For now loader works well. Here it is:
loader\a3100\resetcode\main.c:
void __attribute__((noreturn)) copy_and_restart(void *dst_void, const void *src_void, long length) {
{
char *dst = dst_void;
const char *src = src_void;
if (src < dst && dst < src + length)
{
/* Have to copy backwards */
src += length;
dst += length;
while (length--)
{
*--dst = *--src;
}
}
else
{
while (length--)
{
*dst++ = *src++;
}
}
}
asm volatile (
"MRS R0, CPSR\n"
"BIC R0, R0, #0x3F\n"
"ORR R0, R0, #0xD3\n"
"MSR CPSR, R0\n"
//"STM SP!,{R1,R2}\n"
//"LDR R1, =0xC0220000\n"
//"MOV R2, #0x46\n" //Debug LED_on
//"STR R2, [R1,#0x10]\n" //0x10 - Power_LED
//"LDM SP!,{R1,R2}\n"
"LDR R1, =0xC0200000\n"
"MOV R0, #0xFFFFFFFF\n"
"STR R0, [R1,#0x10C]\n"
"STR R0, [R1,#0xC]\n"
"STR R0, [R1,#0x1C]\n"
"STR R0, [R1,#0x2C]\n"
"STR R0, [R1,#0x3C]\n"
"STR R0, [R1,#0x4C]\n"
"STR R0, [R1,#0x5C]\n"
"STR R0, [R1,#0x6C]\n"
"STR R0, [R1,#0x7C]\n"
"STR R0, [R1,#0x8C]\n"
"STR R0, [R1,#0x9C]\n"
"STR R0, [R1,#0xAC]\n"
"STR R0, [R1,#0xBC]\n"
"STR R0, [R1,#0xCC]\n"
"STR R0, [R1,#0xDC]\n"
"STR R0, [R1,#0xEC]\n"
"CMP R4, #7\n"
"STR R0, [R1,#0xFC]\n"
"LDMEQFD SP!, {R4,PC}\n"
"MOV R0, #0x78\n"
"MCR p15, 0, R0,c1,c0\n"
"MOV R0, #0\n"
"MCR p15, 0, R0,c7,c10, 4\n"
"MCR p15, 0, R0,c7,c5\n"
"MCR p15, 0, R0,c7,c6\n"
"MOV R0, #0x40000006\n"
"MCR p15, 0, R0,c9,c1\n"
"MCR p15, 0, R0,c9,c1, 1\n"
"MRC p15, 0, R0,c1,c0\n"
"ORR R0, R0, #0x50000\n"
"MCR p15, 0, R0,c1,c0\n"
"LDR R0, =0x12345678\n"
"MOV R1, #0x40000000\n"
"STR R0, [R1,#0xFFC]\n"
//"LDR R0, =sub_FF810000\n"
"MOV R0, %0\n" // new jump-vector
"LDMFD SP!, {R4,LR}\n"
"BX R0\n"
: : "r"(dst_void) : "memory","r0","r1","r2","r3","r4");
while(1);
}loader\a3100\resetcode\entry.s:
.section .entry
MOV SP, #0x1900
MOV R11, #0
B copy_and_restartloader\a3100\main.c:
static void __attribute__((noreturn)) shutdown();
static void __attribute__((noreturn)) panic(int cnt);
extern long *blob_chdk_core;
extern long *blob_copy_and_reset;
extern long blob_chdk_core_size;
extern long blob_copy_and_reset_size;
void __attribute__((noreturn)) my_restart()
{
void __attribute__((noreturn)) (*copy_and_restart)(char *dst, char *src, long length);
int i;
for (i=0; i<(blob_copy_and_reset_size/sizeof(long)); i++){
((long*)(RESTARTSTART))[i] = blob_copy_and_reset[i];
}
copy_and_restart = (void*)RESTARTSTART;
copy_and_restart((void*)MEMISOSTART, (char*)blob_chdk_core, blob_chdk_core_size);
//LED_power_on_short();
//LED_power_off();
}
#define LED_PR 0xC0220010
static void __attribute__((noreturn)) shutdown()
{
volatile long *p = (void*)LED_PR; // turned off later, so assumed to be power
asm(
"MRS R1, CPSR\n"
"AND R0, R1, #0x80\n"
"ORR R1, R1, #0x80\n"
"MSR CPSR_cf, R1\n"
:::"r1","r0");
*p = 0x44; // led off.
while(1);
}
static void __attribute__((noreturn)) panic(int cnt)
{
volatile long *p=(void*)LED_PR;
int i;
for(;cnt>0;cnt--){
p[0]=0x46;
for(i=0;i<0x200000;i++){
asm ("nop\n");
asm ("nop\n");
}
p[0]=0x44;
for(i=0;i<0x200000;i++){
asm ("nop\n");
asm ("nop\n");
}
}
shutdown();
}loader\a3100\entry.s:
MOV R3, #0x8000
1:
SUB R3, R3, #1
CMP R3, #0
BNE 1b
// ordinary startup...
MOV SP, #0x1900
MOV R11, #0
B my_restartloader\a3100\blobs.s:
.globl blob_copy_and_reset, blob_copy_and_reset_size
.globl blob_chdk_core, blob_chdk_core_size
.section .blob_copy_and_reset
blob_copy_and_reset_start:
.incbin RESET_FILE
blob_copy_and_reset_end:
.section .blob_chdk_core
blob_chdk_core_start:
.incbin CORE_FILE
blob_chdk_core_end:
.text
blob_chdk_core_size:
.long blob_chdk_core_end - blob_chdk_core_start
blob_chdk_core:
.long blob_chdk_core_start
blob_copy_and_reset_size:
.long blob_copy_and_reset_end - blob_copy_and_reset_start
blob_copy_and_reset:
.long blob_copy_and_reset_startAnd I modified boot.c, so camera now starts normally with spytask, but all hooks don't work yet. My next step will be founding right func addresses (stubs_entry_2.s) and making all hooks work properly.
