ixus175_elph180_100c porting attempt

tsamma

29

ixus175_elph180_100c porting attempt

« on: 02 / March / 2017, 23:48:15 »

Advertisements

I got the new one ixus175 and try to porting but no luck at starting point.
Following progress:
I'm dump own firmware and identify version by ACID. it's tell me 100c version of firmware then copy /loader and /platform from ixus160 and modify step by step in Developer document. Compile with CHDKShell and extract to bootable card. Locked and press Play botton it's never boot.

SYSKEY and NEED_ENCODED_DISKBOOT found in firmware by assembler and modify dancingbits.h and dancingbit.c to append new SYSKEY and NEED_ENCODED_DISKBOOT.

Some question to advances:
1.How to know led address for debug? (Any code to scan)
2.Is NEED_ENCODED_DISKBOOT need in this step?
3.Does /loader need to modify?
4.How to know DISKBOOT is decoded and run well?
5.How to get my DISKBOOT.bin load? (Actually Question

)
Thank you.

Logged

blackhole

940
A590IS 101b

Re: ixus175_elph180_100c porting attempt

« Reply #1 on: 03 / March / 2017, 03:48:20 »

Hi tsamma!
Can you please upload your fw dump somewhere and post a link for download?
You can find LED addresses in stubs_entry.s

Code: [Select]

gmake PLATFORM=xxx PLATFORMSUB=xxx rebuild-stubs

Logged

http://astrofoto.pondi.hr

tsamma

29

Re: ixus175_elph180_100c porting attempt

« Reply #2 on: 03 / March / 2017, 04:56:20 »

Thank you for locate LED Address.

Code: [Select]

// LED table init @ 0xff956444
// LED #1: 0xc022d200 (#98 in GPIO table), offset 0x98
// LED #2: 0xc022d1fc (#97 in GPIO table), offset 0x8
// GPIO table @ 0xffbe342c

It's here: https://drive.google.com/open?id=0B4ujGHeVgSW0MmphbmxuSU56b2M my firmware dump.

My 100c/makefile.inc

Code: [Select]

PLATFORMID=12993
PLATFORMOS=dryos
PLATFORMOSVER=58+p7

# Force ARAM on for ixus160_elph160; but do not load CHDK in ARAM (not enough memory)
override OPT_ARAM_MALLOC=1
override OPT_CHDK_IN_ARAM=

# Set up size variables for AgentRAM
ARAM_HEAP_START=0x60e000
ARAM_HEAP_SIZE=0x22000

# start of firmware
ROMBASEADDR=0xFF810000
MAXRAMADDR=0x07ffffff

MEMISOSTART=0x001899D8

KEYSYS = d4i
NEED_ENCODED_DISKBOOT = 16

but how to get rid this error:

Code: [Select]

========== C:\CHDK\CHDKSHELL\TRUNK\TRUNK4626\BIN\LOGS\ERR-IXUS175_ELPH180-100C.TXT ==========

../../../../platform/ixus175_elph180/sub/100c/libplatformsub.a(stubs_entry.o): In function `viewport_fb_d':
(*ABS*+0x3534): multiple definition of `viewport_fb_d'
collect2: ld returned 1 exit status
C:\CHDK\CHDKShell\gcc\bin\gmake.exe[1]: *** [main.elf] Error 1
gmake: *** [all-recursive] Error 1

Logged

blackhole

940
A590IS 101b

Re: ixus175_elph180_100c porting attempt

« Reply #3 on: 03 / March / 2017, 05:46:40 »

Quote

but how to get rid this error:
Code: [Select]
========== C:\CHDK\CHDKSHELL\TRUNK\TRUNK4626\BIN\LOGS\ERR-IXUS175_ELPH180-100C.TXT ==========

../../../../platform/ixus175_elph180/sub/100c/libplatformsub.a(stubs_entry.o): In function `viewport_fb_d':
(*ABS*+0x3534): multiple definition of `viewport_fb_d'
collect2: ld returned 1 exit status
C:\CHDK\CHDKShell\gcc\bin\gmake.exe[1]: *** [main.elf] Error 1
gmake: *** [all-recursive] Error 1

I do not know what you've got in your source code, try without

Code: [Select]

void *vid_get_viewport_fb_d()
{
    extern char *viewport_fb_d;
    return viewport_fb_d;
}

in lib.c

Logged

http://astrofoto.pondi.hr

tsamma

29

Re: ixus175_elph180_100c porting attempt

« Reply #4 on: 03 / March / 2017, 07:43:51 »

That get more error on wrapper.c look like vid_get_viewport_fb_d is a necessary function.

Now! I head to finsig_dryos.c cause of problem it have these DEF(viewport_fb_d, ) either 100c\stubs_min.S and 100c\stubs_entry.S

Code: [Select]

C:\CHDK\CHDKShell\trunk\trunk4626\platform\ixus175_elph180\sub\100c\stubs_min.S
// 0xff883c54 (0x32d4), 0xff883c90 (0x54); see ixus140 0xff0a7858, 0xff0a7890
DEF(viewport_fb_d, 0x00003328)


C:\CHDK\CHDKShell\trunk\trunk4626\platform\ixus175_elph180\sub\100c\stubs_entry.S
// Values below go in 'lib.c':
//void *vid_get_bitmap_fb()        { return (void*)0x40711000; }             // Found @0xff86689c
//void *vid_get_viewport_fb()      { return (void*)0x40866b80; }             // Found @0xffb93e14
DEF(viewport_fb_d                           ,0x00003534) // Found 0x34d8 (@0xff8853f8) + 0x5c (@0xff885430)
//void *vid_get_viewport_fb_d()    { return (void*)(*(int*)(0x34d8+0x5c)); } // Found @0xff8853f8 & 0xff885430

Any idea?

Logged

blackhole

940
A590IS 101b

Re: ixus175_elph180_100c porting attempt

« Reply #5 on: 03 / March / 2017, 08:18:16 »

As I see it you have in the stubs_min.s DEF's from ixus160 -DEF (viewport_fb_d, 0x00003328).
You only need DEF (viewport_fb_d, 0x00003534) // Found 0x34d8 (@ 0xff8853f8) + 0x5C (@ 0xff885430) in the stubs_entry.s

Logged

http://astrofoto.pondi.hr

srsa_4c

4451

Re: ixus175_elph180_100c porting attempt

« Reply #6 on: 03 / March / 2017, 14:09:39 »

@tsamma
When you're working on stubs_entry_2.S and stubs_min.S, make sure you allow the sigfinder to re-generate stubs_entry.S during the build procedure. You need to copy PRIMARY.BIN to platform/ixus175_elph180/sub/100c for this to work.
If stubs_entry.S is not updated, you can easily get duplicated symbols, like viewport_fb_d in your case.

Note that the sigfinder can make mistakes, it's recommended to double-check at least the variables in stubs_entry.S (variables: the lines that begin with DEF).

Some other notes.

- makefile.inc: Comment out override OPT_ARAM_MALLOC=1 and override OPT_CHDK_IN_ARAM=, until you know how much free RAM you have.
- PLATFORMOSVER: don't include the patchlevel part, just the number (58)
- the dancingbits sequence (for NEED_ENCODED_DISKBOOT) seems to be located at offset 0x2978 in PRIMARY.BIN
- you need to add the new sequence to tools/dancingbits.h and reference it correctly for NEED_ENCODED_DISKBOOT in order to generate a diskboot.bin that the camera can load
- loader/ixus175_elph180/main.c: you need to locate the small asm code snippet in your disassembly and use that - it may differ slightly from the ixus160 version
- to load your diskboot.bin, you need to make your SD card bootable. See http://chdk.wikia.com/wiki/Bootable_SD_card

A word of warning: make sure you don't enable ARAM in your port's makefile.inc until you have a well functioning port. Running Canon Basic scripts (which you may need to during development) corrupts the ARAM memory area.

Oh, and you may want to share your source, so you can get better help.

It looks like the 100c and 100a fw versions are similar enough, so they won't need separate ports.

Logged

tsamma

29

Re: ixus175_elph180_100c porting attempt

« Reply #7 on: 04 / March / 2017, 00:24:38 »

Now. I can show led one shot blink follow by 10s ON then OFF away with this code from chdk-trunk /loader/a495/main.c. ***It's make one shot blink on IXUS160 and boot normal.***

Code: [Select]

C:\CHDK\CHDKShell\trunk\trunk4626\platform\ixus175_elph180\sub\100c\boot.c
void __attribute__((naked,noinline)) boot() {
	#define DEBUG_LED (void*)0xc022d1fc    // Green Led at the backside aui
    #define DEBUG_LED_DELAY 10000000
    volatile long *pDebugLed = (void*)DEBUG_LED;
    int DebugLedCounter;// DEBUG: blink led
    DebugLedCounter = DEBUG_LED_DELAY; *pDebugLed = 0x93d800;  while (DebugLedCounter--) { asm("nop\n nop\n"); };
    DebugLedCounter = DEBUG_LED_DELAY; *pDebugLed = 0x83dc00;  while (DebugLedCounter--) { asm("nop\n nop\n"); };

and another try code_gen.exe command line:
Following commande make me replace file in platform/ixus175_elph180 entirely.

Code: [Select]

C:\CHDK\CHDKShell\trunk\trunk4626\platform\ixus175_elph180\sub\100c>code_gen.exe
 0xFF810000 code_gen.txt PRIMARY.bin
Invalid firmware offset 2866768.
Line - 201, Source --> FW $

seem to be edit code_gen.txt but very time consume to clear in mind.

Thank you.

Logged

srsa_4c

4451

Re: ixus175_elph180_100c porting attempt

« Reply #8 on: 05 / March / 2017, 20:07:28 »

@tsamma
Not sure I completely understand your last post.

Quote

***It's make one shot blink on IXUS160 and boot normal.***

Do you also have an Ixus160?

About code_gen: don't expect code_gen.txt instructions made for one port work on another port, without changes. You'll need to adapt code_gen.txt for the ixus175 firmware.

If something isn't clear, you can ask.

Logged

tsamma

29

Re: ixus175_elph180_100c porting attempt

« Reply #9 on: 06 / March / 2017, 09:53:40 »

Oh yes i have an Ixus160 it's disappeared from the local market and i think it's good to get more experience for my life

.

Try to modify code_gen.txt result file below. it's a very fun part.
This function in boot.c difference from ixus160. It's the last function able to blink led, can't call to task_Startup_my(). No screen display ON (When is it?

).

Code: [Select]

void __attribute__((naked,noinline)) sub_FF827DB8_my() {
asm volatile (
"    STMFD   SP!, {R3,LR} \n"
//"  BL      _sub_FF898FEC \n"  // --> Nullsub call removed.
"    BL      sub_FF82CD0C /*_IsNormalCameraMode_FW*/ \n"
//"  BL      _sub_FF82BE10 \n"  // See: http://chdk.setepontos.com/index.php?topic=12321.msg121619#msg121619
//"  CMP     R0, #0 \n"
//"  BNE     loc_FF827DD8 \n"
//"  BL      _sub_FF82B58C \n"

"loc_FF827DD4:\n"
//"  B       loc_FF827DD4 \n"

"loc_FF827DD8:\n"
"    BL      sub_006B8C18 \n"
"    LDR     R1, =0x60E000 \n"
"    MOV     R0, #0 \n"
"    BL      sub_FF83720C \n"
"    MOV     R3, #0 \n"
"    STR     R3, [SP] \n"
"    LDR     R3, =task_Startup_my \n"  // --> Patched. Old value = 0xFF827D50.
"    MOV     R2, #0 \n"
"    MOV     R1, #0x19 \n"
"    LDR     R0, =0xFF827E14 /*'Startup'*/ \n"
"    BL      _CreateTask \n"
"    MOV     R0, #0 \n"
"    LDMFD   SP!, {R3,PC} \n"
);
}

My code_gen.txt no filewrite.c section, it's very difference from reference ixus160 firmware. Test it's on boot able SD card with DISKBOOT.bin. Just led blink now:-[.
Recommendations please!!!

code_gen.txt: https://drive.google.com/open?id=0B4ujGHeVgSW0ZDZhWHZRWnBENWs
boot.c: https://drive.google.com/open?id=0B4ujGHeVgSW0THppTE41MTltX1k

Logged