Hooray!!! Rockchip SDK!

[AleMaxx]

ROM:600815A0                 BL      delay_nops
ROM:600815A4                 LDR     R1, =0x119
ROM:600815A8                 SUB     R0, R1, #0x17
ROM:600815AC                 BL      Mcupanel_RegSet
ROM:600815B0                 MOV     R0, #0xA
ROM:600815B4                 BL      delay_nops
ROM:600815B8                 MOV     R1, #0x3000
ROM:600815BC                 LDR     R0, =0x103
ROM:600815C0                 BL      Mcupanel_RegSet
ROM:600815C4                 MOV     R0, #0x32
ROM:600815C8                 BL      delay_nops
ROM:600815CC                 MOV     R1, #0x8F
ROM:600815D0                 LDR     R0, =0x282
ROM:600815D4                 BL      Mcupanel_RegSet
ROM:600815D8                 MOV     R0, #0xA
ROM:600815DC                 BL      delay_nops
ROM:600815E0                 MOV     R1, #0x15
ROM:600815E4                 ADD     R0, R1, #0x26C
ROM:600815E8                 BL      Mcupanel_RegSet
ROM:600815EC                 LDR     R1, =0x1BE
ROM:600815F0                 SUB     R0, R1, #0xBC
ROM:600815F4                 BL      Mcupanel_RegSet
ROM:600815F8                 MOV     R0, #0xA
ROM:600815FC                 BL      delay_nops
ROM:60081600                 MOV     R1, #0
ROM:60081604                 MOV     R0, #0x210
ROM:60081608                 BL      Mcupanel_RegSet
ROM:6008160C                 MOV     R1, #0xEF
ROM:60081610                 LDR     R0, =0x211
ROM:60081614                 BL      Mcupanel_RegSet
ROM:60081618                 MOV     R1, #0
ROM:6008161C                 LDR     R0, =0x212
ROM:60081620                 BL      Mcupanel_RegSet
ROM:60081624                 LDR     R1, =0x18F
ROM:60081628                 ADD     R0, R1, #0x84
ROM:6008162C                 BL      Mcupanel_RegSet
ROM:60081630                 MOV     R1, #0xEF
ROM:60081634                 MOV     R0, #0x200
ROM:60081638                 BL      Mcupanel_RegSet
ROM:6008163C                 LDR     R1, =0x18F
ROM:60081640                 ADD     R0, R1, #0x72
ROM:60081644                 BL      Mcupanel_RegSet
ROM:60081648                 MOV     R1, #0x21
ROM:6008164C                 MOV     R0, #7
ROM:60081650                 BL      Mcupanel_RegSet
ROM:60081654                 MOV     R0, #0x28
ROM:60081658                 BL      delay_nops
ROM:6008165C                 MOV     R1, #0x61
ROM:60081660                 MOV     R0, #7
ROM:60081664                 BL      Mcupanel_RegSet
ROM:60081668                 MOV     R0, #0x64
ROM:6008166C                 BL      delay_nops
ROM:60081670                 LDR     R1, =0x173
ROM:60081674                 MOV     R0, #7
ROM:60081678                 BL      Mcupanel_RegSet
ROM:6008167C                 MOV     R0, #0x12C
ROM:60081680                 BL      delay_nops
ROM:60081684                 LDR     R0, =0x202
ROM:60081688                 BL      Mcupanel_Command
ROM:6008168C                 MOV     R5, #0
ROM:60081690
ROM:60081690 loc_60081690                            ; CODE XREF: Mcupanel_PowerOnInit+3A0
ROM:60081690                 MOV     R4, #0
ROM:60081694
ROM:60081694 loc_60081694                            ; CODE XREF: Mcupanel_PowerOnInit+394
ROM:60081694                 MOV     R0, #0xFF0
ROM:60081698                 BL      Mcupanel_Data
ROM:6008169C                 ADD     R4, R4, #1
ROM:600816A0                 CMP     R4, #400
ROM:600816A4                 BLT     loc_60081694
ROM:600816A8                 ADD     R5, R5, #1
ROM:600816AC                 CMP     R5, #240
ROM:600816B0                 BLT     loc_60081690
ROM:600816B4                 LDMFD   SP!, {R3-R5,PC}
ROM:600816B4 ; End of function Mcupanel_PowerOnInit

You can add your own lcd init function. Use hw_fd5420.c -> Fd5420_PowerOnInit as a reference and take the above disassembly to fill in the correct values. Here is an example:

ROM:60081314                 MOV     R1, #1
ROM:60081318                 MOV     R0, #0x600
ROM:6008131C                 BL      Mcupanel_RegSet
ROM:60081320                 MOV     R0, #0xA
ROM:60081324                 BL      delay_nops

translates to:

Mcupanel_RegSet(0x600, 1);
delay_nops(10);  // (10 dec = 0xA hex)

Good luck!

[ChipRocker]

Hi!

I'm a new user of Rockchip players.
My one is Rizone hacked "32GB" (actually 4GB), and the chip is RK2705 (almost equal to RK2706).
It has 400x240 touchscreen, microsd slot and 4 buttons (+reset).
I've put my firmware here: http://www.mediafire.com/chiprocker

What I've found by now:
1) The player supports SDHC class6 cards (mine is 8GB).
2) It's easy to compile the firmware using RK27SDK, but it doesn't work on player.
Haven't tested the emulator yet.
3) It's easy to use SDK to compile RKW file from original firmware folders you've dumped from your player.
This way the process of recovery with RK27DM becomes very easy.
4) Inside the player I've found a 24MHz quartz; however, there's a 12MHz value in SDK files. Maybe, it should be changed.

I'm rather experienced C/C++ coder and I'm interested in good firmware for the player too. Maybe I'll try porting roxkbox when we collect some more info.

Alemaxx, how do you work with firmwares in IDA?

[knob]

hi ChipRocker. Welcome. The more members who can help out the better, we are in need of anyone with c/c++ experience.
We have a lot of information already we just need to get enough members with the right experience interested.

It's easy to use SDK to compile RKW file from original firmware folders you've dumped from your player.

not tried that, how did you do it? I could do with a RKW recovery firmware.

You can add your own lcd init function. Use hw_fd5420.c -> Fd5420_PowerOnInit as a reference and take the above disassembly to fill in the correct values.

Thank you very much AleMaxx I'll try it out, I think it ought to work.

[AleMaxx]

Hi ChipRocker,
yes, I use IDA and sometimes arm-elf-objdump. If you have IDA, load the BASE.RKW as embedded rom-image, choose ARM architecture and load address (ROM) 0x5FFFFFD4. When its loaded go to location 0x60000000 and press 'c'. This should give you a branch (/jump) to some code thats installs the ARM exception handlers. Following the reset vector directs you to the firmwares main(). By comparing the disassembly with the source from the SDK (rename those sub_XXX by pressing 'n') its quite easy to make sense out of it. For a more detailed description have a look at this: RKW Firmware Patching (dont use that patching program on the page).
Btw, Im also working on getting a real firmware running on the rk27 platform to get rid of this ultra crappy RockOS. So far I was aiming at ucLinux. I didnt get the UART working, so development is going really slow. A major step would be to get some virtual UART via USB (using CDC and ACM). I already found code for a virtual usb uart implementation for another platform but this doesnt seem to become easy at all (at least for me).

Regards

[AleMaxx]

Here is what I got for the init code
(warning: may contain wrong values, this is an error-prone preocedure):

void KnobsLCD_PowerOnInit(void)
{
    Mcupanel_RegSet(0x600, 1);
    delay_nops(10);
    Mcupanel_RegSet(0x600, 0);
    delay_nops(10);
    Mcupanel_RegSet(0x606, 0);
    Mcupanel_RegSet(0x001, 0);
    Mcupanel_RegSet(0x003, 0x10B8);
    Mcupanel_RegSet(0x002, 0x100);
    Mcupanel_RegSet(0x006, 0);
    Mcupanel_RegSet(0x008, 0x808);
    Mcupanel_RegSet(0x009, 1);
    Mcupanel_RegSet(0x00B, 0x10);
    Mcupanel_RegSet(0x00C, 0);
    Mcupanel_RegSet(0x00F, 0);
    Mcupanel_RegSet(0x400, 0x3100);
    McuPanel_RegSet(0x401, 1);       // ORR     R0, R1, R1,LSL#10
    McuPanel_RegSet(0x404, 0);
    McuPanel_RegSet(0x500, 0);
    McuPanel_RegSet(0x501, 0);
    McuPanel_RegSet(0x502, 0x18F);
    McuPanel_RegSet(0x503, 0);
    McuPanel_RegSet(0x504, 0);
    McuPanel_RegSet(0x505, 0);
    McuPanel_RegSet(0x010, 0x11);
    delay_nops(10);
    McuPanel_RegSet(0x011, 0x202);
    McuPanel_RegSet(0x012, 0x300);
    delay_nops(10);
    McuPanel_RegSet(0x020, 0x21E);
    McuPanel_RegSet(0x021, 0x202);
    McuPanel_RegSet(0x022, 0x100);
    McuPanel_RegSet(0x090, 0);
    McuPanel_RegSet(0x092, 0);
    McuPanel_RegSet(0x300, 0x101);
    McuPanel_RegSet(0x301, 0);
    McuPanel_RegSet(0x302, 0x16);
    McuPanel_RegSet(0x303, 0x2913);
    McuPanel_RegSet(0x304, 0x260B);
    McuPanel_RegSet(0x305, 0x101);
    McuPanel_RegSet(0x306, 0x1204);
    McuPanel_RegSet(0x307, 0x415);
    McuPanel_RegSet(0x308, 0x205);
    McuPanel_RegSet(0x309, 0x303);
    McuPanel_RegSet(0x30A, 0xE05);
    McuPanel_RegSet(0x30B, 0xD01);
    McuPanel_RegSet(0x30C, 0x10D);
    McuPanel_RegSet(0x30D, 0x50E);
    McuPanel_RegSet(0x30E, 0x303);
    McuPanel_RegSet(0x30F, 0x502);
    McuPanel_RegSet(0x007, 1);
    McuPanel_RegSet(0x110, 1);
    McuPanel_RegSet(0x112, 0x60);
    delay_nops(50);
    McuPanel_RegSet(0x100, 0x16B0);
    delay_nops(10);
    McuPanel_RegSet(0x101, 0x147);
    delay_nops(10);
    McuPanel_RegSet(0x102, 0x119);
    delay_nops(10);
    McuPanel_RegSet(0x103, 0x3000);
    delay_nops(50);
    McuPanel_RegSet(0x282, 0x8F);
    delay_nops(10);
    McuPanel_RegSet(0x281, 0x15);
    McuPanel_RegSet(0x102, 0x1BE);
    delay_nops(10);
    McuPanel_RegSet(0x210, 0);
    McuPanel_RegSet(0x211, 0xEF);		// 239 (= 240 - 1)
    McuPanel_RegSet(0x212, 0);
    McuPanel_RegSet(0x213, 0x18F);		// 399 (= 400 - 1)
    McuPanel_RegSet(0x200, 0xEF);
    McuPanel_RegSet(0x201, 0x18F);
    McuPanel_RegSet(0x007, 0x21);
    delay_nops(40);
    McuPanel_RegSet(0x007, 0x61);
    delay_nops(100);
    McuPanel_RegSet(0x007, 0x173);
    delay_nops(300);
    McuPanel_Command(0x202);		// write to GRAM

    for (j = 0;j < 240;j++)
    for (i = 0;i < 320;i++) Mcupanel_Data(0x000000);	// pure black
}

// not sure if this is really a "ScanDirSet" - its a subroutine taking two arguments
void KnobsLCD_ScanDirSet(UINT16 XSize, UINT16 YSize)
{
    Mcupanel_RegSet(0x201, XSize);
    Mcupanel_RegSet(0x200, YSize);
    Mcupanel_Command(0x202);
}

// possibly data is of type struct { uint16_t x; uint16_t y, uint16_t w, uint16_t h; };
void KnobsLCD_Unknown(uint16_t *data)
{
    Mcupanel_RegSet(0x210, (short)data[1]);
    Mcupanel_RegSet(data[1] + data[3], data[1] - 1);
    Mcupanel_RegSet(0x212, data[0]);
    Mcupanel_RegSet(0x213, data[0] + data[2] - 1)
    KnobsLCD_ScanDirSet(data[0], data[1]);
}

in hw_define.h change

-#define     LCDPANEL        MCUIF_ILI9320_16B
+#define     LCDPANEL        MCUIF_KNOBSLCD_18B
#define      LCDTYPE         MCU18_PANEL  // make sure this is defined

in hw_mcupanel.c add these lines

void Mcupanel_PowerOnInit(void)
{
#if(LCDPANEL == MCUIF_KNOBSLCD_18B)
    KnobsLCD_PowerOnInit();
#endif
...

and some more things to change...

[ChipRocker]

AleMaxx, thanks a lot!

Looking at your disassembly I've found similiar code in my own firmware.
And...... the code is from hw_Ili9320.c!
Hmm... that means my code is already used when building firmware...

[AleMaxx]

Hi ChipRocker,
so the firmware you build ends up as an .RKW file and if you copy it to the System folder it does not get executed? What exactly does happen? In my first attempts to write my own code I modified a firmware internal filename ("HOLDON.BIN") to get some feedback. The firmware will write to/create this file when the player is turned off. You could compare the disassembly of your built against the original firmware maybe using

arm-elf-objdump -D -m arm -b binary BASE.RKW | cat > BASE.asm
arm-elf-objdump -D -m arm -b binary NEW_BASE.RKW | cat > NEW_BASE.asm
diff BASE.asm NEW_BASE.asm

Another issue maybe that the crc32 codes (for header and/or code) of your new BASE.RKW are incorrect this would prevent the loader from executing it but I think it will load the backup version from "SYSTEM00" folder instead. Compatible crc32 generation code can be found in that rkwpatch.c thats available from the link I did mention earlier.

Wait, did you check whether you have an 16bit or 18bit interfaced lcd? Locate that transform function thats called from within mcu_writereg and then its a matter of 0xFC00 or 0x3F00 iirc.

Regards

[ChipRocker]

When I use the base.rkw built with sdk, and try turning the player on, it just gives a single flash of backlight and does nothing more.
Reset gives the same reaction. However, when plugging USB in, the screen shows a few lines of crap, and the player gives access to all disks.
Looks like a problem is not in screen init, but it's more fundamental.

Yes, I'm comparing the firmwares using IDA. Looks similiar, but there are differences. Continue digging...

No, I don't think the problem is in CRC; if you try running 'version.exe -F:base.rkw' it says, that CRC32 is ok.

Both firmwares have 0xFC00.

[AleMaxx]

Okay, I dont have anymore ideas but to actually confirm that the initialization is okay you could try changing the fill color in the last part of the init to something else then black possibly adding a "delay_nops" after or inside the loop. Btw, there is some more code in the lcd init procedure that gets executed afterwards and prevents access to the screen via mcu_xxx routines. If you out comment these lines:

/*
	clr_regbits32(BUFF_CTRL, b_MCU_BYPASS);
	write_reg32(LINE0_YADDR, 0x7fe | b_ALPHA_EN);
	write_reg32(LINE1_YADDR, (XSize - 2) | b_ALPHA_EN);
	write_reg32(LINE0_UVADDR, 0x7ff);
	write_reg32(LINE1_UVADDR, (XSize - 1));
	write_reg32(LINE2_YADDR, (2*XSize - 2) | b_ALPHA_EN);
	write_reg32(LINE3_YADDR, (3*XSize - 2) | b_ALPHA_EN);
	write_reg32(LINE2_UVADDR, (2*XSize - 1));
	write_reg32(LINE3_UVADDR, (3*XSize - 1));
	write_reg32(DELTA_X, 0x200);
	write_reg32(DELTA_Y, 0x200);
	write_reg32(ALPHA_ALX, XSize - 16);
	write_reg32(ALPHA_ATY, 0x0);
	write_reg32(ALPHA_ARX, XSize - 1);
	write_reg32(ALPHA_ABY, YSize);
//	write_reg32(INTR_MASK, b_INTR_PERLINE | b_VERT_INTR);
*/
	// Lcdctrl_Display(ON);
	clr_regbits32(LCDC_CTRL, b_LCDC_STOP);
//	set_regbits32(BUFF_CTRL, b_RS_HIGH | b_BUFF_WRITE | b_BUFF_START);
	// Screen_Configure->Intr_Disable(INTC_LCDC);

(I slightly renamed the function names) mcu_xxx comands will still allow you to access the screen (maybe useful if you want to output messages to the lcd). I have some font code that works this way, I could upload it if you think it may be useful.

[ChipRocker]

Oh, I've mistaken a bit.
The code was just _like_ in hw_Ili9320.c, but actually not the same.
I've spent about an hour rewriting this file using the disassembly of original firmware, and now what.... I have the screen working!!!

The player still doesn't start with play button - just flashes backlight (any ideas?).
BUT when I plug in usb, it gives access to disks, and shows random pictures (the order is wrong) from resources on red background!!
That means that the screen init function works OK!!