Creative Zen Vision:M

[mcuelenaere]

Hmm, but what exactly is it that this does?
I mean, I've changed it a bit and my screen gets garbled.. And if I set Height and width to 480x640 (because of the portrait-mode) it fills the screen almost, but it still misses a piece on the right side if I hold in the ZVM way. (too bad I have to go, because now I don't have time to take pictures)

Never mind that one, as it seems you don't have that problem I've got.

I think your problem is the BASEPX and BASEPY values: these should get adjusted to the Zen Vision ones (they can be found by disassembling the original firmware; they appear in FRESC and in  Â©TL)

[mitch04]

hey mcuelenaere  can you please take a photo of your zen please?

[mcuelenaere]

Progress is hard as a lot of the internal Nucleus messaging and tasking functions are used instead of just direct calls to the hardware, so I'll first have to figure out where they are stored and what's done on that particular value etc..

My current theory is that all keys, key-backlighting, hold switch (and maybe ON/OFF switch) are controlled by the PIC which communicates with the CPU through DM320 built-in I2C.
Also the RTC is controlled through I2C. I haven't found anything about power management nor LCD backlighting, although I do know that LCD can be shut off through BITSET2/BITCLR2.

The LCD is driven directly by the DM320 built-in OSD support, so switching between LCD and TV-out shouldn't be that hard.

If anyone wants to join in figuring out the OF, all help is appreciated

@mitch04: there are some pictures at page 29

@Falafel: if you install CreativeWizard, the source is included in the installation directory (Program Files/CreativeWizard/Source)

[Falafel]

Unable to figure out how to find BASEPX and Y in the OF I just randomly picked a number..
And it happened to be right

But on a sidenote, I wouldn't mind helping you, but I'm not sure how and where to start.. Your using IDA to look for functions and memory addresses right?

[mcuelenaere]

Unable to figure out how to find BASEPX and Y in the OF I just randomly picked a number..
And it happened to be right

But on a sidenote, I wouldn't mind helping you, but I'm not sure how and where to start.. Your using IDA to look for functions and memory addresses right?

Right, so if you could get a hold on a version of IDA (I use v.5.2, so >5.0 should be good) that'll help a lot.
Then the most important files at the moment are FRESC and (C)TL; they both consist kind of the same (speaking of the internals) but FRESC is a smaller version of (C)TL (i.e. it doesn't have to initialize sound and DRM etc..).

Currently I'm working on FRESC; my IDA database of (C)TL is growing a bit too big (>300MB)

I could upload my current IDA databases, but it won't be easy to understand at first.

What you have to know:

• the format (FRESCUE structure) is made so data X can be loaded in memory address Y etc.
  Zook already made a IDA parser for this, so you don't have to worry about that
• there is a memory part (0x1C0000) named USER_DATA which contains again data to be loaded in memory; structure={int Size; int Address; char Data[Size];} (to be loaded in 0xB00000)
  Again, zook made a parser for this.
• The DM320 regs start at 0x30000; so it is important to know which functions refers to here (that's why it is included in the database).
  Again (), zook made an IDA importer for this
• Now the init goes like this: MMU is initialized, I- and D-Cache are enabled, USER_DATA mappings are performed and Nuclues values are initialized. Then there's a jump to the Nucleus kernel init.
• Here are all the Nucleus kernel internals initialized and there is a branch to Application_Initialize()
• (this is Creative custom code): SDRAM, PLL is init'ed; GIO default values are set and 2 threads are added: bootup() and infinite_loop()
  (infinite_loop() waits for an interrupt and then calls TCC_Relinquish)
• After Application_Initialize() threading is started
• bootup(): devices are initialized in register_devices(), a lot of to be figured out code and the loading of (C)TL

Some info about the devices:
* I presume 'iic' is a driver to the DM320 builtin I²C
* I think 'mcu' controls the PIC and trough this the buttons, button backlighting, hold switch etc
* I don't know what 'tvenc' is; either it is the TV Encoder or something else

A last sidenote: to really understand all of the IO_* regs, you'll have to sign a NDA to be able to view the DM320 documentation.

Oh and BTW, don't open FRESC directly; it is encrypted: zook's zen_crypt is able to decrypt it.

Download link

[Falafel]

Right, so if you could get a hold on a version of IDA (I use v.5.2, so >5.0 should be good) that'll help a lot.
.
.
.
.
A last sidenote: to really understand all of the IO_* regs, you'll have to sign a NDA to be able to view the DM320 documentation.

Oh and BTW, don't open FRESC directly; it is encrypted: zook's zen_crypt is able to decrypt it.

Download link

Hmm, I'm having trouble opening your fresc.idb so I thought "use the parser from zook" (zendlr.ldw?) but I do not know how to use it. What I thus mean is this: is it the right file and if so, how do I then use it?

[mcuelenaere]

Hmm, I'm having trouble opening your fresc.idb so I thought "use the parser from zook" (zendlr.ldw?) but I do not know how to use it. What I thus mean is this: is it the right file and if so, how do I then use it?

You do have IDA installed? If so, you can just open it with it (make sure FRESC.dec is in the same directory).

zenldr.ldw needs to be put in X:\Program Files\IDA\loaders\

[Falafel]

Ah now I can at least open fresc nicely
I'll take a look at it, see what I can figure out.

[mcuelenaere]

This is my current I²C implementation; the bootloader tries reading of all available I²C slaves but that won't give me any reliable information (the data changes, but not when I press some buttons)

[THROBiX]

How much work is necessary for being able to boot Rockbox on the Zen players, eventually without the correct LCD resolution and key mappings/working sound? Is a new bootloader enough to just boot the system? I'm just wondering, can't really wait to see how this will progress.   Go Rockbox!

[mcuelenaere]

How much work is necessary for being able to boot Rockbox on the Zen players, eventually without the correct LCD resolution and key mappings/working sound? Is a new bootloader enough to just boot the system? I'm just wondering, can't really wait to see how this will progress.   Go Rockbox!

Do you mean the Creative ZEN or the Zen Vision:M ? As for the latter, it should perfectly boot Rockbox (altough without HDD, audio, keys, RTC, power management, etc support).

As for the Creative ZEN, I don't know. I suppose it uses an other LCD and it definitely isn't TMS320DM320 based so the hardware drivers also should get rewritten.

[THROBiX]

Yep, I meant the Zen Vision:M. Anyway, sounds pretty cool! Hope someone will take a look at the unfinished parts (audio, hdd, keys and so on) soon.

[shotofadds]

..it should perfectly boot Rockbox (altough without HDD, audio, keys, RTC, power management, etc support).

I think booting the Rockbox binary might be a little difficult without HDD support

[mcuelenaere]

I think booting the Rockbox binary might be a little difficult without HDD support

Well, I suppose if I can run the bootloader on the device (and it doesn't have a size limit on it), why shouldn't it run the whole Rockbox binary?
Of course it would be kinda useless; but it should run (if it only requires LCD and ARM access that is).

[mcuelenaere]

No sign of the buttons yet, although I've found the RTC at address 0xD1 in the I²C!
So this means my I²C driver works!

Attached is my diff...

@Falafel: could you verify that the RTC is also located at 0xD1 in the Zen Vision?
You can recognize it because the value of 0xD1 changes exactly every second.

edit:
I still doubt if my addressing is correct, as the OF accesses the RTC at address 0x51 instead of 0xD1 (differs only 1 bit)

edit2:
@Falafel: if the address isn't 0xD1, put i2c_reading(); after i2c_init(); and give me all addresses you get on the screen