Wakeup for Master and Slave firmwares[]
Master[]
ROM:FF811CC4 MOV R3, #0 ROM:FF811CC8 STR R3, [SP,#0x40+var_40] ROM:FF811CCC LDR R3, =DefaultRPCHandler ROM:FF811CD0 MOV R2, #0x50 ROM:FF811CD4 MOV R1, #0x51 ROM:FF811CD8 MOV R0, #0x12 ROM:FF811CDC BL InitializeIPCMasterTask ROM:FF811CE0 LDR R0, =0xC0220044 ROM:FF811CE4 MOV R10, R0 ROM:FF811CE8 BL AJ_deref_R0_n_check_bit_0 ROM:FF811CEC CMP R0, #0 ROM:FF811CF0 BNE loc_FF811F88 ROM:FF811CF4 ADR R2, aWaitSlaveWakeu ; "Wait Slave Wakeup" ROM:FF811CF8 MOV R1, #0x16 ROM:FF811CFC MOV R0, #0x8B ROM:FF811D00 BL DebugMsg ROM:FF811D04 LDR R9, =0x7A120 ROM:FF811D08 B loc_FF811F68 ROM:FF811F88 MOV R2, #1 ROM:FF811F8C MOV R1, #0x11 ROM:FF811F90 MOV R0, #0xA3 ROM:FF811F94 BL EM_Initialize
Slave[]
ROM:FF0126C8 MOV R2, #0 ROM:FF0126CC MOV R1, #0x11 ROM:FF0126D0 MOV R0, #0xA3 ROM:FF0126D4 BL EM_Initialize ROM:FF0126D8 CMP R0, #0 ROM:FF0126DC MOVNE R3, R0 ROM:FF0126E0 MOVNE R0, #0x8B ROM:FF0126E4 ADRNE R2, aEm_initializeX ; "EM_Initialize (%#x)" ROM:FF0126E8 MOVNE R1, #6 ROM:FF0126EC BLNE DebugMsg ROM:FF0126F0 LDR R0, =0xC0220024 ROM:FF0126F4 MOV R6, R0 ROM:FF0126F8 BL AJ_deref_R0_n_check_bit_0 ROM:FF0126FC CMP R0, #0 ROM:FF012700 BNE loc_FF012750 ROM:FF012704 ADR R2, aWaitMasterWake ; "Wait Master Wakeup" ROM:FF012708 MOV R1, #0x16 ROM:FF01270C MOV R0, #0x8B ROM:FF012710 BL DebugMsg ROM:FF012714 LDR R5, =0x2710 ROM:FF012718 B loc_FF012740 ROM:FF01271C ; ---------------------------------------------------------------------------
RPC requests examples[]
R0 seems to be the command and r1, r2, r3, SP params
Master[]
ROM:FF811FC0 MOV R3, #0 ROM:FF811FC4 LDR R1, [SP,#0x40+var_24] ROM:FF811FC8 LDR R2, [SP,#0x40+var_28] ROM:FF811FCC LDR R0, =0x4802 ROM:FF811FD0 STR R3, [SP,#0x40+var_40] ROM:FF811FD4 BL RequestRPC
Slave[]
ask for firmware out version maybe:
ROM:FF012930 ADR R0, dword_FF012C1C ROM:FF012934 LDR R0, [R0] ROM:FF012938 MOV R3, #0 ROM:FF01293C STR R0, [SP,#0x48+var_24] ROM:FF012940 LDR R0, =0x2011 ROM:FF012944 MOV R2, #4 ROM:FF012948 ADD R1, SP, #0x48+var_24 ROM:FF01294C STR R3, [SP,#0x48+var_48] ROM:FF012950 BL RequestRPC
system Log[]
See [IPCT] inter process communication task: ipcsRequest from Slave and ipcmResponse from Master.
Master log[]
(call 'dumpfall' from slave)
0: 7.264 [STARTUP] K250M ICU Firmware Version 1.2.3 ( 5.1.3 )
1: 7.326 [STARTUP] ICU Release DateTime 2010.09.13 18:21:31
2: 7.582 [SEQ] CreateSequencer (Startup, Num = 5)
3: 7.850 [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
4: 8.859 [SEQ] seqEventDispatch (Startup, 0)
5: 8.881 [STARTUP] startupEntry
6: 35.886 [HPD] TOEDetectISR 0
7: 35.966 [HPD] CreateTask Master End
8: 36.471 [HPC] ReserveHPCopyChannel (1, 116)
9: 37.513 [EM] emSlaveChangeCBR : AUTO_POWEROFF (1)
10: 37.645 [EM] emSlaveChangeCBR : UILOCK (0x0)
11: 38.102 [IPCT] ipcStartBulk (MAddr = 0x406d3300, Size = 0xa94)
12: 38.566 [IPCT] ipcmQueueBulk
13: 38.717 [IPCT] ipcmQueueBulk
14: 38.913 [IPCT] ipcmQueueBulk
15: 39.015 [IPCT] ipcmResponse (SAddr = 0x406d44d0)
16: 39.079 [IPCT] ipcmResponse (0x6d44d0, 0x406d3300 -> 0x406d44d0, 0xa94)
17: 39.633 [STARTUP] LockStatus: 1(4)
18: 39.824 [IPCT] ipcmBltDone (Cur = 0xa94, Size = 0xa94)
19: 40.488 [IPCT] ipcStartBulk (MAddr = 0x406d4500, Size = 0xf6a0)
20: 41.310 [IPCT] ipcmResponse (SAddr = 0x406d519c)
21: 41.375 [IPCT] ipcmResponse (0x6d519c, 0x406d4500 -> 0x406d519c, 0xf6a0)
22: 46.378 [IPCT] ipcmBltDone (Cur = 0xf6a0, Size = 0xf6a0)
23: 46.970 [IPCT] ipcStartBulk (MAddr = 0x406e4700, Size = 0x8ddc)
24: 47.683 [IPCT] ipcmResponse (SAddr = 0x406e4a7c)
25: 47.753 [IPCT] ipcmResponse (0x6e4a7c, 0x406e4700 -> 0x406e4a7c, 0x8ddc)
26: 50.636 [IPCT] ipcmBltDone (Cur = 0x8ddc, Size = 0x8ddc)
27: 51.234 [IPCT] ipcStartBulk (MAddr = 0x406f4900, Size = 0x774)
28: 51.938 [IPCT] ipcmResponse (SAddr = 0x406ed9e4)
29: 52.001 [IPCT] ipcmResponse (0x6ed9e4, 0x406f4900 -> 0x406ed9e4, 0x774)
30: 52.302 [IPCT] ipcmBltDone (Cur = 0x774, Size = 0x774)
31: 63.456 [PROPST] dwNewAeModeDial = 0
32: 64.529 [SEQ] NotifyComplete (Cur = 1, 0x60000002, Flag = 0x2)
33: 65.207 [PROPST] dwNewAeModeDial = 0
34: 66.549 [PRP] Complete WaitID = 0x80000001, 0x00000000(0)
35: 66.655 [PRP] SpecialComplete ID = 0x80000001, 0x80000001 1033
36: 67.779 [PRP] MovieParamData
37: 67.874 [PRP] mode 0 size 0x0 , framerate 0x19 , type 0xc
38: 91.589 [STARTUP] StartupCompleteFromPartner
39: 91.694 [SEQ] NotifyComplete (Cur = 1, 0x60000000, Flag = 0x40000000)
40: 97.633 [STARTUP] startupPropAdminMain : End
41: 97.691 [SEQ] NotifyComplete (Cur = 1, 0x20000000, Flag = 0x20000000)
42: 97.853 [EM] emRegisterMulticastCallback : EventID = 13, ClassID = 163
43: 97.932 [SEQ] seqEventDispatch (Startup, 1)
44: 98.261 [STARTUP] LockStatus: 1(4)
45: 98.313 [STARTUP] startupPrepareProperty
46: 99.284 [IPCT] ipcStartBulk : Alloc (MAddr = 0x406fd9dc, Size = 0x1c)
47: 99.788 [IPCT] ipcmResponse (0x80f0fc, 0x406fd9dc <- 0x4080f0fc, 0x1c)
48: 99.940 [IPCT] ipcmBltDone (Cur = 0x1c, Size = 0x1c)
49: 103.008 [IPCT] ipcStartBulk (MAddr = 0x406ff248, Size = 0x10c4)
50: 103.505 [IPCT] ipcmResponse (SAddr = 0x4080f0c4)
51: 103.563 [IPCT] ipcmResponse (0x80f0c4, 0x406ff248 -> 0x4080f0c4, 0x10c4)
52: 103.931 [STARTUP] StartupCompleteFromPartner
53: 103.998 [SEQ] NotifyComplete (Cur = 2, 0x40000000, Flag = 0x40000000)
54: 104.116 [IPCT] ipcmBltDone (Cur = 0x10c4, Size = 0x10c4)
55: 105.009 [SEQ] seqEventDispatch (Startup, 2)
56: 105.036 [STARTUP] startupPrepareCapture
57: 105.437 [RSC] hMemoryQueue (0x6A0010) hStorageQueue (0x6C0012)
58: 110.104 [RSC] AllocateMemoryUnit For ExMem1
59: 110.124 [RSC] AllocateMemoryUnit For ExMem1
60: 110.138 [RSC] AllocateMemoryUnit For ExMem1_2
61: 110.732 [RSC] MemMgr 0 2
Slave log[]
0: 11.150 [STARTUP] K250S ICU Firmware Version 1.2.3 ( 5.1.3 )
1: 11.207 [STARTUP] ICU Release DateTime 2010.09.13 18:21:31
2: 11.475 [SEQ] CreateSequencer (Startup, Num = 6)
3: 11.724 [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
4: 13.259 [SEQ] seqEventDispatch (Startup, 0)
5: 13.281 [STARTUP] startupEntry
6: 27.200 [SEQ] NotifyComplete (Cur = 1, 0x60000002, Flag = 0x2)
7: 28.255 [HPD] CreateTask Master End
8: 29.025 [STARTUP] Master Wakeup
9: 29.166 [HPD] FUNC SW OFF
10: 29.193 [HPD] ERASE SW OFF
11: 38.585 [IPCT] ipcsRequest : Alloc (SAddr = 0x406d44d0, Size = 0xa94)
12: 39.353 [STARTUP] LockStatus0: 1
13: 40.463 [IPCT] ipcsComplete (0x406d3300 -> 0x406d44d0, 0xa94)
14: 40.637 [STARTUP] startupCreateRingHandle
15: 40.852 [IPCT] ipcsRequest : Alloc (SAddr = 0x406d519c, Size = 0xf6a0)
16: 47.051 [IPCT] ipcsComplete (0x406d4500 -> 0x406d519c, 0xf6a0)
17: 47.220 [STARTUP] startupCreateRasenHandle
18: 47.387 [IPCT] ipcsRequest : Alloc (SAddr = 0x406e4a60, Size = 0x8ddc)
19: 51.583 [IPCT] ipcsComplete (0x406e4700 -> 0x406e4a60, 0x8ddc)
20: 51.647 [STARTUP] startupCreateLensHandle
21: 52.014 [IPCT] ipcsRequest : Alloc (SAddr = 0x406ed9c8, Size = 0x774)
22: 54.331 [IPCT] ipcsComplete (0x406f4900 -> 0x406ed9c8, 0x774)
23: 54.443 [SEQ] NotifyComplete (Cur = 1, 0x60000000, Flag = 0x40000000)
24: 54.467 [STARTUP] startupCreateCustomHandle
25: 91.249 [STARTUP] startupPropAdminMain : End
26: 91.309 [SEQ] NotifyComplete (Cur = 1, 0x20000000, Flag = 0x20000000)
27: 91.382 [SEQ] seqEventDispatch (Startup, 1)
28: 91.406 [STARTUP] startupPrepareProperty
29: 91.826 [FM] FM_Initialize (1, 0, 1)
30: 92.192 [FM] fmResultCBR (0x6ee770)
31: 92.742 [FM] PROP_HDD_DCIM_PATH (/)
32: 92.875 [FC] FC_Initialize [drive:3][ClassID:39]
33: 93.023 [FM] PROP_CARD1_FOLDER_NUMBER = 100
34: 93.130 [FM] PROP_CARD1_FILE_NUMBER = 80
35: 93.229 [FM] PROP_CARD2_FOLDER_NUMBER = 100
36: 93.299 [FM] PROP_CARD2_FILE_NUMBER = 0
37: 93.383 [FM] PROP_CARD3_FOLDER_NUMBER = 100
38: 93.442 [FM] PROP_CARD3_FILE_NUMBER = 0
39: 93.527 [FM] PROP_FILE_NUMBERING_MODE = 1, 0
40: 93.577 [FM] PROP_USBDEVICE_CONNECT = -1
41: 93.627 [FM] PROP_NUMBER_OF_CONTINUOUS_MODE = 80
42: 93.679 [SEQ] NotifyComplete (Cur = 2, 0x40000010, Flag = 0x10)
43: 98.345 [STARTUP] LockStatus0: 1
44: 99.046 [IPCT] ipcsPostBulk
45: 99.779 [IPCT] ipcsRequest (SAddr = 0x4080f0e0)
46: 100.615 [IPCT] ipcsComplete (0x406fdb08 -> 0x4080f0e0, 0x1c)
47: 103.528 [IPCT] ipcsRequest : Alloc (SAddr = 0x4080f0a8, Size = 0x10c4)
48: 103.657 [STARTUP] StartupCompleteFromPartner
49: 103.716 [SEQ] NotifyComplete (Cur = 2, 0x40000000, Flag = 0x40000000)
50: 103.855 [SEQ] seqEventDispatch (Startup, 2)
51: 103.875 [STARTUP] startupPrepareCapture
52: 104.486 [RSC] hMemoryQueue (0x780014) hStorageQueue (0x7A0016)
53: 105.095 [IPCT] ipcsComplete (0x406ff26c -> 0x4080f0a8, 0x10c4)
54: 108.082 [STARTUP] startupChangeAckCBR (PROP_CARD_EXTENSION = 0)
55: 114.172 [STARTUP] startupChangeAckCBR (Ceres = 0, USB = -1)
56: 114.189 [STARTUP] Ceres Disappeared
57: 114.634 [STARTUP] LockStatus2: 1
58: 121.675 [RSC] AllocateMemoryUnit For ExMem1
59: 121.697 [RSC] AllocateMemoryUnit For ExMem1_2
compared to 60D[]
Sun Dec 19 18:31:21 2010
0: 11.698 [STARTUP]
K287 ICU Firmware Version 1.0.8 ( 3.3.1 )
1: 11.763 [STARTUP]
ICU Release DateTime 2010.11.08 08:40:51
2: 12.023 [SEQ] CreateSequencer (Startup, Num = 6)
3: 12.280 [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
4: 13.444 [PTPCOM] Magic Lantern 0.1-letstry1-60d_fw108 (dc1bd2d14e62+ (550d) tip)
5: 13.465 [PTPCOM] Built on 2010-12-19 17:17:28 by user@ubuntu1004desktop
6: 13.566 [SEQ] seqEventDispatch (Startup, 0)
7: 13.584 [STARTUP] startupEntry
8: 50.092 [PROPST] Initialize Adjective & Situation
9: 50.937 [HPD] # 1 0 1
10: 53.737 [PROPST] Clear Adjective & Situation (StartupCondition)
11: 54.208 [PROPST] dwNewAeModeDial = 2
12: 54.252 [PROPST] Active Adjective & Situation
13: 54.365 [PROPST] ReqChangeCBR : Adjective 0, 0
14: 54.390 [PROPST] Not ExecMultiConvert Already None : Adjective 0, 0
15: 54.460 [PROPST] Not ExecMultiConvert : Situation 0
16: 55.597 [HPD] CreateTask Master End
17: 56.945 [SEQ] NotifyComplete (Cur = 1, 0x20000002, Flag = 0x2)
18: 57.868 [PROPST] dwNewAeModeDial = 2
19: 58.428 [PRP] Deliv WaitID = 0x80000001, 0xFF1B9248(1)
20: 59.406 [PRP] Complete WaitID = 0x80000001, 0xFF1B9248(0)
21: 59.610 [PRP] SpecialComplete ID = 0x80000001, 0x80000001 1034
22: 60.687 [PRP] MovieParamData
23: 60.857 [PRP] mode 0 size 0x0 , framerate 0x18 , type 0xc zoom 0x0
24: 63.185 [EM] emSlaveChangeCBR : AUTO_POWEROFF (1)
25: 63.374 [EM] emSlaveChangeCBR : UILOCK (0x0)
26: 64.396 [HPD] ERASE SW OFF
27: 82.819 [PRP] Complete WaitID = 0x8000003F, 0x00000000(0)
28: 111.938 [STARTUP] startupPropAdminMain : End
29: 112.000 [SEQ] NotifyComplete (Cur = 1, 0x20000000, Flag = 0x20000000)
30: 112.091 [SEQ] seqEventDispatch (Startup, 1)
31: 112.116 [STARTUP] startupPrepareProperty
32: 112.478 [FM] FM_Initialize (0, 1, 0)
33: 112.846 [FM] fmResultCBR (0x80e2c8)
34: 113.402 [FM] PROP_HDD_DCIM_PATH (/)
35: 113.577 [FC] FC_Initialize [drive:3][ClassID:39]
36: 113.774 [FM] PROP_CARD1_STATUS = 0x1
37: 113.870 [FM] PROP_CARD1_FOLDER_NUMBER = 142
38: 113.954 [FM] PROP_CARD1_FILE_NUMBER = 0
39: 114.045 [FM] PROP_CARD2_STATUS = 0x0
40: 114.130 [FM] PROP_CARD2_FOLDER_NUMBER = 100
41: 114.194 [FM] PROP_CARD2_FILE_NUMBER = 685
42: 114.261 [FM] PROP_CARD3_EXIST = 0
43: 114.299 [FM] PROP_CARD3_STATUS = 0x1
44: 114.337 [FM] PROP_CARD3_RECORD = 0 => 1
45: 114.381 [FM] PROP_CARD3_FOLDER_NUMBER = 100
46: 114.434 [FM] PROP_CARD3_FILE_NUMBER = 0
47: 114.498 [FM] PROP_FILE_NUMBERING_MODE = 1, 0
48: 114.538 [FM] PROP_CARD_EXTENSION = 0
49: 114.577 [FM] PROP_CURRENT_MEDIA = 2
50: 114.615 [FM] PROP_USBDEVICE_CONNECT = -1
51: 114.659 [FM] PROP_NUMBER_OF_CONTINUOUS_MODE = 685
52: 114.691 [SEQ] NotifyComplete (Cur = 2, 0x10, Flag = 0x10)
53: 114.795 [FM] PROP_DSDEFINE ModelId 80000287
54: 114.851 [SEQ] seqEventDispatch (Startup, 2)
55: 114.869 [STARTUP] startupPrepareCapture
56: 115.448 [RSC] hMemoryQueue (0x620010) hStorageQueue (0x640012)
57: 116.725 [RSC] AllocateMemoryUnit For ExMem1
58: 116.745 [RSC] AllocateMemoryUnit For ExMem1_2
Control registers[]
This is reverse engineered from FROM code, executed in slave digic:
"wait WakeUp Slave"
0xC022D000
+0xD0 <- 0x00238000
+0xF8 <- 0x00038C00 <- enable master digic reset line?
0xC0A00000 (IPC comm)
+0x24 <- 0x80000052 <- also called SSTAT register
0xC0220000 (GPIO)
+0x24 -> wait until bit 0 is set <- I/O on pull-up is high due to floating I/O
"WakeUp Master"
0xC022D000
+0xF8 <- 0x00138800 <- release master digic reset line?
0xC0220000 (GPIO)
+0x24 -> wait until bit 0 is cleared <- I/O is driven low by other digic (guess: master-side register 0xC0220040)
0xC022D000
+0xD0 <- 0x0E000000
+0xF8 <- 0x0E000000
notes[]
0xF8010000 - 0xF8F4FFFF TORNADO and Command area 0xF8010000 - 0xF8E2FFFF Program area
0xC0A00000 (IPC comm)
+0x08 some bitmask. interrupt reason?
--1----- IPC read interrupt (command is in SSTAT instead of CMD)
---1---- IPC recv command
----1--- INT TOUTErr
-----1-- INT WrBusErr
------1- INT RdBusErr
-------1 INT IDEVErr
+0x0C slave writes 0x1FF. confirmation?
+0x1C CMD
+0x24 SSTAT
CMD for slave:
0x80000000 0x80000035 0x80000036 0x80000037 0x88xxxxxx IPC Fir File Request (answers with 0xC8000000 to SSTAT) 0x89000010 0x89000018 0x89000020 0x89000022 0xC0000000 0xF800000x IPC File Request
Master:
RPC Command IDs passed to RegisterRPCHandler have this format: 0xTIII T = Type (1 = direct command, 2 = control command, 4 = bulk command) I = ID