Skip to content

Commit b0d009d

Browse files
cedricbompartcedricbompart
committed
first draft on loading the Canon FW
1 parent 4630c5f commit b0d009d

File tree

9 files changed

+620
-20
lines changed

9 files changed

+620
-20
lines changed

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
*.o
2-
#*.BIN
2+
*.BIN
33
*.bin
44
*.lua
55
*.a
@@ -40,3 +40,4 @@ tools/makeexport
4040
tools/makelang
4141
tools/packfi2/fi2enc
4242
tools/pakwif
43+
tools/capdis

‎loader/m6/main.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ ld_ver_t fw = { "GM1.01A", //
1111

1212
int __attribute__((naked)) get_core_id() {
1313
asm volatile (
14-
"mrc p15, #0, r0, c0, c0, #5\n"
15-
"ands r0, #0xf\n"
16-
"bx lr\n"
14+
" mrc p15, #0, r0, c0, c0, #5\n"
15+
" ands r0, #0xf\n"
16+
" bx lr\n"
1717
);
1818
}
1919

‎platform/m6/sub/101a/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
OBJS=boot.o stubs_entry.o stubs_entry_2.o mmu_utils.o
1+
OBJS=boot.o stubs_entry.o stubs_entry_2.o mmu_utils.o debug.o
22
STUBS_AUTO_DEPS=boot.c
33

44
include ../../../makefile_sub.inc

‎platform/m6/sub/101a/boot.c‎

Lines changed: 233 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,248 @@
1+
#include "cache.h"
2+
13
#include "../../../generic/mmu_utils.h"
4+
#include "boot.h"
5+
#include "debug.h"
6+
7+
#define CHDK_MMUTBL_START 0xdffda400
8+
#define CHDK_PAGES_START 0x11d0000
9+
#define CANON_TABLES_AT 0xdffc0000
210

3-
#define LED 0xD20801E0
11+
static int no_chdk_please = 0;
412

5-
void sleep(int duration) {
6-
int i;
7-
for (i = 0; i < duration; i++) {
8-
asm volatile( "nop\n" );
13+
void CreateTask_spytask() {
14+
15+
}
16+
17+
void startup_mode_fix(void) {
18+
int startupmode = *(int*) 0x9eb0;
19+
switch (startupmode) {
20+
case 0x1000000: // rec
21+
break;
22+
default:
23+
no_chdk_please = 1;
924
}
1025
}
1126

12-
void blink() {
13-
volatile long *led = (long*) LED;
27+
void __attribute__((naked,noinline,aligned(4))) patch_E0020668() {
28+
asm volatile (
29+
"bl CreateTask_spytask\n"
30+
"bl sub_E02796AE\n" // execute overwritten instruction
31+
"bl sub_E010E954\n"// execute overwritten instruction
32+
"ldr pc, =0xe0020671\n"// -> back to ROM
33+
);
34+
}
35+
36+
void plant_hacks_for_e0020000(unsigned addr) {
37+
// switch off card instead of exec'ing diskboot
38+
*(unsigned*) (addr + 0x0644) = BL_INSTR_T1(0xE0020644, 0xE04B3F3A);
39+
// conditionally start SpyTask
40+
place_fw_patch_t2_64b(patch_E0020668, addr + 0x0668);
41+
}
42+
43+
void __attribute__((naked,noinline,aligned(4))) patch_E0079DA4() {
44+
asm volatile (
45+
"bl sub_e007006e\n" // startup mode inquiry
46+
"bl startup_mode_fix\n"// +
47+
"bl sub_e007a49c\n"// <kbd_read_keys>
48+
"ldr r3, =0x6a1a8\n"
49+
"ldr pc, =0xe0079dad\n"// -> back to ROM
50+
);
51+
}
52+
53+
void plant_hacks_for_e0070000(unsigned addr) {
54+
// insert startup mode handling
55+
place_fw_patch_t2_64b(patch_E0079DA4, addr + 0x9DA4);
56+
// nop (benign 16-bit instruction, added to replace 1st half of destroyed 32-bit instruction)
57+
*(unsigned short*) (addr + 0x9DA2) = 0xbf00;
58+
}
59+
60+
// following should be integrated in dcache_clean_all
61+
void l2_cache_sync(void) {
62+
*(int*) 0xc1100730 = 0;
63+
}
1464

15-
while (1) {
16-
*led = 0x24D0002; /* on */
17-
sleep(10000000);
18-
*led = 0x24C0003; /* off */
19-
sleep(10000000);
65+
void setup_mmu_for_chdk(int core) {
66+
if (core == 0) {
67+
unsigned l2adr = CHDK_MMUTBL_START;
68+
unsigned rompagecopy = CHDK_PAGES_START;
69+
70+
// at the beginning, ROM tables are in use
71+
// first, make a fresh copy of the ROM translation tables to its usual place in RAM
72+
_make_copy_of_canon_mmutables(CANON_TABLES_AT);
73+
// get flags of ROM area
74+
unsigned flags = get_l2_largepage_flags_from_l1_section(ROMBASEADDR,
75+
CANON_TABLES_AT);
76+
77+
// split first 16MB of ROM area into sections
78+
split_l1_supersection(ROMBASEADDR, CANON_TABLES_AT);
79+
80+
{
81+
// create L2 table for following 1MB ROM section
82+
replace_section_with_l2_tbl(0xe0000000, CANON_TABLES_AT, l2adr,
83+
flags);
84+
85+
replace_rom_page(0xe0020000, rompagecopy, l2adr, flags);
86+
plant_hacks_for_e0020000(rompagecopy);
87+
rompagecopy += PAGE_SIZE;
88+
89+
replace_rom_page(0xe0070000, rompagecopy, l2adr, flags);
90+
plant_hacks_for_e0070000(rompagecopy);
91+
rompagecopy += PAGE_SIZE;
92+
93+
l2adr += 0x400;
94+
}
2095
}
96+
icache_flush_all();
97+
dcache_clean_all();
98+
l2_cache_sync();
99+
_set_canon_mmu_tables_to(CANON_TABLES_AT);
100+
}
101+
102+
void __attribute__((naked,noinline)) park_current_core_then_continue() {
103+
asm volatile(
104+
" movs r4, r0\n"
105+
" movw r0, #0xA\n"
106+
" movt r0, #0\n"
107+
" bl park_current_core\n"
108+
" bx r4\n"
109+
"park_current_core:\n"
110+
" mov r3, lr\n"
111+
" bl disable_branch_prediction\n"
112+
"pcr1:\n"
113+
" dsb sy\n"
114+
" wfi \n"
115+
" movw r1, #0x10C\n"
116+
" movt r1, #0xC100\n"
117+
" ldr r2, [r1, #0]\n"
118+
" subs r1, r2, r0\n"
119+
" movw r1, #0x110\n"
120+
" movt r1, #0xC100\n"
121+
" str r2, [r1, #0]\n"
122+
" bne.n pcr1\n"
123+
" dsb sy\n"
124+
" bl enable_branch_prediction\n"
125+
" bx r3\n"
126+
"disable_branch_prediction:\n"
127+
" mrc p15, 0, r1, c1, c0, 0\n"
128+
" bic.w r1, r1, #0x800\n"
129+
" mcr p15, 0, r1, c1, c0, 0\n"
130+
" dsb sy\n"
131+
" isb sy\n"
132+
" bx lr\n"
133+
"enable_branch_prediction:\n"
134+
" mcr p15, 0, r1, c7, c5, 6\n"
135+
" dsb sy\n"
136+
" mrc p15, 0, r1, c1, c0, 0\n"
137+
" orr.w r1, r1, #0x800\n"
138+
" mcr p15, 0, r1, c1, c0, 0\n"
139+
" dsb sy\n"
140+
" isb sy\n"
141+
" bx lr\n"
142+
);
143+
}
144+
145+
void __attribute__((naked,noinline)) sub_e00200f8_my() {
146+
// capdis -f=chdk -jfw -stubs -s=0xe00200f9 -c=2 PRIMARY.BIN 0xe0000000
147+
asm volatile (
148+
" push {r4, r5, r6, lr}\n"
149+
" ldr r0, =0x002b413f\n" // heap start, modify here
150+
" ldr pc, =0xe00200fd\n"// Continue in firmware
151+
".ltorg\n"
152+
);
21153
}
22154

23155
/**
24156
* @see main startup
25157
*/
26158
void __attribute__((naked,noinline)) boot() {
27-
blink();
159+
// capdis -f=chdk -stubs -s=0xe0020011 -c=6 PRIMARY.BIN 0xe0000000
160+
asm volatile (
161+
" ldr r0, =0xe0020200\n"
162+
" mcr p15, #0, r0, c12, c0, #0\n"
163+
" isb sy\n"
164+
" movw r0, #0x2000\n"
165+
" movt r0, #0\n"
166+
" mov sp, r0\n"
167+
);
168+
169+
// handle 2 cores
170+
asm volatile (
171+
" mrc p15, #0, r0, c0, c0, #5\n"
172+
" ands r0, #0xf\n"
173+
" beq loc_boot\n"
174+
" adr r0, loc_boot\n"
175+
" orr r0, #1\n"
176+
" bl park_current_core_then_continue\n"
177+
"loc_boot:\n"
178+
" mrc p15, #0, r0, c0, c0, #5\n"
179+
" ands r0, #0xf\n"
180+
" bl setup_mmu_for_chdk\n"
181+
);
182+
183+
// capdis -f=chdk -stubs -s=0xe0020025 -c=59 PRIMARY.BIN 0xe0000000
184+
asm volatile (
185+
" mrc p15, #0, r5, c0, c0, #5\n"
186+
" ands r0, r5, #0xf\n"
187+
" bne loc_e0020032\n"
188+
" b.w loc_e002003c\n"
189+
"loc_e0020032:\n"
190+
" b.w sub_e00200f8_my\n"
191+
"loc_e002003c:\n"
192+
" ldr r0, =0xe115d544\n"
193+
" ldr r1, =0x00008000\n"
194+
" ldr r3, =0x00068524\n"
195+
"loc_e0020042:\n"
196+
" cmp r1, r3\n"
197+
" itt lo\n"
198+
" ldrlo r2, [r0], #4\n"
199+
" strlo r2, [r1], #4\n"
200+
" blo loc_e0020042\n"
201+
" ldr r1, =0x002b4138\n"
202+
" mov.w r2, #0\n"
203+
"loc_e0020056:\n"
204+
" cmp r3, r1\n"
205+
" it lo\n"
206+
" strlo r2, [r3], #4\n"
207+
" blo loc_e0020056\n"
208+
" ldr r0, =0xe11bda68\n"
209+
" ldr r1, =0x01900000\n"
210+
" ldr r3, =0x01901444\n"
211+
"loc_e0020066:\n"
212+
" cmp r1, r3\n"
213+
" itt lo\n"
214+
" ldrlo r2, [r0], #4\n"
215+
" strlo r2, [r1], #4\n"
216+
" blo loc_e0020066\n"
217+
" ldr r0, =0x01900000\n"
218+
" ldr r1, =0x00001444\n"
219+
" bl _dcache_clean_by_mva\n"
220+
" ldr r0, =0x01900000\n"
221+
" ldr r1, =0x00001444\n"
222+
" bl _icache_branchpr_invalidate\n"
223+
" ldr r0, =0xe11beeac\n"
224+
" ldr r1, =0xdffc4900\n"
225+
" ldr r3, =0xdffd9ba0\n"
226+
"loc_e002008a:\n"
227+
" cmp r1, r3\n"
228+
" itt lo\n"
229+
" ldrlo r2, [r0], #4\n"
230+
" strlo r2, [r1], #4\n"
231+
" blo loc_e002008a\n"
232+
" ldr r1, =0xdffd9ba0\n"
233+
" mov.w r2, #0\n"
234+
"loc_e002009e:\n"
235+
" cmp r3, r1\n"
236+
" it lo\n"
237+
" strlo r2, [r3], #4\n"
238+
" blo loc_e002009e\n"
239+
" ldr r0, =0xdffc4900\n"
240+
" ldr r1, =0x000152a0\n"
241+
" bl _dcache_clean_by_mva\n"
242+
" ldr r0, =0xdffc4900\n"
243+
" ldr r1, =0x000152a0\n"
244+
" bl _icache_branchpr_invalidate\n"
245+
" b loc_e0020032\n"// +
246+
);
247+
28248
}

‎platform/m6/sub/101a/boot.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#ifndef M6_BOOT_H
2+
#define M6_BOOT_H
3+
4+
extern void _set_canon_mmu_tables_to(unsigned addr);
5+
extern void _make_copy_of_canon_mmutables(unsigned dest_addr);
6+
7+
#endif

‎platform/m6/sub/101a/debug.c‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#include "debug.h"
2+
3+
#define LED 0xD20801E0
4+
5+
void sleep(int duration) {
6+
int i;
7+
for (i = 0; i < duration; i++) {
8+
asm volatile( "nop\n" );
9+
}
10+
}
11+
12+
void blink(void) {
13+
volatile long *led = (long*) LED;
14+
15+
while (1) {
16+
*led = 0x24D0002; /* on */
17+
sleep(10000000);
18+
*led = 0x24C0003; /* off */
19+
sleep(10000000);
20+
}
21+
}

‎platform/m6/sub/101a/debug.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#ifndef M6_DEBUG_H
2+
#define M6_DEBUG_H
3+
4+
void blink(void);
5+
6+
#endif

‎platform/m6/sub/101a/stubs_entry_2.S‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ NHSTUB(EngDrvRead_FW, 0xe05b1d13) // in wrappers
2323
NHSTUB(GetLensCurrentFocalLength, 0xe03f4561)
2424
NHSTUB(GetLensWideFocalLength, 0xe03f4573)
2525

26+
// MMU
27+
NHSTUB(dcache_clean_by_mva ,0xe036ba79)
28+
NHSTUB(clean_l2_cache_by_phys_addr ,0xe00698dd)
29+
NHSTUB(set_canon_mmu_tables_to ,0xdffc7ccb)
30+
NHSTUB(make_copy_of_canon_mmutables ,0xdffc7c55)
31+
NHSTUB(icache_branchpr_invalidate ,0xe036bb4d)
32+
NHSTUB(dcache_clean_and_invalidate_all ,0xe036bb09)
33+
2634
NHSTUB(EnterToCompensationEVF, 0x00000000) // TODO
2735
NHSTUB(ExitFromCompensationEVF, 0x00000000) // TODO
2836
NHSTUB(ExpCtrlTool_StartContiAE, 0x00000000) // TODO
@@ -33,5 +41,3 @@ NHSTUB(Restart, 0x00000000) // TODO
3341
NHSTUB(TurnOffBackLight, 0x00000000) // TODO
3442
NHSTUB(TurnOnBackLight, 0x00000000) // TODO
3543
NHSTUB(WriteSDCard, 0x00000000) // TODO
36-
37-

0 commit comments

Comments
 (0)