replace %0 with dst_void, but not 100% sure. Look in the SD980 thread, I asked there and reyalp answered with a link to the gcc asm docs.

reyalp

https://chdk.setepontos.com/d/4129/19

neszt

Nice. We jump to dst_void. 😀

MOV R0, %0 // dst_void to R0.
BX R0 // jump to where R0 points.

Anyway, this code seems good without modification.

It's time to look up the missing function addresses, but i think my E31 problem is not regarding the function addresses but something else, and it's annoying me.

neszt

I got the first ones.

NHSTUB(EnterToCompensationEVF, 0xFF836D84)
NHSTUB(PT_PlaySound, 0xFF8840D4) // maybe
NHSTUB(RefreshPhysicalScreen, 0xFFA0492C)
NHSTUB(TurnOffBackLight, 0xFF89B6A4)

In the sd980:

NHSTUB(kbd_pwr_off, 0xFF810B04)
NHSTUB(kbd_pwr_on, 0xFF810B04)

And in the firmware there is a function begins at 0xFF810B08! it's seem not ok, or i don't understand something. And why the same address for different functions?

neszt

neszt
NHSTUB(kbd_pwr_off, 0xFF810B04)
NHSTUB(kbd_pwr_on, 0xFF810B04)

And in the firmware there is a function begins at 0xFF810B08! it's seem not ok, or i don't understand something. And why the same address for different functions?

Ok, i see the comment:
// null sub - point these at nullsub_1 as labelled in IDA

What that means? It is seems like importand to find the kbd_pwr_on. (by it's function name 😀 )

reyalp

These functions don't exist on some cams. In that case, you just point them to a return instruction (BX LR). You need to examine the code of your physwtask to figure this out.

Obviously, in your firmware all addresses will be different.

neszt

reyalp
These functions don't exist on some cams. In that case, you just point them to a return instruction (BX LR). You need to examine the code of your physwtask to figure this out.

Obviously, in your firmware all addresses will be different.

Ok, in my firmware at 0xFF810B04, there is also BX LR, so i used the same address for those functions.

Now, i examined every "not found" functions. The statistics:

Found with help of sd980's stubs_entry_2.S: 8 functions.
Pointed to BX LR: 6 functions.
Deadcode for not found: 13 functions.

Now the sx20's stubs_entry_2.S:

#include "stubs_asm.h"

NHSTUB(EnterToCompensationEVF, 0xFF836D84)
NHSTUB(ExitFromCompensationEVF, 0xFF825454) // maybe
NHSTUB(GetBatteryTemperature, 0xDEADC0DE) // NA #1
NHSTUB(GetCCDTemperature, 0xDEADC0DE) // NA #1
NHSTUB(GetZoomLensCurrentPoint, 0xFF9566D4) // maybe
NHSTUB(GetZoomLensCurrentPosition, 0xDEADC0DE) // NA #1
NHSTUB(Lseek, 0xFF83539😎
NHSTUB(PT_PlaySound, 0xFF8840D4) // maybe
NHSTUB(RefreshPhysicalScreen, 0xFFA0492C)
NHSTUB(Remove, 0xDEADC0DE) // NA #1
NHSTUB(TurnOffBackLight, 0xFF89B6A4)
NHSTUB(UIFS_WriteFirmInfoToFile, 0xDEADC0DE) // NA #1
NHSTUB(kbd_pwr_off, 0xFF810B04) // BX LR
NHSTUB(kbd_pwr_on, 0xFF810B04) // BX LR
NHSTUB(openfastdir, 0xDEADC0DE) // NA #1
NHSTUB(readfastdir, 0xDEADC0DE) // NA #1
NHSTUB(rename, 0xDEADC0DE) // NA #1

NHSTUB(PostLogicalEventForNotPowerType, 0xDEADC0DE) // NA #1
NHSTUB(LEDDrive, 0xDEADC0DE) // NA #1
NHSTUB(apex2us, 0xFFA080B😎
NHSTUB(WriteSDCard, 0xFF9409C4)
NHSTUB(UnlockAF, 0xDEADC0DE) // NA #1
NHSTUB(DoAFLock, 0xDEADC0DE) // NA #1
NHSTUB(rewinddir, 0xFF810B04) // BX LR
NHSTUB(SetZoomActuatorSpeedPercent, 0xFF810B04) // BX LR
NHSTUB(Unmount_FileSystem, 0xFF810B04) // BX LR
NHSTUB(Mount_FileSystem, 0xFF810B04) // BX LR
NHSTUB(platformsub_kbd_fetch_data, 0xDEADC0DE) // NA #1

What is the next step? I still got E31. 😀 😀 😀

RaduP

First step is to get the camera to reboot properly.. You an even remove the call to the create spy task thing, just first try to get a clean reboot. Did you finish all the code in /loader ? Does it work fine? Make sure that code runs fine, by blinking the LED.

neszt

RaduP
First step is to get the camera to reboot properly.. You an even remove the call to the create spy task thing, just first try to get a clean reboot. Did you finish all the code in /loader ? Does it work fine? Make sure that code runs fine, by blinking the LED.

Yes i try to make the camera to reboot without adding any spy task. I can blink te led ANYWHERE, including the

loader/sx20/main.c / my_restart(),
platform/sx20/main.c / startup(),
platform/sx20/sub/100f/boot.c / boot().

Moreover, i can blink the LED by replacing the last asm code in boot()

"B sub_FF810354\n"

with my

"B led_debug\n"

Very interesing, that the LED blinks with different speeds in different place. But i think it's normal.

So when i try to reboot the camera normally, i got E31 in bottom-left of the LCD for 4 seconds. That's all. I'll take a photo from it..

neszt

RaduP
Did you finish all the code in /loader ?

I really didn't touch anything in the /loader, but filled LED addresses correctly. What else need to be modified? Probably is ok, if the blinking test is ok?

neszt

neszt
I'll take a photo from it..

http://neszt.hu/SX20_E31_problem_01.jpg
http://neszt.hu/SX20_E31_problem_02.jpg

neszt

RaduP
Did you finish all the code in /loader ?

Can you pls include your /loader in your source? It would be good to have a look at it. Also would be enought the diff from sx10..

https://chdk.setepontos.com/d/4310/25

RaduP

Ok, here is my copy and restart function:

void __attribute__((noreturn)) copy_and_restart(void *dst_void, const void *src_void, long length) {

        {
                char *dst = dst_void;
                const char *src = src_void;

                if (src < dst && dst < src + length)
                {
                        /* Have to copy backwards */
                        src += length;
                        dst += length;
                        while (length--)
                        {
                                *--dst = *--src;
                        }
                }
                else
                {
                        while (length--)
                        {
                                *dst++ = *src++;
                        }
                }
        }

        asm volatile (
                 "MRS     R0, CPSR\n"
                 "BIC     R0, R0, #0x3F\n"
                 "ORR     R0, R0, #0xD3\n"
                 "MSR     CPSR, R0\n"
                 "LDR     R1, =0xC0200000\n"
                 "MVN     R0, #0\n"
                 "STR     R0, [R1,#0x10C]\n"
                 "STR     R0, [R1,#0xC]\n"
                 "STR     R0, [R1,#0x1C]\n"
                 "STR     R0, [R1,#0x2C]\n"
                 "STR     R0, [R1,#0x3C]\n"
                 "STR     R0, [R1,#0x4C]\n"
                 "STR     R0, [R1,#0x5C]\n"
                 "STR     R0, [R1,#0x6C]\n"
                 "STR     R0, [R1,#0x7C]\n"
                 "STR     R0, [R1,#0x8C]\n"
                 "STR     R0, [R1,#0x9C]\n"
                 "STR     R0, [R1,#0xAC]\n"
                 "STR     R0, [R1,#0xBC]\n"
                 "STR     R0, [R1,#0xCC]\n"
                 "STR     R0, [R1,#0xDC]\n"
                 "STR     R0, [R1,#0xEC]\n"
                 "CMP     R4, #7\n"
                 "STR     R0, [R1,#0xFC]\n"
                 "LDMEQFD SP!, {R4,PC}\n"
                 "MOV     R0, #0x78\n"
                 "MCR     p15, 0, R0,c1,c0\n"
                 "MOV     R0, #0\n"
                 "MCR     p15, 0, R0,c7,c10, 4\n"
                 "MCR     p15, 0, R0,c7,c5\n"
                 "MCR     p15, 0, R0,c7,c6\n"
                 "MOV     R0, #0x80000006\n"
                 "MCR     p15, 0, R0,c9,c1\n"
                 "MCR     p15, 0, R0,c9,c1, 1\n"
                 "MRC     p15, 0, R0,c1,c0\n"
                 "ORR     R0, R0, #0x50000\n"
                 "MCR     p15, 0, R0,c1,c0\n"
                 "LDR     R0, =0x12345678\n"
                 "MOV     R1, #0x80000000\n"
                 "STR     R0, [R1,#0xFFC]\n"
              // "LDR     R0, =loc_FF810000\n"
                 "MOV     R0, %0\n"              // new jump-vector
                 "LDMFD   SP!, {R4,LR}\n"
                 "BX      R0\n"
                 : : "r"(dst_void) : "memory","r0","r1","r2","r3","r4");

        while(1);
}

Note that you must copy and modify the equivalent code from YOUR camera, since there are some differences between different firmwares.

neszt

RaduP
Ok, here is my copy and restart function:

...

Note that you must copy and modify the equivalent code from YOUR camera, since there are some differences between different firmwares.

Days before, when i begun to work on it, i made a diff between your firmware (sd980) and mine (sx20) regarding this section, and i found NO DIFF. Now, i examined your code and your firmware and i found one line diff:

Your (and my) firmware section:

MRS R0, CPSR
BIC R0, R0, #0x3F
ORR R0, R0, #0xD3
MSR CPSR, R0
LDR R1, =0xC0200000
MOVL R0, 0xFFFFFFFF
STR R0, [R1,#0x10C]
STR R0, [R1,#0xC]

The regarding, mentioned code part:

"MRS R0, CPSR\n"
"BIC R0, R0, #0x3F\n"
"ORR R0, R0, #0xD3\n"
"MSR CPSR, R0\n"
"LDR R1, =0xC0200000\n"
"MVN R0, #0\n"
"STR R0, [R1,#0x10C]\n"
"STR R0, [R1,#0xC]\n"
"STR R0, [R1,#0x1C]\n"

So there is "MOVL R0, 0xFFFFFFFF" replaced with "MVN R0, #0\n".

I tried to change the code, but i got compile error:

Error: bad instruction `movl R0,0xFFFFFFFF'

However, seems like this works with your camera, and this makes me beleive, should work in my case too.

Anyway, our firmwares identical this way.

RaduP

MOVL is a macro, something like
mov r0,#0
sub r1,r1,1
On ARM cpus you can't just assign whatever values you want to a register like you do with X86, so you must do some tricks.

« Previous Page Next Page »