the sx20 porting thread

neszt

I analysed all the files dozen times and i not found any problem. I must miss somthing, but i don't know what.

Any help appreciated. Where can i debug?

Reyalp: Am i right, that the camera should clean reboot without finding all the function addresses? I didn't add any spy task yet.

RaduP

If you have everything done right, then yes, the camera should restart nicely. So long as you commented the task hook functions so that no tasks are hooked.

neszt

The very first thing that gets called loader/sx20/entry.S

MOV SP, #0x1900
MOV R11, #0
B my_restart

I changed this to

LDR R1, =0xFF83A570
BX R1

to jump the camera's own reset code, and this way i also get E31! So no copy, no trick.

Would be good to know, what is the very first code in the firmware that gets called.

RaduP

The very first code I think is in entry.S
Try to replace MOV R3, #0x8000 with different values (higher, lower, etc.)

You might also want to comment out this code:

// Turn OFF SD Card power
// to support autostart
LDR R3, =0xC0220018
MOV R2, #0x44
STR R2, [R3]

Just to be sure.
And I hope you did test to make sure the code actually reaches this part, right?

reyalp

neszt
Reyalp: Am i right, that the camera should clean reboot without finding all the function addresses? I didn't add any spy task yet.

Depending where you have go to, yes. Obviously having correct addresses for functions only matters if those functions are called. Walk through the execution from loader/<camera>/entry.S onward, and you can see what is needed where. If you don't create spytask or hook any other tasks, then basically you don't need any of the camera functions or variables.

You probably need asm stuff in loader/<camera>/resetcode/main.c to boot correctly after loading an FI2 or diskboot. edit: note that this, like almost all the inline ASM, is specific to your camera.

neszt

RaduP
The very first code I think is in entry.S
Try to replace MOV R3, #0x8000 with different values (higher, lower, etc.)

Days before i tried higher value (64000) with no result, now i tried lower value (1000) with no result.

You might also want to comment out this code:

// Turn OFF SD Card power
// to support autostart
LDR R3, =0xC0220018
MOV R2, #0x44
STR R2, [R3]

Just to be sure.

Yes, of course, i tried to comment this out, but as i analysed the firmware code and i'am 99% sure, this address (0xC022001😎 is also the SD card power address for sx20.

And I hope you did test to make sure the code actually reaches this part, right?

Especially, i didn't tried to blink in loader/sx20/entry.S, but the last line of this code is "B my_restart", and the there were successfull blinking in the fist line of the

void __attribute__((noreturn)) my_restart() {

function. Is this enought, or should i try in asm code?

Thanx for the ideas! Now i'am not hopless. 😀

Somehow i must jump over this silly problem.

neszt

reyalp
Walk through the execution from loader/<camera>/entry.S onward, and you can see what is needed where.

Is that true, if i jump to the code, in the firmware:

asm volatile (
"MRS R0, CPSR\n"
"BIC R0, R0, #0x3F\n"
"ORR R0, R0, #0xD3\n"
"MSR CPSR, R0\n"
"LDR R1, =0xC0200000\n"
"MVN R0, #0\n"
"STR R0, [R1,#0x10C]\n"
"STR R0, [R1,#0xC]\n"
"STR R0, [R1,#0x1C]\n"

in the loader/sx20/entry.S, the camera should boot normally?

https://chdk.setepontos.com/d/4348/63

RaduP

No, I think it will crash or something.
I remember trying to do something similar, and the camera won't restart until you complete some of the restart code. But I forgot where exactly you can safely restart it.

neszt

I begun to try again the DISKBOOT.BIN method. (when i got infinite reboot loop).

I'am curious what, if i can avoid the infinite reboot loop by turning the SD power off. Will i get E31 also?

I dont't know, because i can not avoid the loop, but i'am sure, that the sx20 SD Power address is the same as sx10, sx1, sd980, sd990, sx200. (0xC022001😎

I saw in sx200 case that the delay was incressed to 0xF0000, so i tried also extreme high values, but no result.

RaduP

My SD980 address is wrong though. Don't rely on it.
Also, if you get an infinite boot loop, it means the camera actually does reboot.. try to find the right address.

neszt

I found some keyboard addresses, with simple blink test method.

0xC02200FC & 0x01 Circle button around Func Set (roate left and right) bit
0xC0220100 & 0x01 Capture button, half pressed bit
0xC0220104 & 0x01 Capture button, full pressed bit
0xC0220134 & 0x01 Power button bit
0xC0220137 & 0x01 Play button bit

neszt

RaduP
My SD980 address is wrong though. Don't rely on it.

Is that means, you can test your firmware only with ps.fi2 file with firm update method?

However other cams with released firmware have this (0xC022001😎 SdPower address (by checking their enity.S).

Also, if you get an infinite boot loop, it means the camera actually does reboot.. try to find the right address.

Sorry, if it wasn't clear by my bad english. I'll try to write a lot precise from now.

By searching in the firmware code for SdPower.c as reaylp says, i was nearly sure, that this is the good address. I wonder if there is other method to find it, excluding writing all possible address in a specified memory range. I don't wana do that. I wasn't worry reading any addresses to find keys, but writing to any unknown address is critical, i think.

Probably a tricky hardware hack could help, somehow bounding a led to sd power (3.3V) pins to find it as a led address.

Also i'am sure, that finding SdPower could avoid the infinty reboot loop, but could lead me to a well-known E31 again... So I'am not too motivated..

RaduP

Sorry, the address is correct, I didn't know until yesterday. But yes, I also get the boot loop, so I only use the firmware update method.

RaduP

Ok, now it works for me with the bootloader method as well. Last time I tried, I did not have boot.c working properly.

Anyway, regarding your E31 error message, what is the last confirmed code where the program execution gets to before the magic error message?

neszt

RaduP
Ok, now it works for me with the bootloader method as well. Last time I tried, I did not have boot.c working properly.

Ok, please confirm, that your firmware doesn't boot with DISKBOOT.BIN method, if the SdPower and the delay assembly code is commented out in your very first enrty.S. (loader)

Anyway, regarding your E31 error message, what is the last confirmed code where the program execution gets to before the magic error message?

The very last assebmly code before the last "B ...". That's why i can not debug more. I made sure, that the chdk code was executed until the last line, and we jumped to the camera normal boot process.

It seems, that the camera knows, something is different. Probably the problem is the registers states, but why it's not couse problems on other cameras?

I tried to search "E31" with several mode in the firmware, but it is hopeless, to find anything.

RaduP

Wait, last B in which file/function?

neszt

RaduP
Wait, last B in which file/function?

platform/sx20/sub/100f/boot.c : in the boot() function last assembly code:

"B loc_FF810354"

So, when i insert "B my_debug_led_blinker" just before this last "B loc_FF810354" code, i git led blinks.

RaduP

Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.
Assuming you are using the firmware update method, make sure that you have the correct value for all the variables in boot() I hope you are using the disassembly code from your camera, rather than just copy/paste/modify the SX10 code.

neszt

RaduP
Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.

Sorry, i dont't understand this, will you please try to tell me different way?

Assuming you are using the firmware update method, make sure that you have the correct value for all the variables in boot() I hope you are using the disassembly code from your camera, rather than just copy/paste/modify the SX10 code.

First of all, my reference port is your sd980, rather than sx10 😀

Here is a diff, to see, our firmwares only differs in three ways in the regarding boot section:

                LDR     R1, [R2]
                ORR     R1, R1, #1
                STR     R1, [R2]
-               LDR     R0, =unk_FFC0281C
+               LDR     R0, =unk_FFC0EF3C
                LDR     R1, =0x1900
-               LDR     R3, =0x208F0
+               LDR     R3, =0xE7F4
loc_FF81013C
                CMP     R1, R3
                LDRCC   R2, [R0],#4
                STRCC   R2, [R1],#4
                BCC     loc_FF81013C
-               LDR     R1, =0x153E84
+               LDR     R1, =0x13DD20
                MOV     R2, #0
loc_FF810154
                CMP     R3, R1
                STRCC   R2, [R3],#4
                BCC     loc_FF810154
                B       loc_FF810354

So, of course, i use the code from SX20 firmware section, without this, i got freeze my camera. I only got E31, when i use the correct code, and this way the camera not freezes, just prints E31, and switches off. (I can switch it on without removing batteries)

RaduP

neszt

RaduP
Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.

Sorry, i dont't understand this, will you please try to tell me different way?

Ok, well, as you can see in my code, at the end of the boot() function we jump into a modified routine, "B sub_FF810354_my" //checked //---------->
That jumps into "BL sub_FF81178_my\n" //------------>
Which "LDR R1, =sub_FF815E34_my\n" //------------>
Which "B taskcreate_Startup_my\n"
Which "LDR R3, =task_Startup_my\n" // ->
Which finally: // "BL sub_FF83A2F8\n" // start diskboot.bin
So if you do not modify your code all the way to there, the original firmware will try to load the bootdisk.

« Previous Page Next Page »