supplierdeeply

A1200 porting

  • 15 Replies
  • 6146 Views
  • Publish
    A1200 porting
    « on: 02 / February / 2012, 04:19:45 »
    Advertisements
    A1200

    I have started the learn the process of porting CHDK to the firmware of a Canon camera. Since I already own the A1200 camera I will try to port the CHDK for this camera.
    The reason I choose the Canon A1200 was the pricing and that it is powered by "AA" size batteries, which is a good feature on long hikes in the mountains where you have limited
    possibilities to recharge batteries. That was the two main reasons, cheap and powered by "AA" batteries. After the first hike I became really aware of the limitations of exposure control
    but luckily i found the CHDK community. SO now I am excited to get started with the porting process and share the port if it is successful. I have experience in C-programming but no experience in
    assembler language so what a good opportunity to learn assembler!

    This is what i done so far:
    I have managed to try out some scripts on the A1200 camera:
    1. Version request with ver.req, putting a message to the lcd screen and blinking the LEDS
    2. Dump the firmware whit the use of uDumper, firmware was 1.00A
    3. I dissassembled the firmware whit the GPL method with the disassemble.pl shell script

    From this point I am planning to use the CHDK-shell to compile my efforts.

    I have looked at the code of finished ports that can be found in the "Trunk 1631" of CHDK-shell. I looked at boot.c for the sx220hs, I understand that I need to adjust the address settings in the boot.c code (among other things).
    This is a part of the boot.c code for the sx220hs:

    void __attribute__((naked,noinline)) boot() {
       
       asm volatile (
       "loc_FF00000C:\n"      
                     "LDR     R1, =0xC0410000\n"
                     "MOV     R0, #0\n"
                     "STR     R0, [R1]\n"
                     "MOV     R1, #0x78\n"
                     "MCR     p15, 0, R1,c1,c0\n"         // control reg
                     "MOV     R1, #0\n"
                     "MCR     p15, 0, R1,c7,c10, 4\n"      // drain write buffer
                     "MCR     p15, 0, R1,c7,c5\n"         // flush instruction cache
                     "MCR     p15, 0, R1,c7,c6\n"            // flush data cache
                     "MOV     R0, #0x3D\n"               // size 2GB base 0x00000000
                     "MCR     p15, 0, R0,c6,c0\n"         // protection region 0
                     "MOV     R0, #0xC000002F\n"         // size 16M base 0xc0000000
                     "MCR     p15, 0, R0,c6,c1\n"
                     "MOV     R0, #0x35\n"               // SX220 size 128M base 0x00000000 (s90 is 64M)
                     "MCR     p15, 0, R0,c6,c2\n"
                     "MOV     R0, #0x40000035\n"         // SX220 size 128M base 0x40000000 (s90 is 64M)
                     "MCR     p15, 0, R0,c6,c3\n"
                     "MOV     R0, #0x80000017\n"         // size  4k base 0x80000000
                     "MCR     p15, 0, R0,c6,c4\n"
                     "LDR     R0, =0xFF80002F\n"         // SX220 size  8M base 0xff800000
                     "MCR     p15, 0, R0,c6,c5\n"

    This is the 21 first lines from the top of the disassembled firmware 1.00A of the A1200:
    ff810000:    ea000001    b   loc_ff81000c
    "gaonisoyP":
    ff810004:    6e6f6167    powvsez   f6, f7, f7
    ff810008:    796f7369    stmvcdb   pc!, {r0, r3, r5, r6, r8, r9, ip, sp, lr}^
    loc_ff81000c:
    ff81000c:    e59f1150    ldr   r1, [pc, #336]   ; ff810164: (c0410000)
    ff810010:    e3a00000    mov   r0, #0   ; 0x0
    ff810014:    e5810000    str   r0, [r1]
    ff810018:    e3a01078    mov   r1, #120   ; 0x78
    ff81001c:    ee011f10    mcr   15, 0, r1, cr1, cr0, {0}
    ff810020:    e3a01000    mov   r1, #0   ; 0x0
    ff810024:    ee071f9a    mcr   15, 0, r1, cr7, cr10, {4}
    ff810028:    ee071f15    mcr   15, 0, r1, cr7, cr5, {0}
    ff81002c:    ee071f16    mcr   15, 0, r1, cr7, cr6, {0}
    ff810030:    e3a0003d    mov   r0, #61   ; 0x3d
    ff810034:    ee060f10    mcr   15, 0, r0, cr6, cr0, {0}
    ff810038:    e3a001bf    mov   r0, #-1073741777   ; 0xc000002f
    ff81003c:    ee060f11    mcr   15, 0, r0, cr6, cr1, {0}
    ff810040:    e3a00033    mov   r0, #51   ; 0x33
    ff810044:    ee060f12    mcr   15, 0, r0, cr6, cr2, {0}
    ff810048:    e3a001cd    mov   r0, #1073741875   ; 0x40000033

    At this point I am kind of stuck. What should I do as the next step? How should the boot.c of sx220hs be adjusted?

  • Publish
    Re: A1200 porting
    « Reply #1 on: 02 / February / 2012, 09:01:34 »
    You might find the dissassembler output from CHDK-PT a little easier to work with that the GPL dissassembler

  • Publish
    Re: A1200 porting
    « Reply #2 on: 03 / February / 2012, 02:45:18 »
    You might find the dissassembler output from CHDK-PT a little easier to work with that the GPL dissassembler

    Thank you for the information. CHDK-PT seems to be a wonderful tool! Maybe I will at least be able to make the A1200 boot during the coming weekend.

  • Publish
    Re: A1200 porting
    « Reply #3 on: 05 / February / 2012, 09:00:39 »
    I think I have figured out in general the process of porting CHDK to a new camera. However, could somebody give me some advice, please. I have been able to successfully compile the modified code. But no signs of code executing on the camera. I understand in the beginning of the porting process it is essential to make the camera boot (of course!) what files are needed to accomplish that? Boot.c and the header files?



  • Publish
    Re: A1200 porting
    « Reply #4 on: 05 / February / 2012, 10:00:13 »
    I think I have figured out in general the process of porting CHDK to a new camera. However, could somebody give me some advice, please. I have been able to successfully compile the modified code. But no signs of code executing on the camera. I understand in the beginning of the porting process it is essential to make the camera boot (of course!) what files are needed to accomplish that? Boot.c and the header files?
    Obviously, you need the code in the loader/a1200 working.  Inserting code to blink one of the camera  LED's is a common way to test / debug that.

    Once that is working,  you need a good boot.c and lib.c in the platform/sub/<fw> directory at a minimum.  You can comment out the lines in  taskCreateHook(int *p) to stop the other tasks from starting.  That will allow you to ignore capt_seq.c and movie_rec.c

    Here's a code snippet you can use to work your way through boot.c once you have it booting :
    Code: [Select]
    " STMFD SP!, {R0,R1} \n"   
    " LDR     R0, =0xC02200D4 \n"
    " MOV     R1, #0x46 \n"
    " STR     R1, [R0] \n"
    " LDMFD SP!, {R0,R1} \n"
    Obviously you need to put the address of one of your LED's where it says 0xC02200D4 now.

    Also, I strongly advice you to study the stub_entry.S file.  It will have lots of hints about how to setup the other files and whether some of those values are right for wrong.


  • Publish
    Re: A1200 porting
    « Reply #5 on: 09 / February / 2012, 08:25:38 »
    Thank you for the kind help!
    However, I have not had any luck getting the A1200 boot.

    If the SD-memory card is correctly formatted with "BOOTDISK" at the correct address and the DISKBOOT.BIN is saved on the SD-card.
    Should there be any sign of life from the camera when the SD-card is writeprotected and the power button or play button is hit? Or if the DISKBOOT.BIN file
    is incorrect there will be no sign of life whatsoever? Any suggestions? Is it possible to "recompile" some part of the dumped firmware as it is and then try to boot with the recompiled file?

    *

    Offline reyalp

    • ******
    • 9858
  • Publish
    Re: A1200 porting
    « Reply #6 on: 11 / February / 2012, 01:34:22 »
    If the SD-memory card is correctly formatted with "BOOTDISK" at the correct address and the DISKBOOT.BIN is saved on the SD-card.
    Should there be any sign of life from the camera when the SD-card is writeprotected and the power button or play button is hit? Or if the DISKBOOT.BIN file is incorrect there will be no sign of life whatsoever?
    It crashes early in the boot process, it will appear that the camera hasn't booted at all. No LEDs or other signs of life. This frequently happens if you don't encode your diskboot.bin correctly. It looks like the a1200 should use encoding 6 (from ROM 0xFFBB56E8)
    Quote
    Is it possible to "recompile" some part of the dumped firmware as it is and then try to boot with the recompiled file?
    No.

    If you know an LED address, you can change the code so it sits in a loop and blinks the LED very early in the boot process. This will tell you that your card setup and diskboot encoding is correct. See http://chdk.wikia.com/wiki/Debugging#Using_LEDs_directly
    Don't forget what the H stands for.

  • Publish
    Re: A1200 porting
    « Reply #7 on: 17 / February / 2012, 07:06:06 »
    Thank you for the help reyalp!

    I have been busy with work the last week but I will try the LED blinking debug method during the weekend.

    I have managed to write a canon basic script that blinks the leds and writes the address on the camera LCD so I should be able to use the correct LED address.

    When successful I will share the results.


    *

    Offline fe50

    • ******
    • 3033
    • IXUS50 & 860, SX10 Star WARs-Star RAWs
      • fe50
  • Publish
    Re: A1200 porting
    « Reply #8 on: 18 / February / 2012, 03:24:48 »
    I have managed to write a canon basic script that blinks the leds and writes the address on the camera LCD so I should be able to use the correct LED address.
    Please add the LED address(es) to the A1200 wikia page:

    * http://chdk.wikia.com/wiki/A1200#LED_addresses

  • Publish
    Re: A1200 porting
    « Reply #9 on: 18 / April / 2012, 02:32:10 »
    thanks everyone for trying hard on a1200! unfortunately i ve got no experience in scripting ... It seems i just can clap hands!
    (if any task could be done by a muggle please tell me!)
    thanks

     

    Related Topics