root/platform/ixus50_sd400/sub/101a/boot.c

DEFINITIONS

1. ont
2. h_kbd_p2_f
3. _platformsub_kbd_fetch_data_my
4. boot
5. h_usrInit
6. h_usrKernelInit
7. h_usrRoot

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   5 const char * const new_sa = &_end;
   7 /* Ours stuff */
   8 extern long wrs_kernel_bss_start;
   9 extern long wrs_kernel_bss_end;
  10 extern void createHook (void *pNewTcb);
  11 extern void deleteHook (void *pTcb);
  13 long* ledA=(long*)0xC02200EC;
  15 void ont(void){
  16  *ledA=0x46;
  17 }
  19 void boot();
  21 /* "relocated" functions */
  22 void __attribute__((naked,noinline)) h_usrInit();
  23 void __attribute__((naked,noinline)) h_usrKernelInit();
  24 void __attribute__((naked,noinline)) h_usrRoot();
  26 extern void mykbd_task_proceed_2();
  28 // function above  aDerror0x02x0x0
  29 void __attribute__((naked,noinline)) h_kbd_p2_f()
  30 {
  31     asm volatile (
  32                  "LDR     R4, =0xFBA0\n"
  33                  "LDR     R2, [R4,#0x38]\n"
  34                  "TST     R2, #0x8000\n"
  35                  "BEQ     loc_FF828D10\n"
  36                  "MOV     R2, #0x8000\n"
  37                  "MOV     R0, #0x2F\n"
  38                  "MOV     R1, #2\n"
  39                  "BL      sub_FF8292C0\n"
  40                  "LDR     R3, [R4,#0x38]\n"
  41                  "BIC     R3, R3, #0x8000\n"
  42                  "STR     R3, [R4,#0x38]\n"
  43                  "MOV     R2, R3\n"
  44  "loc_FF828D10:\n"
  45                  "TST     R2, #2\n"
  46                  "BEQ     loc_FF828D38\n"
  47                  "MOV     R1, #2\n"
  48                  "MOV     R2, R1\n"
  49                  "MOV     R0, #0x21\n"
  50                  "BL      sub_FF8292C0\n"
  51                  "LDR     R3, [R4,#0x38]\n"
  52                  "BIC     R3, R3, #2\n"
  53                  "STR     R3, [R4,#0x38]\n"
  54                  "MOV     R2, R3\n"
  55  "loc_FF828D38:\n"
  56                  "TST     R2, #4\n"
  57                  "BEQ     loc_FF828D60\n"
  58                  "MOV     R2, #4\n"
  59                  "MOV     R0, #0x22\n"
  60                  "MOV     R1, #2\n"
  61                  "BL      sub_FF8292C0\n"
  62                  "LDR     R3, [R4,#0x38]\n"
  63                  "BIC     R3, R3, #4\n"
  64                  "STR     R3, [R4,#0x38]\n"
  65                  "MOV     R2, R3\n"
  66  "loc_FF828D60:\n"
  67                  "ADD     R1, R4, #0x30\n"
  68                  "LDMIA   R1, {R1,R3}\n"
  69                  "ADD     R3, R1, R3\n"
  70                  "CMN     R3, R2\n"
  71                  "BEQ     loc_FF828D78\n"
  72                  "BL      sub_FF829320\n"
  73  "loc_FF828D78:\n"
  74                  "LDR     R3, =0x1FBC\n"
  75                  "LDR     R1, [R3]\n"
  76                  "CMP     R1, #1\n"
  77                  "BNE     loc_FF828D94\n"
  78                  "MOV     R0, #0\n"
  79                  "MOV     R2, R1\n"
  80                  "BL      sub_FF8292C0\n"
  81  "loc_FF828D94:\n"
  82                  "BL      sub_FF8299FC\n"
  83                  "B       mykbd_task_proceed_2\n"
  84     );
  85 }
  87 void __attribute__((naked,noinline)) _platformsub_kbd_fetch_data_my(){
  88  asm volatile (
  89                  "STMFD   SP!, {R4-R11,LR}\n"
  90                  "MOV     LR, #0x220000\n"
  91                  "ORR     R3, LR, #0x204\n"
  92                  "LDR     R1, =0xFC74\n"
  93                  "ORR     R3, R3, #0xC0000000\n"
  94             //   "LDR     R9, [R3]\n"                // -
  96             //my code here
  97                  "MOV     R2, R0\n"
  98                  "LDR     R0, [R3]\n" 
  99                  "STMFD   SP!, {R1-R11}\n"  
 100                  "BL      usb_power_status_override\n"
 101                  "LDMFD   SP!, {R1-R11}\n"
 102                  "MOV     R9, R0\n"
 103                  "MOV     R0, R2\n"
 104                  "MOV     LR, #0x220000\n"
 105             //original code
 108                  "LDR     R6, [R1]\n"
 109                  "LDR     R4, =0xFC08\n"
 110                  "LDR     R1, [R0,#0x1C]\n"
 111                  "MOV     R10, R6,LSL#2\n"
 112                  "AND     R1, R9, R1\n"
 113                  "ADD     R12, R4, #0x20\n"
 114                  "SUB     R8, R6, #1\n"
 115                  "SUB     R7, R6, #2\n"
 116                  "STR     R1, [R12,R10]\n"
 117                  "AND     R8, R8, #7\n"
 118                  "AND     R7, R7, #7\n"
 119                  "MOV     R8, R8,LSL#2\n"
 120                  "MOV     R7, R7,LSL#2\n"
 121                  "LDR     R2, =0xFC68\n"
 122                  "LDR     R5, [R12,R7]\n"
 123                  "LDR     R12, [R12,R8]\n"
 124                  "LDR     R3, [R2,#4]\n"
 125                  "EOR     R11, R1, R12\n"
 126                  "EOR     R12, R1, R5\n"
 127                  "ORR     R12, R11, R12\n"
 128                  "EOR     R2, R3, R1\n"
 129                  "STR     R1, [R0,#0x10]\n"
 130                  "BIC     R2, R2, R12\n"
 131                  "LDR     R1, =0xFC68\n"
 132                  "EOR     R3, R3, R2\n"
 133                  "STR     R3, [R1,#4]\n"
 134                  "STR     R2, [R0,#0x34]\n"
 135                  "STR     R9, [R0,#0x58]\n"
 136                  "ORR     R3, LR, #0x208\n"
 137                  "ORR     R3, R3, #0xC0000000\n"
 138                  "LDR     R1, [R3]\n"
 139             //my code here
 140                  "MOV     R2, R0\n"
 141                  "MOV     R0, R1\n"
 142                  "STMFD   SP!, {R1-R11}\n"  
 143                  "BL      my_kbd_read_keys\n"
 144                  "LDMFD   SP!, {R1-R11}\n"
 145                  "MOV     R1,R0\n"
 146                  "MOV     R0,R2\n"
 147                  "MOV     LR, #0x220000\n"
 148             //original code
 149                  "MOV     R2, #0xFF00\n"
 150                  "ADD     R2, R2, #0xFF\n"
 151                  "ADD     R4, R4, #0x40\n"
 152                  "AND     R2, R1, R2\n"
 153                  "STR     R2, [R4,R10]\n"
 154                  "ADD     LR, LR, #0x3000\n"
 155                  "STR     R1, [R0,#0x5C]\n"
 156                  "ADD     R1, LR, #0xC000001C\n"
 157                  "LDR     R3, [R1]\n"
 158                  "AND     R3, R3, #1\n"    
 159                  "ORR     R2, R2, R3,LSL#16\n"
 160                  "STR     R2, [R4,R10]\n"
 161                  "ADD     LR, LR, #0xC0000024\n"
 162                  "LDR     R3, [LR]\n"
 163                  "LDR     R1, [R0,#0x20]\n"
 165               // "AND     R3, R3, #1\n"
 166                  "AND     R3, R3, #0\n"    // - clear SD card R/O flag
 168                  "ORR     R2, R2, R3,LSL#17\n"
 169                  "AND     R2, R2, R1\n"
 170                  "STR     R2, [R4,R10]\n"
 171                  "LDR     R3, [R4,R8]\n"
 172                  "LDR     LR, [R4,R7]\n"
 173                  "LDR     R4, =0xFC68\n"
 174                  "LDR     R1, [R4,#8]\n"
 175                  "EOR     R11, R2, R3\n"
 176                  "EOR     R12, R2, LR\n"
 177                  "EOR     R3, R1, R2\n"
 178                  "ORR     R12, R11, R12\n"
 179                  "BIC     R3, R3, R12\n"
 180                  "EOR     R1, R1, R3\n"
 181                  "ADD     R6, R6, #1\n"
 182                  "STR     R2, [R0,#0x14]\n"
 183                  "STR     R1, [R4,#8]\n"
 184                  "LDR     R1, =0xFC74\n"
 185                  "AND     R6, R6, #7\n"
 186                  "STR     R6, [R1]\n"
 187                  "STR     R3, [R0,#0x38]\n"
 188                  "LDMFD   SP!, {R4-R11,PC}\n"
 189 );
 190 }
 192 void boot()
 193 {
 194     //long *canon_data_src = (void*)0xFFAD0980;
 195         long *canon_data_src = (void*)0xFFAD0980;
 196         // This is address of "Startofdata" string on the firmware
 197     long *canon_data_dst = (void*)0x1900;
 198         // This is where the boot data is copied during firmware update
 199     long canon_data_len = 0xD3E0;
 200         // This is length of data from "Startofdata" to end of firmware dump
 201     long *canon_bss_start = (void*)0xECE0; // just after data
 202         //  = 0xD3E0 + 0x1900,  just after data
 203     long canon_bss_len = 0x7C410 - 0xECE0;
 204         // The original address of h_usrKernelInit - bss start
 205     long i;
 207     asm volatile (
 208         "MRC     p15, 0, R0,c1,c0\n"
 209         "ORR     R0, R0, #0x1000\n"
 210         "ORR     R0, R0, #4\n"
 211         "ORR     R0, R0, #1\n"
 212         "MCR     p15, 0, R0,c1,c0\n"
 213     :::"r0");
 216     for(i=0;i<canon_data_len/4;i++)
canon_data_dst[i]=canon_data_src[i];
 219     for(i=0;i<canon_bss_len/4;i++)
canon_bss_start[i]=0;
 222     asm volatile (
 223         "MRC     p15, 0, R0,c1,c0\n"
 224         "ORR     R0, R0, #0x1000\n"
 225         "BIC     R0, R0, #4\n"
 226         "ORR     R0, R0, #1\n"
 227         "MCR     p15, 0, R0,c1,c0\n"
 228     :::"r0");
h_usrInit();
 231 }
 234 void h_usrInit()
 235 {
 236     asm volatile (
 237         "STR    LR, [SP,#-4]!\n"
 238         "BL     sub_FF811A40\n"
 239         "MOV    R0, #2\n"
 240         "MOV    R1, R0\n"
 241         "BL     sub_FFAB70C0\n" // unknown_libname_849
 242         "BL     sub_FFAA3798\n" // excVecInit
 243         "BL     sub_FF811298\n"
 244         "BL     sub_FF811800\n"
 245         "LDR    LR, [SP],#4\n"
 246         "B      h_usrKernelInit\n"
 247     );
 248 }
 250 void  h_usrKernelInit()
 251 {
 252         asm volatile (
 253         "STMFD   SP!, {R4,LR}\n"
 254         "SUB     SP, SP, #8\n"
 255         "BL      sub_FFAB75C0\n" // classLibInit
 256         "BL      sub_FFAC9DCC\n" // taskLibInit
 257         "LDR     R3, =0xE114\n"
 258         "LDR     R2, =0x78600\n"
 259         "LDR     R1, [R3]\n"
 260         "LDR     R0, =0x7BDD0\n"
 261         "MOV     R3, #0x100\n"
 262         "BL      sub_FFAC56FC\n" // qInit
 263         "LDR     R3, =0xE0D4\n"
 264         "LDR     R0, =0xE4F4\n"
 265         "LDR     R1, [R3]\n"
 266         "BL      sub_FFAC56FC\n" // qInit
 267         "LDR     R3, =0xE190\n"
 268         "LDR     R0, =0x7BDA4\n"
 269         "LDR     R1, [R3]\n"
 270         "BL      sub_FFAC56FC\n" // qInit
 271         "BL      sub_FFACE94C\n" // workQInit
 272         "BL      sub_FF811384\n"
 273         "MOV     R4, #0\n"
 274         "MOV     R3, R0\n"
 275         "MOV     R12, #0x800\n"
 276         "LDR     R0, =h_usrRoot\n"
 277         "MOV     R1, #0x4000\n"
 278         );      
 279 //        "LDR     R2, =0xAC410\n"      // 0x7C410 + 0x40000
 280     asm volatile (
 281                 "LDR     R2, =new_sa\n"
 282                 "LDR     R2, [R2]\n"
 283         );
 284         asm volatile (
 285                 "STR     R12, [SP]\n"
 286         "STR     R4, [SP,#4]\n"
 287         "BL      sub_FFAC700C\n" // kernelInit
 288         "ADD     SP, SP, #8\n"
 289         "LDMFD   SP!, {R4,PC}\n"
 290     );
 291 }
 294 void  h_usrRoot()
 295 {
 296         asm volatile (
 297         "STMFD   SP!, {R4,R5,LR}\n"
 298         "MOV     R5, R0\n"
 299         "MOV     R4, R1\n"
 300         "BL      sub_FF811AA8\n"
 301         "MOV     R1, R4\n"
 302         "MOV     R0, R5\n"
 303         "BL      sub_FFABD73C\n" // memInit
 304         "MOV     R1, R4\n"
 305         "MOV     R0, R5\n"
 306         "BL      sub_FFABE1B4\n" // memPartLibInit
 307         //"BL      sub_FF8118C0\n" //nullsub_1
 308         "BL      sub_FF8117DC\n"
 309         "MOV     R0, #0x32\n"
 310         "BL      sub_FFAC0158\n" // selectInit
 311         "BL      sub_FF811AEC\n"
 312         "BL      sub_FF811ACC\n"
 313         "BL      sub_FF811B18\n"
 314         "BL      sub_FFABFA18\n" // selTaskDeleteHookAdd
 315         "BL      sub_FF811A9C\n"
 316     );
_taskCreateHookAdd(createHook);
_taskDeleteHookAdd(deleteHook);
drv_self_hide();
 323     asm volatile (
 324         "LDMFD   SP!, {R4,R5,LR}\n"
 325         "B       sub_FF811444\n"
 326     );
 327 }