SX60HS Porting - DryOS Development - CHDK Forum
« previous next »
Pages: [1] 2 3 4 5 6 ... 92   Go Down

SX60HS Porting

  • 915 Replies
  • 323287 Views
*

Offline iax

  • *
  • 45
SX60HS Porting
« on: 30 / August / 2015, 18:48:05 »
Advertisements
Hi, I'm trying to port the SX60HS (http://chdk.wikia.com/wiki/SX60HS). As this is D6, I'm taking the work done for the sx270/280 as a starting point.

Currently I'd like to boot the camera and make some LEDs blink without any success so far, so I hope someone could help here.

Is there any way to confirm which flavor of dancingbits works with the SX60HS, or if a new flavor would be needed?  Currenly I'm trying (blindly) with 13 and 14, as, according to dancingbits.h, they could work with r55, but I'm not able to boot even the simplest thing.

I've modified entry.S in order to scan memory for LED address around 0xc0220000 which looking at the dump seems quite reasonable, but again no results (but not sure the probl is my code or just the incorrect encoding of diskboot.bin). I'm not an ARM expert, could someone confirm the following entry.S looks good for scanning LEDs?

Code: [Select]
.section .entry

.code 16
.align 2
.syntax unified

LDR R2, =0x4d0002
LDR R3, =0xc0220000
LDR R0, =0x0000F000
loop:
STR R2, [R3, R0]
SUB R0, R0, #8
CMP R0,#0
BNE loop
loop1:
NOP
B loop1 // infinite loop

B       my_restart
.ascii  "gaonisoy"

I'm pretty confident the values in makefile.inc are correct, listing the content of the file here as well:

Code: [Select]
PLATFORMID=12954

PLATFORMOS=dryos

# points to the start of the memory pool used by the firmware @FC020050
MEMISOSTART=0x3A8BB0

# start of firmware
ROMBASEADDR=0xFC000000

# Found @FC00285E
MAXRAMADDR = 0x1fffffff

# Found @
NEED_ENCODED_DISKBOOT=14

# Found @
KEYSYS=d4d

PLATFORMOSVER=55

# mandatory for DIGIC 6, @FC02003C
MEMBASEADDR=0x8000

Any help greatly appreciated, thanks!
« Last Edit: 18 / January / 2017, 13:16:13 by acseven »
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: SX60HS Porting
« Reply #1 on: 30 / August / 2015, 19:19:09 »
Quote from: iax on 30 / August / 2015, 18:48:05
Is there any way to confirm which flavor of dancingbits works with the SX60HS, or if a new flavor would be needed?  Currenly I'm trying (blindly) with 13 and 14, as, according to dancingbits.h, they could work with r55, but I'm not able to boot even the simplest thing.
The dancingbits _words_ should be around the end of the bootloader (IIRC), try searching for the known sequences.

Quote
I've modified entry.S in order to scan memory for LED address around 0xc0220000 which looking at the dump seems quite reasonable, but again no results (but not sure the probl is my code or just the incorrect encoding of diskboot.bin).
Question: which entry.S is that? You should start at the loader (loader/sx60hs).

Rather than blindly poking the GPIOs, try following what's written here: http://chdk.setepontos.com/index.php?topic=11316.msg111290#msg111290
There's a good chance that the LED addresses can be found that way.
Also note that the old 0xc022xxxx GPIO range is gone, DIGIC 6 uses the MMIO range above 0xd20b0000 for GPIO control.
Logged
*

Offline iax

  • *
  • 45
Re: SX60HS Porting
« Reply #2 on: 31 / August / 2015, 02:15:57 »
Quote
The dancingbits _words_ should be around the end of the bootloader (IIRC), try searching for the known sequences.
Does this mean that, for flavor 10 for instance, I should be able to locate byte sequence 3,6,7,2,4,5,1,0 (or reversed order) in the dump? Is this assumption correct?

Quote
Question: which entry.S is that? You should start at the loader (loader/sx60hs).
Yes it's exactly loader/sx60hs/entry.S
Logged
*

Offline reyalp

  • ******
  • 14003
Re: SX60HS Porting
« Reply #3 on: 31 / August / 2015, 02:47:16 »
Quote from: iax on 31 / August / 2015, 02:15:57
Does this mean that, for flavor 10 for instance, I should be able to locate byte sequence 3,6,7,2,4,5,1,0 (or reversed order) in the dump? Is this assumption correct?
The numbers are 32 bit ints, with the first at the lowest address.
Logged
Don't forget what the H stands for.
*

Offline srsa_4c

  • ******
  • 4451
Re: SX60HS Porting
« Reply #4 on: 31 / August / 2015, 14:06:39 »
Had a look, so here's some details (fw 100b):

fc0044ec dancingbits
fc0650dc ledtableinit, note the numbers '33' and '4'
fc0650b0 set_led_on (don't call this)
fc0650c6 set_led_off (don't call this)
fc0c1aec set_gpio

The set_gpio routine looks like the one in the sx280 firmware, so the potential LED addresses are:
0xd20b0000 + 0x800 + (4*4) = 0xd20b0810
and
0xd20b0000 + 0x800 + (33*4) = 0xd20b0884
Logged
*

Offline iax

  • *
  • 45
Re: SX60HS Porting
« Reply #5 on: 31 / August / 2015, 15:25:49 »
thanks, yes confirming this is flavor 14 and I'm able to turn on both LEDs with my boot sequence. Updated camera page with following details:

0xd20b0810 = AF Assist Beam
0xd20b0884 = Green Led


Next I'll try to boot camera through the CHDK sequence, without the "_my" hooks.
« Last Edit: 31 / August / 2015, 15:30:05 by iax »
Logged
*

Offline iax

  • *
  • 45
Re: SX60HS Porting
« Reply #6 on: 31 / August / 2015, 18:35:20 »
What could be a possible reason for camera to enter an infinite loop while booting? This is what I'm trying to do:

1) Implement reset code in main.c (my_restart), this is what seems reasonable to me, looking at 0xFC0B971A
Code: [Select]
asm volatile (
"LDR     R1, =0xD4010008\n"
"MVN.W   R0, #0xF0000000\n"
"SUBS    R1, #8\n"
"STR     R0, [R1,#0xC]\n"
"STR     R0, [R1,#0x1C]\n"
"STR     R0, [R1,#0x2C]\n"
"STR     R0, [R1,#0x3C]\n"
"STR     R0, [R1,#0x4C]\n"
"STR     R0, [R1,#0x5C]\n"
"STR     R0, [R1,#0x6C]\n"
"STR     R0, [R1,#0x7C]\n"
"STR.W   R0, [R1,#0x8C]\n"
"STR.W   R0, [R1,#0x9C]\n"
"STR.W   R0, [R1,#0xAC]\n"
"STR.W   R0, [R1,#0xBC]\n"
"STR.W   R0, [R1,#0xCC]\n"
"STR.W   R0, [R1,#0xDC]\n"
"STR.W   R0, [R1,#0xEC]\n"
"STR.W   R0, [R1,#0xFC]\n"

"MOVW    R1, #0x4FFC\n"
"LDR     R0, =0x12345678\n"
"STR     R0, [R1]\n"

"MOV.W   R0, #7\n"
"MCR     p15, 0, R0,c6,c2, 0\n"
"MOV.W   R1, #0\n"
"MCR     p15, 0, R1,c6,c1, 0\n"
"MOV.W   R1, #9\n"
"MCR     p15, 0, R1,c6,c1, 2\n"
"MOVW    R1, #0x121\n"
"MCR     p15, 0, R1,c6,c1, 4\n"
"MRC     p15, 0, R0,c1,c0, 0\n"
"BIC.W   R0, R0, #0x20000\n"
"ORR.W   R0, R0, #1\n"
"DSB.W   SY\n"
"MCR     p15, 0, R0,c1,c0, 0\n"
"ISB.W   SY\n"

//"LDR     R0, =(loc_FC020000+1)"
"MOV     R0, %0\n"  //new jump-vector
"add     R0, R0, #1\n"
//"POP.W   {R4,LR}"
"BX      R0\n"
    : : "r"(MEMISOSTART), "r"((blob_chdk_core_size+3)>>2) : "memory","r0","r1","r2","r3","r4"
    );
2) Implement a plain copy of firmware boot sequence starting at 0xfc02000c in boot(), with just the addition of code to turn on a LED

In this configuration, whenever I start the camera, the LED starts blinking indefinitely, indicating that the camera is entering an infinite loop of restarts.

3) If, alternatively, I implement a reset code similar to the one for the sx270 (below), the camera enters the boot() function successfully (LED turns on just once) however it shuts down immediately (LED automatically turns off)

Code: [Select]
   asm volatile (    "mov     r1, %1\n"
    "mov     r0, %0\n"
    "ldr     r2, =0xFC1361CF\n" // address for sx60 100B
    "blx     r2\n"              // caching related routine called at fw startup
    "mov     r0, %0\n"
    "add     r0, r0, #1\n"
    "bx      r0\n"
    : : "r"(MEMISOSTART), "r"((blob_chdk_core_size+3)>>2) : "memory","r0","r1","r2","r3","r4"
    );
Any idea about what could go wrong here? Thanks in advance!
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: SX60HS Porting
« Reply #7 on: 31 / August / 2015, 19:16:09 »
Quote from: iax on 31 / August / 2015, 18:35:20
What could be a possible reason for camera to enter an infinite loop while booting? This is what I'm trying to do:

1) Implement reset code in main.c (my_restart), this is what seems reasonable to me, looking at 0xFC0B971A
Did not look yet what that piece of code is for, but:
- you will need to call that "caching related routine" for the loaded CHDK core area, otherwise there will be some corruption in the core. Please look at this and do the same fix, as I forgot to complete the size alignment in my "original" version. Since you don't have any CHDK core code at the moment, this does not matter much.
- the 0x12345678 magic value is a flag that means "the camera was rebooted". It will be checked by the so called "startupchecks" routines.

Quote
2) Implement a plain copy of firmware boot sequence starting at 0xfc02000c in boot(), with just the addition of code to turn on a LED
In this configuration, whenever I start the camera, the LED starts blinking indefinitely, indicating that the camera is entering an infinite loop of restarts.
You're getting a boot loop because you did not remove the call that starts the diskboot file. You can try booting with the firmware update method (unlock the card if you do that).
Quote
3) If, alternatively, I implement a reset code similar to the one for the sx270 (below), the camera enters the boot() function successfully (LED turns on just once) however it shuts down immediately (LED automatically turns off)

Code: [Select]
   asm volatile (    "mov     r1, %1\n"
    "mov     r0, %0\n"
    "ldr     r2, =0xFC1361CF\n" // address for sx60 100B
    "blx     r2\n"              // caching related routine called at fw startup
    "mov     r0, %0\n"
    "add     r0, r0, #1\n"
    "bx      r0\n"
    : : "r"(MEMISOSTART), "r"((blob_chdk_core_size+3)>>2) : "memory","r0","r1","r2","r3","r4"
    );
You have a typo, the function's address (including the thumb bit) is 0xfc1161cf.

Other than that, you'll need to implement the startupchecks replacement for a successful boot. That consists of
- the C code at the start of sub_fc04f194_my() in sx280 102b boot.c
- disarming the startupchecks routine, that's sub_fc060338_my() in sx280 102b boot.c
Logged
*

Offline iax

  • *
  • 45
Re: SX60HS Porting
« Reply #8 on: 01 / September / 2015, 18:40:29 »
Finally I'm able to start the camera through the CHDK boot process  :). I've just commented out the CreateTask_spytask call and the registration of capt_seq_task and task_ExpDrv in boot.c and camera seems to boot fine.

If I know uncomment CreateTask_spytask, camera crashes inside the conf_restore() function call in /core/main.c. Didn't have the time yet to understand what's happening there.

I was hoping to be able to pull up the CHDK GUI, leaving out for now capt_seq_task and task_ExpDrv, would this be possible? If so I'll focus my next steps in trying to address all the GUI/menu stuff, otherwise I'll port the capture sequence first.

thanks
Logged
*

Offline waterwingz

  • ******
  • 12138
    • Waterwingz
Re: SX60HS Porting
« Reply #9 on: 01 / September / 2015, 18:48:01 »
Quote from: iax on 01 / September / 2015, 18:40:29
If I know uncomment CreateTask_spytask, camera crashes inside the conf_restore() function call in /core/main.c. Didn't have the time yet to understand what's happening there.
Something wrong in the file i/o routines called?

Quote
I was hoping to be able to pull up the CHDK GUI, leaving out for now capt_seq_task and task_ExpDrv, would this be possible?
Totally possible.  And a good idea too.

Quote
If so I'll focus my next steps in trying to address all the GUI/menu stuff, otherwise I'll port the capture sequence first.
You can probably comment out conf_restore() for now.   If you can get spy_task running well enough that the CAM_CHDK_PTP stuff runs,  then you can start downloading images over USB rather than swapping your SD card in & out all the time.  That will really speed things up (although of course you'll still need to swap the SD card in & out if you make a change that causes a crash on startup).

Logged
Ported :   A1200    SD940   G10    Powershot N    G16
Pages: [1] 2 3 4 5 6 ... 92   Go Up
« previous next »
 

Related Topics