the sx20 porting thread

  • 1279 Replies
  • 177519 Views
*

Offline neszt

  • ***
  • 174
  • Publish
    Re: the sx20 porting thread
    « Reply #70 on: 21 / October / 2009, 18:14:39 »
    Advertisements
    I found some keyboard addresses, with simple blink test method.

    0xC02200FC & 0x01   Circle button around Func Set (roate left and right) bit
    0xC0220100 & 0x01   Capture button, half pressed bit
    0xC0220104 & 0x01   Capture button, full pressed bit
    0xC0220134 & 0x01   Power button bit
    0xC0220137 & 0x01   Play button bit

    *

    Offline neszt

    • ***
    • 174
  • Publish
    Re: the sx20 porting thread
    « Reply #71 on: 21 / October / 2009, 18:34:41 »
    My SD980 address is wrong though. Don't rely on it.

    Is that means, you can test your firmware only with ps.fi2 file with firm update method?

    However other cams with released firmware have this (0xC0220018) SdPower address (by checking their enity.S).

    Quote
    Also, if you get an infinite boot loop, it means the camera actually does reboot.. try to find the right address.

    Sorry, if it wasn't clear by my bad english. I'll try to write a lot precise from now.

    By searching in the firmware code for SdPower.c as reaylp says, i was nearly sure, that this is the good address. I wonder if there is other method to find it, excluding writing all possible address in a specified memory range. I don't wana do that. I wasn't worry reading any addresses to find keys, but writing to any unknown address is critical, i think.

    Probably a tricky hardware hack could help, somehow bounding a led to sd power (3.3V) pins to find it as a led address.

    Also i'am sure, that finding SdPower could avoid the infinty reboot loop, but could lead me to a well-known E31 again... So I'am not too motivated..

    *

    Offline RaduP

    • *****
    • 856
  • Publish
    Re: the sx20 porting thread
    « Reply #72 on: 21 / October / 2009, 21:09:01 »
    Sorry, the address is correct, I didn't know until yesterday. But yes, I also get the boot loop, so I only use the firmware update method.

    *

    Offline RaduP

    • *****
    • 856
  • Publish
    Re: the sx20 porting thread
    « Reply #73 on: 21 / October / 2009, 22:33:42 »
    Ok, now it works for me with the bootloader method as well. Last time I tried, I did not have boot.c working properly.

    Anyway, regarding your E31 error message, what is the last confirmed code where the program execution gets to before the magic error message?


    *

    Offline neszt

    • ***
    • 174
  • Publish
    Re: the sx20 porting thread
    « Reply #74 on: 22 / October / 2009, 03:25:02 »
    Ok, now it works for me with the bootloader method as well. Last time I tried, I did not have boot.c working properly.

    Ok, please confirm, that your firmware doesn't boot with DISKBOOT.BIN method, if the SdPower and the delay assembly code is commented out in your very first enrty.S. (loader)

    Quote
    Anyway, regarding your E31 error message, what is the last confirmed code where the program execution gets to before the magic error message?

    The very last assebmly code before the last "B ...". That's why i can not debug more. I made sure, that the chdk code was executed until the last line, and we jumped to the camera normal boot process.

    It seems, that the camera knows, something is different. Probably the problem is the registers states, but why it's not couse problems on other cameras?

    I tried to search "E31" with several mode in the firmware, but it is hopeless, to find anything.

    *

    Offline RaduP

    • *****
    • 856
  • Publish
    Re: the sx20 porting thread
    « Reply #75 on: 22 / October / 2009, 03:26:23 »
    Wait, last B in which file/function?

    *

    Offline neszt

    • ***
    • 174
  • Publish
    Re: the sx20 porting thread
    « Reply #76 on: 22 / October / 2009, 03:52:42 »
    Wait, last B in which file/function?

    platform/sx20/sub/100f/boot.c : in the boot() function last assembly code:

    "B loc_FF810354"

    So, when i insert "B my_debug_led_blinker" just before this last "B loc_FF810354" code, i git led blinks.

    *

    Offline RaduP

    • *****
    • 856
  • Publish
    Re: the sx20 porting thread
    « Reply #77 on: 22 / October / 2009, 04:41:10 »
    Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.
    Assuming you are using the firmware update method, make sure that you have the correct value for all the variables in boot() I hope you are using the disassembly code from your camera, rather than just copy/paste/modify the SX10 code.


    *

    Offline neszt

    • ***
    • 174
  • Publish
    Re: the sx20 porting thread
    « Reply #78 on: 22 / October / 2009, 05:13:46 »
    Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.

    Sorry, i dont't understand this, will you please try to tell me different way?

    Quote
    Assuming you are using the firmware update method, make sure that you have the correct value for all the variables in boot() I hope you are using the disassembly code from your camera, rather than just copy/paste/modify the SX10 code.

    First of all, my reference port is your sd980, rather than sx10 :)

    Here is a diff, to see, our firmwares only differs in three ways in the regarding boot section:

    Code: [Select]
                    LDR     R1, [R2]
                    ORR     R1, R1, #1
                    STR     R1, [R2]
    -               LDR     R0, =unk_FFC0281C
    +               LDR     R0, =unk_FFC0EF3C
                    LDR     R1, =0x1900
    -               LDR     R3, =0x208F0
    +               LDR     R3, =0xE7F4
    loc_FF81013C
                    CMP     R1, R3
                    LDRCC   R2, [R0],#4
                    STRCC   R2, [R1],#4
                    BCC     loc_FF81013C
    -               LDR     R1, =0x153E84
    +               LDR     R1, =0x13DD20
                    MOV     R2, #0
    loc_FF810154
                    CMP     R3, R1
                    STRCC   R2, [R3],#4
                    BCC     loc_FF810154
                    B       loc_FF810354

    So, of course, i use the code from SX20 firmware section, without this, i got freeze my camera. I only got E31, when i use the correct code, and this way the camera not freezes, just prints E31, and switches off. (I can switch it on without removing batteries)

    *

    Offline RaduP

    • *****
    • 856
  • Publish
    Re: the sx20 porting thread
    « Reply #79 on: 22 / October / 2009, 05:35:13 »
    Well, if you don't go further with the boot code modification, you will get stuck into a boot loop, because you need to comment out a jump to the load boot disk function.

    Sorry, i dont't understand this, will you please try to tell me different way?

    Ok, well, as you can see in my code, at the end of the boot() function we jump into a modified routine, "B         sub_FF810354_my"   //checked //---------->
    That jumps into                  "BL      sub_FF81178_my\n"  //------------>
    Which                  "LDR     R1, =sub_FF815E34_my\n"  //------------>
    Which                  "B       taskcreate_Startup_my\n"
    Which              "LDR     R3, =task_Startup_my\n" // ->
    Which finally:       //         "BL      sub_FF83A2F8\n"    // start diskboot.bin
    So if you do not modify your code all the way to there, the original firmware will try to load the bootdisk.

     

    Related Topics