root/platform/ixus40_sd300/sub/100j/boot.c

DEFINITIONS

1. boot
2. h_usrInit
3. h_usrKernelInit
4. h_usrRoot
5. ttyRead
6. mytty_nextline
7. mytty_putc
8. ttyWrite
9. replaceConsoleDriver
10. h_ios_tty_Init

   1 /**
   2     this code completely copied from ../100k + adapted to the 100j firmware
   3 */
   5 #include "lolevel.h"
   6 #include "platform.h"
   7 #include "core.h"
   9 /* These functions need to be taken from the original firmware and addresses need to be modifyed */
  11 /* Ours stuff */
  12 extern long wrs_kernel_bss_start;
  13 extern long wrs_kernel_bss_end;
  14 extern void createHook (void *pNewTcb);
  15 extern void deleteHook (void *pTcb);
  16 const char * const new_sa = &_end;
  18 void boot();
  20 /* "relocated" functions */
  21 void __attribute__((naked,noinline)) h_usrInit();
  22 void __attribute__((naked,noinline)) h_usrKernelInit();
  23 void __attribute__((naked,noinline)) h_usrRoot();
  25 extern void mykbd_task_proceed_2();
  27 void boot()
  28 {
  29     long *canon_data_src = (void*)0xffad76d0; // This is the address of the "Startofdata" string on the firmware
  30     long *canon_data_dst = (void*)MEMBASEADDR; // This is where the boot data is copiedduring firmware update
  31     long canon_data_len = 0xEB60; // This is the length of data from "Startofdata" to the end of the firmware dump
  32     long *canon_bss_start = (void*) (canon_data_len + MEMBASEADDR); //  = 0xEB60 + 0x1900,  just after data
  33     long canon_bss_len = MEMISOSTART - (long) canon_bss_start; // The original address of h_usrKernelInit - bss start
  34     long i;
  36     asm volatile (
  37         "MRC     p15, 0, R0,c1,c0\n"
  38         "ORR     R0, R0, #0x1000\n"
  39         "ORR     R0, R0, #4\n"
  40         "ORR     R0, R0, #1\n"
  41         "MCR     p15, 0, R0,c1,c0\n"
  42     :::"r0");
  45     for(i=0;i<canon_data_len/4;i++)
canon_data_dst[i]=canon_data_src[i];
  48     for(i=0;i<canon_bss_len/4;i++)
canon_bss_start[i]=0;
  51     asm volatile (
  52         "MRC     p15, 0, R0,c1,c0\n"
  53         "ORR     R0, R0, #0x1000\n"
  54         "BIC     R0, R0, #4\n"
  55         "ORR     R0, R0, #1\n"
  56         "MCR     p15, 0, R0,c1,c0\n"
  57     :::"r0");
h_usrInit();
  60 }
  63 void h_usrInit()
  64 {
  65         asm volatile (
  66         "STR     LR, [SP,#-4]!\n"
  67         "BL      sub_FF811B20\n"
  68         "MOV     R0, #2\n"
  69         "MOV     R1, R0\n"
  70         "BL      sub_ffabdc74\n"
  71         "BL      sub_ffaaa210\n"
  72         "BL      sub_FF81125C\n"
  73         "BL      sub_FF811838\n"
  74         "LDR     LR, [SP],#4\n"
  75         "B       h_usrKernelInit\n"
  76         );
  78 }
  81 void  h_usrKernelInit() // @ 0xff811854 in dump
  82 {
  83         asm volatile (
  84         "STMFD   SP!, {R4,LR}\n"
  85         "SUB     SP, SP, #8\n"
  86         "BL      sub_ffabe140\n"
  87         "BL      sub_ffad0c00\n"
  88         "LDR     R3, =0xF88C\n"
  89         "LDR     R2, =0x704A0\n"
  90         "LDR     R1, [R3]\n"
  91         "LDR     R0, =0x7278C\n"
  92         "MOV     R3, #0x100\n"
  93         "BL      sub_ffacc43c\n"
  94         "LDR     R3, =0xF84C\n"
  95         "LDR     R0, =0xFC6C\n"
  96         "LDR     R1, [R3]\n"
  97         "BL      sub_ffacc43c\n"
  98         "LDR     R3, =0xF908\n"
  99         "LDR     R0, =0x72760\n"
 100         "LDR     R1, [R3]\n"
 101         "BL      sub_ffacc43c\n"
 102         "BL      sub_ffad5780\n"
 103         "BL      sub_FF811348\n"
 104         "MOV     R4, #0\n"
 105         "MOV     R3, R0\n"
 106         "MOV     R12, #0x800\n"
 107         "LDR     R0, =h_usrRoot\n"
 108         "MOV     R1, #0x4000\n"
 109         );
 111         //"LDR     R2, =0xB2DC0\n" // 0x72DC0 + 0x40000
 112         asm volatile (
 113         "LDR     R2, =new_sa\n"
 114         "LDR     R2, [R2]\n"
 115         );
 117         asm volatile (
 118         "STR     R12, [SP]\n"
 119         "STR     R4, [SP,#4]\n"
 120         "BL      sub_ffacde40\n"
 121         "ADD     SP, SP, #8\n"
 122         "LDMFD   SP!, {R4,PC}\n"
 123         );
 125 }
 128 void  h_usrRoot() // 0xff811c3c in dump
 129 {
 130 //      volatile long *p;
 132         asm volatile (
 133         "STMFD   SP!, {R4,R5,LR}\n"
 134         "MOV     R5, R0\n"
 135         "MOV     R4, R1\n"
 136         "BL      sub_FF811BA0\n"
 137         "MOV     R1, R4\n"
 138         "MOV     R0, R5\n"
 139         "BL      sub_ffac4428\n" // memInit
 140         "MOV     R1, R4\n"
 141         "MOV     R0, R5\n"
 142         "BL      sub_ffac4ea0\n" // mmPartLibInit <----- OK up to here!!
 144         //"BL      sub_FF811928\n" // Here something BAD happens! It initializes the MMU, but SD500 has this replaced by a NULLSUB call...
 146         "BL      sub_FF811814\n"
 147         "MOV     R0, #0x32\n"
 148         "BL      sub_ffac6910\n" // selectInit
 149         "BL      sub_FF811BE4\n"
 150         "BL      sub_FF811BC4\n"
 151         "BL      sub_FF811C10\n"
 152         "BL      sub_ffac61d0\n" //selTaskDeleteHookAdd
 153         "BL      sub_FF811B94\n"
 154         );
_taskCreateHookAdd(createHook);
_taskDeleteHookAdd(deleteHook);
drv_self_hide();
 161         asm volatile (
 162         "LDMFD   SP!, {R4,R5,LR}\n"
 163         "B       sub_FF811408\n"
 164         );
 166 }
 168 #if CAM_CONSOLE_LOG_ENABLED
 169 typedef struct { 
 170                     long dev_hdr[4]; 
 171                     long opened; 
 173                     long fill[64]; 
 174                 } MY_DEV; 
 176                 #define CONS_W (45) 
 177                 #define CONS_H (128) 
 179                 char console_buf[CONS_H][CONS_W]; 
 180                 long console_buf_line = 0; 
 181                 long console_buf_line_ptr = 0; 
 183                 char cmd[100] = "ShowCameraLog\n\0"; 
 184                 int cons_cmd_ptr = -1; 
 186                 void mytty_putc(char c); 
 188                 int ttyRead(MY_DEV* tty,  char* buffer, int nBytes) 
 189                 { 
 190                     int r = 1; 
 192                     if (cons_cmd_ptr == -1){ 
msleep(2000); 
cons_cmd_ptr = 0; 
 195                     } 
mytty_putc('r'); 
 199                     if (cmd[cons_cmd_ptr] != 0){ 
 200                         *buffer = cmd[cons_cmd_ptr]; 
cons_cmd_ptr++; 
 202                     } else { 
 203                         while (cons_cmd_ptr != 0){ 
msleep(10); 
 205                         } 
 206                         *buffer = cmd[cons_cmd_ptr]; 
cons_cmd_ptr++; 
 208                     } 
 210                     return r; 
 211                 } 
 213                 void mytty_nextline() 
 214                 { 
 215                     int i; 
console_buf_line_ptr=0; 
console_buf_line++; 
 219                     if (console_buf_line>=CONS_H){ 
console_buf_line = 0; 
 221                     } 
 222                     for (i=0;i<15;i++){ 
 223                         int l=i+console_buf_line; 
 224                         if (l>=CONS_H) 
l-=CONS_H; 
console_buf[l][0] = 0; 
 227                     } 
 228                 } 
 230                 void mytty_putc(char c) 
 231                 { 
 232                     if (c == 0xa){ 
mytty_nextline(); 
 234                     } else { 
 235                         if (console_buf_line_ptr>=(CONS_W-1)){ 
mytty_nextline(); 
 237                         } 
console_buf[console_buf_line][console_buf_line_ptr++] = c; 
console_buf[console_buf_line][console_buf_line_ptr] = 0; 
 241                     } 
 242                 } 
 244                 int tyWrite = 0xffaca1bc;
 246     //ttyWrite seems to work, Read might be broken 
 247                 int ttyWrite(MY_DEV* tty,  char* buffer, int nBytes) 
 248                 { 
 249                     int i; 
 251                     for (i=0;i<nBytes;i++){ 
mytty_putc(buffer[i]); 
 253                     } 
 255                     return ((int(*)(void *p, void *p2, int l))tyWrite)(tty, buffer, nBytes); 
 256                 //    return nBytes; 
 257                 } 
 260                 /* 
 261                   Referenced from ttyDrv_init as 
 262                      LDR     R11, =TTY_DRV_NUM 
 263                   and ttyDevCreate as 
 264                      LDR     R9, =TTY_DRV_NUM 
 265                 */ 
 266                 int *TTY_DRV_NUM = (int*)0x0006F578; 
 268                 static void replaceConsoleDriver() 
 269                 { 
 270                     // These function addresses are from ttyDrv_init function call 
 271                     int f0 = 0xffac924c;
 272                     int f1 = 0; 
 273                     int f2 = 0xffac924c;
 274                     int f3 = 0xffac928c;
 275                     int f6 = 0xffac92d0;
 276                     int fRead = (int)&ttyRead; 
 277                     int fWrite = (int)&ttyWrite; 
 278                     int newdriver_id = _iosDrvInstall((void*)f0, (void*)f1, (void*)f2, (void*)f3, (void*)fRead, (void*)fWrite, (void*)f6); 
 280                     *TTY_DRV_NUM = newdriver_id; 
 281                 } 
 283                 void h_ios_tty_Init() 
 284                 { 
 285                 /* 
 286                   asm volatile 
 287                   ( 
 288                       "MOV     R0, #0x1000" 
 289                       "BL      sub_FF811478" 
 290                  
 291                       "MOV     R1, #0x32"                  
 292                       "LDR     R2, =aNull" 
 293                       "MOV     R0, #0x14"                        
 294                       "BL      iosInit" 
 295                   ); 
 296                 */   
_iosInit(0x14, 0x32, "/null"); 
replaceConsoleDriver(); 
 300                 /*  asm volatile 
 301                   ( 
 302                       "BL      sub_FF811878" 
 303                   ); 
 304                 */ 
 305                 } 
 306 #endif