SX260 HS Porting Thread

srsa_4c

4451

Re: SX260 HS Porting Thread

« Reply #60 on: 08 / April / 2012, 20:23:11 »

Advertisements

Quote from: asm1989 on 08 / April / 2012, 10:26:34

but looking at the code there are no similarities between the Led stuff
sx260 vs sx230
sx260 vs sx40 or s100

It's a bit puzzling, any follow-up to look at a bigger picture and trace back where this led pointer should be used?

I'm mainly with Leddrv_c , any other clue?

I don't quite understand what you want to do with the camera's LEDs other than lighting up a certain LED at a certain place of the code. Two of the LEDs have already been found by schapman, he even described how to use them. You need to turn it into a few lines of assembly code, then paste it into the bootup sequence at different places (one at a time, and take care of the registers - don't overwrite a register whose value will later be used).
Also, disable every task override at this point.

I never had to work with code in the loader folder, so I can't help you with that

Logged

asm1989

527
SX720, SX260, SX210 & SX200

Re: SX260 HS Porting Thread

« Reply #61 on: 09 / April / 2012, 00:36:57 »

thanks srsa_4c,

I wan't to set up the led stuff to be able to debug the booting process of chdk,

and till now I was'nt able to use the schapman led procedure inside the boot procedure of chdk, Only using canonbasic.

Logged

philmoz

3450

Re: SX260 HS Porting Thread

« Reply #62 on: 09 / April / 2012, 07:17:50 »

Quote from: asm1989 on 07 / April / 2012, 03:43:13

@philmoz
If I activate DNG_LENS_INFO in platform_camera.h it dosnt find it in finsig and fails ?

I tried it with the 1.00b firmware for the SX260HS and finsig finds the focus_len_table address at 0xfff4bcf0.
This is using DNG_LENS_INFO defined as { 45,10, 900,10, 35,10, 68,10 }, using the values on the Canon web site for the SX260HS.

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)

srsa_4c

4451

Re: SX260 HS Porting Thread

« Reply #63 on: 09 / April / 2012, 11:41:39 »

Quote from: asm1989 on 09 / April / 2012, 00:36:57

I wan't to set up the led stuff to be able to debug the booting process of chdk,

and till now I was'nt able to use the schapman led procedure inside the boot procedure of chdk, Only using canonbasic.

Quote

First, enable control by writing 0x46 to the following addresses

0xC022C200 <-- Required for AF Beam control to work
0xC0223000 <-- Required for I/O LED control to work
0xC0223070 <-- Required for I/O LED control to work

After doing this, these are the on/off addresses

0xC0223030 <-- AF Beam
0xC022C028 <-- I/O LED

Write 0x46 to light the LED, 0xCF to turn it off.

Writing 0x44 will turn off the AF beam, but it won't turn off the I/O LED. 0xCF works for both.

I don't know why you weren't able to light up a LED for debugging (you don't know how to do it or you know how to do it but it doesn't work), but in case you need an example, here it is:

Turning on the AF-LED, based on schapman's description
ONLY use the stmfd and ldmfd lines if you have a valid stack, and it has space for 2 words.
If you can't use stack, choose unused registers in place of r0 and r1 in my code.
Unused register = a register whose current value will never be used.

Code: [Select]

stmfd sp!, {r0,r1}
ldr r0, =0xc022c200
mov r1, #0x46
str r1, [r0]
ldr r0, =0xc0223030
str r1, [r0]
ldmfd sp!, {r0,r1}

To get more LED addresses, you may also try to dump the 0xC022xxxx area with the canon basic script I posted here: http://chdk.setepontos.com/index.php?topic=7887.msg83247#msg83247 , but I don't guarantee that anybody will be able to spot the other LED addresses from it...

Logged

asm1989

527
SX720, SX260, SX210 & SX200

Re: SX260 HS Porting Thread

« Reply #64 on: 09 / April / 2012, 12:57:11 »

Thanks all for your tips,

step by step I can get closer

@srsa_4c, yes I know a bit of the process I ported sx210.

The problem here is that I don't know If It's even loading our firmware to start debuging it,

Loading the bin through canonbasic It hangs, but I'm not sure if it hangs due to the bin or the canonbasic script, since I was unable to light a led in one of the main.c functions of the loader, that why I'm trying to see if have the right or wrong address, since the code is diferent from other cams.

Using your script, this is the ram portion of 0xC0 http://www.4shared.com/file/w3jLP9sg/sx260-C022.html

Logged

c10ud

245

Re: SX260 HS Porting Thread

« Reply #65 on: 09 / April / 2012, 13:57:28 »

if i were you, given the amount of informations you have, i'd go directly with the encoded diskboot.bin and an almost-complete boot procedure, but i never tried loading through cbasic and ymmv ofcourse

Logged

asm1989

527
SX720, SX260, SX210 & SX200

Re: SX260 HS Porting Thread

« Reply #66 on: 09 / April / 2012, 15:50:17 »

@c10ud

Thats what I would like, but I have a "Update File Error" with the encode diskboot, that's why use canonbasic

Logged

asm1989

527
SX720, SX260, SX210 & SX200

Re: SX260 HS Porting Thread

« Reply #67 on: 10 / April / 2012, 11:57:30 »

@philmoz

Quote

I tried it with the 1.00b firmware for the SX260HS and finsig finds the focus_len_table address at 0xfff4bcf0.
This is using DNG_LENS_INFO defined as { 45,10, 900,10, 35,10, 68,10 }, using the values on the Canon web site for the SX260HS.

I used your values,

Also in the finsig detects :

// MAXRAMADDR = 0x0fffffff

but @FF07B064 the value is 0x50000000 -1 = 0x4FFFFFFF

which one is right?

Logged

asm1989

527
SX720, SX260, SX210 & SX200

Re: SX260 HS Porting Thread

« Reply #68 on: 10 / April / 2012, 12:32:39 »

I also detect some new code at boot not present in other cams

Code: [Select]

ROM:FF000138                 LDR     R0, =sub_FF680924
ROM:FF00013C                 LDR     R1, =0x685000
ROM:FF000140                 LDR     R3, =0x69544C

Code: [Select]

ROM:FF680924 sub_FF680924                           
ROM:FF680924                                         
ROM:FF680924                 STMFD   SP!, {R4,LR}
ROM:FF680928                 BL      sub_FF685380
ROM:FF68092C                 LDR     R1, [R0]
ROM:FF680930                 LDR     R4, =0x1964
ROM:FF680934                 LDR     R3, =0x1A70
ROM:FF680938                 MOV     R0, #0
ROM:FF68093C                 MOV     R2, R0
ROM:FF680940                 STR     R1, [R4,#8]
ROM:FF680944
ROM:FF680944 loc_FF680944                            
ROM:FF680944                 LDR     R12, [R3]
ROM:FF680948                 CMP     R0, R12
ROM:FF68094C                 ADDLT   R12, R1, R0,LSL#3
ROM:FF680950                 STRLT   R2, [R12,#4]
ROM:FF680954                 STRLT   R2, [R1,R0,LSL#3]
ROM:FF680958                 ADDLT   R0, R0, #1
ROM:FF68095C                 BLT     loc_FF680944
ROM:FF680960                 ADD     R0, R1, R12,LSL#3
ROM:FF680964                 STR     R0, [R4,#0x10]
ROM:FF680968                 SUB     R0, R0, #8
ROM:FF68096C                 STR     R0, [R4,#0xC]
ROM:FF680970                 MOV     R0, #0
ROM:FF680974                 STR     R2, [R4]
ROM:FF680978                 LDMFD   SP!, {R4,PC}

Code: [Select]

ROM:FF685380 sub_FF685380       
ROM:FF685380                               
ROM:FF685380                 LDR     R0, =0x15444
ROM:FF685384                 BX      LR
ROM:FF685384 ; End of function sub_FF685380

Logged

philmoz

3450

Re: SX260 HS Porting Thread

« Reply #69 on: 10 / April / 2012, 18:56:08 »

Quote from: asm1989 on 10 / April / 2012, 11:57:30

// MAXRAMADDR = 0x0fffffff

but @FF07B064 the value is 0x50000000 -1 = 0x4FFFFFFF

which one is right?

0x40000000 is the 'uncached' address control bit.

0x00000000 - 0x0FFFFFFF is the normal cached RAM range.
0x40000000 - 0x4FFFFFFF is the exact same memory; but access in this range bypasses the cache.

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)