G7X II - need help finding led details. - page 3 - General Discussion and Assistance - CHDK Forum
« previous next »
Pages: 1 2 [3] 4   Go Down

G7X II - need help finding led details.

  • 32 Replies
  • 22345 Views
*

Offline philmoz

  • *****
  • 3450
    • Photos
Re: G7X II - need help finding led details.
« Reply #20 on: 18 / May / 2019, 17:24:23 »
Advertisements
Quote from: srsa_4c on 18 / May / 2019, 07:39:21
Quote from: philmoz on 11 / May / 2019, 06:10:43
There appears to be another boot block at 0xE1200000.
The fw update does contain a ~266kB blob that goes to this address, but I did not disassemble it yet.

Have you tried starting the main firmware without running any CHDK code, like this:

entry.S in loader:
Code: [Select]
.section .entry
// ordinary startup...
.code 16
.align 2
.syntax unified
    mov     r0, 0x300000            // some uninitialized RAM, hopefully retaining content after restart
    ldr     r1, [r0]
    mov     r2, 0xd15c              // marker
    cmp     r2, r1
    beq     already
    str     r2, [r0]
    ldr     r0, =0xe0020001
    bx      r0
already:
    mrc     p15, 0, r0, c0, c0, 5   // read current core id
    ands    r0, r0, #0xf
    b       blink
main.c in loader:
Code: [Select]
void blink(int c)
{
    // GPIO base = 0xD2080000
    // 0xD20801E4   - SD led
    // 0xD20801E8   - AF led

    volatile int* p = (int*)0xD20801E4;
    if (c)
    {
        p = (int*)0xD20801E8;
    }
    *p = 0x24D0002;

    // blinker
    int i;
    while (1)
    {
        *p = 0x24D0002;
        for(i=0;i<10000000;i++) {
            asm volatile(
            "nop\n"
            );
        }
        *p = 0x24C0003;
        for(i=0;i<10000000;i++) {
            asm volatile(
            "nop\n"
            );
        }
    }
}
The marker is for protection against a diskboot boot-loop (address chosen seems uninitialized in RAM-dump, may need to be uncached), both named LEDs should blink if test is successful.


Thanks for the suggestion, unfortunately it hangs the camera with no LED activity at all.
Same result that I get with my boot code, if I don't bypass the store instruction in the function at 0xe04f0d9c.

Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
  g5x (1.00c, 1.01a, 1.01b)
  g7x2 (1.01a, 1.01b, 1.10b)
*

Offline srsa_4c

  • ******
  • 4451
Re: G7X II - need help finding led details.
« Reply #21 on: 18 / May / 2019, 19:30:31 »
Quote from: philmoz on 18 / May / 2019, 17:24:23
Thanks for the suggestion, unfortunately it hangs the camera with no LED activity at all.
That at least suggests that it's the main fw's startup that can't be executed without making some changes.

If you only keep the following asm lines in entry.S, do you get activity on both LEDs?
Code: [Select]
    mrc     p15, 0, r0, c0, c0, 5   // read current core id
    ands    r0, r0, #0xf
    b       blink
Quote
Same result that I get with my boot code, if I don't bypass the store instruction in the function at 0xe04f0d9c.
What happens if you remove the function call I mentioned earlier?
Quote from: srsa_4c on 09 / May / 2019, 12:34:26
For example, the updater's taskcreate_Startup doesn't call an equivalent of sub_E0020848.
Logged
*

Offline philmoz

  • *****
  • 3450
    • Photos
Re: G7X II - need help finding led details.
« Reply #22 on: 19 / May / 2019, 01:35:21 »
Quote from: srsa_4c on 18 / May / 2019, 19:30:31
Quote from: philmoz on 18 / May / 2019, 17:24:23
Thanks for the suggestion, unfortunately it hangs the camera with no LED activity at all.
That at least suggests that it's the main fw's startup that can't be executed without making some changes.

If you only keep the following asm lines in entry.S, do you get activity on both LEDs?
Code: [Select]
    mrc     p15, 0, r0, c0, c0, 5   // read current core id
    ands    r0, r0, #0xf
    b       blink

Only the green SD LED blinks (core 0).

Quote
Quote
Same result that I get with my boot code, if I don't bypass the store instruction in the function at 0xe04f0d9c.
What happens if you remove the function call I mentioned earlier?
Quote from: srsa_4c on 09 / May / 2019, 12:34:26
For example, the updater's taskcreate_Startup doesn't call an equivalent of sub_E0020848.


Removing the call to sub_E0020848 doesn't have any (visible) effect.


I used the LED blink to see what processor mode the code is running, it's set to 0x13 - Supervisor mode, so it shouldn't be a privilege issue.


It's possible the second core is doing something and also needs to be restarted; but I've no idea how to test this.
Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
  g5x (1.00c, 1.01a, 1.01b)
  g7x2 (1.01a, 1.01b, 1.10b)
*

Offline srsa_4c

  • ******
  • 4451
Re: G7X II - need help finding led details.
« Reply #23 on: 19 / May / 2019, 15:59:04 »
Quote from: philmoz on 19 / May / 2019, 01:35:21
Only the green SD LED blinks (core 0).
Thanks, that's useful to know. Can you repeat the test with fi2 boot? I'd expect that to match.

I have taken another look at the main fw start. It's true that the code handles both cores, but executing it from both cores at the same time would fail. Core0 would do the blob copies and then start executing sub_E00200F8, whereas core1 would be sent to sub_E00200F8 right away. There, the core1 code path would execute sub_DFFC570C but that would happen before the other core even started copying the 0xdffc4900 blob.

I guess the answer is either in the updater or in the bootloader.

edit (off-topic):
Can you take a look at the file size rounding code in gui_fselect.c (line 825-)? I'm getting inaccurate file size info.
« Last Edit: 19 / May / 2019, 16:18:58 by srsa_4c »
Logged
*

Offline philmoz

  • *****
  • 3450
    • Photos
Re: G7X II - need help finding led details.
« Reply #24 on: 19 / May / 2019, 18:36:18 »
Quote from: srsa_4c on 19 / May / 2019, 15:59:04
Quote from: philmoz on 19 / May / 2019, 01:35:21
Only the green SD LED blinks (core 0).
Thanks, that's useful to know. Can you repeat the test with fi2 boot? I'd expect that to match.


I haven't tried firmware update booting on this camera - I was not able to get it to work on the G5X, so did not try here.


Have you been able to get this to work on other Digic6 cameras? On the G5X I just get an 'Update file error!!!' message on the LCD.



Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
  g5x (1.00c, 1.01a, 1.01b)
  g7x2 (1.01a, 1.01b, 1.10b)
*

Offline reyalp

  • ******
  • 14128
Re: G7X II - need help finding led details.
« Reply #25 on: 19 / May / 2019, 20:17:08 »
Quote from: philmoz on 19 / May / 2019, 18:36:18
Have you been able to get this to work on other Digic6 cameras? On the G5X I just get an 'Update file error!!!' message on the LCD.
It boots on most, although some have unresolved problems: https://chdk.setepontos.com/index.php?topic=11316.msg137400#msg137400

"Update file error" sounds like an FI2 key issue, or maybe Canon added something to the format again.
Logged
Don't forget what the H stands for.
*

Offline philmoz

  • *****
  • 3450
    • Photos
Re: G7X II - need help finding led details.
« Reply #26 on: 19 / May / 2019, 21:29:35 »
Quote from: reyalp on 19 / May / 2019, 20:17:08
Quote from: philmoz on 19 / May / 2019, 18:36:18
Have you been able to get this to work on other Digic6 cameras? On the G5X I just get an 'Update file error!!!' message on the LCD.
It boots on most, although some have unresolved problems: https://chdk.setepontos.com/index.php?topic=11316.msg137400#msg137400

"Update file error" sounds like an FI2 key issue, or maybe Canon added something to the format again.


I see there is a new option for fi2enc on some of the D6 cameras (-x W).
I'll try this and see if it helps.


EDIT: The '-x W' option worked for the G5X; but no luck with the G7X2 (gives the "Update file error" message).
I know the key and iv are correct because I used them to decode the Canon firmware update.

« Last Edit: 20 / May / 2019, 07:56:01 by philmoz »
Logged
CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)
  g5x (1.00c, 1.01a, 1.01b)
  g7x2 (1.01a, 1.01b, 1.10b)
*

Offline srsa_4c

  • ******
  • 4451
Re: G7X II - need help finding led details.
« Reply #27 on: 20 / May / 2019, 19:04:13 »
Quote from: philmoz on 19 / May / 2019, 21:29:35
no luck with the G7X2 (gives the "Update file error" message).
I wonder what they changed this time - is it another checksum calculation method or one of the fields in header...

About the g5x: I see you enabled fi2 generation in autobuild, but I don't see the related workaround in the source.
If CHDK via fi2 boot is unreliable (crashes on anything movie related or has the orientation sensor issue), it might be better to disable it.
Logged
*

Offline reyalp

  • ******
  • 14128
Re: G7X II - need help finding led details.
« Reply #28 on: 21 / May / 2019, 01:52:14 »
Quote from: srsa_4c on 20 / May / 2019, 19:04:13
About the g5x: I see you enabled fi2 generation in autobuild, but I don't see the related workaround in the source.
If CHDK via fi2 boot is unreliable (crashes on anything movie related or has the orientation sensor issue), it might be better to disable it.
FWIW, I disabled it for now because the autobuild doesn't have the key.
Logged
Don't forget what the H stands for.
*

Offline srsa_4c

  • ******
  • 4451
Re: G7X II - need help finding led details.
« Reply #29 on: 25 / May / 2019, 05:49:37 »
Quote from: philmoz on 19 / May / 2019, 21:29:35
The '-x W' option worked for the G5X; but no luck with the G7X2 (gives the "Update file error" message).
The checksum seems to be word based, so using '-x W' is correct.

Turns out, parts of the fi2 validation process can be run individually. In sub_E04B3DBC, these are functions that get the open()'d FI2 file's descriptor as argument.
Functions with a single argument: sub_E052671E, sub_E05267F4, sub_E0526794
Function with 3 args: sub_E05266B8, see usage in disassembly.
Can you check the return values from these functions?

You can do that from Canon Basic, either printing the result on screen or to a file. The exec eventproc can be used to call a firmware function, similarly to "our" call_func_ptr.
Correct LCDMsg usage can be found in https://chdk.fandom.com/wiki/Canon_Basic/Scripts/Dumper#Improved_universal_dumper
The exec, Open, Close eventprocs are registered by System.Create.
Logged
Pages: 1 2 [3] 4   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal