supplierdeeply
« previous next »
Pages: [1] 2 3 4 5 6 ... 13   Go Down

IXUS145/ELPH135 Porting attempt

  • 126 Replies
  • 42415 Views
*

Offline akira

  • *
  • 19
IXUS145/ELPH135 Porting attempt
« on: 23 / December / 2014, 12:48:54 »
Advertisements
Hi all,

I'm trying to port the CHDK to ELPH135, up to now just self learning, but reached a pitfall. I own the camera and have some knowledge about microcontrollers, assembler, hardware, C development, linux, etc.

What I've done:
- Studied the FW with IDA;
- Download trunk, copied the A2500 as base, maybe the ELPH115 was more close in features, but the ROM has 16MB;
- Sucessfully build, missing symbols and addresses dummy filled in stubs_entry_2.S;
- Tried to guess the led address and put an assembly blinker in the entry.S, but DISKBOOT.BIN crash the camera;
- Back to the basics, searched the led address with this approach http://chdk.setepontos.com/index.php?topic=9005.msg93932#msg93932, found 0xC022302C and 0xC022D1FC, and strangely like camcrazy, it's needed to write to both to control the led, this way Poke8 made the led turn on/off;
- This code is actually on entry.S:
Code: [Select]
    .section .entry

// looks like idle cycle is required for proper shutdown
    MOV     R3, #0xF0000
0:
    SUB     R3, R3, #1
    CMP     R3, #0
    BNE     0b

// ordinary startup...
LDR     R3, =0xC022302C
LDR     R4, =0xC022D1FC
MOV     R1,#10
1:
MOV     R2, #0x46
STR     R2, [R3]
STR     R2, [R4]
MOV     R0, #0x8000
2:
SUB     R0,R0,#1
CMP     R0,#0
BNE     2b
 
MOV     R2, #0x44
STR     R2, [R3]
STR     R2, [R4]
MOV     R0, #0x8000
3:
SUB     R0,R0,#1
CMP     R0,#0
BNE     3b
 
SUB     R1,R1,#1
CMP     R1,#0
BNE     1b
- It still crashing the camera, both the DISKBOOT.BIN (read only card)  and the MAIN.BIN (loaded by http://chdk.wikia.com/wiki/Canon_Basic/Scripts/Loader )

So, even with everything else (entry points, addresses) wrong, the code on entry.S should work, right ?
DISKBOOT.BIN maybe wrong encoded, but MAIN.BIN should be correctly loaded right ?


Regards

Nelson
Logged
*

Offline philmoz

  • *****
  • 3070
    • Photos
Re: IXUS145/ELPH135 Porting attempt
« Reply #1 on: 23 / December / 2014, 15:17:03 »
Welcome, and good luck - the first port can be tricky; but hopefully we can help :)

Your camera is Digic4+ with DryOS R54 - we don't have any working ports for this setup yet.
I don't know if the Canon Basic loader works on this generation - it probably should; but not sure anyone has confirmed that it does.

Assuming the Canon Basic loader works - are you are using MAIN.BIN from the "loader/ixus145_elph135" directory (not the one in the "core" directory)?

It might also help to post your loader and platform code for the port so we can help identify any potential issues.

Phil.
Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
*

Offline akira

  • *
  • 19
Re: IXUS145/ELPH135 Porting attempt
« Reply #2 on: 23 / December / 2014, 15:46:09 »
Hi Phil,

Thanks for the fast reply, I was hesitating to begin just because of the Digic4+ platform, as the port is already done for the A2500 equally cheap camera. But got the IXUS145 on a Xtmas sale at half price.

Yes, I'm putting the MAIN.BIN from "loader/ixus145_elph135" in the SD card.
Follow attached:
- the loader (main.c) is untouched (loader/ixus145_elph135/main.c);
- boot.c  untouched too, as generated;

Regards

Logged
*

Offline reyalp

  • ******
  • 11440
Re: IXUS145/ELPH135 Porting attempt
« Reply #3 on: 23 / December / 2014, 16:29:26 »
Hi,

You might find the code from http://chdk.setepontos.com/index.php?topic=11907.msg118634#msg118634 helpful, they have an ixus145 port for their product. The loader and boot code should be usable for CHDK.
Logged
Don't forget what the H stands for.
*

Offline philmoz

  • *****
  • 3070
    • Photos
Re: IXUS145/ELPH135 Porting attempt
« Reply #4 on: 23 / December / 2014, 16:40:30 »
There's a few things that need addressing; but, if the Canon Basic loader works on your camera you should at least be seeing the LED blink?

As reyalp suggested, the inPhoto code may help.

Other things I've noticed.

Easy stuff:
- loader/ixus145_elph135/entry.s - missing the final SP init and jump to my_restart
- loader/ixus145_elph135/main.c - make sure the assembly code matches the restart code in the firmware
- platform/ixus145_elph135/sub/100c/makefile.inc - PLATFORMID, MAXRAMADDR and KEYSYS are wrong (see stubs_entry.S)

Hard stuff:
- the code in the sub/100c files boot.c, capt_seq.c, filewrite.c, and movie_rec.c is auto generated with the code-gen program (make PLATFORM=ixus145_elph135 PLATFORMSUB=100c run-code-gen). This crashes with the current script in code_gen.txt. The startup code does not appear to be at 0xFF810000 in this camera so it will be a lot more work to port this part.

Phil.
Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
*

Offline akira

  • *
  • 19
Re: IXUS145/ELPH135 Porting attempt
« Reply #5 on: 23 / December / 2014, 17:56:24 »
Hi,

Some hicup on the Internet here (I'm not from North Korea  8) ), just a lot of rain.

reyalp, I tried inPhoto DISKBOOT.BIN, it didn't crashed, but no working display or firing photo, just zoom and power. The MAIN.BIN, won't loaded through the Basic script, so probably it will not work with any. I will check inPhoto parameters for dancing bits with mine, relocation, etc.

Phil, I will check the "easy stuff", my goal now is to generate a loadable DISKBOOT.BIN and just blink the led, to assure the development environment is working.
The "hard stuff", I noticed the unusual start address, it's on 0xFF820000 instead of 0xFF810000, don't know, maybe just a rellocation of the code, at glance the initial code is identical.

Regards

Logged
*

Offline alvm

  • ***
  • 123
Re: IXUS145/ELPH135 Porting attempt
« Reply #6 on: 24 / December / 2014, 07:12:21 »
You can use inPhoto source code just as start point to CHDK portinig. inPhoto is created for remote camera control, so you can't use it without any PC program.

diskboot.bin does not start if its size less 50 kb.
Logged
*

Offline srsa_4c

  • ******
  • 3665
Re: IXUS145/ELPH135 Porting attempt
« Reply #7 on: 24 / December / 2014, 18:02:41 »
@akira

If you'd like to run some code on the camera, there's also a different Canon Basic method to do it, see this post (which links to another). You can't load the whole CHDK binary this way though, it won't fit in the AdditionAgentRAM area.
About the LEDs: the 2 MMIO way you found is not what the firmware is doing, try writing 0x93d800 and 0x83dc00 to the 0xc022dxxx address to switch the LEDs on/off. The newest version of finsig_dryos now successfully locates the LED addresses in (most) DIGIC 4+ dumps (and that confirms the address you found).
The port's boot.c file in the PSM code should help you making a CHDK compatible boot.c (most parts of the bootup sequence are the same, just compare it to a "modern" CHDK port to see the difference).
Logged
*

Offline akira

  • *
  • 19
Re: IXUS145/ELPH135 Porting attempt
« Reply #8 on: 25 / December / 2014, 08:07:18 »
Hi all,

Some progress, DISKBOOT.BIN loading ok and blinking led with C code. So, the file enconding is ok and my envronment. Now, adapting the boot code from inPhoto to the "modern" CHDK as sugested by rsa_4c and alvm.

Thanks to rsa_4c writing 0x93d800 to 0xC022D1FC worked to light the led. A think bit unusual address for  the led.

One thing that I couldn't make work is blink led in asm, just in C. This asm crash, either on entry.S or main.c (loader):
Code: [Select]
STMFD SP!, {R0,R1}
LDR R1, =0xC022D1FC // Green LED
MOVW R0, #0xd800 // Power on LED, the value I want is 0x0093d800
MOVT R0, #0x0093 // It need 2 steps
STR R0, [R1]
LDMFD SP!, {R0,R1}


Regards

Logged
*

Offline srsa_4c

  • ******
  • 3665
Re: IXUS145/ELPH135 Porting attempt
« Reply #9 on: 25 / December / 2014, 08:18:26 »
Quote from: akira on 25 / December / 2014, 08:07:18
One thing that I couldn't make work is blink led in asm, just in C. This asm crash, either on entry.S or main.c (loader):
The DIGIC 4+ still has the old armv5te core, movw and movt instructions are not supported. Load that value with LDR.

edit:
You can find disassemblies of various CHDK parts after build: core/main.bin.dump (CHDK core) and loader/ixus145_elph135/main.bin.dump (loader).
« Last Edit: 25 / December / 2014, 08:23:23 by srsa_4c »
Logged
Pages: [1] 2 3 4 5 6 ... 13   Go Up
« previous next »
 

Related Topics