Release v4

USB CDC works unless the PC sends more than 64 bytes in one packet.
3 small stock firmware bug fixes are also included.

.gitignore

@@ -0,0 +1,4 @@
+/.settings
+/Patch
+/firmware/*.bin
+/firmware/*.zip

.project

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>LHTXmods</name>
+	<comment></comment>
+	<projects>
+		<project>lpc_chip_11uxx_lib</project>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.cdt.managedbuilder.core.genmakebuilder</name>
+			<triggers>clean,full,incremental,</triggers>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.cdt.managedbuilder.core.ScannerConfigBuilder</name>
+			<triggers>full,incremental,</triggers>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.cdt.core.cnature</nature>
+		<nature>org.eclipse.cdt.managedbuilder.core.managedBuildNature</nature>
+		<nature>org.eclipse.cdt.managedbuilder.core.ScannerConfigNature</nature>
+	</natures>
+</projectDescription>

LICENSE

@@ -1,6 +1,15 @@
+Please note that this repository also contains files that might not be subject
+to this license. Specifically the NXP USBD example code may only be used on NXP
+hardware. Watch out for license notes in the header of the files.
+
+The resulting binary firmware files are also not subject to this license since
+they consist of predominantly Valve's code with minor changes and additions.
+
+
+
 MIT License
 
-Copyright (c) 2018 nairol
+Copyright (c) 2018 [email protected]
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,3 +28,5 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+

README.md

@@ -1 +1,7 @@
-# LHTXmods
+# LHTXmods
+
+...
+
+A firmware mod/hack/patch for Lighthouse base stations that adds serial communication via USB. (CDC ACM)  
+
+Not much more to say at the moment but the plan is to add other useful features later.

firmware/Flashing the firmware.txt

@@ -0,0 +1,69 @@
+
+0. This is an unofficial firmware mod for HTC Vive Base Stations.
+   Don't use it with anything else.
+   This firmware enables the USB port and allows using the integrated shell that is usually only reachable via UART.
+
+1. Unplug the power cable from the base station.
+
+2. Find a Micro-USB cable that fits into the port on the back of the base station and plug it in.
+   The other end goes into your PC.
+
+3. Press and hold the mode selection button while plugging the power plug back in.
+   The button is on the back of the box next to the connectors.
+
+4. Your PC should detect a new flash drive called "CRP DISABLD".
+   The base station should stay dark and silent.
+   If it doesn't, unplug the power and try step 3 again.
+
+5. Open the flash drive ("CRP DISABLD") with a file manager.
+   There should be just one file called "firmware.bin".
+
+6. Delete the file "firmware.bin".
+
+7. Copy the new firmware file onto the flash drive.
+   You don't need to change its name back to "firmware.bin".
+
+8. Unplug the power cable and plug it back in.
+
+9. Your operating system should detect the base station as virtual serial port.
+   Use your favorite terminal application to connect to it.
+   The connection settings don't matter but flow control should be disabled.
+   (E.g. 115200 baud, 8 data bits, 1 stop bit, no parity, no flow control)
+
+
+Make a backup of the factory calibration and configuration using the command:
+> eeprom r 0 4032
+Copy its output somewhere safe so that you can restore the base station in case something goes wrong.
+
+Usually though the backup is not needed since you can revert all settings back to factory defaults using the command:
+> factory load-cal
+
+Stay away from the other commands starting with "factory" or "eeprom" if you don't know what you are doing.
+
+Pressing the Tab key will show all available commands.
+
+A list of all configuration parameters can be shown with:
+> param list
+
+Other useful commands are:
+> param info <name>
+> param get <name>
+> param set <name> <value>
+
+A full list of all available commands can be found here:  
+https://github.com/nairol/LighthouseRedox/blob/master/docs/Base%20Station%20Shell.md
+
+
+
+Name: lighthouse_tx_htc_2_0-436-2016-09-20__USB-CDC-v4.bin
+Size: 82744 Bytes
+SHA256: EF5FDFA5E1151BB9F8878795B5638C4F0995FA1599BEFAE7504AA048E6184410
+
+
+
+The modified firmware has been tested successfully on real hardware.
+
+Have fun! :)
+
+[email protected]
+https://github.com/nairol/LHTXmods

src/bugfixes/bugfixes.c

@@ -0,0 +1,22 @@
+#include <stdint.h>
+#include <stdbool.h>
+
+
+/* This file patches some bugs in the stock firmware. None of them are critical. */
+
+
+// Next line is bug fix for the command "ram". First address shown in hex dump was always 0x10000000.
+void __attribute__((section(".FUNC_5594"))) __attribute__((naked)) FUNC_5594( ) { asm volatile("MOV R3, R1 \n\t BL printf_hexdump \n\t POP {R3-R7,PC}"); }
+
+// Next 5 lines fix the superfluous type conversions in ootx_rebuild_frame.
+// All fcal values were converted 3 times (float->halffloat->float->halffloat), now only once.
+void __attribute__((section(".FUNC_32D8"))) __attribute__((naked)) FUNC_32D8( ) { asm volatile("NOP \n\t NOP \n\t NOP \n\t NOP"); }
+void __attribute__((section(".FUNC_32F0"))) __attribute__((naked)) FUNC_32F0( ) { asm volatile("NOP \n\t NOP \n\t NOP \n\t NOP"); }
+void __attribute__((section(".FUNC_3300"))) __attribute__((naked)) FUNC_3300( ) { asm volatile("NOP \n\t NOP \n\t NOP \n\t NOP"); }
+void __attribute__((section(".FUNC_3316"))) __attribute__((naked)) FUNC_3316( ) { asm volatile("NOP \n\t NOP \n\t NOP \n\t NOP"); }
+void __attribute__((section(".FUNC_332A"))) __attribute__((naked)) FUNC_332A( ) { asm volatile("NOP \n\t NOP \n\t NOP \n\t NOP"); }
+
+// Next 3 lines fix the inconsistent table alignment in the auto-completion output (TAB key).
+static const char __attribute__((used)) autoCompletionFormatString[] = "%-11s%s\r\n";
+static char* __attribute__((section(".DATA_5EBC"))) __attribute__((used)) DATA_5EBC = autoCompletionFormatString;
+void __attribute__((section(".FUNC_5C72"))) __attribute__((naked)) FUNC_5C72( ) { asm volatile("LDR R0, [PC, #0x248]"); }

src/bugfixes/bugfixes.ld

@@ -0,0 +1,11 @@
+/* Functions that replace original functions in place */
+.FUNC_5594  0x5594 : {KEEP(*(.FUNC_5594))}   > FLASH
+.FUNC_32D8  0x32D8 : {KEEP(*(.FUNC_32D8))}   > FLASH
+.FUNC_32F0  0x32F0 : {KEEP(*(.FUNC_32F0))}   > FLASH
+.FUNC_3300  0x3300 : {KEEP(*(.FUNC_3300))}   > FLASH
+.FUNC_3316  0x3316 : {KEEP(*(.FUNC_3316))}   > FLASH
+.FUNC_332A  0x332A : {KEEP(*(.FUNC_332A))}   > FLASH
+.FUNC_5C72  0x5C72 : {KEEP(*(.FUNC_5C72))}   > FLASH
+
+/* Constants at specific addresses */
+.DATA_5EBC  0x5EBC : {KEEP(*(.DATA_5EBC))}   > FLASH

src/flex_fdm/flex_fdm.c

@@ -0,0 +1,28 @@
+#include <stdint.h>
+#include <stdbool.h>
+#include <stock_firmware.h>
+#include <usb_cdc/app_usbd_cfg.h>
+
+#include "usbd/usbd_rom_api.h"
+#include "chip.h"
+
+
+// Functions added by the patch
+void __attribute__ ((section (".functions"))) onSyncFlashDone( bool opticalReceiverMaskEnable );
+
+
+// Dummy functions for generating the correct branch instruction in the right place
+void    __attribute__((section(".HOOK_C60A"))) __attribute__((naked)) HOOK_C60A( bool r0 ) { onSyncFlashDone( r0 ); }
+
+
+
+/////////////////////////////////////////////////////////////////////////////////////////////////////////
+// Functions added by the patch:
+
+void onSyncFlashDone( bool opticalReceiverMaskEnable )
+{
+	maskOpticalReceiver( opticalReceiverMaskEnable );
+
+	// my code...
+}
+

src/linkerscript.ld

@@ -0,0 +1,22 @@
+MEMORY
+{
+	FLASH      (rx) : ORIGIN = 0x00000000, LENGTH = 0x00013C00
+	FLASH_FREE (rx) : ORIGIN = 0x00013C00, LENGTH = 0x0000C400
+	SRAM0      (rw) : ORIGIN = 0x10000000, LENGTH = 0x00002000
+	SRAM1      (rw) : ORIGIN = 0x20000000, LENGTH = 0x00000800
+	SRAM_USB   (rw) : ORIGIN = 0x20004000, LENGTH = 0x00000800
+}
+
+SECTIONS
+{
+	/* Functions and constant data added by the patch */
+    .text   : {KEEP(*(.text*))}   > FLASH_FREE
+    .rodata : {KEEP(*(.rodata*))} > FLASH_FREE
+    .bss    : {KEEP(*(.bss*))}    > SRAM1
+
+	INCLUDE stock_firmware.ld
+	INCLUDE shared/system_setup.ld
+	INCLUDE bugfixes/bugfixes.ld
+	INCLUDE usb_cdc/usb_cdc.ld
+
+}

src/shared/system_setup.c

@@ -0,0 +1,35 @@
+// This file contains important base functionality
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stock_firmware.h>
+
+
+// Functions added by the patch
+void init_sram1_and_call_main( );
+
+
+// Dummy functions for generating the correct branch instruction in the right place
+void __attribute__((section(".HOOK_15A0"))) __attribute__((naked)) HOOK_15A0( ) { init_sram1_and_call_main(); }
+
+
+
+
+
+void init_sram1_and_call_main( )
+{
+	// Enable Clocks
+	uint32_t* SYSAHBCLKCTRL = 0x40048080;
+	*SYSAHBCLKCTRL |= (1<<26); // Enable clock to SRAM1
+
+	uint32_t* sram1 = 0x20000000;
+	for( uint32_t i = 0; i<(0x800/4); i+=4 )
+	{
+		sram1[i+0] = 0;
+		sram1[i+1] = 0;
+		sram1[i+2] = 0;
+		sram1[i+3] = 0;
+	}
+
+	main();
+}

src/shared/system_setup.ld

@@ -0,0 +1,5 @@
+
+/* Dummy functions for generating the correct branch instruction in the right place */
+.HOOK_15A0  0x15A0 : {KEEP(*(.HOOK_15A0))}   > FLASH
+
+

src/stock_firmware.h

@@ -0,0 +1,37 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+// Existing functions in the official firmware.
+// Assign these symbols the correct addresses in the linker script!
+void     halt( const char *message, const char *function, const char *file, uint32_t line );
+void     uart_init( );
+uint8_t  uart_readByteBlocking( );
+void     uart_writeByteBlocking( uint8_t data );
+void     uart_handler( );
+uint32_t getSerialNumber( );
+int      printf( const char* formatString, ... );
+void     printString( char* string );
+void     printf_hexdump( uint32_t UNUSED_ARG, void* address, uint32_t length, uint32_t startOffset, const char* prefixString ); // Pass in 0x100003B8 for UNUSED_ARG
+void     systick_init( );
+int      systick_addTimer( void *functionPtr, uint32_t functionArg, bool triggerOnce, uint32_t timerValue );
+void     maskOpticalReceiver( bool maskEnable );
+int      sprintf( const char* str, const char* format, ... );
+void     main( );
+
+/*
+void DPLL_PIDcontroller( uint32_t rotor, int32_t measuredError );
+void DPLL_edge( uint32_t rotor, uint32_t edge, uint32_t timestamp, int32_t timebase_offset );
+bool LTC6904_setFrequency( bool I2C_addressBit, uint32_t controlBits, uint32_t frequency );
+int32_t DPLL_getRotorControlErrorValue( uint32_t rotor );
+uint32_t DPLL_getRotorPIDoutputPWMvalue( uint32_t rotor );
+void SystemCoreClockUpdate( );
+void waitLoop( uint32_t loopCount );
+*/
+
+
+
+// Existing global variables in the official firmware.
+// Assign these symbols the correct addresses!
+//extern uint8_t ootx_enable;

src/stock_firmware.ld

@@ -0,0 +1,21 @@
+
+/* Existing functions in the official firmware */
+
+halt                   = 0x7DCC;
+uart_init              = 0x3788;
+uart_readByteBlocking  = 0x831C;
+uart_writeByteBlocking = 0x8434;
+uart_handler           = 0x3844;
+getSerialNumber        = 0x8498;
+printf                 = 0x2028;
+printString            = 0xB658;
+printf_hexdump         = 0x8B00;
+systick_init           = 0xC768;
+systick_addTimer       = 0xC7D8;
+maskOpticalReceiver    = 0xCC64;
+sprintf                = 0x2048;
+main                   = 0xA52C;
+
+
+/* Existing global variables in the official firmware */
+ootx_enable = 0x100005FC;

src/template.c

@@ -0,0 +1,41 @@
+#include <stdint.h>
+#include <stdbool.h>
+#include <stock_firmware.h>
+
+
+// Functions added by the patch
+//void         __attribute__ ((section (".functions"))) myFunction( );
+
+
+// Dummy functions for generating the correct branch instruction in the right place
+//uint8_t __attribute__((section(".HOOK_xxxx"))) __attribute__((naked)) HOOK_xxxx( ) { return targetFunction(); }
+//void    __attribute__((section(".HOOK_xxxx"))) __attribute__((naked)) HOOK_xxxx( uint8_t r0 ) { targetFunction( r0 ); }
+//ASM alternative:
+//void __attribute__((section(".HOOK_xxxx"))) __attribute__((naked)) HOOK_xxxx( ) { asm volatile("BL targetFunction"); }
+
+
+// Functions that replace existing functions in place
+// Make sure that the new function is no longer than the old one!
+//bool    __attribute__((section(".FUNC_xxxx"))) FUNC_xxxx( ) { return targetFuntion( ); }
+//void __attribute__((section(".FUNC_xxxx"))) __attribute__((naked)) FUNC_xxxx( ) { asm volatile("MOV R0, R4 \n\t BL targetFunction \n\t POP {R3-R7,PC}"); }
+
+
+// Constants at specific addresses (e.g. function pointers)
+//static void* __attribute__((section(".DATA_xxxx"))) __attribute__((used)) DATA_xxxx = myFunction + 1;
+
+
+// Constants that the new functions use.
+// They must be assigned to an empty FLASH block and set in the firmware file.
+//static __attribute__((used)) uint32_t myConst = 0;
+
+
+// Global variables added by the new functions.
+// They must be assigned to an empty RAM block! E.g. 0x10001500
+//uint32_t myVariable;
+
+
+/////////////////////////////////////////////////////////////////////////////////////////////////////////
+// Functions added by the patch:
+
+
+