Re: Why sound isn't working on the TP2.
 

(Just brainstorming :) Thank you again for all the work that you and the others have done :) )

Re: Why sound isn't working on the TP2.
 

hi all, I would like to help on this problem. Is there a schematic for the touch pro 2 hardware some where?

Re: Why sound isn't working on the TP2.
 

not that i can think of.

Most of the info we have is on the wiki

htc-linux.org/wiki

Re: Why sound isn't working on the TP2.
 

RPC really isn't a problem anymore since we have a more or less complete implementation of oncrpc.dll and are able to load the native remoteapisvc.dll and remoteapiclient.dll. But after doing all of that, all it really did is verify that the reversed engineered RPC calls for sound were good enough.

wavedev.dll eventually makes a kernel io control that i believe returns the AMSS version to the drivers, but I don't know how this number is represented or what it should be. Perhaps that is making some part of the driver not work correctly, but it doesn't error.

There are also some strange calls to DEX, SPM, and KLM. In theory DEX an SPM are working, but I didn't verify it very well. There is some question as to what it is for. Maybe cycling power on the DSP?

I have no idea what KLM is. Captnoord said it is MicroP, but I couldn't find a dll that exports a KLM driver. Some massive amount of data is transfered to it, whatever it is. Maybe microcode? Maybe something on the i2c bus.

I don't know what GRP rail is. Audio doesn't crash A9. A9 seems to be happy with what we are doing, AUDPP starts up and says it is ready to play, but DSP never consumes the buffer.

Re: Why sound isn't working on the TP2.
 

Sending anything to 0x3000000F 0x2C is for grp rail. But not to worry about that since i verified its actually on. The only reason i mentioned it is because it would bomb out if i tried to enable it that way.

On wavedrv.dll, did you get this info through disassembly? Cotulla has been very cool in verifying some ASM for me. Maybe he can do the same as long as we provide him the dll.

There is some dood about to sell this tp2. Lets get it so you can jtag that beotch ..lol.

Re: Why sound isn't working on the TP2.
 

I disassembled some of it. Mostly it is that I have a working implementation of windows ce under linux. Just one step at a time looking at the asm and seeing what it expects from windows ce, and getting it to work. Now I have logs of every function the driver makes, what memory it accesses, what parameters it uses, etc.

And as usual, it appears to work, but no interrupt.

Re: Why sound isn't working on the TP2.
 

hello all, does this android use ALSA for the sound library? I haven't look at the code yet or know where to find them, can someone point me in the right direction?

Re: Why sound isn't working on the TP2.
 

http://htc-linux.org/wiki/index.php?..._based_devices

try here

Re: Why sound isn't working on the TP2.
 

Haha .. its as if you and i are on the same boat. I did the same for 3d, but no interrupt.

Recently ive actually looked into the irq.c code to compare dumps of 0xC0000000. I realize that wince has alot of irqs enabled while linux doesnt. I'm wondering if its because the drivers themselves are actually supposed to enable the irq. I know for 3d for example that is the case. Hw3d is supposed to enable the irq, but im gonna try to see if i should have it enabled before like wince. Have you tried this for sound ?

For example this is a dump of wince irqs MSM_VIC_BASE

c0000000 | 00000000 00000000 00000000 00000000 | ................
c0000010 | 55fd0161 00008003 00000000 00000000 | a..U............
c0000020 | 00000000 00000000 00000000 00000000 | ................
c0000030 | 00000000 00000000 00000000 00000000 | ................
c0000040 | f5e401ff 0000003c 00000000 00000000 | ....<...........
c0000050 | 00000000 00000000 00000000 00000000 | ................
c0000060 | ffffffff 00000001 00000000 00000000 | ................
c0000070 | 00000000 00000000 00000000 00000000 | ................
c0000080 | 00000000 00000000 00000000 00000000 | ................
c0000090 | 00000000 00000000 00000000 00000000 | ................
c00000a0 | 80000080 00000034 00000000 00000000 | ....4...........
c00000b0 | 00000000 00000000 00000000 00000000 | ................
c00000c0 | 00000000 00000000 00000000 00000000 | ................
c00000d0 | ffffffff ffffffff 00000000 00000000 | ................
c00000e0 | 00000000 00000000 00000000 00000000 | ................
c00000f0 | 00000000 00000000 00000000 00000000 | ................

Notice c0000010 has 55fd0161 in winmo and under linux we only have 4f0100a1. Thats alot of disabled interrupts.

Re: Why sound isn't working on the TP2.
 

When wavedev.dll boots up, it makes 3 calls to InterruptInitialize() with strange parameters. I couldn't figure out the mapping between the interrupts in wince and hardware interrupts. Unfortunately the code that does the mapping is somehow built into nk.exe, which has no entry points and therefore is difficult to reverse.

I tried enabling more interrupts to see if it was happening somewhere else. I only got to 5 more or so. None seemed to be it. They have to be enabled one at a time because some of them cannot be cleared and hang the kernel.

Phh assured me that the interrupt numbers were correct and that they were checked in multiple ways multiple times. But I never was able to check them myself.

Re: Why sound isn't working on the TP2.
 

I just spoke to phh about it. I'm going to try to enable some irqs by hand to see if it helps.

We did disassembled nk.exe. I'll look for those functions calls and see what they do.

Re: Why sound isn't working on the TP2.
 

Hi guys! :) Great work in here by the way! I watch this thread all the time.

One quick question for ya. I see you guys working with these .dlls, and I need both htcservices.dll and wavedev.dll. I was hoping you guys would be kind enough and could direct me on how to acquire them. Plz? :dontknow:

Re: Why sound isn't working on the TP2.
 

Sup Reef.. try this link out. It should have all the oem dlls

http://www.4shared.com/file/39sLIx_Z/OEMDrivers.html

Re: Why sound isn't working on the TP2.
 

ACL, i have my kernel setup with the DSP interrupt always enabled, and when it goes off it just writes to console that the mysterious event has happened, but it still does not work.

I have disassemblies of NK as well, but they don't seem to do any good. I can't figure out what code handles a particular sys call.

All implementatations are required to implement this http://msdn.microsoft.com/en-us/library/ms904913.aspx, which does the interrupt mapping from user to hardware. I couldn't find this in NK.

Maybe writing some windows ce code that hooks all of the interrupts and then checks for changes in VIC memory would work to figure out what the mapping is.

Re: Why sound isn't working on the TP2.
 

this is exciting, thanks guys

Re: Why sound isn't working on the TP2.
 

keep up the good work guys. you give us all hope.
http://www.clublexus.com/forums/atta...waterboy_2.jpg

Re: Why sound isn't working on the TP2.
 

this thread is so important to me :) i check it multiple times daily.. :D

Re: Why sound isn't working on the TP2.
 

That looks really familiar. Check this out.

.text:80067BC0 sub_80067BC0 ; CODE XREF: sub_80056E84+64p
.text:80067BC0 ; sub_80056E84+8Cp ...
.text:80067BC0 STMFD SP!, {R4,R5,LR}
.text:80067BC4 MOV R4, R0
.text:80067BC8 MOV R5, #1
.text:80067BCC CMP R4, #0x1B
.text:80067BD0 BEQ loc_80067BF0
.text:80067BD4 MOV R1, #0x84000000
.text:80067BD8 MOV R0, #0x800
.text:80067BDC BL sub_8006B6C0
.text:80067BE0 CMP R0, #0
.text:80067BE4 LDRNE R0, =aOeminterrupten
.text:80067BE8 SUBNE R1, R4, #0x10
.text:80067BEC BLNE sub_8005364C

Eventually this gets called

sub_800275AC
MRS R1, CPSR
CMP R0, #0
ORREQ R2, R1, #0x80
BICNE R2, R1, #0x80
MSR CPSR_cf, R2
ANDS R1, R1, #0x80
MOVEQ R0, #1
MOVNE R0, #0
RET

Ahh, now that looks very similar to this below. So i'm pretty sure thats what's actually enabling the interrupts. We might wanna check with Cotulla or Phh. Either way i think we already do this in our code.

/* NewState=1 will enable IRQ, NewState=0 will disable IRQ */
/* ARM core must be in a privileged mode, e.g. supervisor */
void ChangeIRQ(unsigned int NewState)
{
int my_cpsr;
__asm
{
MRS my_cpsr, CPSR /* get current program status */
ORR my_cpsr, my_cpsr, #0x80 /* set IRQ disable bit flag */
BIC my_cpsr, my_cpsr, NewState, LSL #7 /* reset IRQ bit with new value */
MSR CPSR_c, my_cpsr /* store updated program status */
}
}
http://infocenter.arm.com/help/index...qs/ka3540.html

I have reason to believe that the VIC mapping is similar to the 7200. But i wouldnt mind testing with some wince code. Just disabling via api calls and reading bit changes should suffice.

Bits Name Description
31 tChscrn2 Touchscreen controller interrupt 1 of 2 (includes pendown (penirq_n)
30 TChscrn1 Touchscreen controller interrupt 1 of 2 (includes pendown (penirq_n)
29 tchscrn_ssbi Touchscreen controller interrupt 1 of 2 (includes pendown (penirq_n
28 Keysense Keypad key press detected
27 sdc2_1 Secure digital controller 2, source 1
26 sdc2_0 Secure digital controller 2, source 0
25 sdc1_1 Secure digital controller 1, source 1
24 sdc1_0 Secure digital controller 1, source 0
23 adsp_a9a11 ADSP source to both ARM9 and ARM11
22 adsp_a11 ADSP source to ARM11
21 adm_aarm Applications data mover
20 graphics Graphics engine source
19 mdp Mobile display processor source
18 mddi_client MDDI client (camera) source
17 mddi_ext MDDI external display source
16 mddi_pri MDDI primary display source
15 usb_otg USB on-the-go
14 uart3_rx Activity start on UART3 interface
13 UART2_RX Activity start on UART2 interface
12 uart1_Rx Activity start on UART1 interface
11 uart3 UART3 controller source
10 uart2 UART2 controller source
9 uart1 UART1 controller source
8 dEBUg_timer_exp Debug GP timer has expired
7 gp_timer_exp RTOS GP timer has expired
6 a9_m2a_6 Interprocessor interrupt source from modem ARM
5 a9_m2a_5 Interprocessor interrupt source from modem ARM
4 a9_m2a_4 Interprocessor interrupt source from modem ARM
3 a9_m2a_3 Interprocessor interrupt source from modem ARM
2 a9_m2a_2 Interprocessor interrupt source from modem ARM
1 a9_m2a_1 Interprocessor interrupt source from modem ARM
0 a9_m2a_0 Interprocessor interrupt source from modem ARM

I tried enabling irqs on linux today by changing those bits and no luck with 3d. However i do notice sometime the device freezes when enabling 3d app. This can be good or bad, i just cant get any info since the phone crashes.

Re: Why sound isn't working on the TP2.
 

Just wanted to let you know I appreciate your work and effort! Keep going guys!
http://www.bitopia.co.uk/i/mains/thumbs_up.jpg

Re: Why sound isn't working on the TP2.
 

So the interrupt indentifiers in WinCE for audio are 0x3d, 0x3e, 0x3d, 0x40 and 0x33. Not sure what they do individually. I could figure it out if need be. But even if we could just find out what VIC entries those are for it would narrow it down quite a bit.

Again, I have no way to compile code for WinCE. I wouldn't mind writing the code if somebody wants to get it running. Disabling the already enabled interrupts will likely crash the phone sooner or later. In particular if it tries to play a sound. It seems as though we can disable another processes interrupt handler, but without getting its event id, there is no way to restore it.

Re: Why sound isn't working on the TP2.
 

Btw, that code for enabling/disabling interrupts is not quite the right thing. In general ARM architectures only have a single interrupt which is attached to the VIC. A11 actually has 2 interrupts but I don't think anybody uses it. The other is FIQ. So calling either that disassembled code or the linux code really has the effect of either enabling or disabling all interrupts as it disconnects VIC.

Somewhere NK.exe should be writing to the VIC memory to setup an interrupt.

Re: Why sound isn't working on the TP2.
 

The asm i posted ? right or not its straight from the nk.exe. The arm section i posted was just a comparison.

you are right, there is a place in there where vic is written to. If you have IDA search for 0xC0000000 and you will see there are many places where this address is called. Its scattered all over the place so its going to be tough to go through all of that (tough for me at least being asm noob).

Do you have some wince code you need me to compile? if you already have it written let me know. Also i think we can get more done if we get back on the irc chat. Ill be there tomorrow

Re: Why sound isn't working on the TP2.
 

I didn't mean to imply that it wasn't real or anything.

If you wouldn't mind I do have a couple of WinMO program that I need compiled. They are obviously untested and may not build. I'm also concerned that they use trusted api's and may need some coaxing to work. But I can take care of that if you send me the binaries.

http://pastebin.com/G6rAyJLK
http://pastebin.com/XSWUrBEC

Re: Why sound isn't working on the TP2.
 

has anyone tried something like this http://forum.xda-developers.com/show...light=sip+voip

Re: Why sound isn't working on the TP2.
 

Ahh.. i cant seem to compile this. I'm missing pkfuncs.h. I'm gonna have to see if any of the winmo devs can help.

have you tried just haret dumps while playing sound? You dont have that many bits to choose from since all my tests so far show that we match the msm7200 documented bits for vic?

Another idea is to call wavedev.dll functions. I did the same for the ati driver, just dynamically load the dll and call some functions. InterruptInitialize() looks tempting ..

Re: Why sound isn't working on the TP2.
 

do we need some exe like the hd2 sound fix?? CLRCAD.exe mod or something?

Re: Why sound isn't working on the TP2.
 

according to cotolla we may not need anything at all. His advice was to boot without CE or boot directly from nand

Re: Why sound isn't working on the TP2.
 

Here are the new programs. Should compile without pkfuncs.
http://pastebin.com/EUX2X48P
http://pastebin.com/uf7ww1s6

Re: Why sound isn't working on the TP2.
 

You guys are frinkin awesome. The Thanks are raining down!

Re: Why sound isn't working on the TP2.
 

how can we boot without CE?

Re: Why sound isn't working on the TP2.
 

Had to mod slightly to compile but they work. KernelIoControl required some static lib so i just dynamically called the dll. Seems to run fine. Sorry i didnt pay attention to the values. its 2am and i gotta get early am

http://hotfile.com/dl/57783230/c30527f/Apps.zip.html

I ran the files for fun and the phone don't not like disabled interrupts.. lol.. instant reboot. But VIC value your are getting is correct. Matches my haret dump.

Re: Why sound isn't working on the TP2.
 

ACL, here is a wrapper for wavedev, if you wouldn't mind compiling it.

http://pastebin.com/VJZx06Zx

Re: Why sound isn't working on the TP2.
 

had to rename a few vars for the correct caps, and add a def file to export all the symbols (methods)

http://hotfile.com/dl/57925210/ffa24...evice.zip.html

compiled with 6.5 sdk (only dependency is coredll.dll)

Re: Why sound isn't working on the TP2.
 

Thanks a lot man. Jonpry was able to run it but ran into some issues of his own. Nothing that couldnt be fixed.

Re: Why sound isn't working on the TP2.
 

Before we get a rom made by a chef and line up the testes, phh left this on the irc .. did u read it?

the only problem for sound is audmgr version ...
can you try to check these again ?
I still get 0 for both (audmgr and audmgr cb)
only major problem*

I'll check later tonight but do you know what is he talking about ? rpc calls i take it ? I couldnt talk to him much about it.

Re: Why sound isn't working on the TP2.
 

I'm not a DEV but I'm following this thread closely; thank you for your efforts to get sound working.

Is this of any significance? You probably have this information already??It's a list of entry points for functions in WAVEDEV.DLL.

Re: Why sound isn't working on the TP2.
 

OK.. hunting down audmgr calls on remote_apis_clnt and there are 2 (audmgr_enable/disable_client_apps), functions that call 0x30000013:0

adsp_rtos calls 0x3000000A:0

and i think we already know snd calls 0x30000002:0xAA2B1A44

Re: Why sound isn't working on the TP2.
 

dude if you get sound working for tp2 you will be loved by many including me. you all rock.

Re: Why sound isn't working on the TP2.
 

Im following this thread closely.. really eager to hear any updates on sound and 3d

Re: Why sound isn't working on the TP2.
 

Thanks all for your help and support.

We have had a little trouble finding the right configuration for our next experiments. If you want to try and perform this little deal and post your results. What phone, what rom, spl etc.

***** WARNING******** WARNING ******** This will most likely break sound on your phone and will require a hard reset / flash to get it back.

1. Download this file http://hotfile.com/dl/58200301/7da154d/wavedev.dll.html
2. Use resco explorer to overwrite your existing wavedev.dll with it.
3. Reboot, check for sound
4. Post your results.

For the more adventuress, recmod your own wavedev.dll and try it.

THANKS!