Debugging Console - General Discussion and Assistance - CHDK Forum
« previous next »
Pages: [1] 2   Go Down

Debugging Console

  • 13 Replies
  • 5936 Views
*

Offline intrinsic

  • *
  • 29
  • S5IS
Debugging Console
« on: 05 / January / 2008, 22:48:16 »
Advertisements
Hey all,

            Trawling through my S5IS (DryOS) dump I've noticed there's a bunch of functions which are associated with what appears to be debugging console (and DrySH), just wondering if anybody's played with getting access to the console? (This is not at all unusual, many electronic devices these days have debug consoles accessible on them that weren't removed during development because "it works, ship it")

I gather from what I've seen in the code so far that the console is activated by dropping a file called uartr.req in the root of the SD card (a la ver.req to get the real firmware version).

I'm not sure if the connections for the console are broken out to external connectors or whether one would have to crack the camera open to connect to it (I'm not game to do that to mine at the moment ;o) ) but it occurs to me that it'd likely assist the porting efforts as there seems to be all the standard basic debug functionality in there.

intrinsic
Logged
*

Offline jeff666

  • ****
  • 181
  • A720IS
Re: Debugging Console
« Reply #1 on: 06 / January / 2008, 08:36:07 »
In the camera exist stdin and stdout and a lot of functions, including the shell, write output there. The terminal is a device named "/_term" that is created by a function called "termDriverInit" and assigned to stdio by a function called "stdioSetup".

Both, "termDriverInit" and "stdioSetup" are called during the boot from CHDK (if it is active). I tried to divert stdout by calling "stdioSetup" with a filename pointing to the SD ("A/termfile") but it didn't work. I suppose the card isn't available at that time.

If we want to intercept the terminal (and thus everything that uses it), we will have to modify at least one of this functions. Afterwards it may be possible to get some kind of communication over USB or use the shell from scripts.

Btw, the camera works flawlessly if stdioSetup is not executed at all.

Cheers.
Logged
*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: Debugging Console
« Reply #2 on: 01 / September / 2008, 18:29:47 »
Hi!

I also tried with _term stuff without success. (I was that clever to engage the SD first and mount the FS)

But I found some other porn.

In task_Startup_my() there's one interesting call to a sub like this:
sd 1100 firmware 100c
Code: (asm) [Select]
ff82786c: e92d4010 stmdb sp!, {r4, lr}
ff827870: e3a0000c mov r0, #12 ; 0xc
ff827874: eb00ebe0 bl ff8627fc <_binary_dump_bin_start+0x527fc +241544>
ff827878: e59f0080 ldr r0, [pc, #128] ; ff827900: (ff862858)
ff82787c: e3a01000 mov r1, #0 ; 0x0
ff827880: ebffd154 bl ff81bdd8 <_binary_dump_bin_start+0xbdd8 -47784>
ff827884: e59f0078 ldr r0, [pc, #120] ; ff827904: (ff862c50)
ff827888: eb00ea6c bl ff862240 <_binary_dump_bin_start+0x52240 +240056>
ff82788c: e59f0074 ldr r0, [pc, #116] ; ff827908: (ff862fcc)
ff827890: e8bd4010 ldmia sp!, {r4, lr}
ff827894: ea00ea6c b ff86224c <_binary_dump_bin_start+0x5224c +240056>

This set up exception handlers. I tested via qemu, it works! I hooked them (see attached boot.c)
Code: (c) [Select]
#define O_APPEND 0x8
void save_crash(char* buf, int len) {
int fd;
fd = open("A/crash.log", O_WRONLY|O_CREAT|O_APPEND, 0777);
write(fd, buf, len);
close(fd);

script_console_add_line(buf);
script_console_draw();
}

void assert_hook() {
save_crash("assert error\n" , 13);
}

void abort_hook() {
save_crash("abort error\n" , 11);
}

void panic_hook() {
save_crash("panic error\n" , 11);
}

For a controlled crash I used the memory browser. I'll get the msg on screen and it writes out a crash.log !
Fun: camera continues normally w/o chdk. So we can impement a true blue screen  :)

Another POI is taskcreate_PhySw() in SD1100. Compared to other fw I saw, it calls also OpLog.Create and OpLog.Start ...
so I added OpLog.WriteToSD in the exception hook: took one picture then I crashed cam via memory browser.

I found this on SD:
OpLog.txt

#OPERATION LOG
#VERSION=0100
#COMMENT=
[OCCUR]
PRODUCT_ID= 3184
TIME= 2008:09:02 00:04:25
[START]
00000030,0x00000000,0,0x00038000,0x20000000,0x00000000
[DATA]
00000060,0x0000090A,0,0x00018000,0x20000000,0x00000000
00002370,0x80000000,0,0x00018001,0x20000000,0x00000000
00004640,0x80000001,0,0x00018003,0x20000000,0x00000000
00005000,0x00000001,0,0x00018001,0x20000000,0x00000000
00005080,0x00000000,0,0x00018000,0x20000000,0x00000000



Bonus:

I found O_APPEND for dryos
« Last Edit: 01 / September / 2008, 18:33:51 by chr »
Logged
*

Offline dzsemx

  • ****
  • 302
  • [SX40HS][A650][A630]
Re: Debugging Console
« Reply #3 on: 01 / September / 2008, 18:47:45 »
i see the future...

Changeset [497] by chr
+ added bluescreen for chdk...

bsod  chdk:

CHDK ERROR
PRESS FUNC + ALT + DEL TO RESTART YOUR CAMERA
OR PRESS SHUTTER TO RETURN TO YOUR CAMERA AND WAIT
OR REMOVE BATTERIES

just joking, i hope we won't ever need bluescreen...


btw... sometimes my cameras config(not chdk) gets corrupted and it resets to all default settings, generally when shutting down due low battery :(
« Last Edit: 01 / September / 2008, 18:51:58 by dzsemx »
Logged
*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: Debugging Console
« Reply #4 on: 01 / September / 2008, 21:12:28 »
Porno Porno!

It work's

A/crash.log

Exception!! [data abort]
Occured Time  2008:09:02 01:53:08
Task ID: 1441797
Task name: SpyTask
Exc Registers:
0x00000008
0x00000060
0x00000000
0x2000B064
0x000EA7A0
0x00000002
0x000EA7A4
0x19980218
0x19980218
0x19980218
0x19980218
0x19980218
0x00000000
0x0027CF0C
0x000C0298
0x000C46E8  << PC, correct, membrowser
0x60000013
StackDump:
0xFF811F44
0x00000007
0x000EB460
0x0000016D
0x000C93D4
0x000EA558
0x000C00C4
0x00272BB8
0x19980218
0x19980218
0xFF8160BC
0x19980218


I also hooked the watchdog but he is a bit too quiet:

 !!!WatchDog expired!!!


Logged
*

Offline cail

  • *
  • 49
Re: Debugging Console
« Reply #5 on: 02 / September / 2008, 02:04:45 »
Not sure if this helps for DryOs, but long time ago I've implemented stdout file logging for VxWorks ixus65.

See CAM_CONSOLE_LOG_ENABLED define in camera.h

To enable it you have to create "stdio.txt" file in the root.

Code: (c) [Select]
typedef int DEV_HDR;

int (*_tyWriteOrig)(DEV_HDR *hdr, char *buf, int len);


int hook_tyWriteOrig(DEV_HDR *hdr, char *buf, int len)
{
// Slow, but stable writes
FILE *fd = fopen("A/stdout.txt", "a");
if (fd) {
    fwrite(buf, 1, len, fd);
    fclose(fd);
}

    return _tyWriteOrig(hdr, buf, len);

}

void console_init()
{
    DEV_HDR *DRV_struct;

    DRV_struct = _iosDevFind("/tyCo/0", 0);

    _tyWriteOrig = (void*)DRV_struct[DEV_HDR_WRITE_OFFSET];

FILE *fd = fopen("A/chdklog.txt", "a");
if (fd) {
    // can't be used with "Fut" API
    //fprintf(fd, "DRV_struct: %x, _tyWriteOrig: %x\n", DRV_struct, _tyWriteOrig);
    char buf[256];
    int buflen = sprintf(buf, "DRV_struct: %x, _tyWriteOrig: %x\n", DRV_struct, _tyWriteOrig);
    fwrite(buf, 1, buflen, fd);
}

FILE *fdout = fopen("A/stdout.txt", "r");
if (fdout)
{
        DRV_struct[DEV_HDR_WRITE_OFFSET] = (int)hook_tyWriteOrig;
        fclose(fdout);
    // fprintf(fd, "tyWrite replaced, camera log enabled\n");
    fwrite("tyWrite replaced, camera log enabled\n", 1, sizeof("tyWrite replaced, camera log enabled\n"), fd);
    }

if (fd)
{
    fclose(fd);
}

}
« Last Edit: 02 / September / 2008, 02:07:00 by cail »
Logged
*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
Re: Debugging Console
« Reply #6 on: 02 / September / 2008, 02:13:16 »
FYI I diverted /_term to a file in my experimental branch and I also got the console to work... more or less. I couldn't easily put stuff into it so I decided to execute the functions it's got directly instead. It's perfectly possible to do that, even without the shell. It's not extremely useful, though, but it works.
Logged
*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: Debugging Console
« Reply #7 on: 02 / September / 2008, 13:47:00 »
Logged
*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: Debugging Console
« Reply #8 on: 04 / September / 2008, 13:37:24 »
Quote
Log Write to ROM... Successful.

Oh hell, it's indeed logging to ROM and all user settings (e.g. set a custom boot up image) are flashed to ROM!
I compared complete ROM dumps before and after modifying a little setting: diff of about 400-500 bytes, custom boot up image adds 50kb to the ROM. Also the data is shifted, so if we peek for user settings like timezone, we better ask via firmware functions.

So, there are log view functions in the FW and I tried out: it works. My attached screenshot is not a real BOD. My latest patch add a debug menu function to save the rom log and displays that in text reader. The file contains some more information of the latest crash. So I must not hook the exception handlers to hook every printf STDERR.

There are more logging options, e.g. OpLog. Well, let's see if we can get a live logging to the display.

The attached log examples happned testing my incomplete sd1100 port. The cam freezes (watchdog timeout) on every chdk-focus operation, sometimes it raises an exception.


Logged
*

Offline fudgey

  • *****
  • 1705
  • a570is
Re: Debugging Console
« Reply #9 on: 03 / December / 2008, 17:37:30 »
I ported the CAM_CONSOLE_LOG_ENABLED stuff to a570is 1.00e, or at least tried. However I don't get any output to stdout.txt. What sort of output should I be seeing there and when? I do get that one note from platform/main.c console_init() to chdklog.txt, but that's CHDK writing.

The firmware functions in my camera were identical to those in ixus40, memory addresses aside of course.

edit: the changes to trunk 592 attached, I tried to paste them to the message but the forum gives funky errors.
« Last Edit: 03 / December / 2008, 17:40:10 by fudgey »
Logged
Pages: [1] 2   Go Up
« previous next »
 

Related Topics