pulling apart the hvx firmware

hvx200 rev status

hvx200 rev status

The status is that I've pulled apart the hardware just to document and take photos for future reference as I go through the code. I've gone through most of the software at a cussory level and I've found

How to inject or run code
I should be able to do something similar to CHDK and just piggy back onto the routines used for updates from an SD card. Like CHDK we will fool the camera into thinking there is an update when what we are really doing is just running our scripts/patches, no update. vup.sh is the script that handles this and is run from the image on the SD card. It will not be dificult to make my own image (tar and gzip would be enough).

Modifying LCD or sending messages
There are command line interfaces for sending messages and I think I have the driver that handles the frame buffer so flipping images or modifying shouldn't be a problem.

Code: 
/usr/local/bin/
    vup-start.sh
    BMP_PATH=/usr/lib/p16
    BMP_START=update_title.p16
    BMP_END=update_end_title.p16
    BMP_ERROR=update_error_title.p16
The OSD bitmaps are sent to the /dev/fd0 using `vupfb`

Code: 
    vupfb
    vupfb f [p16 bitmap imagefilename] : Display bitmapfile.
    vupfb p [progress value(%)]        : Update progress bar.
    vupfb m [message]                  : Update message string.
    vupfb bp [value1(%)] [value2(%)] [time1(us)] [time2(us)] [count] 
                                       : Brink progress bar.
    vupfb bm [message1] [message2] [time1(us)] [time2(us)] [count] 
                                       : Brink message string.
    vupfb i [PAL/NTSC] : Initialize VGA
P2
I have possible targets that handle the P2 card but im still working through it and could use someone to help pick the targets that will bring the best results before i start digging into the dissassembly.

Code: 
    ./pcmcia/spd_mod.o
    <3>[spd]4:%s:%d:<spd%c>R5C812 on Unkown
    <3>[spd]4:%s:%d:<spd%c>R5C812 on WRITE
    <3>[spd]4:%s:%d:<spd%c>R5C812 on READ
    <1>[spd]2:%s:%d:<spdu%d>ALERT:P2card firmware size 61h only but size=%02xh
Code: 
    pcmcia-config/spd
    #!/bin/sh
    #echo "P2 CARD ha syudou de maunto sitekudasai :-)"
Can someone translate the above? Google doesn't know. This module is one driver that is at the top of my list to look at. The other is:

Code: 
    /kernel/drivers/ieee1394.master/sbp2master.o
    description=IEEE-1394 SBP-2 protocol driver
    parm_desc_sbp2_max_speed=Force max speed (3 = 800mb, 2 = 400mb default, 1 = 200mb, 0 = 100mb)
    parm_desc_sbp2_serialize_io=Serialize all I/O coming down from the scsi drivers (default = 1)
    parm_desc_sbp2_exclusive_login=Exclusive login to sbp2 device (default = 1)
    parm_sbp2_force_inquiry_hack=i
    parm_desc_sbp2_force_inquiry_hack=Force SCSI inquiry hack (default = 0)
    author=Ben Collins <bcollins@debian.org>
    /home/makoto/workdir/myapplication/p2pf_K230/src/contrib/K230_Kernel/include/asm/pci.h
    SCSI emulation for IEEE-1394 SBP-2 Devices

Code: 
    pcmcia-config/spd.conf
    #
    # Configulation file for nsp_cs.o
    #
    device "spd"
      class "spd" module "cb_enabler", "spd"
    # OEM
    card "Panasonic P2 Card"
      pci 0x10f7, 0xf8206
      bind "spd"
    # end
what is nsp_cs.o (above)? I didnt see this driver anywhere. Is it in the kernel, included from home for something like PC mode or is the panasonic P2 spd package based on it?

The P2 cards are each mounted to:
/mnt/spda
/mnt/spdd

This is how they are mounted:
Code: 
    mntp2
    ### Manual mount script for P2card (multi cards)
    ###  
    ###  050527 : add K230(2slot) devfn check by env value HOSTNAME.
                        if [ `mount -t msdos /dev/spd${letter}1 /mnt/spd${letter} -o spd,noatime 2>&1 | wc -l` -ge 1 ];
                        then
                                echo "### Please format % /sbin/mkspdfs /dev/spd${letter}"
                                exit 1
                        fi
Offloading P2 data
I still am trying to determine what will need to be changed to either add usb-storage support for a USB disk or a firewire storage support for firewire disk. For this i need to go through the "NetChip 2280 USB Peripheral Controller" driver which is included, and just understand it. There is this which clearly shows that some support exists, for the RocketStor:

Code: 
    /kernel/drivers/scsi/scsi_mod.o
    MATshi*A
    RocketStor 500S
    RocketStor 2000
Perhaps I should go through the RocketStor firmware to find out how they are mounted. I havent found the mount methods in the HVX200 firmware yet.

Debug console
Code: 
pcmcia-config/config.opts
    # First built-in serial port
    exclude irq 4
    # Second built-in serial port
    #exclude irq 3

    # Options for Raylink/WebGear driver: uncomment only one line...
    # Generic ad-hoc network
I cant find it in my notes but both here and in other locations I found a couple drivers that indicate some sort of PCMCIA slot based network or serial connection which is probably how debugging is handled. I still really need to explore this more and it is high on my priority list because while I can already debug by running my own scripts from the SD card and printing information to the LCD an interactive console is going to speed things up 100 fold.



Other
Code: 
/usr/bin/perl
oh yay! :P

Control LED's:
Code: 
    vupled <ON time(usec)> <OFF time(usec)> <Blinking count>
Code: 
    getshinfo
will dump a bunch of data to the SD card about the SH bootloader:

Code: 
    getlog, dumpFlashRom, dumpMbus, dumpSram
are all scripts which just print out info


Unknown:
Code: 
/sbin/
    cytune
    Usage: %s [-q [-i interval]] ([-s value]|[-S value]) ([-t value]|[-T value]) [-g|-G] file [file...]
    Can't issue CYGETMON on %s: %s
Code: 
    elvtune
    util-linux-2.11h
    usage:
    elvtune [-r r_lat] [-w w_lat] [-b b_lat] /dev/blkdev1 [/dev/blkdev2...]
    elvtune -h
    elvtune -v
    %s elevator ID
Code: 
    tunelp
    , on-line
    , out of paper
    , ready
    , busy
    Usage: %s <device> [ -i <IRQ> | -t <TIME> | -c <CHARS> | -w <WAIT> | 
          -a [on|off] | -o [on|off] | -C [on|off] | -q [on|off] | -s | 
          -T [on|off] ]
    2.11h
Really, a printer?
 
Last edited:
I second the REC location. Moving the focus assist zoom window to left or right would be very helpful on the 16:9 front.


Jason
 
I'm a big fan of printer support ;) Instead of P2 cards we could just bring a few cases of paper.
Here's another low-hanging fruit. Integrate support for the framerate hack so we don't have to load it from SD when we want it. That should be super-simple, right?
 
ProfessorU said:
I'm a big fan of printer support ;) Instead of P2 cards we could just bring a few cases of paper.
Here's another low-hanging fruit. Integrate support for the framerate hack so we don't have to load it from SD when we want it. That should be super-simple, right?
Click to expand...

Variable frame rates by turning the scene file knob would be cool!
 
It would also be sweet to go from 1080 to 720 60p over 24p from just turning the scene file knob that's on the back of the cam. Good for quick run n' gun shoots!
 
I cant find it in my notes but both here and in other locations I found a couple drivers that indicate some sort of PCMCIA slot based network or serial connection which is probably how debugging is handled. I still really need to explore this more and it is high on my priority list because while I can already debug by running my own scripts from the SD card and printing information to the LCD an interactive console is going to speed things up 100 fold.
Click to expand...

Yes, behind the battery of the HVX there is a serial cable that connects to a PCB assembly then to a MS-DOS based computer to tweak and calibrate parameters via serial, such as display/color/tape.
 
DJDecay said:
Yes, behind the battery of the HVX there is a serial cable that connects to a PCB assembly then to a MS-DOS based computer to tweak and calibrate parameters via serial, such as display/color/tape.
Click to expand...

Is this one of the two connectors pictured here:
attachment.php

If so do you know which of those two it is? Btw, there are pictures of the actual PCB boards that relate to these two ports here.

Do you have any more details about the serial interface or the MSdos software?

thanks
 
Cyphunk:

A few other requests. Not sure if they are possible but take a stab at them...

1. It drives me crazy that SD output via composite is automatically switched off when the component cable is plugged in. Not sure if this is a hardware/processing limitation or if both outputs could be active at the same time?

2. The LCD used on the 200 seems to be physically the same as the one used on the 170. But the 170 looks better and is more usable because of the additional amount of peaking on the 170. Is there a way to increase the peaking on the 200 to the LCD via a hack? That would make the 200 easier to focus.

3. The image magnify times out as you know. If you could hack a way to make it an "on-off" switch like they did on the 170, I am sure that 200 users would dig that.

Very cool that you are trying this. As you know, Magic Lantern on the 5D MKII has become a huge hit so it would be very cool if you could do the same for the 200.

Dan
 
Please, Please, Please keep working on this. You have a huge market to sell it for $49 or whatever price. Something like 70,000+ hvx's have been sold worldwide.

You'd get my money.
 
You must log in or register to reply here.
Back
Top