wow. I have a 40D and i think the 5Dc and the 40D are both VxWorks. Am i right? So would it work on a 40D?
It would be awsome to be able to record movies with the 40D.
nice work.
In theory, you have the foundation for running user code on 40D and most other VxWorks cameras.
In practice, there should also be a developer who must have this camera, skills and lots of time to work on it.
thank you.
ok... i have that camera, skills : hmmm, lots of time : doh!
but why not. maybe as a winter project.
Is it the current release or is there a special fork?
It's in the current source tree.
ok, lets see what happens when i start that on my 40D this evening.
Don't run that code blindly, first understand how it works. It has zero chances to work on 40D unmodified, and can be dangerous.
http://magiclantern.wikia.com/wiki/Other_dslr
http://magiclantern.wikia.com/wiki/For_Developers
First get a firmware dump, find out LED address and try blinking it.
yes, right. i will start with little steps. Thank you.
I suggest you look at my initial project for the 5dc:
www.bitbucket.org/coutts/5dplus (http://www.bitbucket.org/coutts/5dplus)
Everything starts in entry.S. First use a dumper tool to extract the firmware image from a canon firmware update file (see the build_scripts/eos_tools_v11 folder in that project linked above). Use decrypt_fw and then dissect_fw to split the FIR up. See this wiki page for more details:
http://magiclantern.wikia.com/wiki/Packing_FIR_Files (http://magiclantern.wikia.com/wiki/Packing_FIR_Files)
After you analyze the firmware dump using a program like IDA Pro (or the free ARM Console (http://magiclantern.wikia.com/wiki/GPL_Tools/ARM_console) created by Alex) to see how the camera boots/works, then attempt to boot a custom FIR file running user code. Use the assemble_fw perl script in the eos_tools directory to assemble a new FIR file with your usercode (compiled autoexec.bin) instead of canon's payload. The final step is to run decrypt_fw again on this fir to sign it for the camera to accept it. (Note: this step may or may not be necessary, depends on the camera. Try both if one doesn't work). Start by just blinking an LED or something basic to know your code runs. You don't need to boot the main firmware to blink an LED.
If 40d is similar to the 5dc, then you won't be able to run any practical code from a FIR (including calling the EnableBootDisk function or booting the firmware/camera) so you will need to write some code that scans the bootloader area (0xFFFF0000-0xFFFFFFFF) for function signatures to identify the read/write bootflag functions. This will allow you to set the camera's bootflag, to boot an autoexec.bin file with a prepared card, and development takes off from there (you will be able to boot the firmware and do anything from autoexec). I created this bootdisk code from the 350d method, using the 400d bootloader to find the signatures I needed. Only modification you will need is to change are the references to these:
Quote
read_bootflag = (ft_read_bootflag)0xFFFF8AE0;
write_bootflag = (ft_write_bootflag)0xFFFF89F0;
https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c (https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c)
The 5dc took me many hours to get going, I dumped many memory addresses through LED blinks in binary, you should be prepared to do the same. Here is some code that you can use to blink out the contents of a memory address if you know the red/blue LED addresses:
https://bitbucket.org/coutts/5dplus/src/a1cc964de4af/init.c
You can use this to write code to search for specific signatures of the read_bootflag and write_bootflag functions. Some signatures would be instructions like:
Quote
MOVEQ R7, #0xF8000000
which is assembled and looks like this in memory:
Quote
0x03A0733E
Use the 5dc bootloader (I can send you it) to know what signatures you're looking for (unique instructions that would only appear in the read/write bootflag functions). After you find a signature and have a match at some spot in the BL area (0xFFFF0000-0xFFFFFFFF), use this address and search in reverse (going backwards in memory to lower addresses) until you find the nearest PUSH (STMFD) instruction, this will be the address of the start of the function so that you can call it / use it.
I'll just tell you the signatures to find.
First, for
write_bootflag. Here is a small snippet from that function, the first 5 instructions:
Quote
ROM:FFFF89F0 STMFD SP!, {R4-R8,LR}
ROM:FFFF89F4 MOV R5, R1
ROM:FFFF89F8 MOV R4, #0
ROM:FFFF89FC CMP R0, #0
ROM:FFFF8A00 MOVNE R7, #0xF8000000
If you were scanning memory, these 5 instructions would look like this(starting at 0xFFFF89F0 on the left and ending on 0xFFFF8A00 on the right):
Quote
0xE92D41F0 0xE1A05001 0xE3A04000 0xE3500000 0x13A0733E
So, look for the signature for the
MOVNE R7, #0xF8000000 instruction, then once you find it, search backwards for the STMFD (push) instruction signature, and you will have located
write_bootflag in the 40d bootloader. Chances are the functions will probably be identical, but take caution to verify at least 3 times that you have located the correct function and it seems the same / similar to the 5dc one (remember we are working blind here).
Now,
read_bootflag. First 5 instructions look like:
Quote
ROM:FFFF8AE0 STR LR, [SP,#var_4]!
ROM:FFFF8AE4 CMP R0, #0
ROM:FFFF8AE8 MOVNE R3, #0xF8000000
ROM:FFFF8AEC ADDNE R3, R3, #0x2000
ROM:FFFF8AF0 MOVNE R2, #0x40
And in memory would look like this (same thing as before, starting at 0xFFFF8AE0 on left and ending at 0xFFFF8AF0 on the right):
Quote
0xE52DE004 0xE3500000 0x3E33A013 0x12833A02 0x13A02040
Note: there isn't a STMFD (push) instruction in read_bootflag. The 400d bootloader is like this too, so chances are the 40d is as well.
NOTE: you may need to reverse endianness of the assembled instructions above to see them in memory, but maybe not, I can't remember :P
So, once you have located read_bootflag() and write_bootflag(), you will be able to really start developing. :) This may seem confusing, and I'm sorry, but I hope you will see how valuable this information is (I had to figure it all out on my own). The 350d people dumped the bootloader using a photo diode and the LED to blink the code in binary to a computer, I couldn't figure that out so I did it this way. Let me know if you have any questions, I can probably help a lot. Do you use gmail?
Argh, first i have to repair my camera... broken release.
Thats really annoying.
coutts, thats some very helpful information and should probably go into the wiki!
Quote from: Michael Zöller on July 23, 2012, 04:20:39 PM
coutts, thats some very helpful information and should probably go into the wiki!
should be more than enough to get any port started :)
There are plenty of Canon 40d users like me waiting to use MagicLantern on their 40d. Please! Make it happen. I am not a developer.....all can I do is to pray for your success :)
Finally some good news! I am enjoying the ML. I thank all who have worked on this project. I hope one day to use the ML with a 40D. I hope to give my contribution to make this possible.
I think the work done by Coutts to 5DC will be useful for even the 40D and 400D.
I'm thinking start doing the first tests.
I know it's a bit risky. Certainly, I will need your help.
Firstly, I will begin by installing and configuring ubuntu to compile the project. When I can, I will test the tools specified by Coutts.
Hi,
I still have nothing to work but I have spent many hours reading the forums CHDK / ML.
I'm learning, have some patience with me. This still seems very complicated. Sorry if the questions are basic.
I got the firmware version 40d1.1.1. With application dissect_fw3_2, I got the unencrypted header and body. I've compiled a small application to try to find the addresses of the red and blue LED, but I've got a problem. I do not know how to encrypt the new firmware to be able to use on my machine. I read a lot about it but I could not understand the steps that have to follow.
If I can correctly encrypt my firmware I can proceed with my tests.
Since I've been searching for some string in the firmware files and I could see some interesting things. I found the string EnableBootDisk.
After seeing the flashing LEDs, I'll try to do a DUMP the firmware.
When I succeed in the previous tests, I proceed to the discovery of the function EnableBootDisk addresses.
Someone can help me create my own firmware for the 40D?
I have a 40D with version 1.1.1. After much reading and testing I was able to flash both LEDs.
I used the information provided by Coutts to flash both LEDs.
See the examples:
1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)
2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)
These are the addresses of blue and red LEDs:
LED_RED 0xC02200E0
LED_BLUE 0xC02200E8
Quote from: jplxpto on August 10, 2012, 04:07:49 PM
I used the information provided by Coutts to flash both LEDs.
See the examples:
1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)
2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)
These are the addresses of blue and red LEDs:
LED_RED 0xC02200E0
LED_BLUE 0xC02200E8
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Quote from: coutts on August 10, 2012, 08:20:03 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Coutts,
yes I am currently reading your posts in CHDK.
In 2008 there were major developments, but for some unknown reason you moved away from this project. Made great advances that have helped future ports to other cameras but 40D & 450D were forgotten! Why?! ...
Their progress in the port 1000D can give a great help! I think the cameras 1000D, 450D, 40D have many similarities. This can be an advantage.
Thank you for providing the code :
https://bitbucket.org/coutts/1000d_dev
I really want to install the Magic Lantern in my camera and give my modest contribution to the community but,
without your precious help will not go away.
You have done an excellent job over the years.
Congratulations.
Quote from: coutts on August 10, 2012, 08:20:03 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Many will read this and get to thinking that an easy task! ;)
Has anyone done a dump of the ROM and BL fir v 1.1.1.?
I read a lot and follow the tips and suggestions from Coutts.
I analyzed the 5DC BL code and found the signatures of functions and read_bootflag write_bootflag.
Later, I created a small program to find them in my 40d fir 1.1.1.
I still do not know the original values of bootflags but I have called the function read_bootflags.
Not yet confirmed, but I believe that the addresses are:
read_bootflag -> 0xffff 63a8
write_bootflag -> 0xffff 62b8
Someone can explain me how to operate the boot flags?
The original values of bootflags are:
F8000000 = 0
F8000004 = 0
F8000008 = -1
F800000C = -1
I have good news.
The autoboot already works!!!
I used the addresses of functions and LEDs that I presented to you earlier.
I used some test applications of Coutts, and made the necessary changes.
The second obstacle has been overcome.
I level up but, the game becomes more complicated and risky.
Wish me luck! ;)
My next steps are:
1) find the addresses of the functions Open, Write and Close;
2) create BL & ROM dumps.
Quote from: jplxpto on August 12, 2012, 09:04:03 PM
My next steps are:
1) find the addresses of the functions Open, Write and Close;
2) create BL & ROM dumps.
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
I've been reading the forums and ML CHDK and found some examples to dump the ROM and BL.
http://chdk.setepontos.com/index.php?topic=1651.45 (http://chdk.setepontos.com/index.php?topic=1651.45)
I found one that allowed you to dump the 40D FW 1.0.8.
They called on four functions in the code of the flasher.
The 'ASalina' made ??the dump from earlier versions.
I now want to do with version 1.1.1.
They found these features in version 1.0.8:
/ / 40d - flasher v1.0.8
open = (ft_open) 0x00989a34;
create = (ft_creat) 0x00989a44;
write = (ft_write) 0x00989534;
close = (ft_close) 0x009896a0;
I've been researching the same functions in version 1.1.1:
/ / 40d - flasher v1.1.1
open = (ft_open) 0x00989a3c;
create = (ft_creat) 0x00989a4c
write = (ft_write) 0x0098953c;
close = (ft_close) 0x009896a8;
I've thought maybe it was not possible to call these functions before starting VxWorks.
I got confused with anything ...
The flasher code calls functions of the ROM?! ...
I still can not understand well the memory map and this is making me lose some time and let me crazy :)
Someone can give me some tips? Maybe you Coutts ... ;) Again ...
Quote from: coutts on August 13, 2012, 04:50:10 AM
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)
I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (
How do I use AUTOEXEC.BIN to start the VxWorks?! ...
Can I use the functions DEBUGMSG and dump before starting VxWorks?
Quote from: jplxpto on August 13, 2012, 07:33:16 AM
Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)
I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (
How do I use AUTOEXEC.BIN to start the VxWorks?! ...
Can I use the functions DEBUGMSG and dump before starting VxWorks?
Those functions you listed earlier sound like they are bootloader functions but they are being called from RAM, so I wouldn't call those (not sure if the functions are copied there or not). I've been looking for file i/o in the bootloader for a while but haven't found it, if you have found these functions in the BL, then that is huge progress! It will help new ports a lot.
Now for booting VxWorks, what I mean is you must copy/paste the boot code starting at 0xFF810000 far enough to where you can spawn your own task. We need to hook ourselves into VxWorks. Once we have started our one task, we can hand execution back to canon and boot the camera like normal.
So, I used some bootcode from chuchin but it is literally copy/pasted line for line from the ROM (at FF810000). As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.
Then begin tracing the boot process to know how much code needs to be re-written. You only need to write until the part where it calls CreateTask on the startup task. We can hook our task in here.
Quote
As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.
I'll test it ...
I'm working on it ...
I already have the dump of the ROM. I've also got the boot flag active.
The Coutts and Cucho have given me a great help ..
They have been fantastic.
The Nano has sent me a file entry.S.
I'll be a little busy, but soon I hope to present you some results.
Does anyone else want to help me?! ... Any help is welcome.
I have good news ...
I already have a tread running ... flashing blue LED!
The LED turns off when the TFT is turned off but with the MENU button it lights up again.
I already found the address of some functions but there is still much work ahead to be able to integrate my code with ML.
Hi guys,
I keep working on this project and I having some successes
Now I can write logs on the card.
I've been analyzing the logs and found some messages that can help me identify the VRAM.
Then I present some:
304: 591.053 < GUI Lock > InitializeGUILock (PUB)
305: 592.017 [GUI] MasterResultCBR
306: 592.224 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
307: 593.033 [GUI] -> handleGuiInit
308: 598.963 [DispCon] InitializeDisplayDeviceController (PUB)
309: 600.121 [IMP] (PUB) InitializeImagePlayer 1113
310: 601.818 [CERES] RegisterAdapterStatusCallback
311: 607.638 [Graphics] GuiStartGraphics (PUB)
312: 608.057 [IMP] (PUB) StartImagePlayer(mode=0) 1189
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
334: 685.052 [IMP] GetVramNumber 580
335: 685.072 [IMP] GetVramNumber 580
336: 716.486 [IMP] (PUB) RefreshImageVram 1597
337: 716.519 [IMP] GetVramNumber 580
338: 716.765 [IMP] GetVramNumber 580
339: 716.791 [IMP] GetVramNumber 580
340: 716.823 [GUI] StopDateTimer
341: 716.852 [GUI] ClearColorPalette (0)
342: 716.924 [GUI] GUI_RegisterPropertySlave
343: 724.367 [GUI] MasterResultCBR_AvailableMyMenuList(0x79594c)
344: 724.618 [GUI] MasterResultCBR_ErrBattery(0x79599c)
345: 725.033 [DP]Dp_GetGlbRegisterCbrTAdr()
346: 725.182 [DP]Dp_GetGlbRegisterCbrTAdr()
347: 725.645 [GUI] GUI_SetLanguage (15)
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
Now I'm trying to change the logging level.
I hope to see something else, but I'm not having great success.
I have to confirm my stubs ... I must be doing something wrong.
I changed the amount of logging that is written but there is something wrong.
I have to understand what is happening.
I wanted to make sure that those are the addresses of VRAM.
I'm going to dump the VRAM (1M) but I still do not know what to do with it... :(
Quote from: a1ex on August 26, 2012, 11:54:20 PM
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
These EDMAC registers are also valid in the DIGIC III?
You can post them here.
I have no idea what's inside DIGIC III.
Thanks Alex, I'll analyze the problem better
One way to find vram:
All vram buffers are like structures, with off_0x00 pointing to a string in the ROM that says "Vram Instance". There's a few of these so you'll have to check for all of them. But, you can dump say the first 0x10000 bytes of ram and look for these pointers. Tip for dumping: you might need to do what I have to do with the 5dc (which I learned from 0xAF with the 400d) and dump using a buffer.
For whatever reason, I can't seem to dump very much without using a buffer. simple code:
//~ dump memory 64kb at a time using a buffer.
void dump_with_buffer(int addr, int len, char* filename)
{
FIO_RemoveFile(filename);
FILE* f = FIO_CreateFile(filename);
if (f!=-1)
{
int address = addr;
while (address<addr+len)
{
char buf[0x10000];
memcpy(buf, (void*)address, 0x10000);
FIO_WriteFile(f, buf, 0x10000);
address += 0x10000;
}
FIO_CloseFile(f);
}
}
when I found the 5dc vram, I did it a bit oddly. I used img.py (http://magiclantern.wikia.com/wiki/VRAM/550D#How_to_find_segments[/url]). You should look into this. You already know the dimensions of the buffer (same as 5dc): 720x240 with a pitch of 360 I believe. so, dump an area of memory and run it all through img.py to see if you can see the menu or whatever screen you dumped the ram at.
Coutts, once again thank you for your help.
I already knew that page. I've also ran this section of your code.
I've done dump part of RAM, but I have not had time to test this python script. Once I have the opportunity I will do this test.
However, I've spent a few hours looking at the 40D firmware. I identified many functions on my camera.
I think there are too many in your 5DC. If you want I send you my stubs for 40D v1.1.1.
I try to read all your posts. You have written some things that I have been very useful for my port.
Soon I will try to present some results. I've been working on it a little every day.
I have found many functions in 40D firmware.
These are the ones that create the state objects (I still do not know if missing some function)
NSTUB(0xFFD4F17C, CreateTaskClass);
NSTUB(0xFFD4EE48, CreateStateObject);
NSTUB(0xFFB04634, DpImgEditState_CreateStateObject);
NSTUB(0xFFB06DC4, DpState_CreateStateObject);
NSTUB(0xFFBB0A2C, TOMState_CreateStateObject);
NSTUB(0xFFC7F9E0, USBC20State_CreateStateObject);
NSTUB(0xFFBB7DFC, CeresState_CreateStateObject);
NSTUB(0xFFB72BEC, PtpDpsState_CreateStateObject);
NSTUB(0xFF84BD74, RMTState_CreateStateObject);
NSTUB(0xFFB57FC4, FSSState_CreateStateObject);
NSTUB(0xFFC86AFC, PropState_CreateStateObject);
NSTUB(0xFFB618B8, RDState_CreateStateObject);
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);
NSTUB(0xFFB32CB8, LVState_CreateStateObject);
NSTUB(0xFFBFDB18, FWState_CreateStateObject);
NSTUB(0xFFBFB9A8, FRState_CreateStateObject);
NSTUB(0xFFBF0B6C, MrkState_CreateStateObject);
NSTUB(0xFFB56580, FCSState_CreateStateObject);
NSTUB(0xFFBAE9D8, SdioTskState_CreateStateObject);
NSTUB(0xFFBD5564, FMNormalState_CreateStateObject);
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);
Yay!
http://a1ex.bitbucket.org/ML/states/40D-alt/index.html
Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc
Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
Alex,
Thanks for your help.
I'll do this test ..
Quote from: a1ex on September 09, 2012, 11:30:54 AM
Yay!
http://a1ex.bitbucket.org/ML/states/40D-alt/index.html
Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc
Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
----------------------------------------
Alex,
I want to know which of your script made this excellent work. I have little experience in the use of your tools. I saw nothing that did that.
I found hundreds of methods in firmware but it took me many hours looking at the assembly.
And how did you get those addresses? ...
Thanks in advance ...
How is this going on? :)
This one:
1) guessfunc.run(dump) in arm console
2) run -i namefuncx.py
http://a1ex.magiclantern.fm/name_funcx.py
IT'S WORKING !!! IT'S WORKING !!! IT'S WORKING !!!
Alex, thanks for the tip
Finally, I got a little time I did the test and it worked!!
I got the JPEG successfully.
LV - JPEG
1024 x 680
-----
LCD
mode : w x h
0 : 720 x 240
1 : 704 x 480
2 : 720 x 576
51722: 13249.867 [DispCon] TurnOnDisplay (PUB)
51723: 13266.642 [LV] lvSetPsave 0x0
51724: 13267.371 [LV] LV_GetPtpZoomWindowArea IX=1560(16384), IY=1038(0)
51725: 13267.404 [LV] LV_GetPtpZoomWindowArea CX=0, CY=0
51726: 13268.004 [LV] lvSetWbIntegRegisterForAe 1
51727: 13268.045 [LV] StartLiveViewWbPass
51728: 13268.920 [LVCDEV]->lvcdevStartDev
51729: 13270.190 [LV] lvResetPsave
51730: 13270.396 [LV] WB 1974 1151 1151 2533(1377)
51731: 13270.503 [LV] lvResetPsave(1) 0x5A 0x454 0x49E
51732: 13270.528 [LV] lvResetPsave(2) 0x0 0x0 0x0
51733: 13271.801 [LVCDEV]->lvcdevResourceGet(0,1)
[b]51734: 13272.366 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0[/b]
51735: 13275.198 [LV] lvVDInterrupt
51736: 13275.363 [LV] WB 1974 1151 1151 2533(1158)
51737: 13279.334 [DEV] LV_JPG YuvWriteCompleteCBR
51738: 13279.373 [DEV] LV_JPG YUVReadCompleteCBR
51739: 13279.499 [DEV] LV_JPG JpCoreCompleteCBR( 0x2e1c6 )
51740: 13279.553 [DEV] LV_JPG JpegPopCompleteCBR
[b] 51741: 13279.672 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1ca9e28e Y411:0x107a0e20[/b]
51742: 13280.277 [LVCDEV]->PD(VF:0x107927ec,MS:0x485540)
[b] 51743: 13282.818 [LV] lvReturnVram[/b]
51744: 13282.851 < GUI Lock > GUILock_PermitPowerLock (PUB)
51745: 13283.134 < GUI Lock > GUILockTask 1
In 2008 dataghost teased the world be getting video from his 40d. Now it looks like it might just happen for other 40d users. Congratulation on your hard work!!!
Yay!
I think this is a lot better than Dataghost obtained (I've followed the thread back then). If all goes well, we will have MJPEG 422 at 1024x680.
Sure, we need to have a working port first. If you share the current status and code, I can help with this.
Congrats you have done marvelous job...........eagerly waiting to use it on my 40d :)
Thank you all, but this would not have been possible without your help.
The Coutts, Chucho and the A1ex helped me a lot.
I have to thank also to the guys of CHDK. In the past they did an excellent job.
Without this work and without tools Alex would be very complicated.
I have spent many hours on it. I'm a little tired. Once you have a little time, I'll share with you my code.
My next steps will be to change the boot process.
I want to do something similar to what exists for other cameras.
I've read some things and did not seem very complex. With time and with your help will be easy.
Take it easy. This low-level stuff can take a lot of time, even for experienced people.
'Vram Instance' : 0xFF9B943C
That's the same LV resolution as the 50D, what about frame rates though?
Some strings from 40dv111 ...
s vram
[b]ffca0178: '[IMP] CreateVram %d' [/b]
ffca0930: '[IMP] CompleteVramSyncroClearCBR err:%d'
ffca0d48: '[IMP] (PUB) SetVramInformation(w:%ld h:%ld) %d'
[b]ffca7528: '[IMPV] MakeHDVram %d' [/b]
ffca0e9c: '[IMP] DrawImageToVram GetJpegInfo():%d'
ffca1298: '[IMP] (PUB) RefreshImageVram %d'
ffca12b8: '[IMP] RefreshImageVram : VramNo not found'
ffca15a8: '[IMP] (PUB) AbortDrawImageToVram %d'
[b]ffca648c: '[IMPV] SetVramImageInfo %d' [/b]
ffca2c04: '[IMP] (PUB) SyncroClearImagePlayVram %d'
ffca089c: '[IMP] ImageVramCompleteCBR err:%d'
ffca349c: '[IMP] (PUB) SetVisibleImageVramOffset %d'
ffca3518: '[IMP] pVramImagePositionY %d'
ffcaff38: 'Not Exist Bitmap Vram!!'
[b]ffca32fc: '[IMP] (PUB) GetVramImageInfo %d' [/b]
[b]ffca0ec4: '[IMP] ERROR DrawImageToVram %s, %d' [/b]
ffca644c: '[IMPV] Complete MakeHDVram Error(%d)\n'
[b] ffca64a8: '[IMPV] SetVramImageInfo x:%ld y:%ld w:%ld h:%ld' [/b]
ff906cd4: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramWidth(%d)'
ff906d88: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramHeight(%d)'
ffca087c: '[IMP] ImageVramCompleteCBR %d'
[b]ffca12e4: '[IMP] RefreshImageVram VramAdd:0x%lX' [/b]
[b]ffca7b8c: '[IMPV] MakeHDVramFromJpeg Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7f74: '[IMPV] (PUB) MakeHDVramCheck %d' [/b]
[b]ffca8254: '[IMPV] GetVramImagePosAndSize s:%ld y:%ld w:%ld h:%ld' [/b]
[b]ffca01b4: '[IMP] Vram%d:0x%lX' [/b]
ffca34f8: '[IMP] pVramImagePositionX %d'
[b]ffcb16fc: '[BmpDDev] RefreshPhysicalVram (PUB)' [/b]
ffca7c84: '[IMPV] MakeHDVram Error!'
ffca02a8: '[IMP] DeleteVram %d'
ffca02bc: '[IMP] CopyCurrentDisplayVramToIdleVram %d'
ffca08c0: '[IMP] CompleteVramSyncroCopyCBR %d'
[b]ffcb0290: '[BmpDDev] CreatePhysicalVram (PUB)' [/b]
[b]ffb2d1d0: 'lv_vram_dump' [/b]
ffca7bd8: '[IMPV] WorkAdd:0x%lX VramAdd:0x%lX RotWork:0x%lX'
[b]ffca7b68: '[IMPV] (PUB) MakeHDVramFromJpeg %d' [/b]
ffca7c50: '[IMPV] VramWork basew:%ld x:%ld y:%ld w:%ld h:%ld'
[b]ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d' [/b]
ffca2984: '[IMP] ERR: Not Found Display Vram'
ffcb03b4: '[BmpDDev] DeletePhysicalVram (PUB)'
ffca822c: '[IMPV] (PUB) GetVramImagePosAndSize %d'
ffcb1ba8: '[ImgDDev] WARNING Divide Zero Vram Width (%d)'
ffca2ff8: '[IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine %d'
ff9122a4: '[GUI] CalcLvVramSize VramSize X(%d) Y(%d) W(%d) H(%d)'
[b]ffb32b30: '[LV] lvReturnVram' [/b]
ffcb3204: 'Already Vram For Adjust!!'
ff8b30ac: '[GUI] PlayModel.c DrawAspectFrame VramSize X(%d) Y(%d) W(%d) H(%d)'
ffca331c: '[IMP] GetVramImageInfo x:%ld y:%ld w:%ld h:%ld'
ffca334c: '[IMP] (STUB) SetImageVramColorMode(color:%ld) %d'
ffcb3530: 'Not Exist Vram For Adjust!!'
ffb34d94: '[LV] WriteEDmacVramCompleteCBR_x5'
[b]ffca3810: '[IMP] (PUB) GetVramInformation %d' [/b]
ffca08e4: '[IMP] CompleteVramSyncroCopyCBR err:%d'
ffca090c: '[IMP] CompleteVramSyncroClearCBR %d'
ffb361c4: '[LV] WriteEDmacVramCompleteCBR_x10'
ff883b18: '[TestEndDrawToVram] dwErrCode = %d'
ffcb8b6c: '[DispCon] GetVramSize (PUB)'
ffb39140: '[LV] WriteEDmacVramCompleteCBR_x1'
[b]ff9b943c: 'Vram Instance' [/b]
ff9b9558: 'pVram->Image.pPaletteIndex != NULL'
ff9b9594: '!IS_ERROR(pVram->hSemaphore)'
ff9b96b0: 'pVram->Mode == LOGICAL_VRAM'
ffca2e4c: '[IMP] (PUB) SyncroAllClearImagePlayIdleVramWithoutEngine %d'
ffca2e88: '[IMP] ERROR : Vram State'
ffca0e6c: '[IMP] (PUB) DrawImageToVram(rot:%d cb:0x%lX) %d'
ffca0d88: '[IMP] (PUB) SetCopyVramMode(mode=%d) %d'
ff87ece8: ' [Graphics] EndDrawToVram (PRI), err %d'
ffcaa8bc: '[IMP][PBFEN] Fencing_StartVRAMMode'
ffca0e0c: 'SetImageVramParameter x:%ld y:%ld w:%ld h:%ld/* Aspect:%d*/'
ffc9ff6c: '[IMP] GetVramNumber %d'
ffc9ffa0: '[IMP] SetVramImageParameter %d'
ffc9ffc0: '[IMP] SetVramImageParameter add:0x%lX BaseW:%ld'
s 411
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffc492c0: '[DPATH] LV_YPACK START Y411:%#lx YPACK:%#lx'
ffc492ec: '[DPATH] LV_YPACK STOP Y411:%#lx YPACK:%#lx'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc46e00: '[DPATH] LV_JPG START Y:%#lx J:%#lx Y411:%#lx'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffc46fbc: '[DPATH] LV_JPG STOP Y:%#lx J:%#lx Y411:%#lx'
ffc96db0: '[IMP][PBRSZ] GetCnv411Mode %d'
s 422
ffc96d90: '[IMP][PBRSZ] GetCnv422Mode %d'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
s YUV
ffc95578: '<RESIZE> SetParameterResizeYuv Abort End Before Lock'
ffc955fc: '[IMP][PBRSZ] RequestResizeYuv RdAdr:%#lx, WrAdr:%#lx'
ffcb56b8: 'gyuv'
ffb301f8: '[LV] YuvAddress = 0x%08lX'
ffb00db8: 'Dp_ReduceImageData_Yuv()'
ffc498dc: 'PonyYuvPath'
ffc95810: '[IMP][PBRSZ] RegisterCBROfCompleteResizeYuv %d'
ffb01094: 'Dp_AdobeRgbToSRgb_Yuv()'
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffb013c0: 'Dp_ClearWidth_Yuv()'
ffc959b8: '[IMP][PBRSZ] Zoom:%d InYuv:%d OutYuv:%d'
ffafaf14: 'Dp_ExecuteYuvRotatingCBR() ErrorCode [0x%08x]'
ffc49f7c: '[DEV] Pony YuvWriteCompleteCBR'
ffca6754: '[IMPV] Yuv:%d Add:0x%lX BaseW:%ld'
ffb02720: 'Dp_CopyImageData_Yuv()'
ffb02738: 'pDstYuvDataAddress [%d]'
ffb02750: 'pSrcYuvDataAddress [%d]'
ffc45c34: 'FactoryYuvPath'
ffc444b8: '[DEV] JPG_EN YuvWriteCompleteCBR'
ffaf9fa8: 'Dp_YuvToYuv()'
ffca47a8: '[IMPL] Yuv:%d Add:0x%lX BaseW:%ld'
ffca4c1c: '[IMPL] (PUB) CalculateYuvResizeParameter %d'
ffb36258: '[LV] WriteEDmacYuvCompleteCBR_x10'
ffc988b0: '<ROTATE> RequestRotationYuv Before Lock'
ffca5294: '[IMPL]_CalcResizeSizeForRotZoom InYuv:%d OutYuv:%d Aspect:%d'
ff84534c: '[FA] FA_YuvDevelopTestImage'
ffca580c: '[IMPL] _CalcResizeSize InYuv:%d OutYuv:%d Aspect:%d'
ffc4604c: '[DEV] FactoryYuvPath_ChangeCBR(ID=%#lx)'
ffca630c: '[IMPV] GetAjustUnitYUV %d'
ffb018bc: 'Dp_CutImageWidth_Yuv()'
ffca6dec: '[IMPV] YuvMode:%d'
ffc47068: '[DEV] LV_JPG YuvWriteCompleteCBR'
ffca72e0: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffca730c: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffcadf00: '[IMP][DECWIN] SetNQDecParam adr:0x%08lX yuv:%d'
ffb01438: 'Dp_ExpandImageWidth_Yuv()'
ffb01490: 'Dp_ShiftYuvRotationData_Yuv()'
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
ffc49c90: '[DPATH] Pony2 START YUV1:%#lx YUV2:%#lx'
ffc9c32c: '[IMPD] (PUB) ExecuteYuvRotating %d'
ffcb6ddc: '[DispCon] Err Factory Adjust For DisplayYUVGain'
ffc49ae4: '[DPATH] Pony1 START C:%#lx YUV:%#lx'
ffc49c2c: '[DPATH] Pony1 STOP C:%#lx YUV:%#lx'
ffc458c0: '[DEV] YuvWriteCompleteCBR'
ffc47048: '[DEV] LV_JPG YUVReadCompleteCBR'
ffb01b2c: 'Dp_AdjustCroppingSize_Yuv()'
ffc49e94: '[DPATH] Pony2 ReStartPonyYuvPath2'
ffb0134c: 'Dp_ClearHeight_Yuv()'
ffc49eb8: '[DPATH] Pony2 STOP YUV1:%#lx YUV2:%#lx'
ffc99db0: '[IMPD] YuvMode:%d'
ffc99de4: '[IMPD] StartYuvResizing Comp'
[b]ffb2d1e0: 'lv_yuv_dump' [/b]
ffcad330: '[IMP][DECWIN] SetResizeParam OutYuv:%d InputSel:%d'
ffcada9c: '[IMP][DECWIN] SetWinResDecParam adr:0x%08lX yuv:%d base:%ld'
ffcb15fc: '[BmpDDev] GetYUVPaletteFromDisplayDevice (PUB)'
ffb02798: 'Dp_ShiftImageHeight_Yuv()'
ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d'
ffc8f344: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc8f3a0: '[IMP][PBLOT] RequestRotationYuv Before Lock'
ffcb0608: '[BmpDDev] SetYUVPaletteToDisplayDeviceh (PUB)'
ffad0f50: 'YuvMode[%d]'
ffad0fd0: 'YuvMode[%d] BaseAddress[%d]'
ffafa738: 'ResizeYuvT Input nYuvMode [%d]'
ffb391d4: '[LV] WriteEDmacYuvCompleteCBR_x1'
ffc98708: '[IMP][PBROT] OUTPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffca6d94: '[IMPV] ZoomMode:%d YuvMode:%d'
ffb0ff6c: 'Dp_YuvToJpeg [0x%08x]'
ffcadfa0: '[IMP][DECWIN] pYuvAddress:%#lx'
ffb02004: 'Dp_AdjustFrameWithWhite_Yuv()'
ffb34e28: '[LV] WriteEDmacYuvCompleteCBR_x5'
ffca5dd0: '[IMPL] rot:%d zoom:%d inYUV:%d outYUV:%d'
ffcb8d9c: '[DispCon] GetYUVGain'
ffc95520: '[IMP][PBRSZ] SetParameterResizeYuvForMovie %d'
ffc95634: '<RESIZE> RequestResizeYuv Abort End Before Lock'
ffc95664: '[IMP][PBRSZ] ERROR pResizeYuvCompleteCBR is NULL'
ffc95698: '[IMP][PBRSZ] CancelResizeYuv %d'
ffc95840: '[IMP][PBRSZ] UnregisterCBROfCompleteResizeYuv %d'
ffc95874: '[IMP][PBRSZ] AbortResizeYuv %d'
ffc96334: '[IMP][PBRSZ] Input:%ld Output:%ld InYuv_f:%ld OutYuv_f:%ld'
ffc46030: '[DEV] YuvWriteCompleteCBR'
ffc4937c: '[DEV] LV_YPACK YuvReadCompleteCBR'
ffb0ff5c: 'Dp_YuvToJpeg()'
ffcb7564: "[DispCon] Warning: YUV Gain Don't Adjust"
ffb17f6c: '[GYO]Dp_YUVDustReduction'
ffc98684: '[IMP][PBROT] SetParameterRotationYuv %d'
ffc986ac: '[IMP][PBROT] INPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffc98838: '[IMP][PBROT] RequestRotationYuv %d'
ffc9885c: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc98cc0: '[IMP][PBROT] CancelRotationYuv %d'
ffc98ce4: '[IMP][PBROT] RegisterCBROfCompleteRotationYuv %d'
ffc98d18: '[IMP][PBROT] UnregisterCBROfCompleteRotationYuv %d'
ffaf9720: 'Dp_JpegToYuvNew() Layout[0x%08x]'
ffaf97a4: 'Dp_JpegToYuvNew [0x%08x]'
ffcad788: '[IMP][DECWIN] SetResWinParam yuv:%d InputSel:%d'
ffb01160: 'YuvBaseAddress [0x%08x]'
ffc99dc4: '[IMPD] StartYuvResizing TIMEOUT'
ffc9a150: '[IMPD] StartYuvRotating Comp'
ffafa4cc: 'Not Executed Dp_YuvToYuvHalf()'
ffafa6a8: 'Dp_YuvToYuvCopy()'
ffafa6d8: 'Dp_YuvToYuvReduce()'
ffafa720: 'Dp_ExecuteYuvResizing()'
ffafa758: 'ResizeYuvT Output nYuvMode [%d]'
ffafa998: 'Dp_ExecuteYuvResizingCBR() ErrorCode [0x%08x]'
ffafa9dc: 'Dp_YuvRotation() Rotate:%d'
ffc8f1c8: 'EvenSize >= YuvUnit'
ffc9f1e0: ' < IMD > ERR: YUV mode'
ffafaf44: 'ExecuteYuvRotation'
ffc99d44: '[IMPD] StartYuvResizing %d'
ffc955d0: '<RESIZE> SetParameterResizeYuv Before Lock'
ffc99d78: '[IMPD] ZoomMode:%d YuvMode:%d'
ffc99e04: '[IMPD] ResizeYuv:%d'
ffc9b9d8: '[IMPD] ERROR Dpx_ExecuteYuvAngleAdjust %d'
ffc49f9c: '[DEV] PonyYuvPath_ChangeCBR(ID=%#lx)'
ffc9c308: '[IMPD] (PUB) ExecuteYuvResizing %d'
ffc9a0f0: '[IMPD] StartYuvRotating %d'
ffcaf664: ' [BmpDDev] ConvertYUVPaletteToPBPalette (PRI)'
ffc44d70: '[DPATH] DCF_EN START DCF:%#lx YUV:%#lx'
ffc44f24: '[DPATH] DCF_EN STOP DCF:%#lx YUV:%#lx'
ffafa4b8: 'Dp_YuvToYuvHalf()'
ffc9c350: '[IMPD] (PUB) ExecuteYuvRotatingFor2Buffer %d'
ffafa68c: 'Dp_YuvToYuv64up() W:%d H:%d'
ff83e778: 'FA_YuvDevelopTestImage'
ff83e844: 'FA_GetYuvImage'
ffb151a8: 'YUV-Control Done'
ffca62f4: '[IMPV] SetUnitYUV %d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
ffafa9c8: 'ExecuteYuvResize'
ff845488: '[FA] FA_GetYuvImage'
ffca0e48: '[IMP] (PUB) SetYuvColorParameter %d'
ffc95550: '[IMP][PBRSZ] SetParameterResizeYuv %d'
something interesting... mbm29lv2mx16
ROM:FFD5D808 aAssertionFai_0 DCB "Assertion failed: (char*)WriteDataInFastModeOnRam > (char*)Erasi"
ROM:FFD5D808 ; DATA XREF: sub_FFD5DE00+28o
ROM:FFD5D808 ; ROM:off_FFD5DE80o
ROM:FFD5D808 DCB "ngMethodOnRam, file ../MTD/mbm29lv2mx16/mbm29lv2mx16.c, line 86",0xA
some more addresses : 0xC0F1407C , 0xC0F14074
In [12]: r 0xC0F1407C
str:[DispCon]_TurnOnDisplay_PUB+172:
str:[DispCon]_ShowBitmap_PUB+60:
str:[DispCon]_HideBitmap_PUB+60:
str:[DispCon]_SetDisplayType_PUB+372:
In [13]: r 0xC0F14074
str:[DispCon]_ShowImage_PUB+60:
str:[DispCon]_HideImage_PUB+60:
str:[DispCon]_SetDisplayType_PUB+356:
str:[DispCon]_TurnOnDisplay_PUB+156:
GetDisplayType_FFCB8668
return *0xBEA0
--------------------------------------------------------------------------------
GetDisplayWidth_FFCB6CAC
if *0xBEA4 == 0 /*EQ*/:
return 720
return 704
--------------------------------------------------------------------------------
GetDisplayHeight_FFCB8B04
if *0xBEA4 == 0 /*EQ*/:
return 240
if *0xBEA4 == 1 /*EQ*/:
return 480
return 576
--------------------------------------------------------------------------------
Display Resolution/Mode (maybe):
0 : w = 720, h = 240
1 : w = 704, h = 480
2 : w = 704, h = 576
--------------------------------------------------------------------------------
0x5B74 : unknown
0x5B78 : unknown
0x5BB8 : unknown
0x5BF8 : Vram Instance (maybe)
0x5BFC : unknown
0x5C00 : unknown
0x5C04 : unknown
0x5C08 : unknown
0x5C0C : unknown
0xB854 : unknown
0xBEA0 : DISPLAY TYPE
0xBEA4 : DISPLAY MODE (maybe)
0x1E004 : VRAM SEMAPHORE (maybe)
0x1E010 : VRAM INFORMATION
0x1E0A8 : unknown
0x1E100 : VRAM PARAMETERS // 0x1E0A8 + 0x58 = 0x1E100
302: 589.004 [GUI] MasterResultCBR
303: 589.210 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
304: 589.992 [GUI] -> handleGuiInit
305: 595.929 [DispCon] InitializeDisplayDeviceController (PUB)
306: 597.086 [IMP] (PUB) InitializeImagePlayer 1113
307: 598.805 [CERES] RegisterAdapterStatusCallback
308: 604.642 [Graphics] GuiStartGraphics (PUB)
309: 605.045 [IMP] (PUB) StartImagePlayer(mode=0) 1189
310: 605.096 [IMP] CreateVram 665
311: 605.252 [IMP] Vram0:0x1065BE00
312: 605.354 [IMP] Vram1:0x106F3C8C
...
858: 10003.647 myTaskDumpf:80: [MY_TEST] VRAM INFO:
859: 10003.702 myTaskDumpf:84: [MY_TEST] Show ImageVramParameter : x:0 y:24 w:720 h:216
861: 10118.505 [IMP] (PUB) GetVramInformation 3766
862: 10118.608 myTaskDumpf:101: [MY_TEST] GetVramInformation : arg0=1065BE00 ; Vram0
863: 10118.642 myTaskDumpf:102: [MY_TEST] GetVramInformation : arg1=00000000
864: 10118.683 myTaskDumpf:103: [MY_TEST] GetVramInformation : arg2=106F3C8C ; Vram1
865: 10118.708 myTaskDumpf:104: [MY_TEST] GetVramInformation : arg3=00000002
866: 10118.739 myTaskDumpf:105: [MY_TEST] GetVramInformation : arg4=000002D0 ; 720
867: 10118.768 myTaskDumpf:106: [MY_TEST] GetVramInformation : arg5=000002D0 ; 720
868: 10118.798 myTaskDumpf:107: [MY_TEST] GetVramInformation : arg6=000000F0 ; 240
0x1E010+0x00 -> arg0
0x1E010+0x04 -> arg4
0x1E010+0x08 -> arg5
0x1E010+0x0C -> arg6
0x1E010+0x10 -> arg1
0x1E010+0x14 -> arg2
0x1E010+0x24 -> arg3
Some more stubs :
NSTUB(0xFFCB02B4, CreatePhysicalVram)
NSTUB(0xFFCA01C8, CreateVram)
NSTUB(0xFFCA75C4, MakeHDVram)
NSTUB(0xFFB32EA0, LV_lvReturnVram)
NSTUB(0xFFCA130C, RefreshImageVram)
NSTUB(0xFFCA38DC, SetVramInformation)
NSTUB(0xFFCA432C, GetVramInformation)
NSTUB(0xFFCA3AA0, SetImageVramParameter)
NSTUB(0xFFCA6520, SetVramImageInfo)
NSTUB(0xFFCA3EC4, GetVramImageInfo)
NSTUB(0xFFCA8498, GetVramImagePosAndSize)
NSTUB(0xFFCA35D0, GetWorkImageLengthAndPosition)
I did dump some state-objects and found that the structure appears to be the same as 5DC.
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject); // Mem 0x7770 / state matrix : 0xFFB3C9D4
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject); // Mem 0x7748 / state matrix : 0xFFB3B540
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject); // Mem 0x7738 / state matrix : 0xFFB39F5C
NSTUB(0xFFB32CB8, LVState_CreateStateObject); // Mem 0x7628 / state matrix : 0xFFB2EDC4
NSTUB(0xFFD5CEA4, DMState_CreateStateObject); // Mem 0xEFDC / state matrix : 0xFFD5CD84
973: 11003.762 logMemory:24: DUMP DMState:
974: 11003.815 logMemory:30: MEM(0x00201AD8) = 0xFFD4EE3C : type - "StateObject"
975: 11003.861 logMemory:30: MEM(0x00201ADC) = 0xFFD5CD7C : name - "DMState"
976: 11003.890 logMemory:30: MEM(0x00201AE0) = 0x00000000 : auto_sequence
977: 11003.935 logMemory:30: MEM(0x00201AE4) = 0xFFD4F018 : StateTransition_maybe
978: 11003.980 logMemory:30: MEM(0x00201AE8) = 0xFFD5CD84 : state_matrix
979: 11004.009 logMemory:30: MEM(0x00201AEC) = 0x0000000E : max_inputs
980: 11004.039 logMemory:30: MEM(0x00201AF0) = 0x00000002 : max_states
981: 11004.069 logMemory:30: MEM(0x00201AF4) = 0x00000000 : current_state
983: 11004.124 logMemory:24: DUMP LVState:
984: 11004.169 logMemory:30: MEM(0x00797940) = 0xFFD4EE3C
985: 11004.214 logMemory:30: MEM(0x00797944) = 0xFFB2F454
986: 11004.244 logMemory:30: MEM(0x00797948) = 0x00000000
987: 11004.289 logMemory:30: MEM(0x0079794C) = 0xFFD4F018
988: 11004.335 logMemory:30: MEM(0x00797950) = 0xFFB2EDC4
989: 11004.366 logMemory:30: MEM(0x00797954) = 0x0000000F
990: 11004.396 logMemory:30: MEM(0x00797958) = 0x0000000E
991: 11004.426 logMemory:30: MEM(0x0079795C) = 0x00000000
993: 11004.483 logMemory:24: DUMP LVCAEState:
994: 11004.528 logMemory:30: MEM(0x00796FB4) = 0xFFD4EE3C
995: 11004.573 logMemory:30: MEM(0x00796FB8) = 0xFFB39F50
996: 11004.603 logMemory:30: MEM(0x00796FBC) = 0x00000000
997: 11004.648 logMemory:30: MEM(0x00796FC0) = 0xFFD4F018
998: 11004.693 logMemory:30: MEM(0x00796FC4) = 0xFFB39F5C
999: 11004.724 logMemory:30: MEM(0x00796FC8) = 0x0000000A
1000: 11004.754 logMemory:30: MEM(0x00796FCC) = 0x00000006
1001: 11004.784 logMemory:30: MEM(0x00796FD0) = 0x00000002
1003: 11004.841 logMemory:24: DUMP LVCAFState:
1004: 11004.887 logMemory:30: MEM(0x0079742C) = 0xFFD4EE3C
1005: 11004.932 logMemory:30: MEM(0x00797430) = 0xFFB3B534
1006: 11004.962 logMemory:30: MEM(0x00797434) = 0x00000000
1007: 11005.007 logMemory:30: MEM(0x00797438) = 0xFFD4F018
1008: 11005.052 logMemory:30: MEM(0x0079743C) = 0xFFB3B540
1009: 11005.082 logMemory:30: MEM(0x00797440) = 0x0000000C
1010: 11005.112 logMemory:30: MEM(0x00797444) = 0x00000009
1011: 11005.143 logMemory:30: MEM(0x00797448) = 0x00000001
1013: 11005.199 logMemory:24: DUMP LVCDEVState:
1014: 11005.245 logMemory:30: MEM(0x0079754C) = 0xFFD4EE3C
1015: 11005.290 logMemory:30: MEM(0x00797550) = 0xFFB3C9C8
1016: 11005.320 logMemory:30: MEM(0x00797554) = 0x00000000
1017: 11005.365 logMemory:30: MEM(0x00797558) = 0xFFD4F018
1018: 11005.410 logMemory:30: MEM(0x0079755C) = 0xFFB3C9D4
1019: 11005.440 logMemory:30: MEM(0x00797560) = 0x00000008
1020: 11005.471 logMemory:30: MEM(0x00797564) = 0x00000003
1021: 11005.501 logMemory:30: MEM(0x00797568) = 0x00000001
DUMP FROM MEMORY ADDRESS 0x0001E000:
MEM(0x0001E000) = 0x00000000 (0) // unknown parameter
MEM(0x0001E004) = 0x0011C1B0 (1163696) // VRAM SEMAPHORE (maybe)
MEM(0x0001E008) = 0x0011C18C (1163660) // maybe another semaphore
MEM(0x0001E00C) = 0x00000000 (0) // unknown parameter
MEM(0x0001E010) = 0x1065BE00 (275103232) // Vram0 address - (GetVramInformation - arg 0)
MEM(0x0001E014) = 0x000002D0 (720) // Vram0 width (maybe) - (GetVramInformation - arg 4)
MEM(0x0001E018) = 0x000002D0 (720) // Vram0 pitch (maybe) - (GetVramInformation - arg 5)
MEM(0x0001E01C) = 0x000000F0 (240) // Vram0 height (maybe) - (GetVramInformation - arg 6)
MEM(0x0001E020) = 0x00000000 (0) // unknown parameter - (GetVramInformation - arg 1)
MEM(0x0001E024) = 0x106F3C8C (275725452) // Vram1 address - (GetVramInformation - arg 2)
MEM(0x0001E028) = 0x000002D0 (720) // Vram1 width (maybe)
MEM(0x0001E02C) = 0x000002D0 (720) // Vram1 pitch (maybe)
MEM(0x0001E030) = 0x000000F0 (240) // Vram1 height (maybe)
MEM(0x0001E034) = 0x00000002 (2) // unknown parameter - (GetVramInformation - arg 3)
MEM(0x0001E038) = 0x1DBC0064 (498860132) // Some Video memory
MEM(0x0001E03C) = 0x00000798 (1944) // RAW (w / 2) - SRAW ???
MEM(0x0001E040) = 0x00000798 (1944) // RAW (w / 2) - SRAW ???
MEM(0x0001E044) = 0x00000510 (1296) // RAW (h / 2) - SRAW ???
MEM(0x0001E048) = 0x00000798 (1944) // WorkImageSize - w
MEM(0x0001E04C) = 0x00000510 (1296) // WorkImageSize - h
MEM(0x0001E050) = 0x00000000 (0)
MEM(0x0001E054) = 0x00000000 (0)
MEM(0x0001E058) = 0x00000000 (0)
MEM(0x0001E05C) = 0x00000000 (0)
MEM(0x0001E060) = 0x00000000 (0)
MEM(0x0001E064) = 0x00000000 (0)
MEM(0x0001E068) = 0x00000000 (0)
MEM(0x0001E06C) = 0x00000000 (0)
MEM(0x0001E070) = 0x00000000 (0)
MEM(0x0001E074) = 0x00000000 (0)
MEM(0x0001E078) = 0x00000000 (0)
MEM(0x0001E07C) = 0x00000000 (0)
MEM(0x0001E080) = 0x00000000 (0)
MEM(0x0001E084) = 0x00000000 (0)
MEM(0x0001E088) = 0x00484E5C (4738652)
MEM(0x0001E08C) = 0x00400000 (4194304)
MEM(0x0001E090) = 0x00000001 (1)
MEM(0x0001E094) = 0x00000F30 (3888) // JpegSize - w
MEM(0x0001E098) = 0x00000A20 (2592) // JpegSize - h
MEM(0x0001E09C) = 0x00001D40 (7488) // EffectiveSizeOfJpeg - w
MEM(0x0001E0A0) = 0x00001380 (4992) // EffectiveSizeOfJpeg - h
MEM(0x0001E0A4) = 0x00000000 (0)
MEM(0x0001E0A8) = 0x00000001 (1) // star of some structure - unknown parameter ???
MEM(0x0001E0AC) = 0x00000000 (0)
MEM(0x0001E0B0) = 0x00000000 (0)
MEM(0x0001E0B4) = 0x1DBC0064 (498860132) // SetImageWorkMemory - 1
MEM(0x0001E0B8) = 0x1E26F264 (505868900) // SetImageWorkMemory - 2
MEM(0x0001E0BC) = 0x106F3C8C (275725452) // Vram1 address
MEM(0x0001E0C0) = 0x00000000 (0)
MEM(0x0001E0C4) = 0x00484E5C (4738652)
MEM(0x0001E0C8) = 0x00400000 (4194304)
MEM(0x0001E0CC) = 0x00000000 (0)
MEM(0x0001E0D0) = 0x00000000 (0)
MEM(0x0001E0D4) = 0x00000F30 (3888) // RAW w
MEM(0x0001E0D8) = 0x00000A20 (2592) // RAW h
MEM(0x0001E0DC) = 0x000009C0 (2496) // SetImageWorkMaxPixel - w
MEM(0x0001E0E0) = 0x00000750 (1872) // SetImageWorkMaxPixel - h
MEM(0x0001E0E4) = 0x00000000 (0)
MEM(0x0001E0E8) = 0x00000000 (0)
MEM(0x0001E0EC) = 0x00000000 (0)
MEM(0x0001E0F0) = 0x00000000 (0)
MEM(0x0001E0F4) = 0x000002D0 (720)
MEM(0x0001E0F8) = 0x000001E0 (480)
MEM(0x0001E0FC) = 0x000002D0 (720)
================================================================
DUMP FROM MEMORY ADDRESS 0x0001E100:
MEM(0x0001E100) = 0x00000000 (0) // pVramImagePositionX - ImageVramParameter
MEM(0x0001E104) = 0x00000018 (24) // pVramImagePositionY - ImageVramParameter
MEM(0x0001E108) = 0x000002D0 (720) // WholeWidth - ImageVramParameter
MEM(0x0001E10C) = 0x000000D8 (216) // WholeHeigh - ImageVramParameter
MEM(0x0001E110) = 0x0001DC00 (121856) // Aspect - ImageVramParameter ???
MEM(0x0001E114) = 0x00000000 (0)
MEM(0x0001E118) = 0x00000000 (0)
MEM(0x0001E11C) = 0x00000000 (0)
MEM(0x0001E120) = 0x00000000 (0)
MEM(0x0001E124) = 0x00000000 (0)
MEM(0x0001E128) = 0x00000000 (0)
MEM(0x0001E12C) = 0x00000000 (0)
MEM(0x0001E130) = 0x00000000 (0)
MEM(0x0001E134) = 0x00000000 (0)
MEM(0x0001E138) = 0x00000000 (0)
MEM(0x0001E13C) = 0x00000000 (0)
MEM(0x0001E140) = 0x005E5558 (6182232)
MEM(0x0001E144) = 0x00000000 (0)
MEM(0x0001E148) = 0x0001DB90 (121744)
MEM(0x0001E14C) = 0x00000000 (0)
MEM(0x0001E150) = 0xFF8851E4 (-7843356)
MEM(0x0001E154) = 0x00012D6C (77164)
MEM(0x0001E158) = 0x00000000 (0)
MEM(0x0001E15C) = 0x00000000 (0)
MEM(0x0001E160) = 0xFFCA415C (-3522212)
MEM(0x0001E164) = 0x00000000 (0)
MEM(0x0001E168) = 0x00000000 (0)
MEM(0x0001E16C) = 0x00000000 (0)
MEM(0x0001E170) = 0x00000000 (0)
MEM(0x0001E174) = 0x00000000 (0) // SetVramImageInfo - x
MEM(0x0001E178) = 0x00000018 (24) // SetVramImageInfo - y
MEM(0x0001E17C) = 0x000002D0 (720) // SetVramImageInfo - w
MEM(0x0001E180) = 0x000000D8 (216) // SetVramImageInfo - h
MEM(0x0001E184) = 0x00000000 (0)
MEM(0x0001E188) = 0x00000000 (0)
MEM(0x0001E18C) = 0x106F3C8C (275725452) // Vram1 address
MEM(0x0001E190) = 0x000002D0 (720)
MEM(0x0001E194) = 0x000000F0 (240)
MEM(0x0001E198) = 0x00000000 (0)
MEM(0x0001E19C) = 0x00000018 (24)
MEM(0x0001E1A0) = 0x000002D0 (720)
MEM(0x0001E1A4) = 0x000000D8 (216)
MEM(0x0001E1A8) = 0x00000000 (0)
MEM(0x0001E1AC) = 0x00000000 (0)
MEM(0x0001E1B0) = 0x00000000 (0)
MEM(0x0001E1B4) = 0x00000000 (0)
MEM(0x0001E1B8) = 0x00000000 (0)
MEM(0x0001E1BC) = 0x00000000 (0)
MEM(0x0001E1C0) = 0x00000000 (0)
MEM(0x0001E1C4) = 0x00000000 (0)
MEM(0x0001E1C8) = 0x00000000 (0)
MEM(0x0001E1CC) = 0x00000000 (0)
MEM(0x0001E1D0) = 0x00000000 (0)
MEM(0x0001E1D4) = 0x00000000 (0)
MEM(0x0001E1D8) = 0x00000000 (0)
MEM(0x0001E1DC) = 0x00000000 (0)
MEM(0x0001E1E0) = 0x00000000 (0)
MEM(0x0001E1E4) = 0x00000000 (0)
MEM(0x0001E1E8) = 0x00000000 (0)
MEM(0x0001E1EC) = 0x00000000 (0)
MEM(0x0001E1F0) = 0x00000000 (0)
MEM(0x0001E1F4) = 0x00000000 (0)
MEM(0x0001E1F8) = 0x00000000 (0)
MEM(0x0001E1FC) = 0x00000000 (0)
Vram0:0x1065BE00
Vram1:0x106F3C8C
698: 3711.532 [GUI] StartPlayMain
699: 3718.551 [Graphics] CreateSharedBuffer !!!
700: 3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
701: 3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200
702: 3719.292 [Graphics] GuiGraphicsNormalMode (PUB)
ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264
0x1dbc0064 + 0x6af200 = 0x1e26f264
0x6af200 size (maybe)
Maybe YUV422 VRAM - Playback Image
I found four 'Vram Instance' strings in memory.
I believe that is the beginning of the structure vram_object.
I think two of them should be cacheable version and the other two uncacheable version.
0x00400B84
0x00800B84
0x10400B84
0x10800B84
I found a service menu on the 40D.
I ran the function at 0xFF8170D4 and appeared to me an error in the CMOS camera's LCD.
NSTUB(test_servicemenu_maybe, 0xFF8170D4) at v1.1.1
757: 59388.950 [GUI] DlgMnMainTabHeader.c PRESS_MLT_LEFT_BUTTON
758: 59403.149 [GUI] DlgMnMainPlay1 GOT_TOP_OF_CONTROL
760: 60043.684 [GUI_E] GUI_Control:60 0x0
761: 60044.247 [GUI] IDLEHandler SERVICE_MENU
762: 60044.300 [GUI] SetGUIRequestMode(25)
763: 60044.324 [GUI] NotifyGUIEvent(1)
---------------------------------------------
ERR 123 123 123 025 032
REL 11709
CMOS J0369547
---------------------------------------------
Be careful what you call, some things can do permanent damage.
Thank you Alex. I'll be careful. I am aware that there is dangerous.
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
For a first port, take a look at 7D changeset, once you find the stubs it's probably a good starting point.
Ok, i'll do that...
Thank you
Quote from: nanomad on September 19, 2012, 12:39:53 PM
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
I appreciate your advice. I've been through some of these stubs and thought the same.
I hope not to make any serious mistake ... I really want to have the ML in my precious camera.
Thank you
40D v 1.1.1 - StateObjects List
NSTUB(0x62B4, DpImgEditState);
NSTUB(0x5D88, DpState);
NSTUB(0x7E38, TOMState);
//NSTUB(, USBC20State_1);
//NSTUB(, USBC20State_2);
//NSTUB(, USBC20State_3);
//NSTUB(, USBC20State_4);
NSTUB(0x7E60, CeresStateState);
NSTUB(0x1AF60, PtpDpsStateState);
NSTUB(0x1AF64, PtpEvtListAccsSem);
NSTUB(0x1D34, RMTState);
NSTUB(0x7824, FSSState);
//NSTUB(0xB710, PropState); // maybe
NSTUB(0x7840, RDState);
NSTUB(0x7770, LVCDEVState);
NSTUB(0x7748, LVCAFState);
NSTUB(0x7738, LVCAEState);
NSTUB(0x7628, LVState);
//NSTUB(???, FWState);
//NSTUB(???, FRState);
NSTUB(0x834C, MrkState);
NSTUB(0x781C, FCSState);
NSTUB(0x7E10, SdioTskState);
NSTUB(0x82CC, FMNormalState);
NSTUB(0xEFDC, DMState);
Dump from 0x00007600 to 0x00008000, when camera menu is showed and mode equal to M :
MEM(0x00007600) = 0xFFB2BDA4 (-5063260)
MEM(0x00007604) = 0xFFB2C4A0 (-5061472)
MEM(0x00007608) = 0x00000000 (0)
MEM(0x0000760C) = 0x00000000 (0)
MEM(0x00007610) = 0x1024F09C (270856348)
MEM(0x00007614) = 0x00000001 (1)
MEM(0x00007618) = 0x10206DC0 (270560704)
MEM(0x0000761C) = 0x10252520 (270869792)
MEM(0x00007620) = 0x10223820 (270678048)
MEM(0x00007624) = 0x007975F4 (7960052)
MEM(0x00007628) = 0x00797940 (7960896)
MEM(0x0000762C) = 0x00000000 (0)
MEM(0x00007630) = 0xC0F03030 (-1058000848)
MEM(0x00007634) = 0x80010000 (-2147418112)
MEM(0x00007638) = 0xC0F03068 (-1058000792)
MEM(0x0000763C) = 0x80010004 (-2147418108)
MEM(0x00007640) = 0xC0F03070 (-1058000784)
MEM(0x00007644) = 0x80010007 (-2147418105)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
MEM(0x0000764C) = 0x00000000 (0)
MEM(0x00007650) = 0xFFFFFFFF (-1)
MEM(0x00007654) = 0xFFFFFFFF (-1)
MEM(0x00007658) = 0xC0F03044 (-1058000828)
MEM(0x0000765C) = 0x00000002 (2)
MEM(0x00007660) = 0xC0F03044 (-1058000828)
MEM(0x00007664) = 0x00000000 (0)
MEM(0x00007668) = 0xC0F0B000 (-1057968128)
MEM(0x0000766C) = 0x00000000 (0)
MEM(0x00007670) = 0xC0F0B004 (-1057968124)
MEM(0x00007674) = 0x00000001 (1)
MEM(0x00007678) = 0xC0F09000 (-1057976320)
MEM(0x0000767C) = 0x00000001 (1)
MEM(0x00007680) = 0xFFFFFFFF (-1)
MEM(0x00007684) = 0xFFFFFFFF (-1)
MEM(0x00007688) = 0xC0F09000 (-1057976320)
MEM(0x0000768C) = 0x80000000 (-
MEM(0x00007690) = 0xC0F0B000 (-1057968128)
MEM(0x00007694) = 0x00000001 (1)
MEM(0x00007698) = 0xC0F0B004 (-1057968124)
MEM(0x0000769C) = 0x00000000 (0)
MEM(0x000076A0) = 0xFFFFFFFF (-1)
MEM(0x000076A4) = 0xFFFFFFFF (-1)
MEM(0x000076A8) = 0xC0F03030 (-1058000848)
MEM(0x000076AC) = 0x00000000 (0)
MEM(0x000076B0) = 0xC0F03068 (-1058000792)
MEM(0x000076B4) = 0x00000000 (0)
MEM(0x000076B8) = 0xC0F03070 (-1058000784)
MEM(0x000076BC) = 0x00000000 (0)
MEM(0x000076C0) = 0xFFFFFFFF (-1)
MEM(0x000076C4) = 0xFFFFFFFF (-1)
MEM(0x000076C8) = 0xC0F0851C (-1057979108)
MEM(0x000076CC) = 0x00060258 (393816)
MEM(0x000076D0) = 0xC0F08520 (-1057979104)
MEM(0x000076D4) = 0x032C0568 (53216616)
MEM(0x000076D8) = 0xC0F11250 (-1057942960)
MEM(0x000076DC) = 0x00900000 (9437184)
MEM(0x000076E0) = 0xC0F11254 (-1057942956)
MEM(0x000076E4) = 0x028F02FF (42926847)
MEM(0x000076E8) = 0xFFFFFFFF (-1)
MEM(0x000076EC) = 0xFFFFFFFF (-1)
MEM(0x000076F0) = 0xC0F0851C (-1057979108)
MEM(0x000076F4) = 0x00060258 (393816)
MEM(0x000076F8) = 0xC0F08520 (-1057979104)
MEM(0x000076FC) = 0x032C0568 (53216616)
MEM(0x00007700) = 0xC0F11250 (-1057942960)
MEM(0x00007704) = 0x011000C0 (17825984)
MEM(0x00007708) = 0xC0F11254 (-1057942956)
MEM(0x0000770C) = 0x020F0241 (34538049)
MEM(0x00007710) = 0xFFFFFFFF (-1)
MEM(0x00007714) = 0xFFFFFFFF (-1)
MEM(0x00007718) = 0x00000000 (0)
MEM(0x0000771C) = 0x00000006 (6)
MEM(0x00007720) = 0xFFB38304 (-5012732)
MEM(0x00007724) = 0x00000000 (0)
MEM(0x00007728) = 0x00796F74 (7958388)
MEM(0x0000772C) = 0x00000000 (0)
MEM(0x00007730) = 0x00000000 (0)
MEM(0x00007734) = 0x00000000 (0)
MEM(0x00007738) = 0x00796FB4 (7958452)
MEM(0x0000773C) = 0x00000000 (0)
MEM(0x00007740) = 0x007973EC (7959532)
MEM(0x00007744) = 0x10202438 (270541880)
MEM(0x00007748) = 0x0079742C (7959596)
MEM(0x0000774C) = 0x00000000 (0)
MEM(0x00007750) = 0x00000000 (0)
MEM(0x00007754) = 0x0079750C (7959820)
MEM(0x00007758) = 0x00000000 (0)
MEM(0x0000775C) = 0x00000005 (5)
MEM(0x00007760) = 0x00000000 (0)
MEM(0x00007764) = 0x00000000 (0)
MEM(0x00007768) = 0x00000000 (0)
MEM(0x0000776C) = 0x00000000 (0)
MEM(0x00007770) = 0x0079754C (7959884)
MEM(0x00007774) = 0x00000000 (0)
MEM(0x00007778) = 0x00010339 (66361)
MEM(0x0000777C) = 0xFFFF0000 (-65536)
MEM(0x00007780) = 0x00040002 (262146)
MEM(0x00007784) = 0x00080004 (524292)
MEM(0x00007788) = 0x009000A4 (9437348)
MEM(0x0000778C) = 0x00200010 (2097168)
MEM(0x00007790) = 0x00FA0020 (16384032)
MEM(0x00007794) = 0x0015FF06 (1441542)
MEM(0x00007798) = 0xFFE80000 (-1572864)
MEM(0x0000779C) = 0x00100040 (1048640)
MEM(0x000077A0) = 0x0018000E (1572878)
MEM(0x000077A4) = 0x00480078 (4718712)
MEM(0x000077A8) = 0x00000010 (16)
MEM(0x000077AC) = 0x00000098 (152)
MEM(0x000077B0) = 0x00000060 (96)
MEM(0x000077B4) = 0x00000088 (136)
MEM(0x000077B8) = 0x0000006F (111)
MEM(0x000077BC) = 0x00000048 (72)
MEM(0x000077C0) = 0x00000058 (88)
MEM(0x000077C4) = 0x00000056 (86)
MEM(0x000077C8) = 0x00000100 (256)
MEM(0x000077CC) = 0x00000080 (128)
MEM(0x000077D0) = 0x00000000 (0)
MEM(0x000077D4) = 0x00000000 (0)
MEM(0x000077D8) = 0x00000000 (0)
MEM(0x000077DC) = 0x00000000 (0)
MEM(0x000077E0) = 0x00000000 (0)
MEM(0x000077E4) = 0x00000000 (0)
MEM(0x000077E8) = 0x00000000 (0)
MEM(0x000077EC) = 0x00000001 (1)
MEM(0x000077F0) = 0x00000000 (0)
MEM(0x000077F4) = 0x00000000 (0)
MEM(0x000077F8) = 0x00000004 (4)
MEM(0x000077FC) = 0x00000000 (0)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
Quote from: a1ex on August 26, 2012, 11:54:20 PM
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
These are the values I got ...
EDMAC Registers (maybe)
MEM(0xC0F04008) = 0x3FBFFFF6
MEM(0xC0F04108) = 0x3695B69E
MEM(0xC0F04208) = 0x3F802DFC
MEM(0xC0F04308) = 0x1BB044CA
MEM(0xC0F04408) = 0x3E04583E
MEM(0xC0F04508) = 0x3A91B07C
MEM(0xC0F04608) = 0x1EA3FFCC
MEM(0xC0F04708) = 0x00000000
MEM(0xC0F04808) = 0x3A6F3EDE
MEM(0xC0F04908) = 0x3F20DE9E
MEM(0xC0F04A08) = 0x3D701EFE
MEM(0xC0F04B08) = 0x194F3D52
MEM(0xC0F04C08) = 0x34794AD6
MEM(0xC0F04D08) = 0x2A674EDE
MEM(0xC0F04E08) = 0x00000000
MEM(0xC0F04F08) = 0x00000000
at 0xFFCF8184 : MOV R3, 0xC0F04008
NSTUB(0xFFCF8184, GetEDmacAddress)
Doesn't look like anything known, so it's probably not edmac.
I also did not like the results.
I found several LV functions that are registered, so they can be invoked by name.
FW v 1.1.1
NSTUB(0xFFB2E208, lv_start)
NSTUB(0xFFB2E244, lv_stop)
NSTUB(0xFFB2E280, lv_vram_dump)
NSTUB(0xFFB2E308, lv_yuv_dump)
NSTUB(0xFFB2E38C, lv_fps)
NSTUB(0xFFB2E3FC, lv_psave_on)
NSTUB(0xFFB2E46C, lv_psave_off)
NSTUB(0xFFB2DB54, lv_debug_ae)
NSTUB(0xFFB2DCF4, lv_debug_wb)
NSTUB(0xFFB2E4DC, lv_debug_af)
NSTUB(0xFFB2E5F8, lv_ae)
NSTUB(0xFFB2E668, lv_wb)
NSTUB(0xFFB2E6D8, lv_af_raw)
NSTUB(0xFFB2E748, lv_debug_flag)
NSTUB(0xFFB2E588, lv_data_count)
NSTUB(0xFFB2E82C, lv_eshutter)
NSTUB(0xFFB2E97C, lv_tvaf_start)
NSTUB(0xFFB2E89C, lv_magnify)
NSTUB(0xFFB2E90C, lv_save_raw)
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know, if there is a lantern at the end of the tunnel;)
Is there any way to support you?
Kind regards
Uwe
Quote from: LensPainter on September 21, 2012, 10:01:58 AM
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know,
if there is a lantern at the end of the tunnel;)
Is there any way to support you?
Kind regards
Uwe
I'm also very anxious to see the ML working for the first time ... and on my camera :)
I am new at this but I'm motivated ... soon I hope to ignite that light ...
for now i just lit the blue and red LED :)
I never received anything for my work, but donations are welcome.
They are the fuel needed to be able to see the light ... My God! :)
I found the location of the structure 'vram_info'.
/** VRAM info in the BSS.
*
* Pixels are in an YUV 422 format.
* This points to the image VRAM, not the bitmap vram
*/
struct vram_info
{
uint8_t * vram; // off 0x00
uint32_t width; // maybe off 0x04
uint32_t pitch; // maybe off 0x08
uint32_t height; // off 0x0c
uint32_t vram_number; // off 0x10
};
SIZE_CHECK_STRUCT( vram_info, 0x14 );
extern struct vram_info vram_info[2];
NSTUB(0x0001E010, vram_info)
MEM(0x0001E010) = 0x1065BE00 (275103232)
MEM(0x0001E014) = 0x000002D0 (720)
MEM(0x0001E018) = 0x000002D0 (720)
MEM(0x0001E01C) = 0x000000F0 (240)
MEM(0x0001E020) = 0x00000002 (2)
MEM(0x0001E024) = 0x106F3C8C (275725452)
MEM(0x0001E028) = 0x000002D0 (720)
MEM(0x0001E02C) = 0x000002D0 (720)
MEM(0x0001E030) = 0x000000F0 (240)
MEM(0x0001E034) = 0x00000000 (0)
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.
People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.
But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
Quote from: mediabaron on September 23, 2012, 04:36:05 AM
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.
People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.
But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
I have spent many hours with my camera, but I've done a few shots. I can not say when will release the first version for testing. I believe there are many users around the world who have this camera. I started this project because I feel a little revolted. The canon has never released a version with AF microadjustment. Many of us bought high quality lenses that would greatly benefit from this functionality. We gave billions of profit to Canon. I think they should respect us more and remember living of our money. I know the camera was discontinued but I did not let being a customer paying for a quality service. I may be a drop in the ocean with sharks but many, donald duck got rich collecting small coins. This is my response to the canon. If things go the way I want in a few months you can all enjoy my work without being forced to pay a penny.
I found some more interesting things:
strings -t x 40d.111.ROMF1.0xFF800000.bin | perl renumber.pl 0xFF800000 > 40d.111.ROMF1.0xFF800000.string
grep 40d.111.ROMF1.0xFF800000.strings -e "Mgr$"
ffacff30 DpMgr
ffb04078 DpImgEditMgr
ffb2d10c LiveViewMgr
ffbaee34 TOMgr
ffbc55a0 FileMgr
ffc49060 DDDMgr
ffc877fc PropMgr
ffd17614 CardServiceMgr
ffd4c084 DbgMgr
ffd5a30c PowerMgr
With this simple command is simple filter many of the file names of the source code.
Sometimes it may be useful to help find some things in the dump.
grep 40d.111.ROMF1.0xFF800000.strings -e ".*\.c" > 40d.111.ROMF1.0xFF800000.files
Some memory address at firmware:
ffff1c6c Write Address : 0x00000000
ffff1c8c Write Address : 0x04000000
ffff2714 4.Erase TORNADO and Command area (0x%x -> 0x%x)
ffff2748 5.Erase Program area (0xF8010000 -> 0xF862FFFF)
ffff3578 Is flg written(Y=ON(0xFFFFFFFF)/N=OFF(0x00000000))? :
ffff3608 Is flg written(Y=ON(0x00000000)/N=OFF(0xFFFFFFFF))? :
ffff3774 ERASE [ROM1][0x00000000]
ffff39e4 Input start_address (ram 0x00000000 -> 0x40000000) :
ffff3a1c Input end_address (ram 0x00000000 -> 0x40000000) :
ffff3a54 Input address (rom 0xf8000000 -> 0xf87FE000) :
ffff5914 FROM Check Sum is 0x%08x
ffff5930 ( 0xF8010000 - 0xF85FFFFF )
grep 40d.111.ROMF1.0xFF800000.strings -e ".*[GUI].*StartMn" | awk -F' ' '{ print $3 }' | sort | uniq -u
StartMnActiveSweepApp
StartMnActiveSweepAutoApp
StartMnBrightnessApp
StartMnBusyApp
StartMnBusyKeepEventBtnApp()
StartMnCameraClearApp
StartMnCameraRegApp
StartMnCameraRegConfirmApp
StartMnCameraUnRegApp
StartMnCameraUnRegConfirmApp
StartMnCameraUnRegSelectApp
StartMnCardExtensionApp
StartMnCardFormatBeginAp
StartMnCardFormatexcuteApp
StartMnCopyBusyApp()
StartMnCopyConfirmApp
StartMnCopyMsgApp(
StartMnCopyResultApp(
StartMnCustomFnApp(%d)(%d)
StartMnCustomFnClearApp
StartMnDustOffDataApp
StartMnDustOffDataCompleteApp
StartMnDustOffDataExcuteApp
StartMnEraseImageApp
StartMnEraseImageBusyApp
StartMnEraseImageConfirmApp
StartMnEraseImageDummyApp
StartMnHandWorkSweepApp
StartMnImageZoneQualityApp
StartMnLanguageApp
StartMnLiveViewApp
StartMnMainCustomFuncApp()
StartMnMainMyMenuApp()
StartMnMainPlay1App()
StartMnMainPlay2App()
StartMnMainRec1App()
StartMnMainRec2App()
StartMnMainSetup1App()
StartMnMainSetup2App()
StartMnMainSetup3App()
StartMnMainStudioApp()
StartMnMmMessageApp(
StartMnMwbImageConfirmApp
StartMnMWBWarningApp
StartMnMyMenuDeleteApp()
StartMnMyMenuPreRearrange(
StartMnMyMenuRearrange(
StartMnMyMenuSelect()
StartMnMyMenuSetting()
StartMnPictureStyleDetailApp
StartMnPictureStyleMain
StartMnPictureUserDetail
StartMnQualityApp
StartMnQualityDivideApp
StartMnQualityDivideSelectApp
StartMnSensorCleanApp
StartMnStroboBuiltInSettingApp
StartMnStroboControlApp
StartMnStroboCustomFnApp
StartMnStroboCustomFnClearApp
StartMnStroboErrorApp
StartMnStroboFnSettingApp
StartMnStroboFnSettingClearApp
StartMnStroboFnSettingHeaderApp()
StartMnStroboOldOutSettingApp
StartMnStroboWirelessApp
StartMnStudioModeChangeConfirmApp
StartMnWBApp
StartMnWbBktApp
With this command we can get the list of menus available in firmware. This command can be useful for finding the code some functionality that is available in the original firmware.
Some more strings...
grep -e "libc" 40d.111.ROMF1.0xFF800000.strings
ffcb9150 ../libcsvg/svg_canvas.c
ffcbd930 gfff../libcsvg/svg_paint.c
ffcbe118 ../libcsvg/svg_render.c
ffcbeb48 ../libcsvg/dom/dom.c
ffcbfc5c ../libcsvg/dom/dom_common.c
ffcc22e4 ../libcsvg/dom/dom_trait.c
ffcc629c ../libcsvg/core/attrib_core.c
ffcc6a88 ../libcsvg/core/attrib_graphics.c
ffcc733c ../libcsvg/core/attrib_paint.c
ffcca84c ../libcsvg/core/elem_anim.c
ffcd3138 ../libcsvg/core/elem_path.c
ffcd5b54 ../libcsvg/core/elem_shape.c
ffcd8354 ../libcsvg/core/elem_struct.c
ffcda5fc ../libcsvg/core/render_path.c
ffcdb054 ../libcsvg/core/render_shape.c
ffcdda64 ../libcsvg/core/stack_canvas.c
ffcddba4 ../libcsvg/core/stack_common.c
ffcddd38 ../libcsvg/core/stack_coordinate.c
ffcddedc ../libcsvg/core/stack_core.c
ffcde000 ../libcsvg/core/stack_element.c
ffcdebf8 ../libcsvg/core/stack_transform.c
ffce0f44 ../libcsvg/common/hash.c
ffce1274 ../libcsvg/common/id_table.c
ffce15b0 ../libcsvg/common/queue.c
ffce3a1c ../libcsvg/common/utils.c
ffce5bd8 ../libcucs/ucs.c
ffce9b34 ../libcsvg/common/uriref.c
ffcea324 ../libcsvg/svg_path.c
ffcef4e0 ../libcsvg/core/attrib_animtiming.c
ffcf09f4 ../libcsvg/core/datatype_preserveaspectratio.c
ffcf1568 ../libcsvg/core/render_anim.c
Those Start***App sometimes can be started, but it's not a clean method for using them IMO. These calls may bring the correct dialog, but they do not setup the keys (guimode) and probably other things.
There is a SVG library inside, but nobody figured out how to use it.
I keep looking for the addresses of VRAM ... My next goal is to write on the LCD.
Unfortunately I have not got great results ... soon, I hope to get this my goal.
I know there are many similarities between the 5DC and 40D cameras.
So I decided to look some things coutts already found in your 5DC.
from magic lantern source code...
/** Canon data structure containing BMP VRAM address.
*
* LCD: it points to a 720x480 cropped area, but the image buffer is actually 960x540.
* HDMI: it points to the full image buffer.
*
* ML alters this pointer to always indicate the 720x480 cropped area
* (to avoid the possibility of buffer overflow due to race conditions when changing display modes).
*/
struct bmp_vram_info
{
uint8_t * vram0;
uint32_t off_0x04;
uint8_t * vram2;
};
extern struct bmp_vram_info bmp_vram_info[];
from 5DC.111 firmware...
NSTUB(0x29448, bmp_vram_info)
MakeName(0xFFB0A95C, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFB0B174, "str:[BmpDDev]_DisplayPhysicalScreen");
REAL BMP VRAM : 0x29320+8 =0x29328
REAL BMP VRAM : 0x29330+8 =0x29338
REAL BMP VRAM : 0x29350+8 =0x29358
from 40D.111 firmware...
NSTUB(0x1E450, bmp_vram_info)
MakeName(0xFFCAFAE0, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFCB0468, "str:[BmpDDev]_DisplayPhysicalScreen");
REAL BMP VRAM : 0x1E328+8 = 1E330
REAL BMP VRAM : 0x1E338+8 = 1E340
REAL BMP VRAM : 0x1E358+8 = 1E360
Here are some of the logs generated by my tests ...
667: 10003.609 myTaskDumpf:204: [JP] VRAM INFO:
668: 10003.670 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x1065BE00
669: 10003.698 printVramInfo:26: [JP] VRAM_INFO: width = 720
670: 10003.722 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
671: 10003.746 printVramInfo:28: [JP] VRAM_INFO: height = 240
672: 10003.767 printVramInfo:29: [JP] VRAM_INFO: vram_number = 0
673: 10003.806 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x106F3C8C
674: 10003.830 printVramInfo:26: [JP] VRAM_INFO: width = 720
675: 10003.853 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
676: 10003.876 printVramInfo:28: [JP] VRAM_INFO: height = 240
677: 10003.897 printVramInfo:29: [JP] VRAM_INFO: vram_number = 2
678: 10003.921 printBmpVramInfo:45: [JP] BMP_VRAM_INFO: i = 0x00
679: 10003.961 printBmpVramInfo:46: [JP] BMP_VRAM_INFO: vram0 address = 0x10631714
680: 10003.988 printBmpVramInfo:47: [JP] BMP_VRAM_INFO: off_0x04 address = 0x00000000
681: 10004.027 printBmpVramInfo:48: [JP] BMP_VRAM_INFO: vram2 address = 0x48544F00
687: 11143.643 myTaskDumpf:230: [JP] MEM(0x0001E330) = 0x10631714 // vram0 address
688: 11143.707 myTaskDumpf:231: [JP] MEM(0x0001E340) = 0x10631714 // vram0 address
689: 11143.741 myTaskDumpf:232: [JP] MEM(0x0001E360) = 0x00000000
690: 11143.773 myTaskDumpf:234: [JP] MEM(0x0000BEA0) = 0x00000000 // DisplayType
691: 11143.802 myTaskDumpf:235: [JP] MEM(0x0000BEA4) = 0x00000000 // W x H = 720x240
692: 11143.832 myTaskDumpf:236: [JP] MEM(0x0000B854) = 0x00000002
These stubs are very important for our work so I decided to put them here ... require confirmation ...
I have not tested them all. I have used them to make some memory dumps.
40d v 1.1.1
NSTUB(0xFFC39AE4, FIO_RemoveFile)
NSTUB(0xFFD1682C, FIO_OpenFile)
NSTUB(0xFFD168F8, FIO_CreateFile)
NSTUB(0xFFD16A80, FIO_ReadFile)
NSTUB(0xFFD16BF0, FIO_WriteFile)
NSTUB(0xFFD16CA8, FIO_CloseFile)
NSTUB(0xFFD16D5C, FIO_GetFileSize)
NSTUB(0xFFD17244, FIO_GetDeviceName)
NSTUB(0xFFD7A968, FIO_FindNextEx)
Can you dump around 200K from each VRAM address?
Use the cacheable addresses if you can't (remove the first 1).
Quote from: a1ex on September 24, 2012, 08:40:42 AM
Can you dump around 200K from each VRAM address?
Use the cacheable addresses if you can't (remove the first 1).
Yes, I will do that ..
Quote from: jplxpto on September 24, 2012, 12:01:31 PM
Yes, I will do that ..
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.
great to see your progress!!
Quote from: coutts on September 26, 2012, 08:12:32 PM
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.
great to see your progress!!
Cloutts, thank you for this suggestion ... more I had thought about doing something similar but I am afraid to write to memory before I was sure it matches the VRAM.
Hi guys
I did some more tests today ...
I finally got the memory address of LV_VRAM.
I made a small application that writes into log file the addresses of LV_VRAM.
I put the camera in LV mode, and every 40ms, I wrote in the log file, the address and size of the LV_VRAM.
I repeated the process twice, and got the following data:
Address : 0x1CA700C8 / Average Size : ??????????
Address : 0x1CEAE304 / Average Size : 0x0003D068
I've also downloaded the JPEG. I had done before but did not know the memory address.
The JPEG has 1024x680 pixels and has a size of 213446 bytes
Some logs...
45578: 63053.752 [LVCDEV]->lvcdevResourceGet(0,1)
45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
45580: 63057.331 [LV] lvVDInterrupt
45581: 63057.493 [LV] WB 1926 1135 1135 2454(1158)
45582: 63059.349 [LV] lvReturnVram
45583: 63059.379 < GUI Lock > GUILock_PermitPowerLock (PUB)
45584: 63059.666 < GUI Lock > GUILockTask 1
45585: 63059.735 [DispCon] TurnOnDisplay (PUB)
45586: 63061.319 [DEV] LV_JPG YuvWriteCompleteCBR
45587: 63061.365 [DEV] LV_JPG YUVReadCompleteCBR
45588: 63061.498 [DEV] LV_JPG JpCoreCompleteCBR( 0x4af66 )
45589: 63061.558 [DEV] LV_JPG JpegPopCompleteCBR
45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
45591: 63062.313 [LVCDEV]->PD(VF:0x1078d7e8,MS:0x485540)
45592: 63081.284 [LV] WriteEDmacWbIntegCompleteCBR
45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.
I used this STUB, and wrote somewhere in vram0.
NSTUB(0x1E450, bmp_vram_info)
In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.
Once you get it, I want to improve the boot process.
Some additional information:
http://en.wikipedia.org/wiki/Canon_EOS_40D (http://en.wikipedia.org/wiki/Canon_EOS_40D)
Quote from: jplxpto on September 27, 2012, 06:26:54 AM
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.
I used this STUB, and wrote somewhere in vram0.
NSTUB(0x1E450, bmp_vram_info)
In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.
Once you get it, I want to improve the boot process.
you should start porting ML to the 40d, clone the latest repo and look for CONFIG_5DC, maybe add #define CONFIG_5DC CONFIG_40D and copy the same diretory structure / entry.S of the 5dc. All of the changes for the 5dc in menu.c should be valid for the 40d too.
Thanks Coutts ... I'm working on it :)
Good news ...
In recent days, me and Alex, we can give a good progress in 40D port.
Finally, we have a "Hello World" working ...
soon I'll post a picture here ...
Awsome. My Camera is still broken and im trying to repair it.
Me and many others are silently waiting for Good news
With a little time and patience, one day will come true ...
The Coutts and Alex have done an excellent job with 5DC.
I think that much of this work can be useful for the 40D.
Some more stubs
40D v1.1.1
Quote
NSTUB(0x1E458, LCD_Palette)
NSTUB(0x1E498, RGB_Palette)
NSTUB(0x1E388, PB_Palette)
NSTUB(0xFFCB0B6C, SetRGBPaletteToDisplayDevice)
NSTUB(0xFF867AA8, ChangeColorPalette)
NSTUB(0xFFCAFA0C, SetParameterToBitmapDisplayDevice)
NSTUB(0xFFCB7EBC, EnableBitmapVBufferForPlayBackAndWaiting)
NSTUB(0xFFCB9078, BmpDDev_give_semaphore);
NSTUB(0xFFCB9028, BmpDDev_take_semaphore);
NSTUB(0xFF8156F8, bindGUISwitchCBR)
Alex... I'm working on it :)
3878: 23394.264 [MC] M:1,ID:B(29)
3879: 23394.303 [BIND] Switch (11, 5)
3880: 23394.345 [GUI_E] GUI_Control:25 0x0
3881: 23394.537 [JP] (50/3) my_gui_main_task:85: EVT 246[0]: p=19 *o=0x0/0x0/0x0 a=0
3884: 23426.474 [JP] (50/3) my_gui_main_task:85: EVT 247[4]: p=0 *o=0x80030014/0x96/0x0 a=0
3887: 23445.017 [MC] M:1,ID:B(30)
3888: 23445.059 [BIND] Switch (11, 3)
3889: 23445.092 [GUI_E] GUI_Control:23 0x0
3890: 23458.398 [JP] (50/3) my_gui_main_task:85: EVT 248[0]: p=17 *o=0x0/0x0/0x0 a=0
3893: 23489.950 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
3894: 23490.172 [DispCon] SetTempForBackLight Temp 150
3895: 23490.318 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
3896: 23495.865 [MC] M:1,ID:B(31)
3897: 23495.904 [BIND] Switch (11, 2)
3898: 23495.941 [GUI_E] GUI_Control:22 0x0
3899: 23496.137 [JP] (50/3) my_gui_main_task:85: EVT 249[0]: p=16 *o=0x0/0x0/0x0 a=0
3902: 23527.803 [GUI] DlgPlayMain.c PRESS_MLT_UP_BUTTON
3903: 23546.781 [MC] M:1,ID:B(32)
3904: 23546.821 [BIND] Switch (11, 4)
3905: 23546.853 [GUI_E] GUI_Control:24 0x0
3906: 23547.040 [JP] (50/3) my_gui_main_task:85: EVT 250[0]: p=18 *o=0x0/0x0/0x0 a=0
3909: 23578.686 [GUI] DlgPlayMain.c PRESS_MLT_LEFTUP_BUTTON
3910: 23589.717 [MC] M:1,ID:B(0)
3911: 23589.753 [BIND] Switch (11, 6)
3912: 23589.790 [GUI_E] GUI_Control:26 0x0
3913: 23589.970 [JP] (50/3) my_gui_main_task:85: EVT 251[0]: p=1a *o=0x0/0x0/0x0 a=0
3916: 23621.610 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
3917: 23640.641 [MC] M:1,ID:B(1)
3918: 23640.683 [BIND] Switch (11, 8)
3919: 23640.721 [GUI_E] GUI_Control:28 0x0
3920: 23640.907 [JP] (50/3) my_gui_main_task:85: EVT 252[0]: p=1c *o=0x0/0x0/0x0 a=0
3923: 23672.516 [GUI] DlgPlayMain.c PRESS_MLT_LEFTDOWN_BUTTON
3924: 23691.575 [MC] M:1,ID:B(2)
3925: 23691.617 [BIND] Switch (11, 9)
3926: 23691.655 [GUI_E] GUI_Control:29 0x0
3927: 23691.839 [JP] (50/3) my_gui_main_task:85: EVT 253[0]: p=1d *o=0x0/0x0/0x0 a=0
3930: 23723.499 [GUI] DlgPlayMain.c PRESS_MLT_DOWN_BUTTON
3931: 23793.658 [MC] M:1,ID:B(3)
3932: 23793.698 [BIND] Switch (11, 5)
3933: 23793.737 [GUI_E] GUI_Control:25 0x0
3934: 23793.937 [JP] (50/3) my_gui_main_task:85: EVT 254[0]: p=19 *o=0x0/0x0/0x0 a=0
3937: 23825.534 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
3938: 23844.343 [MC] M:1,ID:B(4)
3939: 23844.384 [BIND] Switch (11, 3)
3940: 23844.420 [GUI_E] GUI_Control:23 0x0
3941: 23844.610 [JP] (50/3) my_gui_main_task:85: EVT 255[0]: p=17 *o=0x0/0x0/0x0 a=0
3944: 23876.253 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
3945: 23895.276 [MC] M:1,ID:B(5)
3946: 23895.315 [BIND] Switch (11, 0)
3947: 23895.350 [GUI_E] GUI_Control:21 0x0
3948: 23895.543 [JP] (50/3) my_gui_main_task:85: EVT 256[0]: p=15 *o=0x0/0x0/0x0 a=0
3951: 23945.275 [MC] M:1,ID:B(6)
3952: 23945.317 [BIND] Switch (11, 6)
3953: 23945.354 [GUI_E] GUI_Control:26 0x0
3954: 23945.559 [JP] (50/3) my_gui_main_task:85: EVT 257[0]: p=1a *o=0x0/0x0/0x0 EVT 257 a=0
3957: 23977.234 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
Quote from: nanomad on October 04, 2012, 09:22:14 PM
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
Nanomad. I haven't shared my code in this repository.
I sent my initial developments to Alex's email.
After that, he then began to integrate it into the ML.
We've been working together a few hours.
I loved working with him on this project, but we had little time.
Right now, I have a problem displaying the menus on the LCD.
I suspect there is a problem of any competition in memory access, calculations wrong, wrong resolutions or access buffers that were allocated dynamically and are already invalid.
Yes, I am thinking to create a repository on bitbucket
I also hope to have their precious help ;)
BR
Hi guys
My 40D camera now say :
"Magic Lantern is up and running...3 tasks started."
... but has serious problems on the LCD. I still can not see the menu of ML :(
I can only see messages like "Hello World!" and sometimes appears at the top of the image a green rectangle,
a little blurred with pixels of other colors. I think is the menu! And sometimes the entire screen flashes.
It seems that, we switch the color palette. This is something very strange happens.
I'll have to ask someone for help ... I still can not fully understand the code of VRAM.
We should be using buffers invalid or the wrong dimensions. If I can I do some tests for next week
Guys? Someone can help me on this? ... Maybe you Alex ... ;)
Thank you in advance!
I'll keep you updated with the latest news ...
I identified some errors ...
618: 1078.659 [JP] (50/3) read_entire_file:889: File 'A:/ML/DATA/FONTS.DAT' size 32744 by
619: 1091.459 [FR] readsize = 0x20000
620: 1110.717 [FR] readsize = 0x20000
621: 1124.497 [FR] readsize = 0x20000
622: 1141.060 [FR] readsize = 0x20000
623: 1155.195 [FR] readsize = 0x20000
624: 1172.910 [FR] readsize = 0x1f000
625: 1187.773 [FR] A:/DCIM/100CANON/IMG_1685.JPG read done (8288KB/S)
626: 1187.961 [GUI] SetPlInfoPLAYMode(100_1685)
627: 1188.080 [IMP] (PUB) SetDpRotationAngle 2845(0)
628: 1188.119 [IMP] (PUB) SetColorConvertTable 2832( 0x0 )
629: 1188.137 [Graphics] GuiDrawOneImage (PUB)
630: 1188.180 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
631: 1188.208 [IMP] (PUB) SyncroClearImagePlayVram 2569
632: 1188.226 [IMP] GetVramNumber 580
633: 1188.246 [IMP] GetVramNumber 580
634: 1189.050 <RECTCOLOR> RequestRectangleColor Before Lock
635: 1189.432 [FW] fwSetUnitSize (0x200000)
636: 1191.298 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
637: 1191.367 [IMP] (PUB) SetImageAspect 3683
638: 1191.451 SetImageVramParameter x:48 y:24 w:340 h:102/* Aspect:976264*/
639: 1191.489 [IMP] (PUB) SetImageFileParameter 1348
640: 1191.567 [IMP] (PUB) DrawImageToVram(rot:0 cb:0xFF8851E4) 1393
641: 1191.593 [IMP] GetJpegInfo 750
642: 1192.330 <DJP> RequestDecodeJpeg Before Lock
643: 1214.231 [IMP] SetRotationAngle 616
644: 1214.264 [IMP] SetVramImageParameter 640
645: 1214.294 [IMP] GetVramNumber 580
646: 1215.508 <DJP> RequestDecodeJpeg Before Lock
647: 1242.982 [JP] (50/3) Calling init_func ../../src/bmp.c (b807f4)
648: 1247.041 [JP] (50/3) Calling init_func ../../src/font-dyn.c (b82aa8)
649: 1247.089 [JP] (50/3) Calling init_func debug (b87f68)
650: 1247.193 [JP] (50/3) Calling init_func ../../src/property.c (b8b020)
651: 1248.238 [PROPAD] ERROR GetPropertyData ID = 0x0205000E
652: 1248.373 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0205000E L:874
653: 1248.839 [JP] (50/3) _prop_handler_PROP_LAST_JOB_STATE:1781: job state: 0
654: 1249.631 [PROPAD] ERROR GetPropertyData ID = 0x0206001E
655: 1249.745 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0206001E L:874
656: 1249.901 [PROPAD] ERROR GetPropertyData ID = 0x0204000D
657: 1249.983 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0204000D L:874
658: 1250.579 [JP] (50/3) Calling init_func ../../src/tweaks.c (b8bf38)
659: 1251.006 [JP] (50/3) Calling init_func lens (b8f1f8)
660: 1251.151 [JP] (50/3) Calling init_func ../../src/zebra.c (b93e00)
661: 1251.681 [JP] (50/3) Calling init_func shoot (b9f87c)
662: 1252.387 [JP] (50/3) Calling init_func ../../src/movtweaks.c (ba7b30)
663: 1252.554 [JP] (50/3) Calling init_func help_menu (ba8fbc)
664: 1252.724 [JP] (50/3) Calling init_func ../../src/focus.c (ba97c0)
665: 1253.079 [JP] (50/3) Calling init_func ../../src/notify_box.c (bab220)
1381: 1791.326 < GUI Lock > GUILock_TurnOnDisplay (PUB)
1382: 1791.488 < GUI Lock > GUILockTask 1
1383: 1791.527 [DispCon] TurnOnDisplay (PUB)
1384: 1791.555 [DispCon] TFT_POWDET Low Wait
1385: 1792.743 [DispCon] TFT_POWDET Low Wait
1386: 2262.465 [CFS] Mini Info. (0x1000000e)
1387: 2262.552 [JP] (50/3) read_entire_file:910: failed
The my_gui_main_task seems to be working... ;)
5938: 15903.631 [MC] M:1,ID:E(1)
5939: 15903.676 [BIND] Switch (14, 1)
5940: 15903.714 [GUI_E] GUI_Control:1 0x0
5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT
5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5955: 15936.334 [FC] _FC_GetFirstFileHandle
5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)
5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0
5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)
Be patience, ... we still have much work ahead!
Quote from: jplxpto on October 05, 2012, 02:23:00 AM
The my_gui_main_task seems to be working... ;)
5938: 15903.631 [MC] M:1,ID:E(1)
5939: 15903.676 [BIND] Switch (14, 1)
5940: 15903.714 [GUI_E] GUI_Control:1 0x0
5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT
5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5955: 15936.334 [FC] _FC_GetFirstFileHandle
5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)
5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0
5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)
Be patience, ... we still have much work ahead!
Good job. I am waiting.
Jplxpto,
First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts
Indy
Quote from: Indy on October 06, 2012, 04:03:28 PM
Jplxpto,
First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts
Indy
Hi Indy
Will I have a great honor to also have your help.
You have given me a fantastic help. I am very grateful to you all.
My current code is all in hudson repository of ML.
For more details we can exchange some PM.
BR
Quote from: a1ex on August 26, 2012, 11:54:20 PM
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
I found this :
MEM(0x00007648) = 0xC0F0B008
http://www.magiclantern.fm/forum/index.php?topic=1452.msg12152#msg12152
I found three 40D v 1.1.1 fonts:
I used the script find_fnt.py but I changed it a bit.
...
print 'Find bitmap fonts in Canon DSLR firmwares'
print 'Arm.Indy. based on work by Pel, Trammel Hudson and A1ex\n'
off = 0
while off < len(m) and off <> -1:
off = m.find('FNT\0', off)
if off <> -1:
val = getShortLE(m, off+4)
if val==0xffd8 or val==0xffe2 or val==0xffec:
parseFont(m, off, base)
off = off + 4
...
python ../../../../find_fnt.py 40d.111.ROMF1.0xFF800000.bin 0xFF800000
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex
0xff9ed2e4: FNT
0xff9ed2e8: (+0x04) 0xffec
0xff9ed2ea: (+0x06) font_width = 20
0xff9ed2ec: (+0x08) charmap_offset = 0x24
0xff9ed2f0: (+0x0c) charmap_size = 0x21f0
0xff9ed2f4: (+0x10) bitmap_size = 0x36858
0xff9ed2f8: (+0x14) font name = 'HCanonGothic'
0xff9ed308: (+0x24) char_codes[]. 2172 chars
0xff9ef4f8: (+0x2214) offsets[]. Last offset value = 0x367ea
0xff9f16e8: (+0x4404) bitmaps[]
0xffa27ed2: (+0x3abee) last bitmap
+0x00: bitmap width = 36
+0x02: bitmap height = 36
+0x04: char width = 36
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0xb4
0xffa27f40: FNT
0xffa27f44: (+0x04) 0xffe2
0xffa27f46: (+0x06) font_width = 30
0xffa27f48: (+0x08) charmap_offset = 0x24
0xffa27f4c: (+0x0c) charmap_size = 0x170
0xffa27f50: (+0x10) bitmap_size = 0x2eb8
0xffa27f54: (+0x14) font name = 'HCanonGothic'
0xffa27f64: (+0x24) char_codes[]. 92 chars
0xffa280d4: (+0x194) offsets[]. Last offset value = 0x2e36
0xffa28244: (+0x304) bitmaps[]
0xffa2b07a: (+0x313a) last bitmap
+0x00: bitmap width = 30
+0x02: bitmap height = 30
+0x04: char width = 30
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0x78
0xffa2b0fc: FNT
0xffa2b100: (+0x04) 0xffe2
0xffa2b102: (+0x06) font_width = 36
0xffa2b104: (+0x08) charmap_offset = 0x24
0xffa2b108: (+0x0c) charmap_size = 0x170
0xffa2b10c: (+0x10) bitmap_size = 0x4448
0xffa2b110: (+0x14) font name = 'HCanonGothic'
0xffa2b120: (+0x24) char_codes[]. 92 chars
0xffa2b290: (+0x194) offsets[]. Last offset value = 0x438a
0xffa2b400: (+0x304) bitmaps[]
0xffa2f78a: (+0x468e) last bitmap
+0x00: bitmap width = 36
+0x02: bitmap height = 36
+0x04: char width = 36
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0xb4
Sounds good.
On 5Dc, ML changes the palette, so it's probably normal. Can you post some screenshots?
You can map the button codes, and once this is done, menu should be usable.
At least someone else is using this script ;-) maybe I should put them on bitbucket...
@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?
Indy
Quote from: Indy on October 09, 2012, 08:23:27 PM
At least someone else is using this script ;-) maybe I should put them on bitbucket...
@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?
Indy
Indy, you're right files have one week ... in the last days I had little time to work on it.
I was just looking for some stubs and clarify my doubts with other forum members.
Yes I used your script and it was useful to confirm the addresses of fonts.
I have enabled the bootflags and dump the ROM dump.
Last week, me and Alex located the HD & BMP VRAM, but I still do not know the address of the LV VRAM.
I already have some ML threads running but, still could not see any menu. Is there any problem in presenting the image on the LCD.
I should have solved this, but my lack of time and knowledge has not allowed me to resolve this issue.
There is also a problem in the image display on the LCD.
The can.on menus are constantly changing color. The problem must be related to the color palette.
I already found the addresses of color palettes and some stubs used by Alex in 5DC. I did not upload but did post here.
Some more stubs
40D v1.1.1
NSTUB(0xFFD4F338, TryPostEvent)
NSTUB(0xFFD4F398, TryPostEvent_end)
NSTUB(0xFFD56470, TryPostStageEvent)
NSTUB(0xFFD564FC, TryPostStageEvent_end) // PendStageEvent
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
I commented out the calls to the set_ml_palette and set_ml_palette_if_dirty functions and,
now the colors are presented as they were before.
I have not created my repository to share my changes with you, but I hope to do that later this week.
After upgrading my project with the latest version of ML available,
I checked that the code does not compile.
Some more stubs are needed to 40D. I however able find what was missing.
I'm now using changeset a53eef8d1c7d.
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
My next step is to draw a rectangle on the screen to see if I understand what is happening with the VRAM. Later, I'll validate events. The ML is already processing some events but I have to review all the constants.
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
jplxpto,
As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...
Indy
Quote from: a1ex on October 10, 2012, 07:59:28 AM
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
Thanks, I'll test it soon ...
Quote from: Indy on October 10, 2012, 04:06:30 PM
jplxpto,
As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...
Indy
"How about audio threshold (there is a script for that :-) " ...
I'm sorry but I did not understand what you mean.
Why tell me in audio?
Dear Jplxpto,
sorry I was not clear.
do you have all audio stubs ? and the address of audio threshold ?
Indy
Quote from: jplxpto on October 11, 2012, 12:06:24 AM
"How about audio threshold (there is a script for that :-) " ...
I'm sorry but I did not understand what you mean.
Why tell me in audio?
Sorry, I also do not explained well
I think the 40D has no audio.
Well.. the 40D doesn't record video normally, but will do so with Magic Lantern. We already have the ingredients :)
Today I had a big scare. I was trying to get all the constants of the buttons and my camera blocked. Moments later I realized that it was not possible to navigate the menus of the canon. Only the icons appeared, but the items were not presented. After a few tries, remove card, remove battery, put battery, remove the lens, place the lens, changes ... so, disconnect, connect, etc, etc ... I was scared but I can resurrect my camera. After a few attempts, I managed to solve the problem because I was able to open the 'My Menu' ... (Mode C1 + Menu + SET) ... this sequence showed me the items of 'My Menu' and I registered the function that cleans the camera settigns, and I enabled this custom menu. After I accept the changes, the camera is working again normally. It seemed a miracle!!!! Huufff
I have not given up yet, I'll start having more careful ... I'll analyze the firmware to obtain the constants of a safer way. I think the code that writes the LCD acceded to an invalid memory area. I still have problems with the VRAM. Solving this problem is now a top priority.
There are a few other features that write to RAM (e.g. magic zoom writing on LV buffer, fast zoom in play mode altering the current zoom value, exposure override, SET+MainDial changing the image buffers). Look through consts.h to see how each thing is used - and if you are not sure about that constant, and it's used for writing, don't enable that feature.
For menu, you should start only the two menu-related tasks and some button/event handlers.
Hello Alex,
I think almost everything is disabled. How can I check the tasks/features are being launched?
I checked that some of the listed buttons are wrong.
I was trying to solve this problem. I just enabled the hijack of the events and removed the comment from end_gui_...
How can I force automatic presentation of the menu at system startup.
I've done some tests with bmp_fill, bmp_draw_rec, draw_palette.
Soon I will send you a picture with the palette drawn on the LCD.
Thank you
The source from ML repo only starts 3 tasks (debug, menu, menu_redraw) => it's OK. There are a few features that run from button handlers too (e.g. histogram in playback mode, which you showed me).
To start the menu... give_semaphore(gui_sem).
Edit: if you use the 5DC method for task hijacking (which you probably should, I don't know a better one), leave the gui_init commented (Canon code already did it).
Alex, thanks for your clarification. I'll see it better.
Finally I had a little time to create my repository ...
https://bitbucket.org/jplxpto/magic-lantern
Some more constants (gui.h)
#define BGMT_WHEEL_UP 0x00
#define BGMT_WHEEL_DOWN 0x01
#define BGMT_WHEEL_LEFT 0x02
#define BGMT_WHEEL_RIGHT 0x03
#define BGMT_PRESS_SET 0x04
#define BGMT_MENU 0x05
#define BGMT_INFO 0x06
#define BGMT_JUMP 0x07
#define BGMT_PLAY 0x08
#define BGMT_TRASH 0x09
#define BGMT_PICSTYLE 0x13
#define BGMT_PRESS_ZOOMIN_MAYBE 0x0a
#define BGMT_UNPRESS_ZOOMIN_MAYBE 0x0b
#define BGMT_PRESS_ZOOMOUT_MAYBE 0x0c
#define BGMT_UNPRESS_ZOOMOUT_MAYBE 0x0d
#define BGMT_PRESS_DIRECT_PRINT 0x0e
//#define BGMT_UNPRESS_DIRECT_PRINT_ 0x0f WRONG MAYBE
//~ happens anytime joy stick is unpressed from any position
#define BGMT_UNPRESS_UDLR 0x15
#define BGMT_PRESS_UP 0x16
#define BGMT_PRESS_UP_RIGHT 0x17
#define BGMT_PRESS_UP_LEFT 0x18
#define BGMT_PRESS_RIGHT 0x19
#define BGMT_PRESS_LEFT 0x1a
#define BGMT_PRESS_DOWN_RIGHT 0x1b
#define BGMT_PRESS_DOWN_LEFT 0x1c
#define BGMT_PRESS_DOWN 0x1d
#define BGMT_PRESS_CENTER 0x1e
// dummy
#define BGMT_PRESS_HALFSHUTTER 0x0b
//#define BGMT_UNPRESS_HALFSHUTTER -12345
#define BGMT_UNPRESS_SET -123456789
#define GMT_GUICMD_OPEN_SLOT_COVER 0x28
#define GMT_GUICMD_START_AS_CHECK -12345678
#define GMT_GUICMD_LOCK_OFF -12345678
#define BGMT_Q BGMT_PRESS_DIRECT_PRINT
#define BGMT_LV BGMT_JUMP
#define BTN_ZEBRAS_FOR_PLAYBACK BGMT_JUMP
#define GMT_OLC_INFO_CHANGED -12344
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
Quote from: ilguercio on October 13, 2012, 10:16:18 PM
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
Sorry but I still do not know!
Hello guys,
I keep working on this project and A1ex has helped me a lot.
Now I'm trying to open the ML menu.
Again ... thanks Alex
Hi Guys,
I've got to see the menus of ML. But I still have some problems ... DOUBLE_BUFFERING with 1 not working.
The menus are constantly flashing. The keys work almost all.
Hi guys,
After a few hours of work and an excellent help from Alex,
I could finally see the menus of ML. This is a modest contribution but I'm happy.
The port of ML for 40D was not planned and I donated a few hours of my work and
dedication to one day also be a user of this wonderful sofware.
I'm still new to this project and I have a lot to learn but motivated to continue so that one day all
40D owners can also take advantage of ML.
Today, I made my first Pull Requests into hudson repository.
If you are interested can follow my development at:
https://bitbucket.org/jplxpto/magic-lantern (https://bitbucket.org/jplxpto/magic-lantern)
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
Quote from: ilguercio on October 15, 2012, 01:53:48 AM
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
Thank you!
Don't click me! ;)
https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3 (https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3)
Your ptp_register_handler function is correct
Quote from: nanomad on October 19, 2012, 12:28:17 AM
Your ptp_register_handler function is correct
For me this is a good and bad news ... : (
I can't connect to the camera with --chdk switch and i don´t know why...
I see the logs of the camera again ... perhaps there is some hint
Thank you!!!
Created account just to state that we are more people that eagerly and happily follow your progression. ;)
I'm happy to know there are more people interested in this project.
I and other developers have been working on this project almost every day.
The Coutts, the Chochin the A1ex, the Nanomad and G3gg0 and Indy have helped me.
Thanks to all of them ...
In recent days I and G3gg0 have invested some time trying to change the boot process.
The idea is to do something similar to what has already been done for other cameras.
The G3gg0 have helped me a lot ... it also has many technical skills and is an excellent 'colleague';)
Thank you G3gg0.
I've done some testing in order to use PTP to transfer ML for my camera.
To perform the tests sometimes need to constantly insert and remove the card ...
I've done it dozens or hundreds of times.
I want to make this task easier and increase the life of the CF connector of my camera.
Quote from: jplxpto on October 19, 2012, 03:03:59 PM
I want to make this task easier and increase the life of the CF connector of my camera.
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
Quote from: Faxe on October 19, 2012, 03:15:38 PM
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
I'll see that...
Thank you
n/p, you are welcome ;)
check your mail, i sent you a new version.
Quote from: g3gg0 on October 19, 2012, 09:24:28 PM
n/p, you are welcome ;)
check your mail, i sent you a new version.
Thank you G3 ...
More some stubs for 40d v1.1.1 :
NSTUB(0xFFD427B0, register_interrupt)
NSTUB(0xFFC8DF90, SIO3_ISR)
NSTUB(0xFFC8DEC8, MREQ_ISR)
Hello everybody.
I come here today to inform you that I finally able change the boot process in 40D.
Now I use the cache_hacks.
I have to thank once again the A1ex and G3gg0.
They have many skills and have helped me a lot.
If you wish you can see my changes in:
https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f (https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f)
you got it working? nice, good job!
I own a 40D, and I look forward to seeing this! I also own a Rebel T3i with Magic Lantern installed, and it works great. I'm eager to see what this port has to offer! ;D
Quote from: g3gg0 on October 21, 2012, 10:10:54 AM
you got it working? nice, good job!
Without your valuable help I would never have succeeded.
Thank you.
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
Quote from: Polanin on October 21, 2012, 11:39:27 PM
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
I'm working with the latest version available ... 1.1.1. I advise you to update the firmware of your camera. see page of the canon ... is simple and fast.
And, unless I'm mistaken, you can always roll-back to an older fw version
Quote from: nanomad on October 22, 2012, 10:42:53 AM
And, unless I'm mistaken, you can always roll-back to an older fw version
I already did rollback to version 1.0.8 just to create a dump :)
Some more progress ... now with PTP ;)
http://www.magiclantern.fm/forum/index.php?topic=1512.msg16147#msg16147
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
Quote from: dor1847 on October 26, 2012, 09:44:53 PM
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
A donation will be a good gesture of support.
Quote from: dor1847 on October 26, 2012, 09:44:53 PM
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
Thanks for your eulogy.
My friend, everything in life has its risks. Currently, I just got this camera. If you ever want to try ML in your camera will have to take the risk. They may be very low, but there will always be a risk associated with it.
Quote from: samacochan on October 27, 2012, 03:48:19 PM
A donation will be a good gesture of support.
I'm perfectly in accordance with your comment.
Hi,
My work on this project continues. I've made some progress.
I have been trying to use the PTP and GDB in 40D.
1) With the help of g3gg0 and their fantastic cache hacks I managed to change the boot of the 40D. This may solve some legal problems.
2) I've able register the operations of ML & CHDK but this subject is not yet closed. I still have some unresolved issues.
I've done some tests but still can not debug with GDB. I'm trying the GDB Stubs created by g3gg0. This task is not a priority but soon I hope to get back to doing some tests and be successful.
3) In the last days, I spent some time with the overlays.
I'm trying to use the code developed for 5DC.
With Alex's help I managed to display some overlays in play mode.
Hi all,
have you considered to integrate the additional menus of the WFT-E3 and the GPS Menu? Maybe this is disturbing a little bit the ability to read out all the parameters and set the values. The screen flashing because of nulls/values missing??
I think it's the most complicated part of the menu-structure! Lots of menus where you can really get lost...
I could shoot some pics with my iPhone and mail them, if you are interested.
Kind regards
Uwe
@LensPainter
Hi,
I just had a chance to answer it now.
I appreciate your suggestion, but I do not know if this is possible.
I do not own any of these devices, so I never saw these menus.
I know they exist because I've seen some strings in the firmware.
I would love to see these photos. I'm waiting ... Thank you.
@jplxpto
Hi,
I think I need your email-address - there are 98 pictures so far...
Kind regards
Uwe
Thank you!
Hi Pedro - and your welcome - de nada (is that right?)
Hope it helps!
Kind regards
Uwe
Some screenshots:
(http://i.imgur.com/fSV5U.jpg)
(http://i.imgur.com/cX2od.jpg)
(http://i.imgur.com/0T3EJ.jpg)
(http://i.imgur.com/Nq8le.jpg)
(http://i.imgur.com/M0NeM.jpg)
(http://i.imgur.com/2AIC3.jpg)
I think, finally found a buffer of LVRAM.
I had seen the address of a memory dumps I made with the help of ptpcam.
With the help of Alex and his img.py file. I can guess the width and height of the image as well as the pitch.
I intercepted the PRINT key event and did two dumps of RAM starting at address 0x10000000 and a size of 256M.
I followed the instructions described on the following page
http://magiclantern.wikia.com/wiki/VRAM/550D
ipython
run -i img.py
a = readsampled("./VRAM_01.DAT")
b = readsampled("./VRAM_02.DAT")
d = array(a) - array(b)
d[d != 0] = 1
plot(d); show()
After reviewing the chart and repeat the test a few times, I identified the pitch.
guessed pitch = 2916
width = pitch / 2 = 1458
height = 1458 / (3/2) = 972
With the help of graphic and addresses that I found when I did a dump to address 0x1e000.
I suspected that the address 0x1dbc0064 is an address VRAM.
I subtract the address of the beginning of my dump and got the following value:
0x1dbc0064 - 0x10000000 = 0xdbc0064 = 230424676
x = 230424676
gw = 1458
gh = 972
gp = 2916
gx = x + gp * (0)
gs = gp * gh
s = readseg("./VRAM_02.DAT", gx, gs)
imgseq(s, gp)
hex(gx)
In the end I visualized the images generated and to my surprise
I finally had my picture in perfect condition (black and white).
The best picture was the 000-odd.png
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064
MEM(0x1e0a0 + 0x14) = MEM(0x1E0B4) = 0x1dbc0064
<conn> w 0x1e000 512
0001e000 00000000 0013a2dc 0013a2b8 00000000 10687248 000002d0 000002d0 000000f0
0001e020 00000000 1071f0d4 000002d0 000002d0 000000f0 00000002 1dbc0064 00000798
0001e040 00000798 00000510 00000798 00000510 00000000 00000000 00000000 00000000
0001e060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e080 00000000 00000000 00484e5c 001ee400 00000001 00000f30 00000a20 00001d40
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4
0001e0c0 00000000 00484e5c 001ee400 00000000 00000000 00000f30 00000a20 000009c0
0001e0e0 00000750 00000000 00000000 00000000 00000000 000002d0 000001e0 000002d0
0001e100 00000000 00000018 000002d0 000000d8 0001dc00 00000000 00000000 00000000
0001e120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e140 0080478c 00000000 0001db90 00000000 ff8851e4 00012d6c 00000000 00000000
0001e160 ffca415c 00000000 00000000 00000000 00000000 00000000 00000018 000002d0
0001e180 000000d8 00000000 00000000 1071f0d4 000002d0 000000f0 00000000 00000018
0001e1a0 000002d0 000000d8 00000000 00000000 00000000 00000000 00000000 00000000
0001e1c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e1e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
(http://i.imgur.com/csh1y.png)
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?
If this could be added, we could name this cam 45D ^^
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.
If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).
What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.
Check repo.
Hi,
good progress Jplxpto !
maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
4a0290 [BmpDDev] CreatePhysicalVram (PUB)
4a03b4 [BmpDDev] DeletePhysicalVram (PUB)
in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
32fa8 MonOpen
32fb0 MonClose
32fbc MonRead
32fc4 MonReadAndGetData
32fd8 MonWrite
32fe4 MonCall
32fec FA_TestMonRead
32ffc FA_TestMonCall
3300c FA_TestMonReadAndWrite
33130 m_hSemaphoreDataComp
33148 ../MpuMonitor.c
Indy
Quote from: nexiabass on November 12, 2012, 07:16:31 AM
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?
If this could be added, we could name this cam 45D ^^
Welcome to our forum.
Thank you for your nice words.
Remember, we can add great features in ML but still can not transform an old black & white TV to a color TV with a feature like HD and 3D.
For now, I just think support the features that already exist in other cameras, If I ever get that it will be a big win for me :)
When I reach that goal, I hope to have your help to test the result of my work.
BR
Quote from: Indy on November 12, 2012, 12:04:25 PM
Hi,
good progress Jplxpto !
maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
4a0290 [BmpDDev] CreatePhysicalVram (PUB)
4a03b4 [BmpDDev] DeletePhysicalVram (PUB)
in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
32fa8 MonOpen
32fb0 MonClose
32fbc MonRead
32fc4 MonReadAndGetData
32fd8 MonWrite
32fe4 MonCall
32fec FA_TestMonRead
32ffc FA_TestMonCall
3300c FA_TestMonReadAndWrite
33130 m_hSemaphoreDataComp
33148 ../MpuMonitor.c
Indy
Hi, Indy.
I hope you're well.
To be honest I had met some of these stubs 'Mon' but I did not know its purpose.
I still do not know what is in them. I no longer have to availability or knowledge to explore these stubs.
Maybe you are one of the people with the capacity to accomplish this task.
I had already looked at the [BmpDDev] CreatePhysicalVram and [BmpDDev] DeletePhysicalVram but
I did not know how to intercept the calls to these functions.
I think I saw something in your post about the 500D or 550D.
I'll follow your suggestion ...
Thank you.
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF844528, MonCall)
NSTUB(0xFF844284, MonClose)
NSTUB(0xFF84425C, MonOpen)
NSTUB(0xFF844354, MonReadAndGetData)
NSTUB(0xFF8442AC, MonRead)
NSTUB(0xFF844480, MonWrite)
NSTUB(0xFFB27438, mon)
NSTUB(0xFF843024, mon_funcs_table)
grep -i mon 40d.111.ROMF1.0xFF800000.strings
ffb44014 (Called->MoveFocusLensForPcMon)
ffb44038 Err:MoveFocusLensForPcMon, Unexpected PC_MON_MF_MODE = %d
ffb44074 MoveFocusLensForPcMon LatestStep=%d
ffb46c38 Err:HaveLensError, Mounting MonitorTool
ffb47a28 Err:CalcMovingStepForPcMon, Unexpected Coeff = %d
ffb47a5c Err:CalcMovingStepForPcMon, Result step is over 2bytes
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);
int width;
int height;
int pitch;
int *vRamAddress;
int result;
result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);
result is :
0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)
width is 0x2D0 (720)
height is 0x0F0 (240)
pitch is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.
block size = 0x15180+4 = 86404 d = 360 * 240 bytes
I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
I think, there is another memory location (temporary?) in memory address 0x1e26f264.
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4Quote from: jplxpto on September 17, 2012, 01:36:51 AM
698: 3711.532 [GUI] StartPlayMain
699: 3718.551 [Graphics] CreateSharedBuffer !!!
700: 3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
701: 3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200
702: 3719.292 [Graphics] GuiGraphicsNormalMode (PUB)
ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264
0x1dbc0064 + 0x6af200 = 0x1e26f264
0x6af200 size (maybe)
Seems I actually found two memory locations that I had seen in the past.
ImageWorkMemory 1 & 2. They are YUV 411. W:2496, H:1872 and size: 0x6af200 (>6,68MB)
Quote from: a1ex on November 12, 2012, 09:44:36 AM
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.
If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).
What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.
Check repo.
"otherwise 40D would be the first Canon dslr that can record 2K" ... that would be fantastic, a miracle! :)
Thank you
I found these stubs for testing :
NSTUB(0xFF83EE50, FA_CaptureTestImage)
NSTUB(0xFF8473B4, FA_CreateTestImage)
NSTUB(0xFF83F1C4, FA_DefectsTestImag)
NSTUB(0xFF847538, FA_DeleteTestImage)
NSTUB(0xFF840880, FA_DetectDefTestImage)
NSTUB(0xFF83FF80, FA_FA_ProjectionTestImage)
NSTUB(0xFF840060, FA_FA_ShadingTestImage)
NSTUB(0xFF84037C, FA_ObIntegTestImage)
NSTUB(0xFF840C78, FA_ShadingTestImageForLV)
NSTUB(0xFF83F084, FA_SubtractTestImage)
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF84144C, FA_VProjectionTestImage)
NSTUB(0xFF845380, FA_YuvDevelopTestImage)
NSTUB(0xFF8841E4, GuiTestOneImage)
NSTUB(0xFFB64954, LVTest)
I checked that there are several functions that use the memory address registered in memory location
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064. (SetImageWorkMemory 1)
For example, in the function IMP_PUB_DrawImageToVram the following happens:
FFCA110C : R0=0x1E038
...
FFCA1120 call IMPV_PUB_MakeHDVramFromYuv_FFCA7D48
I think that in this case the address 0x1E038 is the parameter of the function IMPV_PUB_MakeHDVramFromYuv
NSTUB(0xFFCA0EE8, IMP_PUB_DrawImageToVram)
NSTUB(0xFFCA7D48, IMPV_PUB_MakeHDVramFromYuv)
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).
Today, I no longer have time to test ... tests are for another day!
Quote from: jplxpto on November 12, 2012, 10:32:42 PM
When I reach that goal, I hope to have your help to test the result of my work.
For sure :)
I can't wait to see this happen to the good old 40D!
Hello people...
I have good news...
As I told you before, I don't have much time to dedicate myself to this project but,
I have devoted some time to understand code and read some documentation.
I have talked to other ML developers and they have helped me a lot.
They have been fantastic ... I think we have a team motivated, united and well organized.
Yesterday I have dedicated some time to test autofocus patterns (AF POINTS)
I can now choose the focus points.
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news! ;)
Quote from: scaricame on November 23, 2012, 10:13:54 AM
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news! ;)
You're welcome!
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.
Thanks for the time that's already been put towards this and the efort that's currently being invested.
And thanks jplxpto!
Quote from: tanninety on November 25, 2012, 12:05:58 AM
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.
Thanks for the time that's already been put towards this and the efort that's currently being invested.
And thanks jplxpto!
The work is advancing slowly ... in the last days were made many changes to the code of ML.
I'm now trying to recover what has been working.
The g3gg0 needed to make changes to the boot process and the camera stopped doing boot.
He is helping me solve this problem.
I have to find STUB PtpPropSetUILock.
The Coutts used to unlock the UI when the PTP is connected. I need to do the same.
40d 111
ffb66f7c %s PtpPropSetUILock [%x][%x]
STUB(0xFFB67014, PtpPropSetUILock__maybe);
https://bitbucket.org/hudson/magic-lantern/commits/f85b386a2d61c369050edf490fa324da17794e40
Quote from: jplxpto on November 12, 2012, 11:48:26 PM
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);
int width;
int height;
int pitch;
int *vRamAddress;
int result;
result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);
result is :
0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)
width is 0x2D0 (720)
height is 0x0F0 (240)
pitch is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.
block size = 0x15180+4 = 86404 d = 360 * 240 bytes
I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
Quote from: jplxpto on November 13, 2012, 02:02:11 AM
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).
Today, I no longer have time to test ... tests are for another day!
MEM(0x5BF8) = 0xff9b943c
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
00005be0 aaaaaa7f bbbbbb7f cccccc7f dddddd7f eeeeee7f ffffff7f ff9b91e4 ff9b943c
00005c00 0065cae4 000002d0 000000f0 00000001 00000001 00000000 006301dc 0062ffcc
00005c20 0065cae4 00671d2c 000002d0 000001e0 00000000 00000000 007c417c 00687104
00005c40 ff9c1918 000ea508 00000007 00000001 00000000 00000000 00000000 00000000
00005c60 ff9c3540 0065bbec 0065bcb0 0065c28c 0065c424 0065c1ec 0065bf0c ff9caf40
00005c80 ff9caf50 ff9caf68 0062e8d8 00000000 ff9ed2bc ffa2f848 ffa913e4 ff9d1368
0065cae0 00000038 ff9b943c 000002d0 000002d0 000000f0 10671da4 000ea52c 00000000
0065cb00 00000000 00000000 000002d0 000000f0 0065cad8 00671d20 00015210 22f586fa
0065cb20 50bf205e 0c2f13f7 407d0aff 12fa6ff5 05f758ff 08f70afa 00df0aed 81f92c25
0065cb40 409fe0ff 00fe3dff 01bc04df 027f0d1f 84fe20fc 017db0e5 08fd08cf 22222222
MEM(0x5BFC) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x5c00) = 0x0065cae4 ; VRAM Address (maybe)
MEM(0x5c04) = 0x000002d0 ; width (720)
MEM(0x5c08) = 0x000000f0 ; height(240)
MEM(0x5c0C) = 0x00000001 ; ???
MEM(0x5c24) = 0x00671d2c ; VRAM Address (maybe)
MEM(0x5c28) = 0x000002d0 ; width (720)
MEM(0x5c2c) = 0x000001e0 ; height(480)
MEM(0x5c3f) = 0x00000000 ; ???
MEM(0x0065cae4) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x0065cae8) = 0x000002d0 ; width (720)
MEM(0x0065caec) = 0x000002d0 ; pitch (720)
MEM(0x0065caf0) = 0x000000f0 ; height (240)
MEM(0x0065caf4) = 0x1065cb5c ; ???
MEM(0x00671d2c) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x00671d30) = 0x000002d1 ; width (721) ???
MEM(0x00671d34) = 0x000002d0 ; pitch (720)
MEM(0x00671d38) = 0x000000f0 ; height (240)
MEM(0x00671d3C) = 0x10671da4 ; ???
size = 0x15180 bytes ( 720 / 2 * 240 )
In search of lost VRAM of 40D111...
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
hexdump -C DUMP_RAM_0x0_0x100000.bin | grep "3c 94 9b ff"
00005bf0 7f ee ee ee 7f ff ff ff e4 91 9b ff 3c 94 9b ff |............<...|
000ea4e0 12 00 00 00 02 00 00 00 3c 94 9b ff 01 00 00 00 |........<.......|
000ea530 3c 94 9b ff 01 00 00 00 38 a5 0e 00 38 a5 0e 00 |<.......8...8...|
0065cae0 38 00 00 00 3c 94 9b ff d0 02 00 00 d0 02 00 00 |8...<...........|
00671d20 10 cb 65 00 58 1d 67 00 38 00 00 00 3c 94 9b ff |..e.X.g.8...<...|
MEM(0x00005BF0) = 0xFF9B943C
MEM(0x000EA4E8) = 0xFF9B943C (LV VRAM 1) maybe
MEM(0x000EA530) = 0xFF9B943C (LV VRAM 2) maybe
MEM(0x0065CAE4) = 0xFF9B943C (BMP VRAM 1) maybe
MEM(0x00671D2C) = 0xFF9B943C (BMP VRAM 2) maybe
I've got 2 x 40D, therefore following this development with a smile :-)
Quote from: TTS on December 05, 2012, 12:19:21 AM
I've got 2 x 40D, therefore following this development with a smile :-)
Thank you!
When there is life there is hope ... do not give up.
Sometimes dreams do come true. If not I give you this, others will certainly do it!
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
Quote from: tanninety on December 08, 2012, 12:44:14 AM
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
Unfortunately, I've been a little tired and busy with other tasks. Soon I hope to dedicate myself more time to this port. The good news I have to give you is that in principle we have more developers to work with me on this port. We have verified that there are still very users interested in having ML this camera so, you'll spend more time. This of course depends on our available time.
Unfortunately I just sold my 40D! But I root for your success! Nice work.
Quote from: RenatoPhoto on December 08, 2012, 01:57:08 AM
Unfortunately I just sold my 40D! But I root for your success! Nice work.
Thank you and good Christmas
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)
I have a 40D and i'm more than willing to help with the porting effort.
Quote from: moodoki on December 08, 2012, 05:10:15 AM
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)
I have a 40D and i'm more than willing to help with the porting effort.
You are welcome to our team.
http://www.magiclantern.fm/develop
"
Become developer
Our development capacity is limited. A lot of time goes into bugfixing and working towards a stable version.
If you'd like to help, here are the steps for getting started:
Step 1. Get the source code
hg clone -r unified https://bitbucket.org/hudson/magic-lantern
Step 2. Setup the compiler
http://magiclantern.wikia.com/wiki/Build_instructions/Unified
Step 3. Start hacking
http://magiclantern.wikia.com/wiki/For_Developers
If you get stuck, ask here.
"
You can do: make clean; make 40D
There are some methods to launch ML but have not yet been published. You need to activate the bootflag.
I suggest you start with me to spend a few hours reading documentation. And I did that and still did not stop.
You can also look at the source code.
Thou shalt also read:
http://wiki.magiclantern.fm/install
http://wiki.magiclantern.fm/userguide
You should know that you can turn your camera into a brick. We take great care with the development but we are not free from danger.
We CAN NOT be responsible for something bad to happen to your camera.
Good Luck
@moodoki
Some more links
http://magiclantern.wikia.com/wiki/Developing_info
http://magiclantern.wikia.com/wiki/Special:AllPages
http://www.magiclantern.fm/forum/index.php?topic=3267.msg20369#msg20369
I found a stub with an interesting name (BugDetect).
One of two ... or Canon admits may have bugs in the firmware, or they implemented some functionality to help take pictures of wildlife :)
40d111
NSTUB(0xFFD3E2FC, BugDetect)
@jplxpto
thanks for all the links:)
got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.
Now to get working on 40D..
Quote from: moodoki on December 09, 2012, 03:41:50 PM
@jplxpto
thanks for all the links:)
got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.
Now to get working on 40D..
You have to check if your camera has installed the FIR version 1.1.1
Good Luck
Nice work jplxpto and associates! I'm so happy to see the amazing job you guys have done so far! I'll be following with great interest!! :)
Keep it up!
As much as I want new features on the 40d I have to admit the largest problem with taking nice shots is the head behind the camera. ::)
Thank you!
Our team likes to know that you value our work and support us. Your words are always welcome lovable.
I'm a little busy but I still work in this port. In recent days I devoted some time to the forum and other matters of our development team. Soon I hope to have time and can get the intervalometer working. I've invested some time in this feature.
It is with pleasure that I announce you that we have another developer in the team.The 0xAF from 400dplus.
He has already started working on the port of 5DC.
There is much in common between the 40D and 5DC.
I will work in partnership with him. He is a good developer and already has much experience in this type of projects.
I hope to soon have the collaboration of Chucho.
He helped me a lot earlier this port. I hope your life, possible to devote a little more to this project.
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.
Thank you guys.
Quote from: samacochan on December 11, 2012, 07:26:20 PM
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.
Thank you guys.
Hi
Thank you for your kind words.
I have the same dream and that is why I have registered in this forum.
I never thought of creating an application to run on my little princess.
I almost killed my little baby, but little by little it grows and and gaining some maturity.
I started this project by insistence.
Everyone told me that this camera has VxWorks and this made it almost impossible one day ML support this equipment.
I've always been hurt by this statement.
I thought ... why my camera need be excluded from this wonderful world that is ML.
I wanted to learn a bit more and one day be able to have ML on my camera that I decided to start learning about ML. Past few days I've registered in the forum I was admitted as a developer for this fantastic team. I'm very grateful, they all welcomed me in the best way. Until today, always helped me whenever I needed. My free time is not much but I have learned a lot. I hope one day give you this happiness. Do not worry, I'm hoping to achieve ... if not me, another member will do it for me. Keep on dreaming ... maybe one day wake up and have a surprise in our forum :)
jp
I was examining some stubs that allow register, search and call functions by name.
I already knew them almost all but this time I found one that sounded interesting.
Some time ago I wanted to, at runtime, get the list of all registered functions.
I intend to write code that creates in the memory card, a file (registered_stubs.S) with all stubs registered by name.
I found the stub GetListOfName which I believe to be part of the tasks necessary to accomplish this goal.
When I have an opportunity I will analyze the firmware in more detail the firmware and do some testing.
40D111
NSTUB(0xFFD45DE0, GetListOfName)
NSTUB(0xFFD3E320, call);
NSTUB(0xFFD45CB8, FindName)
NSTUB(0xFFD4ECC0, Register_Func_with_Name)
NSTUB(0xFFD3E45C, Register_Func_with_Name_sub_1)
As I mentioned in a previous post, I'm trying to put the intervalometer working.
I've been examining the firmware and found some strings that can help me find the STUB that take photos.
I suspect the FA_Release stub is that I need to take pictures.
Once I have the opportunity I will try.
NSTUB(0xFF84768C, FA_Release)
ff811130 FA_Release
ff83ebc8 FA_Release
ff83ebd4 FA_ClearReleaseModeForLV
ff83ebf0 FA_SetReleaseModeForLV
ff83edec [FA] FA_CaptureTestImage
ff8478fc Remote
ff847a58 this
ff847a60 ../Remote.c
ff847a6c rmtRelease
ff847a78 rmtSaveToPC
ff84c148 RssRemoteReleaseQue
ff84c15c [RSS]FAReleaseExecute:%lx,%lx,%lx
ff84c180 [RSS]rssFAReleaseEnd:%lx
ff84c19c FA_RemoteRelease
ff84c1b0 FA_FinishRemoteRelease
ffb64a38 PtpDpsRmtReleaseEventFlag
The strings rmtRelease and rmtSaveToPC should be used to make the registration by name but i still unknown where on the registration is done. Maybe a solution is to list all the functions that are registered by name at runtime. Maybe.....
Quote from: jplxpto on December 12, 2012, 03:27:05 AM
I was examining some stubs that allow register, search and call functions by name.
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...
So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
Quote from: 0xAF on December 12, 2012, 10:00:28 AM
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...
So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
Thank you
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
Quote from: jplxpto on December 15, 2012, 04:21:16 AM
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
Quote from: 0xAF on December 15, 2012, 02:52:26 PM
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
You are right. After writing this post I read a bit more and this seems to be the expected behavior.
I have news.
After a few days away from development ... I came back to dedicate a few hours to the 40D port.
I managed to carry one more feature. The intervalometer is already working on my 40D.
I still can not decide which will be the new feature, maybe start by getting a list of all properties (or more important).
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
Quote from: Crowler on December 16, 2012, 04:33:06 PM
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
I hope so, but first I'll have to solve some problems with overlays.
I'm starting to identify some necessary properties for future functionality.
I've been testing two additional features that seem to be working well:
Expo/Aperture
Expo/Shutter
I will not be already available features because they change the values of properties and can turn the camera on a brick :)
I first got to have more trust in changes.
Once I have some free time, I'll try to change the value of the ISO and the program.
I'll try to provide all the features that are on the menu Expo.
Here is a list with the names of the properties. Regular expressions are not my specialty. :)
grep ".*[[:space:]]PROP_" 40d.111.ROMF1.0xFF800000.bin.strings | sed -e "s|.*[[:space:]]PROP_|PROP_|g" | sed -e "s|[[:space:]].*$||g" | sed -e "s|[\:\=\[\(].*$||g" | sort | uniq > 40d111_properties.txt
cat 40d111_properties.txt
PROP_ABORT
PROP_ACCESS_REMAIN
PROP_ACTIVE_SWEEP_ACTIVATE_CONDITION
PROP_ACTIVE_SWEEP_MODE
PROP_ACTIVE_SWEEP_STATUS
PROP_AEB
PROP_AFPOINT
PROP_AUTO_POWEROFF_TIME
PROP_AUTO_ROTATE
PROP_BATTERY_CHECK
PROP_BATTERY_REPORT
PROP_BEEP
PROP_BODY_ID
PROP_BUILTIN_STROBO_SETTING
PROP_CARD1_CLUSTER_SIZE
PROP_CARD1_EXIST
PROP_CARD1_FILE_NUMBER
PROP_CARD1_FOLDER_NUMBER
PROP_CARD1_FREE_SIZE
PROP_CARD1_IMAGE_FORMAT
PROP_CARD1_IMAGE_QUALITY
PROP_CARD1_IMAGE_SIZE
PROP_CARD1_NEXT_FOLDER_NUMBER
PROP_CARD1_RECORD
PROP_CARD1_STATUS
PROP_CARD2_CLUSTER_SIZE
PROP_CARD2_EXIST
PROP_CARD2_FILE_NUMBER
PROP_CARD2_FOLDER_NUMBER
PROP_CARD2_FREE_SIZE
PROP_CARD2_NEXT_FOLDER_NUMBER
PROP_CARD2_RECORD
PROP_CARD2_STATUS
PROP_CARD3_CLUSTER_SIZE
PROP_CARD3_EXIST
PROP_CARD3_FILE_NUMBER
PROP_CARD3_FOLDER_NUMBER
PROP_CARD3_FREE_SIZE
PROP_CARD3_IMAGE_FORMAT
PROP_CARD3_IMAGE_QUALITY
PROP_CARD3_IMAGE_SIZE
PROP_CARD3_NEXT_FOLDER_NUMBER
PROP_CARD3_RECORD
PROP_CARD3_STATUS
PROP_CARD_EXTENSION
PROP_CARD_IMAGE_FORMAT
PROP_CARD_IMAGE_QUALITY
PROP_CARD_IMAGE_SIZE
PROP_CARD?_STATUS
PROP_CFN_TAB3
PROP_CFN_TAB4
PROP_COLOR_SPACE
PROP_COMP
PROP_COMPRESSION_L
PROP_COMPRESSION_M1
PROP_COMPRESSION_M2
PROP_CONNECT_TARGET
PROP_CONNECT_TARGET_WFT
PROP_CURRENT_MEDIA
PROP_CUSTOM_WB
PROP_DATA_INPUT_TRANSMISSION
PROP_DATE_DISPLAY_FORMAT
PROP_DEFAULT_OBWBREG
PROP_DIR_SUFFIX
PROP_DISPLAY_AF_POINTS
PROP_DP_DPOF_PARAM
PROP_DP_EXT_OPTION_PARAM
PROP_DP_STANDARD_PARAM
PROP_DSDEFINE
PROP_DUST_DELETE_DATA
PROP_ELECTRIC_SHUTTER_MODE
PROP_ERROR_FOR_DISPLAY
PROP_FILE_NUMBERING_MODE
PROP_FILE_PREFIX
PROP_FIRM_VERSION
PROP_FIXED_VERSION
PROP_FLAVOR_BW
PROP_FLAVOR_FAITHFUL
PROP_FLAVOR_LANDSCAPE
PROP_FLAVOR_MODE
PROP_FLAVOR_NEUTRAL
PROP_FLAVOR_PORTRAIT
PROP_FLAVOR_STANDARD
PROP_FLAVOR_USER1
PROP_FLAVOR_USER2
PROP_FLAVOR_USER3
PROP_FLAVOR_XXXX
PROP_GPS_STATUS
PROP_GUI_STATE
PROP_HDD_DCIM_PATH
PROP_HIGHLIGHT_ALERT
PROP_HISTOGRAM
PROP_ICU_AUTO_POWEROFF
PROP_ICU_UILOCK
PROP_Initialize
PROP_LANGUAGE
PROP_LAST_JOBID
PROP_LAST_JOB_STATE
PROP_LCD_BRIGHTNESS
PROP_LCD_STATE
PROP_LENS
PROP_LIVE_VIEW_GRID
PROP_LIVE_VIEW_VALID
PROP_LOGICAL_CONNECT
PROP_LOGICAL_CONNECT_WFT
PROP_LV_AF_RESULT
PROP_LV_AVAILABLE_AREA
PROP_LV_EXPOSURE_MODE
PROP_LV_HISTOGRAM
PROP_LV_OUTPUT_DEVICE
PROP_LV_SPDN_BTN_STATUS
PROP_LV_TEST_REMOTE_RELEASE
PROP_MENU_POSITION
PROP_METERING_MODE
PROP_METERING_TIMER_FOR_LV
PROP_MWB
PROP_MWB1
PROP_MYMENU_LIST
PROP_NO_CARD_RELEASE
PROP_NUMBER_OF_CONTINUOUS_MODE
PROP_PC_FLAVOR1_PARAM
PROP_PC_FLAVOR2_PARAM
PROP_PC_FLAVOR3_PARAM
PROP_PC_FREE_SIZE
PROP_PC_WB1
PROP_PC_WB2
PROP_PC_WB3
PROP_PC_WB4
PROP_PC_WB5
PROP_PERMIT_ICU_EVENT
PROP_PHOTO_STUDIO_ENABLE_ISOCOMP
PROP_PHOTO_STUDIO_ISOCOMP
PROP_PHOTO_STUDIO_MODE
PROP_PHOTO_STUDIO_MODE_CHANGE_AUTO_PASSWORD_KEY
PROP_PHOTO_STUDIO_MODE_CHANGE_MANUAL_PASSWORD
PROP_PHOTO_STUDIO_SETUP_PASSWORD
PROP_PHYSICAL_CONNECT
PROP_QUICKREVIEW
PROP_QUICKREVIEW_MODE
PROP_RED_EYE_REDUCTION
PROP_REMOTE_BULB_RELEASE_END
PROP_REMOTE_BULB_RELEASE_START
PROP_REMOTE_RELEASE
PROP_SAVE_MODE
PROP_SaveMpuDebugData
PROP_SDIO_PHYSICAL_CONNECT
PROP_SDIO_PHYSICAL_CONNECT_START
PROP_SELECTED_FILE_PREFIX
PROP_SET_TV
PROP_SHOOTING_TYPE
PROP_SHUTTER_COUNTER
PROP_SPECIAL_OPTION
PROP_STARTUP_CONDITION
PROP_STROBO_CFN
PROP_STROBO_SETTING
PROP_STROBO_WIRELESS_SETTING
PROP_TEMP_STATUS
PROP_TRANS_METHOD_WFT
PROP_TUNING_FLAG
PROP_USBDEVICE_CONNECT
PROP_USER_FILE_PREFIX
PROP_USER_FILE_PREFIX2
PROP_VIDEO_PHYSICAL_CONNECT
PROP_VIDEO_SYSTEM
PROP_WBB_BA
PROP_WBB_GM
PROP_WB_MODE
PROP_WBS_BA
PROP_WBS_GM
PROP_WFT_ADAPTERINFO
PROP_WFT_CAPTION
PROP_WFT_DELIMITER_STATUS
PROP_WFT_DONGLE
PROP_WFT_FTP
PROP_WFT_HOSTINFO
PROP_WFT_HTTP
PROP_WFT_IMAGE_TRANS
PROP_WFT_LOCK
PROP_WFT_SYSTEM
PROP_WFT_TCPIP
PROP_WFT_TRANSMISSION
PROP_WFT_WIRED
PROP_WFT_WIRELESS
PROP_WIZARD_WFT
I think it is not missing any. If you detect any problems let me know. Thank you.
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...
PROP_LV_AF_RESULT
Quote from: jplxpto on December 18, 2012, 02:15:02 AM
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...
PROP_LV_AF_RESULT
Hi guys, glad to see an active develop thread on the 40D.
My 2 cents: 40D can indeed autofocus in LV, via C. Fn. III-6. Please check http://photography-on-the.net/forum/showthread.php?t=428535, so PROP_LV_AF_RESULT is probably related to it.
Regards
Hi Thank you for registering at our forum. You are welcome to this community.
I appreciate your link. I learn a little more. Glad to hear that works with a 40D.
I hope one day to enhance your camera.
BR
I'm sure you will.
Thank you very much!
waiting waiting waiting :)
Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
Quote from: imme on December 29, 2012, 09:11:31 AM
waiting waiting waiting :)
Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
There's no ML for the 400D. It's a different project altogether called 400plus. We do share some code and ideas though
Thanks ......I thought it was ML. 400plus is a good project. I am waiting for 40d ML. It good to see you people working on this project
News??? :)
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
Quote from: imme on January 11, 2013, 01:56:47 PM
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
I can't answer that question.
I work on this project whenever I have time and disposition.
I'm busy finishing a project and I have many issues to deal with in my life.
I hope soon to be able to continue with this port.
I started making the discovery of most properties.
Many of them are critical to continue the port but this task takes a long time.
In recent days I have devoted some time to the 650D.
I have a camera with me and I'll start doing some tests with ML.
JPLXPTO........i am a big fan of your work. It was you who started working on this port. I am hopeful you will make 40d ML very soon.
Thank you!
I just wanted to say I remember sitting in the earlier days of ML, hoping a 40D patch would come, then hearing not, and I don't know how I missed this thread...
Anway, just going to give some moral support, and when I get a little time see if I can assist further (I do own a 40D, and am happy to help where I can).
PS I am really impressed by the work of the developers and the talented people using ML.
Took time following the fantastic work they are doing you, and just wanted to congratulate you for it.
I also give my moral support to this project, because as j-Veitch said I too have been waiting for the arrival of the patch to the 40D.
I think we all know how hard it must be to create this, and I also believe strongly that the EOS 40D ML deserves.
I hope to be helpful at some point and I apologize for my bad English.
A greeting.
news???
I have just registered just to post here and give you a thumbs up.
Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.
I am seeking for any news about it.
Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
Quote from: ariznaf on February 21, 2013, 06:38:21 PM
I have just registered just to post here and give you a thumbs up.
Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.
I am seeking for any news about it.
Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
I am afraid you will be disappointed. Come back in six months and see if I am wrong.
Well, firmware is new to me. And I am reading what I can in the time I have. i did get round to dl'ing the ubuntu vm... And one o the devs at my work has at least used vxworks amd arm in the past. But, really not sure where to go from here. Anyway, i haven't given up hope yet.
I have several Eos cameras, however the 40D has the best sharpness per pixel performance. Just look at DP preview's review of 50D and how it compared to the 40D 10mp sensor. So if someone are able to fix ML for the 40D, it think it will be one of the sharpest video enabled DSLR.
I will also pay something if I get HD video properties to 40D! Would be great to utilize the old camera!!
We all are desperately waiting for 40d Magiclantern version. But I think 40d is not on priority list of ML.
Please! I request that If 40d port is possible than keep this thread alive in other case close this thread and say 40d port is not possible due to all new camera portings. It will close the case forever. I am not disappointed or emotional but I am trying to convey feelings of several 40d users who are anxiously waiting for 40d version. But there is no development priority for this.
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
I'M LIVE :)
Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.
I think the developers have done an excellent job.
I promise appear shortly.
BR
Quote from: ariznaf on March 06, 2013, 11:13:04 PM
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
YES!!! You are right! Thank you for your kindness.
You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(
I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.
BR
Quote from: ariznaf on March 06, 2013, 11:13:04 PM
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
I still have some outstanding issues to resolve but I will endeavor to return soon.
I have several eos cameras, the 40D however produses very sharp and clean images for it's size (10Mp). Take a look at DP's (Digital preview) review of the 50D where the older 40D at delivered the same image quality as the 50D when magnefied, even if the 50D has a 15.1 Mp sensor.
I think a Magic Lantern converted 40D camera would be one of the best and sharpest film cameras, and to a fair price. ;)
Quote from: jplxpto on March 21, 2013, 02:04:22 AM
YES!!! You are right! Thank you for your kindness.
You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(
I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.
BR
Well come back and many thanks for your efforts. Glad to hear from you.
Hope your personal troubles and your health issues have been solved.
Programming is a very time consuming task, and this kind of programming Is even more demanding.
Hope you find the time to complete the task, but even if you cannot complete it, we should be gratefully for your efforts and time.
I come often to the thread to read about the progress. I would like to test ml in my 40d and test video in a DSLR.
May be in the near future, when the price lowers more, I will buy a 7d as my video camera is dead, but I am not sure that a DSLR is an alternative to a consumer video camera.
Anyway there are many interesting g things in ml for photography too.
jplxpto，I found some information for you
1.http://valexvir.narod.ru/ -----from Russian，for 40D, 50D, 5D Mark II и 1Ds Mark III - record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK http://chdk.wikia.com/wiki/For_Developers
3.one chinese cracked the firmware of 40D，found out the "factory menu"；ISO 50-6400；AF CK;but he stoped （write text.bin），
http://bbs.fengniao.com/forum/1397306_8.html
http://bbs.fengniao.com/forum/1397306_9.html
Quote from: mincanphoto on March 24, 2013, 02:33:52 AM
jplxpto，I found some information for you
1.http://valexvir.narod.ru/ -----from Russian，for 40D, 50D, 5D Mark II и 1Ds Mark III - record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK http://chdk.wikia.com/wiki/For_Developers
3.one chinese cracked the firmware of 40D，found out the "factory menu"；ISO 50-6400；AF CK;but he stoped （write text.bin），
Thank you!
My dear friends,
Finally, I got some time to update my repositories and make the necessary changes to make the build of ML for 40D.
My next task will be to fix the menus.
Many changes were made to the menu system and now some things are not well presented. For example, icons appear with double the size.
I think, users of 5DC will have the same problem.
I made small fixes that should have an impact on 5DC but I do not have this camera for testing.
https://bitbucket.org/hudson/magic-lantern/pull-request/71/some-change-to-build-ml-for-vxworks/diff
Just want to say, thanks for all your efforts so far. I just never seem to have the time to look further myself... It is quite a learning curve for me.
Some screenshots:
http://i.imgur.com/qfFlm6w.jpg
http://i.imgur.com/cqslQ9x.jpg
http://i.imgur.com/eRVDcgb.jpg
http://i.imgur.com/X0YpUVX.jpg
This are great news ;D
Great to see progress.
I really would like to help, so if some alpha-testing is necessary ^^
Do you already have an idea if a iso expansion would work?
It does already, use Lightroom.
;)
Thats the standard answer ;)
But it's a bit easier and better to handle to select a iso value instead of underexposure.
It's just the standard workflow with the cam - for me ;)
Created an account to show support for this project. I'll also throw my camera up for grabs for testing if needed.
Hello! I have created account too, just to show my support. I already follow this thread unregistered, from the its begining and just because of maybe incoming Magic Lantern for 40D, I still keep my three 40D's.
Many many thanks to the developers of Magic Lantern! When I watch what you guys do, it seems to my like a rocket science. Really unbeliveable...
If you successfuly finish this project, you will receive a donation from me, for your big success.
Big thanks in advance and I will stay tuned to the new happening.... :)
I too have created account, to congratulate you all, for trying. My 40D is wainting to test ML.
I did the same thing as anyone else :) i made an account just to say good work and keep it going! i would love to make my 40d take short clips but i have one thing to ask, would it be hard to add the timelaps feature in the 40d magic lantern? becouse i would loe to take some timelaps without the 200$+ remote :o
Keep doing your awesome work 8)
:) will we be able to film video on 40D?) cool
Great, I see that you are now back in the developement and makin progress.
Thank you for your work and time.
I love my 40D - its a great camera and it does a great job!
If ML is going to hit it, it would be a big rebirth for the cam.
I am thankful to all of the developers for their personal effort in ML as a whole and jplxpto in special for his work on the 40D.
It's an "old" camera, so it is not a matter of course that someone takes over such a hard and long work for it. So: thumbs up for you jpl and never forget: don't mind how many people are asking for features/dates/whatever: there are more important things in life.
> there are more important things in life.
Such as?!
No, seriously. While I go to this page almost every day in the hope of some progress, I realize that ML is not a make or break for me becoming a better photographer. And, sadly enough, neither is getting new lenses... But the geek in me would love to test out new features on the 40D any day, so I keep coming back. Keep it up jplxto, really appreciated!
At this point, anyone with a 40D and some C skills can grab the source code and improve it. So... what are you waiting for? ;)
Alex is right about it.
But is there an easier way to do it for the majority who may not know how to do with the source codes. Is there a simplified version with only a few functions e.g. intervalometer, auto WB control etc. to start with. I think most 40D owners will agree to pay to finance the development.
Any thoughts from the supporters of this thread.
Compiling the current source code will give you that version to get started. The menu works, but other than that I have no idea what else works.
Maybe jplxpto can publish the devkit (the FIR for enabling the bootflag and dumping the firmware)?
How much it cost the developing of a working firmware?
Hundreds of man-hours.
I bought a second 40D (i have another 40D from before) that i intend to reserve for use with and furure realease of ML.
Hello all!
Tell me please, where I can download current source code?
Is there AF microadjustment function? I need only this one.
Or maybe I can adjust AF without ML?
Thank you for this job!
And sorry for my english, I'm from Russia :)
@ jplxpto , coutts.
Thanks guys for all your efforts and hard work. :)
If finally we get a ML download for 40D, do we get a ML for 450D as well?
No, but it will be easier to port, if anyone is interested in doing that.
Quote from: n0rt0n on April 19, 2013, 11:04:16 AMIs there AF microadjustment function?
Нету в ML микроаджустмента, такчто даже не надейтесь.
Quote from: n0rt0n on April 19, 2013, 11:04:16 AMOr maybe I can adjust AF without ML?
У 40д нет такой фичи, так что только нести объектив в сервис.
Quote from: n0rt0n on April 19, 2013, 11:04:16 AMI'm from Russia :)
Ничего, бывает =)
I have 40D and would like to give it a try with Magic Lantern. I have a background with CHDK but never thought about ML until now. If anyone has a dumped 1.1.1 please PM me.
Consider to switch to 50D/550D and install ML to play with. The price drop of the 40D since last year was a significant amount(from $350 to $250 on the Craigslist in Canada) and so are the other two mentioned here. 40D is good but the other two are equally good in some other aspects.
Anyway, don't waste time waiting, just go out and click, click and click.
Quote from: a1ex on April 23, 2013, 04:38:58 PM
No, but it will be easier to port, if anyone is interested in doing that.
Thanks for the reply. I hope this happens. :)
It's not really that hard - if you have enough time, motivation, some basic programming skills and the desire to learn, you can do it. It's quite similar to programming embedded devices or microcontrollers.
See also:
http://chdk.wikia.com/wiki/FAQ#Q._My_camera_isn.27t_ported_yet._Is_a_port_planned.C2.A0.3F_When_will_it_be_ready.C2.A0.3F_How_can_I_help.C2.A0.3F
news???
news? oh you are wanting a personal update just for you, gotcha, sorry carry on......
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)
Wow......will this happen on 40D ?
Quote from: samacochan on May 27, 2013, 01:56:01 PM
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)
Wow......will this happen on 40D ?
I found the required function stubs for it, so in theory it should work if somebody is still working on this port ;)
Too bad that the developer seems to have abandoned ship, so we may never know... :-\
Then again, this is all voluntary work, and messy stuff, so I can understand it if he suddenly decided it wasn't worth the effort... I unfortunately completely lacks the skill to finish off what he started.
I have 5DmII but I would like to try ML on my 40D its any progress there? :)
+ I could help you with testing etc
this topic caught my attention as well. If I had the skills I certainly would help, I did a little of coding in my past years but I can't imagine how hard it is to achieve a firmware modification on a camera. there are certain things that an older camera like the 40D would benfefit from, like the software is really old (auto-iso etc.) but the images are still awesome (I do prefer sometimes the 10MP sensor over smaller pixels) so, what canon wants us to do: buy a newer tool. with software so complicated to adjust on cameras its really a smart step of camera manufactures to keep them at dinousaur stage.
well, I assume you all agree, what I wanted to say: If there is a way I can help, I'll invest a lot of my free time (which I got like a month for this summer) If there is enough information available that someone like me could possibly read into that field of work.
best regards
I was following this thread when it was active, but I think the 50D development has been prioritized for the moment.
I've got a 40D, so I would certainly help with testing builds, but like others I have limited programming experience.
yea 40D is really good camera.. (I used 50d and I dont like it 40 was better) I like this camera cause this cam is very good in sharp and its really fast in focus (im still using it for rally etc)
Quote from: jplxpto on March 21, 2013, 01:56:47 AM
I'M LIVE :)
Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.
I think the developers have done an excellent job.
I promise appear shortly.
BR
Hope things have bettered up for you 'jplxpto'. Thanks so much for the dedication you have put into the development of ML for us 40D users. (Of course gratitude goes out to Alex and all the other developers also).
I heard about ML only last night from my wife's boss who uses it on the 5D MkII. He does commercials and all that stuff with it. He's very excited about it and trust me, I can see why.
It would be a real joy to be able to shoot video on my trusty 40D. I just cant wait.
Thanks for the great work guys. I'll surely be one of the first to download ML for the 40D.
Hello guys ... sorry ... I've been very busy with work ...and also some health problems.
I've been completely absent during the last months ...
I hope to soon be able to return to work for this magnificent community
and of course I'll come to invest some time in the port of 40D.
Best regards
that is awesome news jplxpto, I am new to the community and although I am fortunate enough to have ML for 6D I have been hoping to see the 40D with some ML 'goodness' :D
very encouraging!!
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.
Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
Quote from: imme on July 31, 2013, 09:59:31 AM
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.
Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
Hi,
This week I've been reading about the latest news.
I updated the source code to the 40D but the project did not compile ...
I've started to make some changes but still could not test anything.
The menus have worked in 40D.
Before getting out of the project, I was making the discovery of the main properties.
The selection of the focus points have worked correctly.
I also able to change the aperture and shutter speed.
Some overlays also have work in play mode.
I still can not display the overlays in live view mode.
I still could not find the addresses of HDVRAM. I hope to do that soon.
I hope your health problems are not serious.
It's nice to see you are back to work with us!
Quote from: ilguercio on July 31, 2013, 03:19:58 PM
I hope your health problems are not serious.
It's nice to see you are back to work with us!
I'm fine... Thank you...
BR
Goodluck........ :D
Well come back.
Glad to hear you aee ok and tour health problemas are gone.
Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
After a few months away. ML works again on my 40D.
I hope soon to have time to fix the loading of modules.
At this time no module is loaded.
I also saw that there are some problems in the menus.
The fonts seem to me unclear.
Quote from: ariznaf on August 07, 2013, 11:08:36 AM
Well come back.
Glad to hear you aee ok and tour health problemas are gone.
Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
Thanks for everything but there is still much work to be done.
if you could add iso 12800 - i would donate some cash for your work :)
Quote from: nexiabass on August 13, 2013, 11:44:58 AM
if you could add iso 12800 - i would donate some cash for your work :)
I apologize to disappoint you, but all systems have their physical limits (hardware) and the software does not perform miracles ...
I do not think that's possible.
If I could do that, probably the noise would be so high that no one would want to use.
Still ... this fantastic community needs help to survive.
There are some very active members who deserve to be properly rewarded, even if it's with new equipment, ... new challenges, ...
and recognition of their work ... some of them work hard for this project ... day after day ...
Briefly, a help is always welcome :)
BR
Hello jplxpto, I can and wish to help if you just give me a few step-by-steps how to.
What do I need of the equipment to start working and helping in this project?
JPL........its good you are back on track. I know port will take time to complete and also it needs your spare time and good health. We are waiting and wish you goodluck.
Is there currently a more "modern" version of the firmware extract/build instructions to create a FIR file for the 40D than the one located here : http://www.magiclantern.fm/forum/index.php?topic=1452.msg3856#msg3856 ?
Some of the tools listed in that don't exist in the repository anymore, so I'm getting the distinct impression that the build process has changed slightly.
Thanks!
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
Quote from: rufustfirefly on August 28, 2013, 05:45:10 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
http://www.magiclantern.fm/forum/index.php?topic=7955.new#new (http://www.magiclantern.fm/forum/index.php?topic=7955.new#new)
JPL any update???????
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?
I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
Quote from: rufustfirefly on September 08, 2013, 12:23:21 AM
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?
I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
rufustfirefly. I am not a developer but if you read this thread from start you will get lots of information. JPL, Nanomad and alex had in detail discussions related to development and 40d porting.
Quote from: rufustfirefly on August 28, 2013, 05:45:10 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?
Quote from: StefanKeller.AC on September 21, 2013, 12:07:01 PM
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?
I'm having some issues getting development rolling on the 40D, primarily because I've been unable to extract an unencrypted version of the 1.1.1 firmware (as I had mentioned earlier in the thread). This has left me unable to find the rest of the function locations, so getting this port working, at least at the 1.1.1 firmware revision, isn't going to happen -- pending being able to get an unencrypted copy of the firmware to work with.
Alternately, I can try to move to using 1.0.5 or 1.0.8, which have both had their encryption keys reverse engineered. I hate backing out versions of firmware, but if it's the only way I can proceed, I may go that way.
News???
I have built a set of dumpers, which should dump out the active firmware. If someone wants to try to load one or the other up on their 40D running v1.1.1, we should be able to get an unencrypted dump of the firmware.
It's all based off of the previous 1.0.5 and 1.0.8 work, so mileage may vary.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir)
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir)
There's a disclaimer that this could do something awful -- but one of them should just dump a file to your card (after a flurry of activity).
If anyone wants to check my work, it's all on bitbucket:
https://bitbucket.org/rufustfirefly/40d108-dumper (https://bitbucket.org/rufustfirefly/40d108-dumper)
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.
Quote from: imme on November 02, 2013, 06:00:11 AM
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.
The trick is to dump the .FIR file onto your CF card (presumably using a CF card reader), then use the "Update Firmware" menu option to attempt to sideload the dumper code. It won't actually upgrade your firmware, but rather attempt to run the custom code which should, in theory, spin the CF card for a bit and dump out a file containing the loaded firmware.
It could also do bad things, which it shouldn't do. If, for some reason, it locks up completely and hasn't done anything within 30 seconds or so, you might want to pull the battery.
On a 1.1.1 40D with full battery :
After a few seconds of "loading firmware update"
- 108D1.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
- 108D2.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
Both needed a battery remove, and the 40D still works fine after that.
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
Quote from: pixelk on November 09, 2013, 02:21:38 PM
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
I see more or less the same (also with 1.1.1) - except the camera won't capture, but focus works...
/Anders
Yes sorry, I didn't try to capture, maybe it didn't work, maybe it did. But without the CF card recognised, my only urge was a full reset ;D
hi,
rufustfirefly is there any update on 40d ML version you are working ????
jplxpto & rufustfirefly any latest update on 40d port? have not heard from you guys for a long time.
...and here's another guy willing to contribute work that
might even brick his camera for the sake of getting a
running 40d port. So, if there's anything I could
possibly do, let me know!
Hi everyone,
What is the current status? Do we have a forked development of the 40D ML or rufustfirefly progressing on his own? I am very confused.
Guys whatever the case is thank you so much! Let us hope for the best. ;D
I've just installed his build - and it has a few features... Now I know we are talking about quite an old body. Indeed since 2007 way too many things have developed. And yet could some more features
be expected?
Can you please tell me what features are supported in this firmware. I just need HDR and timelapse feature. is it there?
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
Quote from: Canon40D on March 31, 2014, 05:18:59 AM
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
Quote from: Marsu42 on March 31, 2014, 11:37:32 AM
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
I'll just stick to my T2i for now, though I love the feel of my 40D over my T2i which is why I would love to get ML working on it.
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
Quote from: rufustfirefly on April 02, 2014, 05:49:10 PM
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
wow, god job bro
Quote from: rufustfirefly on April 02, 2014, 05:49:10 PM
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
Just joined, and have a 40D. Noted that 40D is listed on the home page as "supported" but based on what I'm seeing, that's perhaps a bit misleading...
However, I do have code experience with the msp430 microcontrollers, and from what I'm seeing, there would be a learning curve with the controller for the 40D, but hopefully not insurmountable. I guess time will tell.
Aside from this extensive thread, are there any other resources regarding design of the app??? Or is it just "read the code?"
Thanks!
bob
Quote from: NurseBob on April 04, 2014, 11:51:18 PM
Aside from this extensive thread, are there any other resources regarding design of the app??? Or is it just "read the code?"
I've found it to be a bit sprawling, but there is a lot of information buried on the wiki http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki (http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki)
chris_overseas
Thanks! Looks like a great starting point, and a whole lot of homework... So it goes. :)
bob
> Thanks! Looks like a great starting point, and a whole lot of homework... So it goes. :)
For what it is worth, we are several people who still follow this thread closely! We wish you good luck, should you except the challenge.
I am following and waiting for this port for long time :D
Today I thought I must remove 40d ML updates from my RSS feeds. But NurseBob I hope you can make it a reality for lot of Magic lantern users.
I am not a developer but this whole 40d thread contains lots of information sharing by some developers and Magic lantern team lead.
Goodluck
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
Quote from: tonesen on April 23, 2014, 12:44:55 PM
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
hi
im donating some micro bitcoins to someone who can finally make the 40d capture video at, preferably, 24fps with 720p resolution, ideally
who's with me? ive got a 40d lying around here, clean and dust free.. by the way, good job on that rufustfirefly!
Quote from: Canon40D on April 24, 2014, 02:17:24 AM
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
It is possible to shoot video today, but through a connected computer.
See http://sourceforge.net/projects/eos-movrec/
First - thanks to those who have contributed to ML, it is an awesome tool.
I have 7D with it running, but my 40D seams to be collecting dust, because some of the tasks I would use it for would benefit form ML. like built in intervalometer, bulb timer, bulb ramping or even better - automatic ettr with deflicker. I wish i could help, even tough I have written some code in in various languages, including even low level assambler for atmel avr micro controllers, newer got a good grasp of C, somewhat it always have made me lose interest in it. now I bite my fingers, should have learned it.
I really hope that some day, before the 40D dies we would see ML in it. IMHO video functions, even tough cool, are not for the humble 40D, there are cameras much better for this. Photography would benefit greatly form ML tough.
Hello friends!
I did not understand where I can download the modified firmware for my Canon 40D ... can you help?
it is still in development.
Any updates? Also waiting for this firmware update... goodluck guys
everyone is really anticipating this great hack/tool for a great camera 40D :)
I am waiting too! :)
Quote from: Marsu42 on May 21, 2014, 05:21:18 PM
Don't pray, code!
Also, these days you can emulate ML code in QEMU (http://www.magiclantern.fm/forum/index.php?topic=2864.msg117430#msg117430) and you have two early ports in progress. No more excuses ;)
Any update? :)
No volunteer for a DIGIC 3 based system.... Come one. Where is the chalenge these days?
What need help? I have 40d camera.
great, it seems to work anyway. :)
seams to work what?
What is working? Where???
Ok. What do you need? Voulontier? here i am. Shoot. :)
Any updates? I just heard about Magic Lantern and wanted to try it on my 40D, was dissappointed to see that the latest release doesn't support it.
Hi all,
Can somebody clarify about 40D?
On main page it is written
Supported Cameras:
5Dc, 5D2, 5D3, 6D, 7D, 40D, 50D, 60D, 500D (T1i), 550D (T2i), 600D (T3i), 650D (T4i), 700D (T5i), 1100D (T3), EOS M, 100D (SL1)
On download page http://www.magiclantern.fm/downloads.html is written that only these camera are supported
5D Mark ii 2.1.2
50D 1.0.9
60D 1.1.1
500D 1.1.1
550D 1.0.9
600D 1.0.2
and finally here http://www.magiclantern.fm/features.html is written that for 40D only beta version with Core ML features exists.
I completely do not understand will it work or not? and if beta exists where can I download this beta and try?
Is somebody working on the 40D ML right now? I know it is hard to say, but when we could expect some update or even first working version. (Video recording feature will be great!)
Thank you, for any responses. ;)
I too hope that you get ML working on the 40D I would love to do time lapse with mine and as for video....well ;)
Daf
i think that we will never get 40d i wanted to know programming to do it.. but idk :/ :(
40D is not going to have video, it has not that much cpu power, nor hardware for that, in 50D case the feature (h264 encoding) was there, just not enabled. Other thing is that 40D is VxWorks so that is different platform at all.
for time lapses tough 40D is grate, I own one, and I would like to have histograms, intervalometer, bulb timer, dual iso there - but it seams that those few capable of doing this are not owning a 40D, so thus no progress. Sadly CHSDK says that 40D is to pro for them. so we are stuck in between.
It can, both MJPEG and RAW. Read the thread ;)
(whether somebody will implement it or not, that's another story, but the proof of concept was done)
I ment the h264 one, mjpeg would be possible for any camera that shoots jpg, right. as for raw, Have anybody done tests on max card speed in this camera? Otherwise the 40D would be a good choice because of considerably smaller pixel count, thus when skipping lines, less moire. I really wish that I would had time to learn C, and could work on this port...
Has anyone done a dump of the ROM?
But a1ex unfortunately most of us on this 40d post are not developers. We are waiting for someone who can do this favour to us. Can you please do us a favour and do something for all people like us who are waiting for this port.
any update on the port
i realy like the ML on 500D and want to have on 40d
I would like to use my 40d as timelapse camera, so if there is a version that enables the main features for timelapse would be great!
I think vxworks is really very difficult task to do since no one has yet been able to create a workable solution for the 40D.
I am buying another 40D again today (since it is the cheapest decent camera I could find) after I sold that last one (due to money problems) and I would really like to see some developments for this in Magic Lantern.
Any chance for 40D ? It can be without video, timelapse is what I need.
Wake UP 40D People's after 6 month non stop work on magic lantern on my 40d already i completed some verizon and tested ML 2 days now every thing work great i will continue with testing full month.
Please share a link to your bitbucket repository. ;)
Is it working? Did you manage to enable video? Will you share?
Please, Post here all the news with the 40d, there is a lot of people wanting to record video on the great 40D and you´re our last hope, we appreciate all of your work. Thanks.
Hi everyone, I just discovered Magic Lantern for the first time and I'm interested in getting involved. I have a 40D and I'm a software engineer by profession. I'm not sure exactly where to start, i.e. what's the status on 40D support, what needs to be done, etc? I can download the code and build it but I don't want to brick my camera right off the bat. If anyone can point me in the right direction it'd be great!
Source to use:
https://bitbucket.org/hudson/magic-lantern/src/7d67bc6f378a8e7f607369a374f617491f32d2c5/platform/unmaintained/40D.111/stubs.S?at=unified&fileviewer=file-view-default
Check also "Qeen Mum's" thread:
http://www.magiclantern.fm/forum/index.php?topic=1010.0
eduperez has also 400plus running which is not ML but they share some stuff:
https://github.com/400plus/400plus
- Preferrably you would fork the unified branch from ML on bitbucket
- Move the initial linked 40D platform out of unmaintained
- Strip down code or uncomment stuff which produces compile errors while first trying to #define CONFIG_HELLO_WORLD
- regarding your brick question: comment out #define CONFIG_PROP_REQUEST_CHANGE from internals.h and you are good to go
- You would need the 40D.111 firmware dump (anyone?) to find stubs and consts. Remember: dumps have to be kept private. No public posting.
- You would need a way to enable bootloader (is there any installer (ML-SETUP.FIR) available already?)
- for state objects check: http://a1ex.bitbucket.io/ML/states/index.html
- Prepare yourself for endless hours of work and try to catch a1ex on IRC if you need help with the bootloader :P
Hi all,
Do you accept pull requests for unmaintained (f.e. this very 40D) platforms? Instead of someone hacking on his/her own and later possibly dropping the whole thing for losing interest, or for not able to finish it, without telling anyone how far he/she got, it could make sense.
Thanks,
-w-
Now and then someone is posting something here. Now we have a some source files at our disposal, but how to run them on the Canon 40D?
Please could anyone explain.
Thank you in advance who ever you might be.
Hi,
I checked out changeset 8159 (the last one with 40d changes) and compiled it with arm toolchain 4.6.2. It went without problems, I did not try any newer version)
Then I took the 5D installer from installer/5DC.111, replaced the addresses of LEDs and write_bootflag/read_bootflag functions with the ones found on the first page of this thread, compiled and created installer firmware with dissect_fw3 and assemble_fw tools. There is no known address for write_card_bootflag so I formatted the card manually.
Then It successfully enabled the bootflag and the camera is able to boot the built magic lantern, which works good enough to show menu. Then I dumped the fw and run ARM-console on it. Too bad that I don't understand the ARM assembler much.
I wanted the fps override function for night focusing, but I could not find anything like shadow registers, so I ended with a hack that writes hardcoded value to fps register from ISO prop handler each time when iso is set to 1600.
Also I noticed that the camera is rather unstable and crashes after several shots. I disabled everything except boot code and finally found that it gets fixed by calling cache_unlock() from ml_hijack_create_task_cmd_shell() in platform/40D.111/init.c.
Then I just re-enabled the ISO prop hack.
The camera now provides all the functionality that I need and is quite stable, so I don't plan to work on it further,
Sounds good!
Do you mind sending me a copy of your ROM, for trying it in QEMU? The one I have is incomplete.
It would be lovely if a usable version could be made before I buy the 5D M4.
If I can make use of the huge ML features
- Auto ETTR and
- RAW histogram
- dual ISO (if possible).
That would make quite an awesome old camera.
I've been plugging away at trying to replicate vnd's success with a modern version of ML -- which has been complicated by most of the VxWorks code being relatively unmaintained (from what I can see).
I'm most of the way through getting it to compile, although there are some deficiencies I've been trying to hack around. If anyone's interested in jumping in:
https://bitbucket.org/rufustfirefly/magic-lantern (https://bitbucket.org/rufustfirefly/magic-lantern)
(I'd be more than happy to either accept pull requests or grant full access to the repository, if anyone else wants to work on it.)
For a quick update:
I've got everything compiling, but I'm pretty sure some of my functions aren't defined in the right places, etc, so it's failing to link properly -- but otherwise it looks as though it's doable to get this working with the modern ML codebase, assuming that I (or someone else a bit better at this) untangle a few of the bad references and definitions in there.
That's as of this commit:
https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d (https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d)
Update:
I've got it compiling and linking, although there's some serious hackery involved, as well as a bunch of functions which have been dummied up, since I'm not sure where they map on the 40D's OS.
https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847 (https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847)
Quote from: rufustfirefly on October 01, 2016, 11:13:50 PM
I've got it compiling and linking
Did you try to run it on your camera?
Quote from: vnd on September 25, 2016, 07:58:34 PM
There is no known address for write_card_bootflag so I formatted the card manually.
For 40D111 it should be 0xFFFF43A0.
Some small progress that also applies to 40D:
Quote from: a1ex on November 01, 2016, 08:45:51 PM
Added the 450D and 40D changes to the vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks) in the main repo. Did some minor cleanups (compiler warnings), had some attempts at emulating it in QEMU, but didn't really check any deeper yet.
For reverse engineering, I've adapted the dm-spy-experiments (http://www.magiclantern.fm/forum/index.php?topic=2388.msg113154#msg113154) branch as vxworks-dm-spy (https://bitbucket.org/hudson/magic-lantern/branch/vxworks-dm-spy) (tested in qemu).
So is it working? :-) Sorry not quite clear for me :-[
Nobody knows.... as it seems. A dead end :/
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.
Thanks
Quote from: Morbius on August 16, 2017, 02:48:46 PM
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.
Thanks
As the documentation for 400plus
clearly states, "
It is designed specifically for the Canon 400D/XTi and will not work with other camera models".
Even after all this time.... Here things are as stuck as they are on the 5D4. Why do I pick the wrong for ML camera :/
Is there anyone currently working on porting ML to the 40D? If not, is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
Quote from: Theta Sigma on December 02, 2017, 03:46:39 PM
is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
Likely all three.
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D111.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu16.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml1.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml2.png)
What does this mean? Porting ML on this camera is no longer difficult at all - it's just a matter of fixing the remaining issues (you've just got a very powerful tool for that) and bringing the source tree up to date with the mainline code. All the changes from rufustfirefly are also in our vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks), but there are a few stubs missing; still, it shouldn't be hard to fix them and get this working in the emulator.
For the impatient: QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/), installation video for Ubuntu (https://twitter.com/autoexec_bin/status/913530810686418944), for Mac (http://www.magiclantern.fm/forum/index.php?topic=16012.msg191686#msg191686) and guide for Windows (http://www.magiclantern.fm/forum/index.php?topic=20214.0).
Next steps: dfort's porting tutorial (http://www.magiclantern.fm/forum/index.php?topic=19417.0) the EOS M2 walkthrough (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084) and the 450D port (http://www.magiclantern.fm/forum/index.php?topic=8119.0) as reference.
As mentioned earlier - the camera is capable to record video (both MJPEG and RAW).
Want to help? Please follow the above links and confirm you can get the same results (screenshots) on your system. Proof-reading the QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) is also very welcome.
Happy hacking!
@a1ex WOW.. you are putting in work. By the way happy holidays.
Possible MJPEG? Is this something unique to the 40D or have I missed out on some more recent developments?
https://mobile.twitter.com/autoexec_bin/status/944627528999800839
Awesome! Thank you Walter!
Quote from: a1ex on December 23, 2017, 09:39:29 AM
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
...
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
.....
Happy hacking!
Lovely! MORRAL KOMBAT is next! :)))
Joke aside! This is a great news! After all these years it would be lovely to have a working 40D with advanced functions available. Even though my 40 D got so broken to the point its repair cost is the same as buying a second hand 40D. But I've got a friend who's hobby is photography and he got the same body.
I hope for the best! :)
Quote from: a1ex on December 23, 2017, 09:39:29 AM
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Thanks a1ex!
Here's photo of my 40d's info screen:
(https://i.imgur.com/fWyLEk3.jpg)
Beautiful. You are wonderful people. :)
Quote from: a1ex on December 23, 2017, 09:39:29 AM
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Here's mine.
(http://image.ibb.co/bwu4Uw/20180103_214532.jpg)
a year ago my 50D eos where I had installed ML crashed and since then I'm using the old 40D, although I miss not being able to enjoy ML. Is there anyone who's managed to get ML running on the 40D? Thank you in advance
The closest thing I could find is reply #379 (https://www.magiclantern.fm/forum/index.php?topic=1452.msg172529#msg172529) - that provides some good hints on how to get started, and a changeset ID that is known to work, to some extent.
Next stops:
https://www.magiclantern.fm/forum/index.php?topic=991
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
Thank you A1ex for your information and time. Unfortunately, my knowledge does not allow me to perform the tasks recommended in the posts. I will have to wait until some member can upload an operational version for the 40D :'(. Greetings
I started to think this might happen before the 80D was cracked, but it looks that's a bit more lively at the moment.
Are the issues wholly different, or is the primary roadblock common to both efforts?
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.
The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.
Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
Quote from: a1ex on May 02, 2018, 08:55:04 PM
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.
The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.
Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
If you want to PM me the steps and risks involved, I might be able to help in that regard.
Hi All,
I have a Canon 40D and am somewhat technical, I would be happy to invest a few hours testing with the advice of someone who knows the deeper development side.
Really looking forward to getting a distributable build working for the 40D, even if it doesn't have *all* the features!
Jonathan
Just curious if anyone has made progress in the last seven months, or if things stand as before?
Hi, I recently got interested in ML and would like to make something of it on my old 40D...
I'm still looking around in the forum and trying to understand how code is organized, but I'm also stuck with the preliminary step of rom dump.
I tried the portable dumper (DUMP_40D.FIR) with 4 different CF cards, also old ones with 256 MB capacity, but it does not seem to work: the MD5 for ROM1.BIN is different each time (even if the check with PC always succeeds).
I was wondering if anyone had success with DUMP_40D.FIR and could suggest anything...
Otherwise I'll have to try what previously described in this thread, but that I'll need some more work to be ready with that...
That's probably alright - Canon firmware reflashes the ROM at every shutdown, to save their settings. If you compare the two ROMs, you will see differences only in the settings area (not in the executable code).
To get the same MD5 every time, you need to avoid starting the main Canon firmware between the two attempts (i.e. just run the dumper twice, possibly on different cards, without booting the camera normally in-between).
Ok, I see, I'll check that.
Thank you A1ex!
I checked out the vxworks branch (commit 18ac6b0, the last one on that branch) and tried to build ML for the 40D.
I am on Win7 + Cygwin at the moment and did:
cd platform/40D.111
make zip
Many modules were not built, other modules had comments such as "Will not load on 40D".
In the end I have a zip named magiclantern-Nightly.2019Jul28.40D111.zip containing, among the rest, the following modules:
$ ls -l
total 1028
-rwxr-xr-x 1 ... 33118 Jul 28 15:58 40D_111.sym
-rwxr-xr-x 1 ... 21828 Jul 28 16:03 adv_int.mo
-rwxr-xr-x 1 ... 11816 Jul 28 16:03 arkanoid.mo
-rwxr-xr-x 1 ... 17800 Jul 28 16:03 autoexpo.mo
-rwxr-xr-x 1 ... 18068 Jul 28 16:03 bench.mo
-rwxr-xr-x 1 ... 7632 Jul 28 16:03 deflick.mo
-rwxr-xr-x 1 ... 11636 Jul 28 16:03 dot_tune.mo
-rwxr-xr-x 1 ... 15488 Jul 28 16:03 dual_iso.mo
-rwxr-xr-x 1 ... 324544 Jul 28 16:03 edmac.mo
-rwxr-xr-x 1 ... 28240 Jul 28 16:03 ettr.mo
-rwxr-xr-x 1 ... 14600 Jul 28 16:03 file_man.mo
-rwxr-xr-x 1 ... 304104 Jul 28 16:03 lua.mo
-rwxr-xr-x 1 ... 42224 Jul 28 16:03 mlv_lite.mo
-rwxr-xr-x 1 ... 44372 Jul 28 16:03 mlv_play.mo
-rwxr-xr-x 1 ... 62596 Jul 28 16:03 mlv_rec.mo
-rwxr-xr-x 1 ... 5772 Jul 28 16:03 pic_view.mo
-rwxr-xr-x 1 ... 30576 Jul 28 16:03 raw_rec.mo
-rwxr-xr-x 1 ... 22028 Jul 28 16:03 silent.mo
This is my very first attempt to build ML: would you please let me know if I'm on the right track, or is there anything evidently broken?
I have disassembled my ROM dump, my next step would be trying to understand more about stubs...
Hi acasta
I'm joining in the fight to get ML running on the 40D.
The modules that "Will not load on 40D" should not have been put into your zip file I think, it looks like you get all modules in the zip file (17 out of 17 in the Makefile.modules.default).
Might be a cygwin issue (?). Compiling on a new installed ubuntu server, for 40.111/vxworks branch I get only 3 modules in my zip file:
All other modules do compile, but throws a "Will not load on 40D" and "../../modules/Makefile.modules:64: recipe for target '<module>dep' failed" on my platform.
Most of the modules are missing functions not implemented. Regardless of what - if you try to load a module with a symbol missing it just won't load so is not that big a issue.
Thank heder :)
At the moment I'm struggling a bit to build QEMU on Cygwin.
I had to modify configure_eos.sh to make it use the right compiler and then some dependecies were missing.
Now I get some compiler errors that I still have to analyze...
Indeed, building this on Cygwin is apparently not so well supported and some problems could be because of that. But I can't use WSL at the moment.
...too many problems with Cygwin :o
I switched to an Ubuntu VM and everything went smoother and much faster.
Finally got abit of work done ;). Took sometime because I had to deal with all kinds of other issues,
mainly qemu+gtk+vncserver not understanding my keys correctly, so I finally switched to sdl,
eventhou that removes the possiblity for me to see console.
Anyways :) a couple of fresh screenshots, now it's possible to see menu's .. ect.
(https://lh3.googleusercontent.com/ssay8eW4Bpcf_ycxsWPsnpS3dumbsBuyM_PuM7hvplIv2RSP-IYl_WtnmXUn6U4ABr6kYBzLuu98iHjwCwlkKQYEg67bnOss6bT7DYbfKKeGHfK9br9ZRgD4qGY9G9eizS1ODgtS_q8SogJO-0XH3AiTnCPyBdVzjtlyCY1UjdISmtxpiQIfp23n3scvkZVbebx8a9fPP543G9RIeMzi42WqXFdJlECwFBEMxb60aOHdv29T7MTc-5ihEO539Eetwb7MAvXOBVaI2uBl695eStam5bz_D0DfVTUgKM8ut04wUWprzJ3-50ye8ZWLDPiymQA31LgbV_trBNQTIWBZ32C4-Wh4wZTysx4HWJ2fLROnSOTFzV4gMGjzyPGSFt_23KuM3_ght1HBmtd-IYzH3iZJxXpqhJYAvtMEn6ee0Z_j7Pb2jlqYPdgMlvPiyR8aqUQ40Dv7c8V5MrQGasPsY0C-9d3KOK4t3kfeoca_d9wqlK1SWskZQIN0f29VY7hmYIIQqqn6qOYswLdMNibeA2RPkFiqiJ70V91K80ev98WcPgrclXq6Oz_Agc_IuWUZK-p2osMr9C2s6qfbUoLD69PHsvjUF4NXNlXk0r_CujaBjMJHg6olWmWhWL6lzx5Q6FR4hPptuvNjHdgtUrZQorQhQ-b38RlCiWV-V3L43l-GUXUg_QzgyGGtd65bHjqWK35J8ig8kwclvImMlercK3e5=w544-h385-no)(https://lh3.googleusercontent.com/urvtiD2GHa5-nnhhQSh0Tb2F0cOJoMmr97w3chh1mZbvtqQVrqOK038sAaPTcdCrgujnyWPnIPd7Lohxtw=w312-h220-rw)(https://lh3.googleusercontent.com/N2cpvd8TY0TFpIWIIlOHEMnNa8WxdZSKbXElP_6VYx7zCYFCyxeU1gsdbY03Psv2GYc54D73eMuCShWFIA=w311-h220-rw)
Great work!
Thanks for your great work!!
Here wishing luck for the peeps with the necessary knowledge, this will be an awesome budget camera with focus peaking and basic video :)
I could'nt get fonts working, properly due to incorrect qemu / cf access or similar. None of the FIO funktions work.I got a bunch of cf card errors in qemu. I decided to do a quick
and dirty hack for now and use "xdd --include" to include the fonts as data and load then internally. Now everything looks like they should
(atleast for now).
(https://lh3.googleusercontent.com/25gAo_2Jk0ufUXi3QejAMxntoC7CtownpES3MeXYBCsTTYIXM-xw8Xq5g9Kk-Wf7dDuYMT1sc0OF8OWomKr8Nn68swkariyiD0ClPy6G2Wb2MSBlx28hROh0bKUt4G8vEtZmAB4Z3Urfm4hM03kty__JKQDeGMvVArN5Y6-xYCp32MSsyxdo8PqhJx0x9S-abv9CNsHXWXZOsux2pUOGJR5OZ3PI0ZQiLVi9g7UqlE3SdylosQ-IGRdJI94s1BiBCcr2q3bOatklCA243f_PHrfYRCkjtSd8gi-7PWuWkyUCcZrdcniX6SSEYxMmKFbAat_VYBTwtp0nmow_WvHAzjh8DYDlrVxlPXSoPmKLYRj6UHXgx7xY2pBgl1oH6v6X0AE5XOaSyBfjeVJ4qQ6jmYTdbQB7dUvFcWMj6kbrintwyTogkEdQE6a3n7bwtHY5OzctKrLl3X1NW0S809lIyVkynqh-gq0JYWUAyTreZJdwqbOF-2B-CSTSM9D7CcIqJSVp44f63V1des_nsa6LdR-vy2cYIELZdim7BTV_BcrDaU7o6Ec2L7mQARv1eIAZu1_ufbRjdHdJQv1rh3o6Opj9cjFz0h_GkYCF0qU-Ym3jw95pBv1wO8EFj93mNu92cepmO6iITiqemPfTYAjwlAuksZ81U9iy8E1QOB1hx8vLusrgBGs6KsZqFkfcbRJgC4geSAUwqu-1GgNp1p8kqhVa=w1602-h815-no)
Then I tried to load this version into the camera, nothing happened :(. The camera did light up with the red led for a long time, and the camera worked just fine,
but no ML when pressing trash can button.
I need to set the bootflag in the camera to true, but I can't seems to find any ".fir" files for that.
Suggestions ?
Ok .. I found the solution .. read page 1+2 of this thread really carefully :D and create a fir file that will toggle the camera bootflag
Finally some success!
Got a bootloader constructed and loaded with ML. Images of vxwork branch running in my camera (upper images) and changeset 8159 from unified (lower images). I will spend the next days by getting a status of the Canon 40D progress, create proper bootloader and hopefully commit and push needed files for continued development. Then I'll make a new post.
Vxwork branch + modified (fonts have been included as static fonts)
(https://lh3.googleusercontent.com/umeaql3xh5hBN_bmNp8GXRJEDfr1pYKAZgp1W-woO4vSkrL_LNowZ3KtOQXaZdGsmze2bpwOvrHqtsNenjMKcuVREeSgwCDyKFr8v7yMB13EEsI7CkTbN9-HiTv_ZqdC22nzKx1k3efcIBS1P-hxEidfBsWQ5ibwLjzF_YTpBw2oyktw8_S8m6gHU5g670W6K2DhQFDYZUBqe0bI0m4kioHqbeynLZvX1W0cc62X_JWGV-8yJPIFROJVqb8I_1BIniHXFr27qqLW1Hq63ODRXsYPtaOYgONIz1HXWPFjU4tpcyl6KCcVyucZf7nT7lpCW15tVcNm2xQ73HLaMTmt2XNgNSUi6beONCB8jIEWKr4ZDIv6dS1cJ26I1OIEFub15g5YMuNEwdpKVd-ynL8GmjEVcPTfxMpEi4UBn7MCqi0mQRqYB8ZoXXBYT0KNimTaeLpXvrHAWE3iVAIoGS570PjsWWe7hFeA06KTmi6ounPK_269JEIFdUx2IsG_OzLyxkEMoee6hIq4KZ2ejUbG-SCVuLpw0QoJ7jXfKTP6Fh04VR5NXgjgCg7wDwZlxpWnmdh0X6EP-6R3qX3jNJ1HZB-AD7KKneV7D5sjcgkv-waQaTZA6-EZvBmdoSdrmMbmU9uAE1jCdqD6FwbHvjjuSr44HpZXh3T79DahtIQoKMteGoUlhS7UsvdQhISdEyy5NoHxsOnauSmy1X1h5BWMbQeo=w1027-h770-no) | (https://lh3.googleusercontent.com/9phT5t0s4D_FMvbedGFmBgqFTm0T4gsbW0WcliUlymlI8dq3y7PB3JZNERwyJn3e2Xli8rxzmI_QNa8Tni0twjMJtPL4pTtTLNEzSrOhD_rlUNl1PcLzTNcX7Ci7B2bq0Tz4rVuSqHe5jk5XaS1yczUK2yeF9b4G7S5KNaxh8mzoaBGztjxuwkgxEZwmKTgFfZDTMWHnrNhfLGeFF9PnbXjrEQIwnwrh1GxSNwOcDpA-ZgpkeIfkNWgVll2oqPNpIMUQjVmEGqrZtMAzgG0EUScDmZcKJu0K4j-d6WrbUcd9tIhl0pkoAoSCtCAprWrLtnB4QcH6LhSb4eBF_eIEqkv0h-QqxMj8svlkMTubAseHGXIuvZfcioyTU-O_scE30QlXUSlPeqJgSrLho2LnMjQryGJIzU08b8SVSx54Wl_CDbWvXUVVDcDG_3wIIcP3qr_lfBMBFwLqY7wYcwKnmu6pjHG0yTNzhO73qNMq93jzJ10cMYtnqbZ5iztC3aV2gGOd9umrC_DiSyVEIn-nPC-QKiAC4MWlxRj6U4f1Xak27H4CEn6nVNxQX1zG6_NyH7c4tiagamz5HGbuDnnmbWOoUXtnF7u612JlfNkSu_5uveB0Tp6ujNEj9iC1RFqGf1oS8c4-UZz917-c5l-FM2pQ8ZHOpGVtCCvaOiiDKrBGWOcU8_Z-O5g7cyur7jvLR6GDEGfVrp6adjZnJqzr9DxD=w1027-h770-no) | (https://lh3.googleusercontent.com/yzv7BRLSpAwSjv4Lv4LRMpW1kLTEaPBPaaF6VADhup4VvANak2J3r6z0qxZ8HTkUtYEPSm-WteDIMjc9qgZ7NPz6wSKyr_MABRBC-lUChp9oRcZLbOHM6otkt2SSYIODLlDK39gJmUhm3ZeIFrHup7XYu5LwnJFSlqwqVxgXF34JGM5E3gyJUeVuqecPOiL8ywBepv0q2GhKB2bHGd9D8lBR5ePUEI0uEkeFFWuBYAqRWC7BMcxDDBfhYdbSSj4U4ii6Fe_b0jLWCAlw83bDnEzICLcDJbGcL7tIUQ9anaeclKrExerUc9H4FfSMHL0-GZvR0zvL1dXYHge-Qq3le9bV-R5Fp6hLMo__-HZEmJmsJL_FWC3aDtEyuf7Scvd70IoDoKReLlGvRLrvmW-mNS4XJSWhdPYgSE4bidDZC6a2iD82NN8BDQtMINsUddA97L-P4DAv5uHowa3ypVEsMFhIxu_4ead1JT-9sEj4rnyx_Wn5be1zPXmPWgAHdD7hbEQgmhbdUGNMvLRE5RZZmRdXqmg7RR58sbvtlXgnofVSOGX04uLyZTie07l04odtpWRwAUlHn0TnHIOGfmt-d_u8a3eNOV-hwDM4jQHVnZwFO7ixX_HAEWVjfN77q8BR6XGm5E9gYP8mi8cAHTSAqeOo9c9flThsdcS3ItIGQQuPpkENjai12x7guhsCfNArzFI63fGnyDGhYBGNWyPNORj3=w1027-h770-no) |
Unified - changeset 8159 (commit 091b9f8)
(https://lh3.googleusercontent.com/S-F6MCWyeIwPyJ_IEuo9Yske5cRpQVXiawLH1k2Itk9_TpQlM2rA416dtKnGoklvhma8BKb7HRxf5xHSMlv18tl5QBPSYvtwZkojxAKfkzYXFCd8T8KFyT9X8MvdVlONCskzVhV27WHMhFha4GdipF0v9J90n6eTPLqCdtr2S6Rn-QFAtkT6d3xyIlJq6nLQp3dpNilFlldowq4QZWcXkN2QNrSd_YGNaVfez8tEXKOtJ87u_Eev2HAtOu0KNT9Vpk6a1Uv-0GR822-etTzJ8TONG4nzjqTU7vUHHGJrR9vf9sxMeDNi6iExaucgYX8L7ZSlb60XEyBUBwcCfAPa4tEdmsFf0_JSvWa4wsaPpVBxEsdryt_bjzRXy1pMiBufTLphzF1nNtzJKYQOSVi5s5Qdh8zsyZZPjEwO-I2vC_gBCHJK90g_xmS7x5VjUq2sXbTr0YV5H_PieJq_C20sxGIyZZcmrUY7BQGkZ4J-WPwUirBnuiFhux3xk1BUsa7NsdUn-IfZTLVz1PilVusidt6EVyk3NEEKcpmsv2aULoHOayft5cPFSfpeV1DHMAKSk4m_w58pnUCAHAiBu2aPQ77E97nJR4wO82ZJrVLNTI5EIosS3rTS-ttfKx_ChQ7zoinN0dak2BuiQWfwjXdUEWvKCjBIyiXAemQ9SXzqsqqqctzDT9sNEfLV9KXBqcX06nCH3fLiUDhXwHWLZ6Aec3b0=w1027-h770-no) | (https://lh3.googleusercontent.com/I_VubBqmtUdjvhwk8uNx0krxNT8qpT-NL7_aeB4W4HfXlUhPvEB3dTeo2LQb3ba-WFh4U25Wh4JjuTAAIpLozKdiRUUuBtaBRwgBWnsgDfXbTiSB5XiFxgUbO7z8ue4ezc5eXv8oJyeFvUceqZccwYgShzhwRU7fru9yNvUzjY_x9vcpbK2S4OIIZy6bG92Ckd20iK7qm9V2sTbJtkLpLHRJHf0BN2aTVAm5GAZsA2OSu-Sb4u0uEW-OTPrIeWnbEmvliyth1qZlUu6w-jR144UCVMMFx3OZzIxOQ1aXDcokCVOiihJL_eP4FTMLz4BxGOthT5zIOfDKJck9tWQgAayKEmwfoPbSHvmdiKAZldXLb_9FifLb6N-f5dvnpXL2J7ElmfV9J82XJvNOZyKw1goMhdX0u1qwRNyyMUl2jhxwfsqbUjXczRnxjbvcxQLy9lzGEjlh3XznwYev8UElKhZmwCNwYhZe3anpae1zIdvZykpf5eT9NwAErSzNtO4Pl8eAc5frxeaiI0Aj25tLRRnXpxx1ZfoOcWR7tMB3fGfvTG_vo5NuWCz5Rp2s08Wrw3jhg22gkIliSQHdh7Cas9inA5GFpj7TQMec-U2x6-OBSVV1XoMCwlGHjqlk8RbXgY8qg1vUW_7vGC0n_jaIOTVq3d_c14FKFXUEfFZtEVyEABQFEZkXzttsVaWCoN6SSfqP3piWU1WDKXCCx9axEtvp=w1027-h770-no) | (https://lh3.googleusercontent.com/ovIpWheJOXTBHfatV-ToJCN9Ol-6fup1vEGIk-OarYWFwKN5KsbptpCbeKwbJdH5Q46a91pnl263ytvE8dbO-kXgeiZCwaNG5EJzYK695vfonIQelQktGoKrygYt2Gvn6hcdW_JQCew_m2RF6QJGK7exIVDLAECl6KqJDvAnvj_rGJm3RjLOt0LfFE33rqiuX3Xu_GXL_-bmw8NqylVOVJxXMlRVqOKfVmGQuNvYyoXqXepLpaDidBVXbo4BCgeSyKX5JXlp1LqJsgcfljvc4K2Ie6NXqXjtPi35dc8PZQIcT_NiX97Vu_k1xp-ke5KT9VQpDkbSSgqbn3Q_R8kmBdF2sdCO9XrnxnfLpc0WLbyuzE2NGFnSBsYDe3EAynQ7LvVnoxC3IL7TgocCn91JTod0vYkGvrYqVBZREZmXdDFJfe8in27kRHiwvRRjAIWEAIkliKVxJMm7QxJ0wQX7TTzKr52qX2kiXkJ9K4VwWnDwSASdshxKnegJZ-ZisyFhqA-bjMoKnAwU6gSqs8xFJCHhi1nfwB1eSjOoLS8kvzSH_4S_Dbj_v2Xa7d_O-5d7cChGCmcJMvpW9XvkkGYaYvTroBcNAD87pwtlhOerW5_02lCBQodkL-LYTC8oQI8tOq2ZcBnrcVCJJyBygVLBsjZXiEHg7bN4odMh3mir8Ti3CAF7zA13LdOyknjeDvPImR3TfJvbLyKxC7PcpkalX9xs=w1027-h770-no) |
Up with de great work!!....Congrats.
Thank you heder!
Hi all! .. Long post.
I have worked the last couple of days to get a overview of the Canon 40D port which is born with the DIGIC III processor. All models with this processor have more or less stalled so getting one model ported should make it much easier to complete the others. It's the first processor in the DIGIC series to have 14 bits support and with the Canon 40D's LiveView support, we have all the possibilities for a great ML upgrade - it's just here around the corner.
I hope more people with a canon 40d (or 450d, 1100d = all DIGIC III) will come help me creating a experimental release of ML for Canon 40d before Christmas, that would be cool (if not - its gonna be a easter release). I know it and old camera, but it still a pretty cool camera no matter if you use it as your primary or backup camera. And in these days with mercurial "sunsetting" (what a shitty word) on bitbucket we need some development to move the focus away from this.
Here is a short status:
Rom dumper
Link: https://www.magiclantern.fm/forum/index.php?topic=16534.0 (https://www.magiclantern.fm/forum/index.php?topic=16534.0)
The rom dumper work fine, but is victim of a power save mode and thus after 1-2 seconds after executing the rom dumper the screen goes dark. The rom dumper works, and you will need to wait for a minute or two before removing the battery. The ROM files are in ML\LOGS folder. Only ROM1.BIN has code, you can decompile/analyse it in Ghidra, specs are here (click image to expand):
(https://lh3.googleusercontent.com/G0tbX206XJ6I_05lWtb7Fd2yx2F9z9AYix0M6ylFMaxCTSxYTZ_tWJGYJp6Yv_nLirrvLbH3sdY6qZh7mFfj2IOcycMf8zxO-H9mPWvX_Q-q0eXLxC6ilQ8qibS6657Iyb_dVrua5agfccqeQ05KxRtUNo-Jf4ulRXxybRKmuv0N_UHwLYsew4okxmEcREUlgYAV47-25VGwY3woTCziuNXrXDiS0nNtoNZwN1-XTXkqwdtz8wsw1N82eGqx9B-Bs8CMNYcI9HBJ3D07g5L-1ii4kcmzydNFVR-OskzfcgVG99d8XU3xrGBT-FRc4QFwX_GePsfNRX7-LYysCf6g6Hmrj0o3_mb7OlZA7cotHOFNbd3R4B5umkJfY_iwCMoognWbn6W_EJUGgtQjpiFeGF0Ml6Ud8bKmFSRf2mUGAstYg5d_6ZtC8CyvhUJwU0EUuX1s7fcllXhHpUMzo7iviDDZlbk9jFRopJdjOLh_f75yLX62dgr6mf8IPFj4d9xco4vCw7dhZkXXg1GWzSwgxnc0URHJ80vro3G_5BsmuYuLDPlxX8ic7K-yN0p1zpie9XlyIJ6EZj8Ri_rkJ2ZCk8hgyTw7laGQFRbXzXL7Ch97M7SNv3ySCd6PVoXxtGXsDbY0ZIrnl3q2BKrk7tgPSOk1pKyW4uzGgPaeqlvt-azcTSNeDH7YmC13HAnJ8TZFkr5IO5QL5Xovi2EktfaCwyCac_Tu3vyggCXapek96dHTm3ge=w676-h420-no)
Useable source repositories:
1. https://bitbucket.org/jmheder/vxworks_canon40d/src/vxworks/ (https://bitbucket.org/jmheder/vxworks_canon40d/src/vxworks/) (vxworks branch)
2. https://bitbucket.org/hudson/magic-lantern/src/vxworks/ (https://bitbucket.org/hudson/magic-lantern/src/vxworks/) (vxworks branch)
3. https://bitbucket.org/hudson/magic-lantern/unified (https://bitbucket.org/hudson/magic-lantern/unified) (unified changeset 8159)
1. My working branch, properbly the best starting point atm. This is based on 2. with a some modifications (stubs,debug, defines, temporary static rbf fonts )
2. main "vxworks branch", rufustfirefly rework of 3. will load, but no font are loaded (so no text)
3. The branch vnd used, old menu, but with static font, so text is shown, missing cache_lock() call.
Compilers
Compilers from launchpad, which I have been lightly tested are listed below. If you are on a Linux you will need multiverse for executing the old compilers (they are x86 compiled).
(4.6.2) ok, gcc-arm-none-eabi-4_6-2012q4-20121016.tar.bz2
(4.7.3) ok, gcc-arm-none-eabi-4_7-2012q4-20121208-linux.tar.bz2
(4.7.4) ok, gcc-arm-none-eabi-4_7-2014q2-20140408-linux.tar.bz2
(4.9.3) ok, gcc-arm-none-eabi-4_9-2015q3-20150921-linux.tar.bz2
(5.4.1) ok, gcc-arm-none-eabi-5_4-2016q3-20160926-linux.tar.bz2
(6.3.1) ok, arm-none-eabi-gcc (15:6.3.1+svn253039-1build1) 6.3.1 20170620 - Ubnutu standard
(8.3.1) bad, ML crashes at boot. gcc-arm-none-eabi-8-2019-q3-update-linux.tar.bz2
Bootloader / Flipper:
It works, but the code is not ready for releasing yet. It's based on the 5DC, but it does not work consistenly everytime, but so far it has'nt kill my 40D, so the errors are not fatal. This is my priority no.1 to get done.
Status, what works
* Basic bootloader works
* Booting magic lantern works
* GUI menu system works
* Totals Clicks (in debug menu)
* Temperature partial works (only shows raw temperature, but changeset 8159 (unified) shows celcius)
* Showing edmac channels (we have 16 channels)
* Showing vxworks threads
* Dumping log via call("dumpf") works see end of post for example (unified changeset 8159)
What does'nt work
* FIO_* system does not work and will result in somekind of file system lock
* Camera will not save images after capture (FIO issue), busy spinning icon appears, when powering off.
* Fonts are not loaded (FIO_ issue)
* Modules are not found/loaded (FIO_ issue)
* Dumping rom and does not work (?)
* Small fonts is incorrect scaled, totally unreadable
* Power off will sometimes result in crash
* Menu/GUI system LiveView button (set) not recognised, after liveview press PLAY before going into ML
QEMU emulation (QEMU branch)
I'm building on vxworks, but using QEMU branch to run it. On my mini server (intel atom) QEMU is rather unstable, only using vnc or no display will get it running
properly with a properbility of 50%. The emulator plays more nice that the real camera. I don't have the same problems with file system (FIO). I can dump
rom and call("dumpf") without problems my working branch.
Digic III
The Digic III processor uses same address space like all others, yet since this is a older Digic processor it might miss out on some features. CF address space is same. EDMAC address space is same (but only have 16 channels) FPS_REGISTER_A and FPS_REGISTER_B are same as all others. DMA0 the same .. ect. Mainboard comparison 40D/50D/5DMKII can be seen here - they are quite similar (click to expand image)
(http://www.centralds.net/cam/wp-content/uploads/2012/04/50d_5DmkII_Mainbord.jpeg)
Medium/Larger tasks (random listed)
* Create a proper bootloader ("You may now remove the battery") (my priority 1)
* Fix FIO_* vxworks issue, file system lock (my priority 2)
* Get modules / Digic Poke working (FIO fix needed)
* Find free eDMAc channels and enable edmac_memcpy (channel 7,14,15 is reported as "unused?" in debug menu)
* Investigate how many dma channels we have, I have seen DMA0 is ghidra, but not DMA1.
* Investigate liveView
* Iso register investigation
* Bulb mode investigation
* ect ..
Small (random listed)
* Verify that we have 16 edmac channels
* Find Base Clock Mhz and compute default fps in liveView
* Compute FPS_REGISTER_B default (computed, see code at 0xFFFFA050) FPS_REGISTER_A = 0A070A07h (defined at 0xFFFFA130)
* Implement take_screenshot (FIO fix needed)
* Perform benchmark with slow and fast CF cards (bench.mo - FIO fix needed)
* Use Digit Poke to check for CF UDMA 3/4 support
-> CFA3.0 is supported (string is present in FW)
-> cfSetTiming does not touch UDMA registers
-> 1Ds Mk III (DIGIC III) supports UDMA mode 3 - 45 MB/S
-> new 2019 CF disks just uses CFA3.0 80 ns access (pio mode I guess) - see dumpf log below
* Test arkanoid for a couple of hours (long term test - FIO fixed needed)
* Investigate dump log (startup + enabling liveview), maybe the experts can find some interessing stuff in there ?
Canon 40d "dumpf" log from camera (Properly from source 3.). I started the camera and went into LiveView and then disabled LiveView again.
https://drive.google.com/file/d/10SMuQdFO1qWTv7p5qGRpd0wwj211At_6/view?usp=sharing (https://drive.google.com/file/d/10SMuQdFO1qWTv7p5qGRpd0wwj211At_6/view?usp=sharing)
/heder
heder
Do you have the same problem (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212509#msg212509) with ML menu in LV mode?
Quote from: Ant123 on September 03, 2019, 12:07:09 PM
heder
Do you have the same problem (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212509#msg212509) with ML menu in LV mode?
I cannot said yet, LiveView is'nt enabled and supported on my build yet, but I will keep that in mind.
I don't known about 450D, but in Canon 40D LiveView has no special button, and must be enabled in Canon menu system. Once enabled LiveView can be enabled in some mode when pressing "set" button.
Quote from: heder on September 03, 2019, 02:39:20 PM
I don't known about 450D, but in Canon 40D LiveView has no special button, and must be enabled in Canon menu system. Once enabled LiveView can be enabled in some mode when pressing "set" button.
EOS 450D also uses "Set" button to turn on LiveView.
for your camera see page 161 (https://www.the-digital-picture.com/Owners-Manuals/Canon-EOS-40D-Manual.pdf)
I realized driving home from work that CF card system was really slow, so I did a really quick test. It turns out that ML uses the CF card system before it was initialized which leads to wrong behaviour and lock of the file system. Inserting a long delay after inside ml_init_task before executing anything else solved the FIO issue. :)
* Fonts can be loaded
* Camera can shoot images
* Camera can dump logs and ROMs
@heder Can you load modules?
Make sure module_task is launched from ml_big_init_task() inside custom init.c
I get wrong behaviour with 5DC, they are listed with wrong filename (it show only last 4 characters of the module's name) so can't be found on card.
Would like to know if it's the same with 40D.
Quote from: aprofiti on September 06, 2019, 06:12:54 PM
@heder Can you load modules?
Make sure module_task is launched from ml_big_init_task() inside custom init.c
I get wrong behaviour with 5DC, they are listed with wrong filename (it show only last 4 characters of the module's name) so can't be found on card.
Would like to know if it's the same with 40D.
Hi. No I don't have the issue you have. I can now load modules in the camera - Arkanoid and File_mgr works just fine.
Thanks for checking. Need to figure out somehow to solve the issue, I'll try to have a look again
More stubs found
- _EngDrvOut,_engio_write,shamen_read
- Cancel(Stop)DateTimer,StartTimerAfter
- dm_Set_store_level
- and others ..
* Interface to dm_det_store_level on Canon 40D is different than other camera, but input data is the same, so I'm creating a wrapper function. 40D interface is
foo(uint32_t *) Newer camera uses
foo(uint32_t,uint32_t) * Bulb mode does'nt work, PROP SW1 and SW2 is not defined exactly as in newer camera, but call("dumpf") revealed the SW1 and SW2
is defined. The old property values are 0x80002001{5/6} but Canon 40D checks on 0x1000002B (SW1) and 0x1000002D (SW2)
...
562: 4627.423 [GUI] IDLEHandler PRESS_SW1_BUTTON
...
571: 4672.101 [GUI] IDLEHandler PRESS_SW2_BUTTON
...
609: 7982.061 [GUI] IDLEHandler UNPRESS_SW2_BUTTON
...
614: 7999.412 [GUI] IDLEHandler UNPRESS_SW1_BUTTON
* take_screenshot() saves incorrectly (but does'nt crash either)
Quick update :)
I'm still working being the scenes, stubs, reading decompiled code to get the 40D running better. The good thing it that the boot up process work better and better. ML is becomming more
stable and with less crashes.
Boot
- prop_init() need to be called early on to get all PROP messages. (shutter PROP comes early)
- CF card is really slow and after prop_init() I sleep 1600 ms before CF card system is ready for use :o
Debug Stuff
- dm_set_store_level is working fine, dumpf log is being spammed.
- dm-spy (my_DebugMsg) works in QEMU but not camera - so I'm using internal dumpf
Shooting menu
- I located a nice function, named is usbShutterActivation, I guess it used via usb to activate shutter release in normal mode, liveview mode and bulb
- Bulb with intervalometer is now working using usbShutterActivation
- Bulb in standalone mode is not working (I think half pressed shutter is not detected, but i'm not sure)
- PROP_SW1 and PROP_SW2 is not present is firmware
Expo menu
- Started to populate Expo menu and it's better than I expected
- Shutter works - only minor issue BULB/32". Moving dial to BULB is seen as BULB, but when changing it from within ML from 30" into BULB .. ML says 32"
- Aperture works - only minor issue is the aperture is not always 100% correct, sometimes only 90% or so
- ISO works fine
- White Balance
not enabled (PROP modes need to be verified) - now verified and working
(https://lh3.googleusercontent.com/65wtae1-4yRCZAsISdTUSktEvQZI7eyujPPhJcIWzneB5CPf6PQQBFyekXWeaTak05gMTY5ZXVlwYgamIkzpkFjy6NeMcXn-FYoy8Rk583EOk65xPS9V9C0APxcLAYTfGEz23YU-7-0pOoJ9X_DD90VbMjfnOT44HMw0n82gSO00tCd3P-rmMXzHaTpehcauypFKbWZ2jL2fvLkYqCfBQd8yeX9xvAUCzLrrTNTBZZcdBDnkspa8-1PG5KXf1T1Ats_lW6K1XbjAnvf2xm-xALgBk0G9wpLfPI3q_BcIQXTY1SnvDH8jUhqaxzwl19tgJLXHlZLDx_eClNMm_ErVeTM3Z9feRDSnQnuEotkBTmJliBCdSLizvywjS4w3he5h8m2ns4lbfSmEqmIaZfwjFCXDWVAKEf1nuMAYG9sNj6rkTr3lVAi5ucGKoOaOGw7KwCo79qYZ8sB1uLqI66fs6EKNYDqJ8tkJzd8oAHjz5VAJjwLzGOnh8Ybl5n2OfmY9InmSzhFBMuEOPzjb79CiZ__encp1k5jpuGzrw78RpKkhYffbbBozMclNMAdGJWfZB0O8WR89Hl6nTF1URXTamDoYU0vUTWbzHj0CjqlfgzJlf-trcjn-9LDc_oBJXloXdf52URvcW7wLz86z6ulY7E1atmTLUISI4pqRWtdYRD0JJGiDd_Q6Nti9ZsFgrrt3GriwR6QLSckd2SltGhEGLwJ852Q86xt2JGMDLZU7TNL2pkiI=w1000-h750-no)
@heder
Thanks for your great effort to run ML in 40D. Regards
Weekly status report, week 39Font bugs (due to the SW uses HD buffers rather than LV buffers
- Drop down menus were subject to a shawdow bug (low resolution display ?) making the text look ugly. Solved by not drawing shadow (background)
- Scaling bug on small font making the text unreable (low resolution display ?). This was solved, text is still not 100% ok, but readable.
CF card benchmark (using new Sandisk 833x card)
- Benchmark module crashes due to multiple reasons, so I included bechmark into ML inorder to get a first benchmark using PIO mode; Result was 13 MB/s, both read and write.
- Will tryout all other PIO modes later, CF_SetTiming(uint) checks for 0,4,50,100,120 as input argument. 0 is for some Lexar cards
LiveView
- LiveView is running 30 fps in all modes (standard, zoom x5 x10), which is nice (analyzed dumpf logs)
- When setting dm_set_store_level to minimum (maxmimum logging) zoom modes will have corrupted timing (info just so I don't forget)
Exposure menu
- Picture style is now recognized
Stubs and consts
- msg_queue_count located (all needed msg_queues are located)
- 3 additional timer stubs have now been located (all timers are now located) - but not tested yet
- Located Canon 40D's internal memcpy, not strictly needed
- WINSYS_BMP_DIRTY_NEG might be wrong
- half shutter pressed is not defined (const.h), bulb standard alone mode and focus trap need this feature
- Trying to located AE_STATE and AE_LEVEL, code tells me around 0x4700 - 0x4900, will try out mem_spy later
- Digic III will crash when accessing 0x40000000 (dump RAM) and 0x50000000 (benchmark module), need to find proper mirror addreess
Modules status
- Modules are loading even worse now than before, at start of september (4th) it was much better.
Code
- For reference all my code is pushed to my local repo, I don't work there much, other than pushing my code onces a while, as backup.
https://bitbucket.org/jmheder/vxworks_canon40d/branch/vxworks
Last engio write before liveview start to stream
5584: 8729.649 [ENGIO][0](Addr:0xc0f06008, Data:0x5490549 )
5585: 8729.703 [ENGIO][1](Addr:0xc0f0600c, Data:0x5490549 )
5586: 8729.741 [ENGIO][2](Addr:0xc0f06010, Data:0x549 )
5587: 8729.781 [ENGIO][3](Addr:0xc0f06084, Data:0x20271 )
5588: 8729.826 [ENGIO][4](Addr:0xc0f06088, Data:0x369050d )
5589: 8729.857 [ENGIO][5](Addr:0xc0f06000, Data:0x1 )
5590: 8729.908 [ENGIO][0](Addr:0xc0f06014, Data:0x49d )
5591: 8729.940 [ENGIO][1](Addr:0xc0f06000, Data:0x1 )
T1 = 1181+1 = 1182
T0 = 1353+1 = 1354
VideoClock = 30 fps * 1182 * 1354 = 48012840 => 48 Mhz.
AFAIK this is the highest video clock of all Canon EOS, see https://docs.google.com/spreadsheets/d/16cgnRivbUv7nA9PUlCLmLdir3gXdIN3pqzCNAAybepc/edit#gid=3 (https://docs.google.com/spreadsheets/d/16cgnRivbUv7nA9PUlCLmLdir3gXdIN3pqzCNAAybepc/edit#gid=3)
I don't get this
5587: 8729.781 [ENGIO][3](Addr:0xc0f06084, Data:0x20271 )
5588: 8729.826 [ENGIO][4](Addr:0xc0f06088, Data:0x369050d )
According to https://magiclantern.fandom.com/wiki/Register_Map (https://magiclantern.fandom.com/wiki/Register_Map) this means
0xC0F06084 RAW first line|column. = 0x2 | 0x0271 = 2 | 625
0xC0F06088 RAW last line|column. = 0x369 | 0x050d = 873| 1293
RAW LV image size = 871 x 668 ???
The 450D appears to have 56 MHz x 1 channel (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212440#msg212440) :)
For the raw buffer size, the lower half is the number of column groups read out in parallel (i.e. it needs to be multiplied by 2 or 4 or something like this). More likely, 1336x871. Judging from still photo resolution (3888×2592, maybe slightly higher with dcraw), expected active area in LiveView is about 1296x864, as most EOS cameras use 3x3 column binning / line skipping.
Timing analysis, similar to the one from 450D:
- VSizeSetting = 0xFFC2F5F4 (called after [CAP] GetPassResources)
- 53 microseconds / line (from emulating VSizeSetting)
- timer A in still photo mode: 0xA0D + 1 (from FFC2F358 -> FFC32D90 -> 0x94B4 -> 0xc0f06008: 0xa0d0a0d)
- the above confirms the 48 MHz clock and gives 53.625 microseconds / line
- timer B in still photo mode: 2622? (guessed from VSizeSetting)
- 140 ms / frame (up to 7.1 fps burst; 6.5 fps official - check)
Not bad at all - 48 MHz x 2 channels, i.e. as fast as 5D2 (https://www.magiclantern.fm/forum/index.php?topic=23084.msg208824#msg208824) :D
- timer A (FPS_REGISTER_A) is hardcoded as const in code to 0xa0d0a0d (photo mode)
- Taking a normal image timer B (FPS_REGISTER_B) becomes 0xa3d = (2621) and with the "+1" = 2622 :D
5580: 8729.414 [LV] GetImageTrimming X(1998)=0(0, 0), Y(1319)=0(0, 0)
5581: 8729.469 [LV] GetAfWindowArea W=1336, H=872
5582: 8729.498 [LV] GetAfWindowArea X=567, Y=353
5583: 8729.524 [LV] GetAfWindowArea AfW=256, AfH=172
Yes liveview is 1336x872
Nothing much going on other than I'm trying to decode the CF address and registers .. updating https://magiclantern.fandom.com/wiki/Register_Map/40D this might take awhile
Working on LiveView ;)
(https://lh3.googleusercontent.com/AHhCdoLMfOfB1ALToUfVZgfKd6d6MOPAwVCHTmknrSaQ6km4L4_CW760Ar_4tFzMoQqhP0hSPNiwD2-76pCeZuWC9nr_R8xduAiazkHxgOw3zzrVnEncgPeu9wM3raIKb2xWVAdqoDD-AWGSldEnus1NVLJTUx3jN6YHNn885OKZR8q5yGb5CZ_0UeUBPvd3jGjwqaCxDV8gqYaAEZCMpkXAgTOPhemwnf81X5zpVONNMY2sgpoFxklRW4tRKRWkJMVwSW5xKV3UG5lMPY4qutH1y5nlpJ-5BHHXWCNgCVIl1z4ub2l9FjQLC_raqLKJzYOK2R666wLvRmd89XxwrN-AtopaCtKrY82C0XNZaMJZwz9YksCyL3_13Rps4IGDYROcbpCZMxelzRtLPTRQO3_MXYg-AYXszE2RpsbOT8WITphC901AylC_b6SEQZjfbjud2ATayGQOfiAj-oaOskcNLGvLqdeCLW6AIwWcfyViqVN33jws1WdBahss-QsdDxiyp3j-vQ03iZ0tvtz0I_s-T7Q8dmBc2s0Zt0a5JUji8bCx6LGWVaQL2BMLU6EvxKXKmknHyGETllDP6cl6By3lBJSwauRHfS6Ig8kgv6lomWgTRdOE-RAte9ibB85655GsQhrDxUeIMyxbLcpOHYl4_hccY343QNA5qnk2s4YsK9FX7POdMs4Meu3RLfhjFLrY0SlNBN8Z1AQunWeptg0hT8HwOOrZ1ncDHWFPrhRnJkoX=w660-h495-no)
Image missing..
Now the image should be viewable
Now is visible. Incredibly 8)
Still working, current status ...
(https://lh3.googleusercontent.com/PShr1oEKYe1bl0x7U9Rq1WJjlKQL5BDQ5i3GCiRFXfjWqpZAfsjidv5AT4Ou79S9IqYsav2zdH3-Ig8AvusFlTV4SxKlRCd-tmJMxLa0Q7yq99tLyFg8GAtkWuB94EA8jN6GuWdH3uEbRaNLjnv_L8N6mXQkJV8UTK-v-aEqvOnWvLaUj1OO77oqqUq_N5W1ApKSFlU1uiXr6uup22rNFMWjEwQh-X3k9vP6BVNS4KreX7WvowbLQIH-A2UmKvxCmAd87SyEEwCWmy2_hiBEOKpBcYTaYi1vY44axemT8fA-M_Bot_4BLMAtwuCafxlxIHRsGnB6wh_gLgO-uvEnN4nRJmZtvEEI4zS5g5laFAHQTip2tyvxsmxFPLF6oBQUPixIb9JzzGoraiCAYbpvYTjCm7d2AmHv_Yr1MyO24qZcTZyIFhQhHx0P-GaDr24KV2NhV791TZKztUOsmpugjIFCzMJOJfu3RSPoIemljjFsaTLHkwRktOd91L1roy75cqfES415-J_MfFDO7Cd15nwt3Ol5OvHWyKChSjpZjmXWUL4BVz1mpyg9Oof529eX6drF07sM91qbgoKpuhkEap65uw7n1Bxa05AACezQ9WD6jqvWAr-f3_YNzVApgYr-8e8be6j2pyXU2viOkWNc-TRbSmUHFNUE5bKmE-UbNLZIe_XfxmrtpNVnNbQ1dcleKPxBRZyVHPgG5WvRxGiRBHexZS1omIrUPKSOGSwWtE3wKhoq=w906-h543-no)
I'm stuck at the moment :(. My issue in inside LiveView with the HD buffers.
When the camera is started in liveView the HD buffers are correct, and my histogram is correct and it shows the histogram of LiveView.
When I capture a image in LiveView, the HD buffer seems to be locked to the image taken and thus the histogram is locked to the image taken.
So when I return to Live View, the HD buffer is locked to the captured image and does no longer show the histogram of LiveView. When I take
another image the HD buffer gets updated to this new image, and the histogram is changed. The buffer returned to me is not HD buffer with
LiveView content but the image buffer of the last captured image.
I'm going to make screenshot work for 40D (yuv mode) so I can dump correct images and then I guess I need to run the 40D FW in QEMU
with breakpoints in the firmware. There is a function "lvGetResources" that prints out the correct LiveView YUV buffer address in the log, but
ghidra fails to decode which function(s) call lvGetResources. I would like to get that call tree.
Quote from: heder on November 12, 2019, 12:05:00 PM
I would like to get that call tree.
In case qemu can't get that far, you could also try using cache hacks (src/cache_hacks.h) on the camera.
YES thanks, good idea, I just need to intercept the call using cache hacks and read the LR register, then I can find the return address of the caller
I'm having trouble, I hoped I could get a version before xmas, but it looks badly. It's a simple requirement I thought was allready done, but its not : The position of the HD vram buffers are not static.
I havent found the caller of lvGetResources yet, QEMU/gdb won't break, and cache hacks won't do the trick in the real camera either, I'v had troubles in the past with cache hacks on 40D, like I can't use cache hacks on the canon debugmsg function, this does however work in QEMU. My last try is going to use cache hack in QEMU (next week) - This should work.
Scenarios tested:
1. Live Mode
-> Start camera
-> goto LiveMode
-> save all HD buffer 1,2,3.
Result : All three images is Live HD images :)
2. Live Mode + image capture
-> Start camera
-> goto LiveMode
-> capture image (take photo)
-> re-enter LiveMode
-> save all HD buffer 1,2,3.
Result : All three images is the captured photo - NOT live mode images :(
3. Photo Mode
-> Start camera
-> Capture image (take photo)
-> Goto Live Mode
-> save all HD buffer 1,2,3.
Result : All three images is noise :(
.. back to basics ..
Quote from: heder on November 20, 2019, 10:53:24 PM
I'v had troubles in the past with cache hacks on 40D
I've had similar experience on PowerShots.
I found that the firmware's (and CHDK's) cache manipulation functions counter-act cache hacks. The locked part of cache remained locked, but the content vanished from time to time.
The real solution (IMHO) would be a rewrite of all offending cache manipulation functions, so that they don't touch the locked part. A less reliable way would be re-adding the hacks at the end of each such function.
I chose an even less reliable solution: I re-added the hacks every 10ms, using a task that cycles once every 10ms. It was good enough for doing research.
As far as I know, some ML ports and modules rely on cache hacks - I have no idea how they get away without experiencing similar issues.
One more tip: If I see it correctly, lvGetResource only has data references (no b or bl targets it directly). You could get away just by patching those references using the data cache.
Srsa .. You are right about cache hacks. The QEMU "Digic" processor works better in some cases, but on LvGetResources I ran out of luck. Ghidra shows no direct reference to lvGetResource, but alot of function is'nt called directly but indirectly just like lvGetResource, but in most cases I am able to find a pointer to the function, being passed as a argument to another function, but again with lvGetResource I ran out of luck. Ghidra is really good, but in all cases is does'nt understand functions that does'nt start with a stmdb, like if there a mov before the stmdb ghidra get confused, and having to manually make these function is waste of time, and I have a feeling that the pointer to the function or direct call is hidden somewhere.
I wanted was to find the memory (struct) that points to the LV buffers, as this is the very last task before making a beta build.
For now in working in a different direction, I'm have dump'ed the 256 MB ram and have disected this into images as green(rgb),grey,luma(YUV422),chroma(YUV422) in 8 different sizes (512,720,864,972,1024,1944,3888), which resulted im over 6000 images I need to review, which was converted into a movie using ffmpeg, which I need to watch :). If the LiveView buffers are there, I should beable to find them.
if this failed I might try your to 10 ms re-adding hack cache method.
Quote from: heder on November 27, 2019, 09:26:17 AM
Ghidra shows no direct reference to lvGetResource, but alot of function is'nt called directly but indirectly just like lvGetResource, but in most cases I am able to find a pointer to the function, being passed as a argument to another function, but again with lvGetResource I ran out of luck.
Assuming lvGetResource is the function that references the "[LV] lvGetResource 0x%lX (0x%lX)" string, there are 4 data references pointing to it (= the function's address appears 4 times). These references are a few kBytes "above" the function. It looks like Ghidra doesn't automatically notice references like that. I found them by placing the cursor to the function's first instruction and choosing "Search" -> "For direct references" in the CodeBrowser's menu. I then had to turn those bytes into pointers (P button). The references all appear to be part of a huge struct, and that struct is referenced from a function. I'm not familiar with this style of code as PowerShots implement state machines differently.
Quote from: srsa on November 27, 2019, 06:57:55 PM
Assuming lvGetResource is the function that references the "[LV] lvGetResource 0x%lX (0x%lX)" string, there are 4 data references pointing to it (= the function's address appears 4 times). These references are a few kBytes "above" the function. It looks like Ghidra doesn't automatically notice references like that. I found them by placing the cursor to the function's first instruction and choosing "Search" -> "For direct references" in the CodeBrowser's menu. I then had to turn those bytes into pointers (P button). The references all appear to be part of a huge struct, and that struct is referenced from a function. I'm not familiar with this style of code as PowerShots implement state machines differently.
Oh yes, I see it clearly now. Huge struct, that will take some time to dig into that. I never learned the "Search" -> "For direct references" until now, thank you for pointing that one out.
I have located LiveView, but they're not at a fixed address.
I dumped the ram and converted into different size and formats 512,720,864,972,1024,1080,1944,3888 versus grey,green (rgb),luma(Y422),chroma(Y422),chroma(YUV411) and finally converted them into a movie with ffmpeg, that way I analyzed around 10000 images. Quite effective. This method took some time but it's really nice. I found multiple images in different sizes all over the place, and I found what I was looking for the LiveView buffer. The images I found (smaller size) was:
1. HD buffers
Numbers : 32
Size : 1024 x 680
Address : Dynamic (changes when a image is taken)
Encoding : YUV422
2. LiveView buffers
Numbers : 2
Size : 720 x 214
Address : Dynamic (changes when a image is taken)
Encoding : YUV411
3. Miniature (NOT LV image)
Numbers : 1
Size : 180 x 320
Address : Dynamic (changes when a image is taken)
Encoding : YUV422
Next step is to locate the memory that references these images - or finding the pointers passed to lvGetResources .. seems to be same issue ???.
Finally I made some progress again :). I had to ditch the previous attempt and re-read the disassembled code in order to hunt the correct HD images, this was a pretty good idea. A function called within lvGetResources actually stored the main input parameter (first argument to lvGetResources) at 0x1c804. This pointer is static allocated and points to structure in memory (possibly allocated), at offset 0x94 in this struct is a pointer to one of the current YUV HD images. The image pointer is always correct and is updated after each shot. Now I can shoot images in livemode with correct histogram and vectorscope.
I'm working on the bootloader, using the recovery branch.
My main issue is that the old bootloader does not work everytime as expected - it too much a hack, so I need to remake it the right way.
It seems that Call("") on 40D supports :
"EnableFirmware"
"DisableFirmware"
"EnableBootDisk"
"DisableBootDisk"
"EnableMainFirm"
"DisableMainFirm"
Any one tryed these out on other cameras ? or have clues to which one to use inorder to make autoexec.bin being loaded ?
Started working again, it's rainly constantly here in denmark, so no time for astrophotography.
Digged into FPS override mode and finally got it working (low light mode only). It turns out there is no shadow memory area on Canon
40D, so a lot of peripheral registers can't be read. The solution was to create virtual (fake) registers for fps register A and B which is
used in fps override.
Can't do above 30 fps, only below.
Live Mode buffer images : Upper image is standard live mode in "M" mode (30 fps) with the settings that gave me the brightess image. Lower image is 1 fps with
exposure lock (ISO 3200 "H") and approx 1 second imtegration. Hot pixels are present :)
(https://lh3.googleusercontent.com/HyBjQjL-_DfQ8PT7q71RZDcSt9m5aiZUS7s1xVyL6Z9g7x-I8mHTW3SE7j2Km6o8ksB-M82_1wImgM8oSYri7BFc2AmWRHfo-WCNidPPkg1wKlNoVWysgOvKHaGcXrT0AZIyuupuhTu55ZpTz30v2G9MPcv9KA56k3bfhZ-BwW7saxI04ug22ZffFUu-fCN57HQE20TKP0vpT5qSzFPunpoVZgk0viEVJ_C65QlZLp7Mguah4Q_jhlaSN8hNkwCH1EdFB0IR6H1fAvBh2c3aqYR36k62_brQAXQBsrmF1CWc11tZ2pXhWOx6PxK1jB7x6Jo9cxf_GMbCjf8T8SYxfpbeqOZ3Vws5EMxSPl_AYBnidNvSJtTeS4Cf3XBMGH8twxeJZ0FplBsek3ttFwY7NRyC-t4KNjaXVFSlMZpVvn6JrfE3RLv0TqhlzwE4CbfwTtagk1qfCu58WbzsNyjhqiV4vEVEr8J5wd7-6bDx09CdUrlyNbk1S4GeO_Ar_jYVrmkGZ6oxj8mWehsZl4-xjQPfwrGxRNMrS13LPlxbDEWt5LDmvfjJUBLpx9BEkZf2uEJeUQXE4ErBU3v6XdXZp6pZllSYlAZ0iPdzR1NJA7Eoc6qC4msOxOAepx63Lm9IYpJ8l6jEVeuzH0Yi0j0VaeUiJwpyjpw4IQ4fH-NaeiF2I57dy7-1MJfgu8f-8A4_SXS4C7i_ZjKsePikfN3BrkTeF0LV_UCjHKkC-zOoEL_i3bYB=w1024-h680-no)
(https://lh3.googleusercontent.com/oXA-Nd3n5tVShGRblpk110ARgmmN9PLQtgCT647uhAPzmSjpgbxyqQH3vOLXOZQk_Y8lV3fUGyvSWPwNp822VCvj7KKwnGfaB9_HonUR-gSZIF5OiMC7750w4zdKG9VaaaPoeERLUjiZL-G0UpC7L4_IVCIaVWwy2rmmG8gMXo0uKrB8D-hPW_hknuZcbh6aNjUmqmcKwCpjIVKLqr-c_3XL820ukTf8wJdKSyEgO3kvdLVW4c08gst85e8bq5aDKOZil5pJuaPoe0zhcEfmhILN4226F3QA3uehMjCGxx2OzT3FMZ6n0jhYrqg3aZSEoVGxZjmmoQXIu4tP2OJeRb_ruOXeUx_dy6iMERP-qYjzP6ur_T5Lwvs6lkAsKUqHKARkQkjku1_LGayw_O0UW5GSWQvHqrg2I36ywCWGOoM-QTFH7ezBkGgX9TYR8-4CwmP4orhtnaIOfBax1y0J5vyw2ItwG74Waw_MoxX88OOcYBJjtuSaMS1Tdq83IZ-Na74p9fo4jGHeKFkb0_Xaumyotw6gDiyia_FYxWio809iJ4_a6CQ6HQLwbvtG56EFy4bbYJ9lbQFFl40kfGumbKK41pV76OFLJVB22Zl02hSP58X7CQ1rsidwJpZecyV3DfoeCXebU2dHhgjojBYrtXQtiqIOHnlH3TW4YxF8ivFZOvB41oJe1Gic3te4NzZKJ7D4pWfhXMhwgxZaW6SyKJl1fhb75e9CqqMl3gaqtJjQMbXx=w1024-h680-no)
Where download current version for install and testing ?
Hi Dezmond2
I'm working on the bootloader, that the last thing needed.
I have a basic working bootloader for 40D (abit similar to 450D and 5D classic bootloaders), but it's not perfect, and I wish to have a bootloader that cannot be activated on the wrong cameras or wrong 40D versions, as this might brick the camera. I have no idea when it done, but my hope is within the next 3-4 weeks.
I will post the complete packages here in this thread.
Notes on jpeg recording
The jpeg in live mode 1024x680 (no zoom) has maximum size 330.8k. The header is hardcoded (and so are the jpeg-edmac channels), but the actual file can vary in length, and is typically smaller. I can't not find the true lenght of the jpeg unless I search the entire 330.8k block for the jpeg end container, easy solution is just to save the entire 330.8k block. Inorder to have a efficient recording system, these images must be copied using edmac into larger buffers, which can be saved. Larger buffers increase the write speed to the CF card, small buffers lower the bandwidth. The FIO file system used dma. The big issue there is not the size - the jpeg is small, but it the fact that there are no "free" edmac avilable on the DIGIC III, (free = not used by firmware). All edmac are used (no wonder that the DIGIC4 have many more of these). The firmware even seems to be using some edmac for multiple operations. So stealing a edmac is gonna be difficult- but I guess not impossible. The jpeg-edmac channels used for encoding and tranfering the jpeg image is used in approx 5ms per frame, so in the remaining time they seems to be unused. At 24 fps I have around 36 ms for tranfering the image to another location, before the jpeg-edmac is used again, this should be possible.
Minimum CF bandwidth needed at 24 fps = 24 * 330.8k ~ 8 mb/s.
These bandwidth requirements are also below the capabilities of the CF system, the bandwidth limit is around 14 mb/s and overclocked around 20 mb/s, so this should also be possible, and higher fps should also be possible. I could also "just" try to hijack a simple function which is called just after jpeg tranfering completes, then save the frame directly, but this requires that the CF system is capable of 8 mb/s in small blocks and that the LV system can cope with the additional code overhead. Also, even more interessing, the Live Mode jpeg is 1024x680, but the raw image is larger 1334x872, and in zoom x5 mode, the raw size is close to HD = 1872x1066 pixels.
Hurray ! it's beta release day for 40D
This is the first public release series of ML for 40D. Please take notice that this is a strictly experimental version, there are no guarantees - if it breaks, you get to keep both pieces. If you find bugs, please let me know, in this thread. If you try this build out, please keep in mind that I have strictly focused on getting main features supported, while spending little time on minor issues. Features/Modules that crashed the camera was removed, but nothing more. "If it aint broke dont fix it". There are options and menus that does not work, but nor crashes the camera. Most modules were removed. The complete package is larger than normal ML packages, as I don't have a efficient bootloader encryptor, but just an old inefficient version.
Latest version: "1.0.6" (18 Feb 2021)
Features: Basic ML support with exposure control, intervalometer and live mode functionality
Important: Trashcan button to enter Magic Lantern. The Q button on 40D is "picture" button.
Important: If the camera crashes, please remove the battery.
Canon FW: 1.1.1
Src: https://github.com/jmheder/ml/raw/master/vxworks_1.0.6.zip
Compiler used: gcc-arm-none-eabi-4_7-2014q2-20140408-linux.tar.bz2
Download (1.0.6): https://github.com/jmheder/ml/raw/master/magiclantern-Nightly.2021Feb18.40D111.zip
Older version:
Download (1.0.5): https://github.com/jmheder/ml/raw/master/magiclantern-Nightly.2020Aug23.40D111.zip
Download (1.0.4): https://github.com/jmheder/ml/raw/master/magiclantern-Nightly.2020Jul29.40D111.zip
Download (1.0.0): https://github.com/jmheder/ml/raw/master/magiclantern-Nightly.2020Jan24.40D111.zip
The main features
Bootloader and installation
See the video in the next reply.
Exposure control
Basic exposure time, F ratio, ISO, color temperature, Av,Tv,ISO lock is available, but I haven't tested them all, so I expect additional issues here. If you wish to use exposure simulation, enable this in the canon menu - and enable it in the ML menu aswell.
Live Mode
Not all overlays is support yet. AF Focusing in Live Mode will produce a temporary corrupted green screen, it not serious, it's just annoying and will go away automatically. Remember to enable live mode in (canon menu), also enable focusing in Live Mode (canon menu)
Raw video
Basic mlv_lite module is supported
Intervalometer.
Intervalometer with or without bulb is supported, but there are of issue (see below) Practice and you will learn. Easy solution: turn off review time and keep one seconds delay between each shot.
Astrophotography
For those into astrophotography, the camera with this ML build is a great combination, the intervalometer with bulb is working, and Live Mode plus low fps and a large exposure time will enable you focus on stars, a great tool for fine adjustment of the focus. Astro module added (star focusing only for now)
List of known minor issues
A. --
B. --
C. Exposure simulation. Don't change ExpSim in exposure control, ML always think it's enabled (remember to enable it via canon menu)
also you can use "info" button in Live Mode to verify that canon's own function to verify exposure simulation is within tolerances.
D. LiveMode. When AF focusing in Live Mode a corrupted green screen will occur, it's not important, just annoying.
E. --
F. Intervalometer, this ML version think image review time is fixed to 3(?) sec (you might see incorrect warnings in lower screen)
G. --
H. Intervalometer, in bulb mode keep exposure time below "take pic every sec" + review time, if you set review time
in canon menu to zero, you should be able to do "crazy pic" if needed.
I. Exposure. Exposure times above 15 ?(20?) seconds is not correctly recognized by ML in exposure menu.
J. --
K. Live Mode. To have a nice Live Mode (with bars) the internally view aspect ratio is changed, a few times you
might see the bar positions incorrectly. To remove triple bars either exit and enter Live Mode or press the AF focus
button.
M. --
N. Canon Menu. Really odd colors in canon menu can be caused by a previous crash (after crash : console is on). Enable console and
disable it again to resolve this issue.
O. Color Temperature. ML recognized some color temperature as names like "Sunny", if the temperature was set from Canon menu / dials.
When changing the color temperature within ML you only get to see the temperature as a number
P. Menu. Some options does not work, but nor crashes the camera.
Q. --
Additional info - Source code repository details & future:
Branch: https://bitbucket.org/jmheder/magic-lantern/branch/vxworks
I have merged unified into vxworks and updated the code the 40D platform code, thus this vxworks repository includes more or the lastest unified code (end 2019), which is great news!. The downside is that the 40D is a digic III processor and quite different from digic 4/5..., and this can be seen in the code. No shadow memory, low resolution display, few edmac, fewer PROP's, address space is different and so on.I had to create a simulation layer to keep the code somewhat clean. So I don't think 40D will be included into mainstream "unified", it will take to much time. I will however keep my focus on supporting the 40D with bug fixes and possibly more features, like modules and even try to get mjpeg stream recording up and running.
Installation on 40D
The build include is a simple "bootflag flipper" bootloader, like the 5Dc,400D's. Update the camera with ML-SETUP.FIR, this will take some seconds. After the screen goes black, a few seconds will pass, then bootloader will run. When the bootloader is running the follow led pattern can be seen:
very fast blue led blinking = bootloader is running (this will allways occur at first)
solid blue led = camera bootflag was enabled, please remove the battery
very slow blue led blinking = camera bootflag was disabled, please remove the battery
solid red led = Incorrect firmware version (use Canon 40D FW = 1.1.1), please remove the battery
You will also need EOSCard to make the CF card bootable, see the video
Quick VideoSmall mistake around 1:50, "Bootloader is running, bootloader is on". I should have said "Bootloader is running, camera bootflag is on"
Congrats!!! Up with the great work!!Thanks
Hi Heder
I've tried to install your ML in the Eos 40D FW 1.1.1.
When doing so the blue LED does what you say, it flashes fast about 20 times, then solid and then slow.
I remove the battery and switch the camera back on and it remains without changing the FW and does not charge the ML.
How can I run it?
What am I doing wrong?
Excuse my poor English.
Greetings
Hi ilex.
It would be a good idea to read the installation guide. https://wiki.magiclantern.fm/install
But ... a quick introduction. The bootloader (the one you installed) will enable the camera to boot magic lantern firmware from the card ... but ONLY if the CF card is prepared correctly. You forgot to make the bootflag in the CF-card partition table set true and set the volumen label to be "EOS_DEVELOP". You can use EOS_Tool.exe to do that.
1. Upgrade the Canon 40D with the FIR file and make sure that the BLUE led is solid at the end (solid blue = camera bootflag enabled).
2. Put your CF into your CF card reader.
3. Download https://pel.hu/down/EOScard.exe and run it. Press the EOS_DEVELOP and bootdisk button and then save
4. Make sure you have autoexec.bin (magic lantern) on the CF card.
Hi heder,
Thanks for your quick answer.
I used ML on an EOS 50D until two years ago and I currently have it installed on an EOS M and neither had this problem with the boot up.
I will try to install it during the day according to your advice and the ML installation page.
Thanks for your great work to port ML to this old EOS 40D, which will help to give it a new life.
Greetings
Hi
My 40d bootloader does not charge the CF card, like other bootloaders. You Will have to use Eos-Tool. Maybe later in 2020 i Will change the bootloader to work like all others.
@ilex: He is referring to EOScard (https://pel.hu/eoscard) utlity.
On Windows:
Run EOScard
Delete all content from card
Copy heder's extracted build to card.
On macOS:
Run Macboot (https://www.zenoshrdlu.com/macboot/macboot.html)
Copy heder's extracted build to card.
Or use makeboot.sh
@heder,
thanks for the information...I'm trying, without success yet.
Thank you, @Walter,
I'm trying to follow your instructions and those of @heder, and the only thing I get is that the bootloader loads, the blue led remains fixed, I remove the battery, I try again to update the FW and again the blue led changes to blink...and I can't get past that loop.
Looks like you are actually toggling Cam's bootflag. Works as designed.
After status "solid" the Cam's bootflag is enabled and - after reboot - ML should start from bootable card.
You haven't described what you actually did with the card. "Followed the instructions" can mean anything.
Describe and be precise!
Should I male a Short video and post it later this week, to rule out misunderstandings ?
Wait a while. No info about OS, yet.
@Walter
My PC has Windows10
This is what I did step by step
1 Format the card in the camera
2 Run Eos card activating EOS_DEVELOP and BOOTDISK
3 Delete all content from card
4 Copy heder's extracted build to card.
5 After status "solid" the Cam's bootflag is enabled and - after reboot - ML don't start from bootable card.
@heder "Should I male a Short video and post it later this week, to rule out misunderstandings ?"It would be a great help for me, who don't have much knowledge of informatics.
Just to be sure: You pressed trashcan button after cam started and Canon's screen apperared?
Card size?
@Walter
The card I use is a Kingston elite pro 133X 8GB. This card rules perfectly ML in my old 50D.
In the heder's ML the Q button on 40D is "picture" button, not the trashcan one.
I pressed both, but no one make run ML.
Regards and thanks for your interest with me.
Quote from: Walter Schulz on January 26, 2020, 11:48:38 PM
Try this:
Rename autoexec.bin to autoexec.bak
Insert card into cam and try to startup.
If cam is not starting up correctly:
Verified that Cam's bootflag is set and card is bootable.
If cam runs plain Canon: Either Cam's bootflag isn't set or card is not bootable.
Toggle/flip Cam's bootflag once and retest.
Ilex, I can't figure the issue, so here is a
early morning video ..
Small mistake around 1:50, "Bootloader is running, bootloader is on". I should have said "Bootloader is running, camera bootflag is on"
@heder
Thank you very much!!
Now ML is running.
My mistake was to interpret the picture button as you said in your post "The Q button on 40D is "picture" button" instead of the trash button.
Now I'll start testing the new features.
@Walter
Thanks for yor help an interest.
Glad to hear its working!.
Updated the posts about the firmware and installation, making it easier to understand incl. the installation video.
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Engine DMA controller is up and running, using the edmac module. This morning I also tested the edmac module while LiveView was running and everything seems to work, this is an important step towards mjpeg recording.
* EDMAC HW engine seems the same
* EDMAC SW functions seems the same
* I can read the edmac address directly
* All other edmac registers can not be read (not directly nor shadow read)
* The way to use/lock resources is the same (except we have fewer channels,connections)
* ResLock struct is different (first char* name is missing), but we don't interface with the struct, so it's not important
EDMAC "memcpy" speed in "offline mode (only screen active)" was 345 MB/S with the flags below. In LiveMode (no zoom) the speed dropped to 322 MB/S.
R:4 W:2 bytes per transfer. flags R:0x60000000, W:0x40000000
R:4 W:2 bytes per transfer. flags R:0x60000000, W:0x40001000
R:4 W:4 bytes per transfer. flags R:0x60000000, W:0x60000000
R:4 W:4 bytes per transfer. flags R:0x60000000, W:0x60001000
R:4 W:2 bytes per transfer. flags R:0x60001000, W:0x40000000
R:4 W:2 bytes per transfer. flags R:0x60001000, W:0x40001000
R:4 W:4 bytes per transfer. flags R:0x60001000, W:0x60000000
R:4 W:4 bytes per transfer. flags R:0x60001000, W:0x60001000
Next step it to verify which channels can be used in LiveMode, I have looked into the gihdra decompiled source and written a list https://magiclantern.fandom.com/wiki/Register_Map/40D, but I need to verify atleast a couple of them.
Still working in the "engine-room" dma-memcpy seems to be working fine, when it's done at the right time. Now working on a hal-layer which will make the digic 3 system act like a digic 4 processor, as this will allow me to use the unified code "as is".
Also sucessfully got the cache_tricks fully to work. Calling cache_lock and cache_fake does work as intended. Cache_fake calls need to be done prettly later afte the cache_lock call (seconds later ?), no idea why. I'm now doing these inside LiveMode because thats were I need these.
Then I sucessfully hijacked EngDrvOut and engio_write so I could dump all registers in LiveMode to disk. Also sucessfully hijacked a function to perform lv_vsynconization (for lv recording later)
Currently stuck in finding adgt/cmos read/write function as they're not the same as the digic4 and newer platforms. Working on finding the correct pgio and io addresses for those
Quote from: heder on February 19, 2020, 07:25:31 PM
Currently stuck in finding adgt/cmos read/write function as they're not the same as the digic4 and newer platforms.
What about function names registered in sub_FFB24D68 (40D111) ?
Quote from: Ant123 on February 25, 2020, 05:54:11 PM
What about function names registered in sub_FFB24D68 (40D111) ?
Yes you are right, there are function with the right names, but in a odd spot. I have been digging around there for a long time. The function at ffb24d68 stores/registers alot of function (ad)tg,dfe,cmos,head,iso and others). All or most groups have three function - read,write and show. But the function interfaces are odd and most takes no arguments, and the functions do not write anything directly to any gpio's.
I did however to call most of the "show" function which dumped alot alot of files which gave me some clues and data to search for. Using the data from the "show" function finally realized that the function I was looking for was exceptionly badly decompiled using gihdra. It failed to decode around 80% of the sio read/write function
TG File, first value is some kind of property value, second value is bytes in table. All other files are similar
00010000
000003dc
01008000
01101047
0120303c
0130000c
01700011
02100000
02201100
02500000
02600707
02700707
02800707
02900030
02a00000
02b00010
02c0000f
04000002
04100028
04200002
04300028
04400004
04500012
04a00012
04b00002
04e0000e
04f00234
058000f0
05900136
05a00234
05b00294
06000002
06100028
062000ee
06300230
06a00002
06b00028
06c00078
06d000e0
07600002
07700070
08a00236
08b0023c
09000236
0910023a
09200236
0930023a
09400238
09500238
09800246
0990024a
09a00246
09b0024a
09c0025e
09d0025e
09e00056
09f0005e
0a200234
0a300002
0a400002
0a50023c
0a600250
0a8000e8
0a900136
10102802
10205830
10305038
1140020e
11502234
11602028
1170204e
11800002
11900028
11a02056
11b0207e
11c0205e
11d02076
11e00082
11f016c6
14600002
14700709
1480000a
1490000a
14a00a3e
14b00001
15300003
15400a3f
15500a40
15a00a3e
15b00a3f
15c00a40
15d00002
20000008
20100003
30000101
3010061f
30200019
30300713
3040202c
30500000
34005555
34105555
34205555
34305554
34404555
34505555
34605555
34705555
34805554
04800236
0490023e
0520000e
05300234
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
02600606
02700606
02800606
09c0025e
09d0025e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01008000
ffffffff
0100a002
ffffffff
01000003
ffffffff
01008004
ffffffff
01700111
08a00236
08b0023c
09000236
0910023a
09200236
0930023a
09400238
09500238
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700111
08a0024c
08b00252
0900024c
09100250
0920024c
09300250
0940024e
0950024e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700111
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700011
ffffffff
01203131
01700111
ffffffff
01203031
01700000
ffffffff
01000018
ffffffff
01000001
ffffffff
01000007
ffffffff
01100047
02b00000
0980025a
0990025e
09a0025a
09b0025e
14e00004
15000a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024a
09a00246
09b0024a
14a00010
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024a
09a00246
09b0024a
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024e
09a00246
09b0024e
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
0980025a
0990025e
09a0025a
09b0025e
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01000000
ffffffff
On the 40D I have located 3 low level sio function which performs the actual writing. These are the once that gihdra fails to decompile properly
ffff9cf4(uint32*t) : sio write Function A; write 32 bits data to SIO (channel 0)
ffff7268(uint32*t) : sio write Function B; write 16 bits data to SIO (channel 1)
ffc2e2a8(uint32*t) : sio write Function C; write 32 bits data to SIO (channel 0)
Function A writes to SIO channel 0 but this function is only called with data static. The function is also rather simple, no readback, checks or anything. I also search for direct references (aka. pointers to this function) but found none in ROM. This function writes 32 bits data.
Function B writes to SIO channel 1 this function is also called with data static. The function is also simple, bit I did found two references to this function in memory in ROM. This function writes 16 bits data.
Function C
Seems to be the real function, and reminds me of the adtg write function on 550D. It writes to channel 0. This function writes 32 bits data. I had to decompile it by hand. Has a message inside, [CAP]SIO0_STATUS_READ_ERROR, and this function is also called by another function with the message "[TG] IMG_POWDET NG !!". Setup the SIO0 on each call, check for busy - and will perform 100 retries is it fails to write properly. This function is called alot of places with static data, but also alot of places with dynamic allocated data. The input data value between Function A and Function C corresponds ok, and seems to be reg16bit|value16bit like newer cameras.
I tried to recode the adtg_gui with the interface to ffc2e2a8(uint32_t*) but my camera goes constant black.
The data written to channel 0 does not correspond with any known adtg values from newer cameras
I need some help rearding button control.
When I press the trashcan button after the camera is booted I get into ML correctly, menu opens and everything is ok.
But when I get into LiveMode (by pressing the SET button) and then pressing the trashcan button nothing happens - no menu, I can't figureout why and the gui files/structure is pretty confusing.
Any suggestions are welcome.
Updated open beta to 1.0.1
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Fixes =
Exposure Menu. Fixed "RAW:0" message, camera reads shutter upon startup.
Debug Menu. Memory allocation (nearly) completed, currently ~54 MB is now avilable atm.
(https://lh3.googleusercontent.com/cV4loszCy_UG4rFLzoCdgDlvnV9LnrATHlEyYW_UNI3cV8UlqYPH8Tg8S6ZE3Ig3fEpyzYPF0gm6cvAnBmJH2mCSx8nep7KBBWHqAuwEVT1KTp0EwtuH1g6JWZKqRjRSnLMETTiArmUzpZIR3qLFbTJVPCIVStKuGKrz3arUQRyxO5YM6cx9PbMjWq4OW79haMElTNQgcBVeNNDZFuUNfxfoTuJr8kKz4HHqVa8H40EgWZhwSKLfHuhx_JMZhdhpdFli8OuOoYlS4L4w26fMgJg8zRRxPJyCgRACvfhgpx1dX7FsnE9jB6KHiegF68Pays9rYxeoGuQlEaqFV18XBcPPBwj4-qTJg4USYUiOIfDikOt-i0DBZKdDtMQoNWGmE3OmYyWcI2BwFQvbCxAwEaU5DDSyJL4UbGIi4ZlZZrJZMfsx028fTKZDLKLixIYiLhaMXKincX74HZjjKJTHyCRWMhKJu7RAyYdVZ43uES3xZofgH4CMKE3LIzWeFv76Sy49gl-3S7LpjnXYZdGktSYSE01H6-5E0HjJzHBXjWec4DalHR2QgkJ8o06GOFLmAIuS-xkzBe-AHv_ZZg8laxQyM0OKUp_664SZX-cQq9MIq54AnWEc_8j3aKjFBryAm3QFPlYsWH_Iy7nwwUWfVgOnvxfxcEEFarl3e_vKdRkQhNpOz0798OuRrs5FK_vwxpj772lat2VBnt4TZ-J0BsYasZxiM_Pg2Sj9_s_IszaXHsZG=w1329-h677-no)
abit of documentation on my current approch, (sorry for my bad english)
After hijkacing engio_write,EngDrvOut and EngDrvOuts, and reading the output I have finally tracked down RAW_LV_EDMAC to edmac channel 4,
and with shamem_read nearly completed, next step in a week or two is to tryout CONFIG_RAW_LIVEVIEW.
********************************************************************************************************
Section liveview generic start ...
engio_write start/end = engio_write
EngDrvOuts = EngDrvOuts
All others are = EngDrvOut
First value = some timer tick counter
********************************************************************************************************
-99030 : Read Addr: 0xc0f04008, Data: 0x3ffffffe [16383 65534] DMA 0 REG dst
-99029 : Read Addr: 0xc0f04108, Data: 0x34913f4a [13457 16202] DMA 1 REG dst
-99028 : Read Addr: 0xc0f04208, Data: 0x38002ade [14336 10974] DMA 2 REG dst
-99027 : Read Addr: 0xc0f04308, Data: 0x3bf404a8 [15348 1192] DMA 3 REG dst
-95190 : Read Addr: 0xc0f04408, Data: 0x3e34587e [15924 22654] DMA 4 REG dst
-95189 : Read Addr: 0xc0f04508, Data: 0x3ea8f27e [16040 62078] DMA 5 REG dst
-95188 : Read Addr: 0xc0f04608, Data: 0x34a96fe8 [13481 28648] DMA 6 REG dst
-95187 : Read Addr: 0xc0f04708, Data: 0x 0 [ 0 0] DMA 7 REG dst
-91450 : Read Addr: 0xc0f04808, Data: 0x3ba65e1e [15270 24094] DMA 8 REG dst
-91448 : Read Addr: 0xc0f04908, Data: 0x1d2e4a48 [ 7470 19016] DMA 9 REG dst
-91448 : Read Addr: 0xc0f04a08, Data: 0x3e25122e [15909 4654] DMA 10 REG dst
-91446 : Read Addr: 0xc0f04b08, Data: 0x39e1dbce [14817 56270] DMA 11 REG dst
-87680 : Read Addr: 0xc0f04c08, Data: 0x35a051be [13728 20926] DMA 12 REG dst
-87679 : Read Addr: 0xc0f04d08, Data: 0x291b4efe [10523 20222] DMA 13 REG dst
-87678 : Read Addr: 0xc0f04e08, Data: 0x 0 [ 0 0] DMA 14 REG dst
-87677 : Read Addr: 0xc0f04f08, Data: 0x 0 [ 0 0] DMA 15 REG dst
-43209 : Write Addr: 0xc0f14080, Data: 0x fc0000 [ 252 0] LiveView
-43207 : Write Addr: 0xc0f14084, Data: 0x 346de7f [ 838 56959] LiveView
-43206 : Write Addr: 0xc0f14088, Data: 0x 36dcba1 [ 877 52129] LiveView
-43205 : Write Addr: 0xc0f1408c, Data: 0x 31a66ea [ 794 26346] LiveView
-43204 : Write Addr: 0xc0f14090, Data: 0x 3a42280 [ 932 8832] LiveView
-43202 : Write Addr: 0xc0f14094, Data: 0x 3604377 [ 864 17271] LiveView
-43201 : Write Addr: 0xc0f14098, Data: 0x 3cf9a16 [ 975 39446] LiveView
-43200 : Write Addr: 0xc0f1409c, Data: 0x 393b94b [ 915 47435] LiveView
-43199 : Write Addr: 0xc0f140a0, Data: 0x 0 [ 0 0] LiveView
-43198 : Write Addr: 0xc0f140a4, Data: 0x 3000000 [ 768 0] LiveView
-43197 : Write Addr: 0xc0f140a8, Data: 0x 3190000 [ 793 0] LiveView
-43195 : Write Addr: 0xc0f140ac, Data: 0x 33a0000 [ 826 0] LiveView
-43194 : Write Addr: 0xc0f140b0, Data: 0x 3750000 [ 885 0] LiveView
-43193 : Write Addr: 0xc0f140b4, Data: 0x 39c0000 [ 924 0] LiveView
-43192 : Write Addr: 0xc0f140b8, Data: 0x 3c30000 [ 963 0] LiveView
-43191 : Write Addr: 0xc0f140bc, Data: 0x 3eb0000 [ 1003 0] LiveView
-43189 : Write Addr: 0xc0f14078, Data: 0x 1 [ 0 1] LiveView
-68927 : Write Addr: 0xc0f14080, Data: 0x fc0000 [ 252 0] LiveView
-68926 : Write Addr: 0xc0f14084, Data: 0x 346de7f [ 838 56959] LiveView
-68924 : Write Addr: 0xc0f14088, Data: 0x 36dcba1 [ 877 52129] LiveView
-68923 : Write Addr: 0xc0f1408c, Data: 0x 31a66ea [ 794 26346] LiveView
-68922 : Write Addr: 0xc0f14090, Data: 0x 3a42280 [ 932 8832] LiveView
-68921 : Write Addr: 0xc0f14094, Data: 0x 3604377 [ 864 17271] LiveView
-68920 : Write Addr: 0xc0f14098, Data: 0x 3cf9a16 [ 975 39446] LiveView
-68918 : Write Addr: 0xc0f1409c, Data: 0x 393b94b [ 915 47435] LiveView
-68917 : Write Addr: 0xc0f140a0, Data: 0x 0 [ 0 0] LiveView
-68916 : Write Addr: 0xc0f140a4, Data: 0x 3000000 [ 768 0] LiveView
-68915 : Write Addr: 0xc0f140a8, Data: 0x 3190000 [ 793 0] LiveView
-68914 : Write Addr: 0xc0f140ac, Data: 0x 33a0000 [ 826 0] LiveView
-68913 : Write Addr: 0xc0f140b0, Data: 0x 3750000 [ 885 0] LiveView
-68912 : Write Addr: 0xc0f140b4, Data: 0x 39c0000 [ 924 0] LiveView
-68910 : Write Addr: 0xc0f140b8, Data: 0x 3c30000 [ 963 0] LiveView
-68909 : Write Addr: 0xc0f140bc, Data: 0x 3eb0000 [ 1003 0] LiveView
-68908 : Write Addr: 0xc0f14078, Data: 0x 1 [ 0 1] LiveView
Multiple ClockOuts
-58341 : Write Addr: 0xc0f0b000, Data: 0x 0 [ 0 0]
engio_write start
-58338 : Write Addr: 0xc0f03030, Data: 0x80010000 [32769 0]
-58334 : Write Addr: 0xc0f03068, Data: 0x80010004 [32769 4]
-58333 : Write Addr: 0xc0f03070, Data: 0x80010007 [32769 7]
-58332 : Write Addr: 0xc0f0b008, Data: 0x 0 [ 0 0]
engio_write end
-58272 : Write Addr: 0xc0f0b000, Data: 0x 1 [ 0 1]
Multiple ClockOuts
engio_write start
-57672 : Write Addr: 0xc0f18000, Data: 0x 2 [ 0 2]
-57669 : Write Addr: 0xc0f18004, Data: 0x 3fff000 [ 1023 61440]
-57668 : Write Addr: 0xc0f18008, Data: 0x 0 [ 0 0]
-57666 : Write Addr: 0xc0f1800c, Data: 0x 1c7f00 [ 28 32512]
-57665 : Write Addr: 0xc0f18010, Data: 0x 0 [ 0 0]
-57664 : Write Addr: 0xc0f06004, Data: 0x 0 [ 0 0] Videotiming - standby
-57662 : Write Addr: 0xc0f06008, Data: 0x 5490549 [ 1353 1353] Videotiming - T0(0)
-57661 : Write Addr: 0xc0f0600c, Data: 0x 5490549 [ 1353 1353] Videotiming - T0(1)
-57659 : Write Addr: 0xc0f06010, Data: 0x 549 [ 0 1353] Videotiming - T0(2)
-57658 : Write Addr: 0xc0f06018, Data: 0x 20 [ 0 32] Videotiming - ?
-57657 : Write Addr: 0xc0f0601c, Data: 0x 0 [ 0 0] Videotiming - ?
-57655 : Write Addr: 0xc0f06020, Data: 0x 2 [ 0 2] Videotiming - ?
-57654 : Write Addr: 0xc0f06024, Data: 0x 0 [ 0 0] Videotiming - ?
-57652 : Write Addr: 0xc0f06028, Data: 0x 0 [ 0 0] Videotiming - ?
-57651 : Write Addr: 0xc0f0602c, Data: 0x 0 [ 0 0] Videotiming - ?
-57649 : Write Addr: 0xc0f06030, Data: 0x 0 [ 0 0] Videotiming - ?
-57648 : Write Addr: 0xc0f06034, Data: 0x 0 [ 0 0] Videotiming - ?
-57647 : Write Addr: 0xc0f06038, Data: 0x 0 [ 0 0] Videotiming - ?
-57645 : Write Addr: 0xc0f0603c, Data: 0x 0 [ 0 0] Videotiming - ?
-57644 : Write Addr: 0xc0f06040, Data: 0x 0 [ 0 0] Videotiming - ?
-57642 : Write Addr: 0xc0f06044, Data: 0x 0 [ 0 0] Videotiming - ?
-57641 : Write Addr: 0xc0f06048, Data: 0x 0 [ 0 0] Videotiming - ?
-57640 : Write Addr: 0xc0f0604c, Data: 0x 0 [ 0 0] Videotiming - ?
-57638 : Write Addr: 0xc0f06050, Data: 0x 0 [ 0 0] Videotiming - ?
-57637 : Write Addr: 0xc0f06054, Data: 0x 0 [ 0 0] Videotiming - ?
-57635 : Write Addr: 0xc0f06058, Data: 0x 0 [ 0 0] Videotiming - ?
-57634 : Write Addr: 0xc0f0605c, Data: 0x 0 [ 0 0] Videotiming - ?
-57632 : Write Addr: 0xc0f06060, Data: 0x 0 [ 0 0] Videotiming - ?
-57631 : Write Addr: 0xc0f06064, Data: 0x 0 [ 0 0] Videotiming - ?
-57630 : Write Addr: 0xc0f06068, Data: 0x 0 [ 0 0] Videotiming - ?
-57628 : Write Addr: 0xc0f0606c, Data: 0x 0 [ 0 0] Videotiming - ?
-57627 : Write Addr: 0xc0f06070, Data: 0x 0 [ 0 0] Videotiming - ?
-57625 : Write Addr: 0xc0f06074, Data: 0x 0 [ 0 0] Videotiming - ?
-57624 : Write Addr: 0xc0f06078, Data: 0x 0 [ 0 0] Videotiming - ?
-57623 : Write Addr: 0xc0f0607c, Data: 0x 0 [ 0 0] Videotiming - ?
-57621 : Write Addr: 0xc0f060e8, Data: 0x 1fff [ 0 8191] Videotiming - ?
-57620 : Write Addr: 0xc0f06080, Data: 0x 0 [ 0 0] Videotiming - ?
-57619 : Write Addr: 0xc0f06084, Data: 0x 20271 [ 2 625] Videotiming - raw first line & coloum
-57617 : Write Addr: 0xc0f06088, Data: 0x 369050d [ 873 1293] Videotiming - raw last line & coloum
-57615 : Write Addr: 0xc0f0608c, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57614 : Write Addr: 0xc0f06090, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57612 : Write Addr: 0xc0f06094, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57611 : Write Addr: 0xc0f06098, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57610 : Write Addr: 0xc0f0609c, Data: 0x 2222200 [ 546 8704] Videotiming - ?
-57608 : Write Addr: 0xc0f060a0, Data: 0x 0 [ 0 0] Videotiming - ?
-57607 : Write Addr: 0xc0f060a8, Data: 0x 0 [ 0 0] Videotiming - ?
-57606 : Write Addr: 0xc0f060ac, Data: 0x 0 [ 0 0] Videotiming - ?
-57604 : Write Addr: 0xc0f060b0, Data: 0x 0 [ 0 0] Videotiming - ?
-57603 : Write Addr: 0xc0f060b4, Data: 0x 0 [ 0 0] Videotiming - ?
-57601 : Write Addr: 0xc0f060cc, Data: 0x 0 [ 0 0] Videotiming - ?
-57600 : Write Addr: 0xc0f060d0, Data: 0x 0 [ 0 0] Videotiming - ?
-57598 : Write Addr: 0xc0f060d4, Data: 0x 0 [ 0 0] Videotiming - ?
-57597 : Write Addr: 0xc0f060d8, Data: 0x 0 [ 0 0] Videotiming - ?
-57596 : Write Addr: 0xc0f060dc, Data: 0x 10 [ 0 16] Videotiming - ?
-57594 : Write Addr: 0xc0f060e0, Data: 0x 0 [ 0 0] Videotiming - ?
-57593 : Write Addr: 0xc0f060e4, Data: 0x 0 [ 0 0] Videotiming - ?
-57592 : Write Addr: 0xc0f06000, Data: 0x 1 [ 0 1] Videotiming - trig
-57590 : Write Addr: 0xc0f07008, Data: 0x 1 [ 0 1] HEAD timer
-57589 : Write Addr: 0xc0f07010, Data: 0x 3fff [ 0 16383] HEAD timer
-57587 : Write Addr: 0xc0f07014, Data: 0x 63 [ 0 99] HEAD timer
-57586 : Write Addr: 0xc0f07018, Data: 0x 1c [ 0 28] HEAD timer
-57585 : Write Addr: 0xc0f0701c, Data: 0x 0 [ 0 0] HEAD timer
-57583 : Write Addr: 0xc0f0707c, Data: 0x 0 [ 0 0] HEAD timer
-57582 : Write Addr: 0xc0f071ac, Data: 0x 10 [ 0 16] HEAD timer
-57580 : Write Addr: 0xc0f07004, Data: 0x 1 [ 0 1] HEAD timer
-57579 : Write Addr: 0xc0f0700c, Data: 0x 1 [ 0 1] HEAD timer
-57578 : Write Addr: 0xc0f07020, Data: 0x 0 [ 0 0] HEAD timer
-57576 : Write Addr: 0xc0f07024, Data: 0x 0 [ 0 0] HEAD timer
-57575 : Write Addr: 0xc0f07028, Data: 0x 1000 [ 0 4096] HEAD timer
-57573 : Write Addr: 0xc0f0702c, Data: 0x 0 [ 0 0] HEAD timer
-57572 : Write Addr: 0xc0f07038, Data: 0x 40 [ 0 64] HEAD timer
-57571 : Write Addr: 0xc0f07048, Data: 0x 0 [ 0 0] HEAD timer
-57569 : Write Addr: 0xc0f0704c, Data: 0x 0 [ 0 0] HEAD timer
-57568 : Write Addr: 0xc0f07050, Data: 0x 0 [ 0 0] HEAD timer
-57567 : Write Addr: 0xc0f0705c, Data: 0x 0 [ 0 0] HEAD timer
-57565 : Write Addr: 0xc0f07060, Data: 0x 0 [ 0 0] HEAD timer
-57564 : Write Addr: 0xc0f07064, Data: 0x 0 [ 0 0] HEAD timer
-57562 : Write Addr: 0xc0f07134, Data: 0x 0 [ 0 0] HEAD timer
-57561 : Write Addr: 0xc0f07138, Data: 0x 0 [ 0 0] HEAD timer
-57559 : Write Addr: 0xc0f0713c, Data: 0x 0 [ 0 0] HEAD timer
-57558 : Write Addr: 0xc0f07148, Data: 0x 0 [ 0 0] HEAD timer
-57557 : Write Addr: 0xc0f0714c, Data: 0x 0 [ 0 0] HEAD timer
-57555 : Write Addr: 0xc0f07150, Data: 0x 0 [ 0 0] HEAD timer
-57554 : Write Addr: 0xc0f07068, Data: 0x 0 [ 0 0] HEAD timer
-57552 : Write Addr: 0xc0f0706c, Data: 0x 0 [ 0 0] HEAD timer
-57551 : Write Addr: 0xc0f07070, Data: 0x 0 [ 0 0] HEAD timer
-57550 : Write Addr: 0xc0f07078, Data: 0x 0 [ 0 0] HEAD timer
-57548 : Write Addr: 0xc0f0708c, Data: 0x 0 [ 0 0] HEAD timer
-57547 : Write Addr: 0xc0f07090, Data: 0x 0 [ 0 0] HEAD timer
-57546 : Write Addr: 0xc0f07094, Data: 0x 0 [ 0 0] HEAD timer
-57544 : Write Addr: 0xc0f07098, Data: 0x 0 [ 0 0] HEAD timer
-57543 : Write Addr: 0xc0f0709c, Data: 0x 0 [ 0 0] HEAD timer
-57541 : Write Addr: 0xc0f070a0, Data: 0x 0 [ 0 0] HEAD timer
-57540 : Write Addr: 0xc0f070a4, Data: 0x 0 [ 0 0] HEAD timer
-57539 : Write Addr: 0xc0f070b4, Data: 0x 0 [ 0 0] HEAD timer
-57537 : Write Addr: 0xc0f070b8, Data: 0x 10020 [ 1 32] HEAD timer
-57535 : Write Addr: 0xc0f070bc, Data: 0x 0 [ 0 0] HEAD timer
-57534 : Write Addr: 0xc0f070c0, Data: 0x 411 [ 0 1041] HEAD timer
-57533 : Write Addr: 0xc0f070c4, Data: 0x 1101000 [ 272 4096] HEAD timer
-57531 : Write Addr: 0xc0f070cc, Data: 0x 0 [ 0 0] HEAD timer
-57530 : Write Addr: 0xc0f070d0, Data: 0x 0 [ 0 0] HEAD timer
-57529 : Write Addr: 0xc0f070d4, Data: 0x 0 [ 0 0] HEAD timer
-57527 : Write Addr: 0xc0f070e0, Data: 0x 4 [ 0 4] HEAD timer
-57526 : Write Addr: 0xc0f070e4, Data: 0x 4 [ 0 4] HEAD timer
-57524 : Write Addr: 0xc0f070e8, Data: 0x 8 [ 0 8] HEAD timer
-57523 : Write Addr: 0xc0f070ec, Data: 0x 8 [ 0 8] HEAD timer
-57522 : Write Addr: 0xc0f070f0, Data: 0x 10 [ 0 16] HEAD timer
-57520 : Write Addr: 0xc0f070f4, Data: 0x 10 [ 0 16] HEAD timer
-57519 : Write Addr: 0xc0f070f8, Data: 0x 0 [ 0 0] HEAD timer
-57517 : Write Addr: 0xc0f070fc, Data: 0x 1 [ 0 1] HEAD timer
-57516 : Write Addr: 0xc0f07100, Data: 0x 0 [ 0 0] HEAD timer
-57515 : Write Addr: 0xc0f07104, Data: 0x 0 [ 0 0] HEAD timer
-57513 : Write Addr: 0xc0f07108, Data: 0x 211 [ 0 529] HEAD timer
-57512 : Write Addr: 0xc0f0710c, Data: 0x 500 [ 0 1280] HEAD timer
-57511 : Write Addr: 0xc0f07110, Data: 0x 0 [ 0 0] HEAD timer
-57509 : Write Addr: 0xc0f07114, Data: 0x 0 [ 0 0] HEAD timer
-57508 : Write Addr: 0xc0f07000, Data: 0x 0 [ 0 0] HEAD timer
engio_write end
engio_write start
-57499 : Write Addr: 0xc0f06008, Data: 0x 5490549 [ 1353 1353] Videotiming - T0(0)
-57497 : Write Addr: 0xc0f0600c, Data: 0x 5490549 [ 1353 1353] Videotiming - T0(1)
-57496 : Write Addr: 0xc0f06010, Data: 0x 549 [ 0 1353] Videotiming - T0(2)
-57494 : Write Addr: 0xc0f06084, Data: 0x 20271 [ 2 625] Videotiming - raw first line & coloum
-57493 : Write Addr: 0xc0f06088, Data: 0x 369050d [ 873 1293] Videotiming - raw last line & coloum
-57492 : Write Addr: 0xc0f06000, Data: 0x 1 [ 0 1] Videotiming - trig
engio_write end
engio_write start
-57483 : Write Addr: 0xc0f06014, Data: 0x 218 [ 0 536] Videotiming - T1
-57482 : Write Addr: 0xc0f06000, Data: 0x 1 [ 0 1] Videotiming - trig
engio_write end
Multiple ClockOuts
-56996 : Write Addr: 0xc0f05004, Data: 0x 6 [ 0 6] edmac connection
-56994 : Write Addr: 0xc0f05038, Data: 0x 1 [ 0 1] edmac connection
EngDrvOuts start
-56981 : Write Addr: 0xc0f0410c, Data: 0x 2 [ 0 2] DMA 1 REG yn | xn
-56980 : Write Addr: 0xc0f04110, Data: 0x ca70080 [ 3239 128] DMA 1 REG yb | xb
-56979 : Write Addr: 0xc0f04114, Data: 0x 80 [ 0 128] DMA 1 REG ya | xa
-56978 : Write Addr: 0xc0f04118, Data: 0x 0 [ 0 0] DMA 1 REG off1
-56977 : Write Addr: 0xc0f0411c, Data: 0x 0 [ 0 0] DMA 1 REG off2b
-56976 : Write Addr: 0xc0f04120, Data: 0x 0 [ 0 0] DMA 1 REG off1a
-56974 : Write Addr: 0xc0f04124, Data: 0x 0 [ 0 0] DMA 1 REG off2a
-56973 : Write Addr: 0xc0f04128, Data: 0x 0 [ 0 0] DMA 1 REG off3
EngDrvOuts end
-56969 : Write Addr: 0xc0f04104, Data: 0x60000000 [24576 0] DMA 1 REG flags
-56967 : Write Addr: 0xc0f04108, Data: 0x1dbc0064 [ 7612 100] DMA 1 REG dst
EngDrvOuts start
-56961 : Write Addr: 0xc0f0490c, Data: 0x 2 [ 0 2] DMA 9 REG yn | xn
-56960 : Write Addr: 0xc0f04910, Data: 0x ca70080 [ 3239 128] DMA 9 REG yb | xb
-56959 : Write Addr: 0xc0f04914, Data: 0x 80 [ 0 128] DMA 9 REG ya | xa
-56958 : Write Addr: 0xc0f04918, Data: 0x 1ff80 [ 1 65408] DMA 9 REG off1
-56957 : Write Addr: 0xc0f0491c, Data: 0x fffff80 [ 4095 65408] DMA 9 REG off2b
-56956 : Write Addr: 0xc0f04920, Data: 0x 1ff80 [ 1 65408] DMA 9 REG off1a
-56955 : Write Addr: 0xc0f04924, Data: 0x 0 [ 0 0] DMA 9 REG off2a
-56954 : Write Addr: 0xc0f04928, Data: 0x 0 [ 0 0] DMA 9 REG off3
EngDrvOuts end
-56951 : Write Addr: 0xc0f04904, Data: 0x40000001 [16384 1] DMA 9 REG flags
-56950 : Write Addr: 0xc0f04908, Data: 0x1078bbf8 [ 4216 48120] DMA 9 REG dst
-56943 : Write Addr: 0xc0f04104, Data: 0x60000000 [24576 0] DMA 1 REG flags
-56942 : Write Addr: 0xc0f04100, Data: 0x 1 [ 0 1] DMA 1 REG ctrl
-56941 : Write Addr: 0xc0f04904, Data: 0x40010001 [16385 1] DMA 9 REG flags
-56940 : Write Addr: 0xc0f04900, Data: 0x 1 [ 0 1] DMA 9 REG ctrl
-50079 : Read Addr: 0xc0f04130, Data: 0x 2 [ 0 2] DMA 1 REG intr
-50067 : Write Addr: 0xc0f04104, Data: 0x 0 [ 0 0] DMA 1 REG flags
-50064 : Write Addr: 0xc0f04100, Data: 0x 4 [ 0 4] DMA 1 REG ctrl
-49995 : Read Addr: 0xc0f04930, Data: 0x 1 [ 0 1] DMA 9 REG intr
-49986 : Write Addr: 0xc0f04904, Data: 0x 0 [ 0 0] DMA 9 REG flags
-49985 : Write Addr: 0xc0f04900, Data: 0x 4 [ 0 4] DMA 9 REG ctrl
-49886 : Read Addr: 0xc0f01004, Data: 0x 3045 [ 0 12357] PowerCtrl
-49883 : Read Addr: 0xc0f01000, Data: 0x b045 [ 0 45125] PowerCtrl
-49878 : Write Addr: 0xc0f01004, Data: 0x 3045 [ 0 12357] PowerCtrl
-49877 : Write Addr: 0xc0f01000, Data: 0x b045 [ 0 45125] PowerCtrl
Multiple ClockOuts
engio_write start
-48732 : Write Addr: 0xc0f08100, Data: 0x 0 [ 0 0] PreProc
-48730 : Write Addr: 0xc0f082dc, Data: 0x 1 [ 0 1] PreProc
-48729 : Write Addr: 0xc0f0810c, Data: 0x 0 [ 0 0] PreProc
-48728 : Write Addr: 0xc0f08394, Data: 0x 0 [ 0 0] PreProc
-48725 : Write Addr: 0xc0f08108, Data: 0x 3 [ 0 3] PreProc
-48724 : Write Addr: 0xc0f08390, Data: 0x 0 [ 0 0] PreProc
-48723 : Write Addr: 0xc0f08264, Data: 0x 0 [ 0 0] PreProc
-48721 : Write Addr: 0xc0f08130, Data: 0x80000000 [32768 0] PreProc
-48719 : Write Addr: 0xc0f08134, Data: 0x 1 [ 0 1] PreProc
-48718 : Write Addr: 0xc0f08138, Data: 0x 10 [ 0 16] PreProc
-48716 : Write Addr: 0xc0f0814c, Data: 0x 6 [ 0 6] PreProc
-48715 : Write Addr: 0xc0f08158, Data: 0x 0 [ 0 0] PreProc
-48713 : Write Addr: 0xc0f08154, Data: 0x 8 [ 0 8] PreProc
-48711 : Write Addr: 0xc0f08140, Data: 0x 0 [ 0 0] PreProc
-48710 : Write Addr: 0xc0f08150, Data: 0x fff [ 0 4095] PreProc
-48708 : Write Addr: 0xc0f0815c, Data: 0x 2 [ 0 2] PreProc
-48706 : Write Addr: 0xc0f08160, Data: 0x 3fff [ 0 16383] PreProc
-48705 : Write Addr: 0xc0f0826c, Data: 0x 0 [ 0 0] PreProc
-48703 : Write Addr: 0xc0f08180, Data: 0x80000000 [32768 0] PreProc
-48702 : Write Addr: 0xc0f08420, Data: 0x 200 [ 0 512] PreProc
-48700 : Write Addr: 0xc0f08428, Data: 0x 111 [ 0 273] PreProc
-48699 : Write Addr: 0xc0f0842c, Data: 0x 0 [ 0 0] PreProc
-48697 : Write Addr: 0xc0f08430, Data: 0x 0 [ 0 0] PreProc
-48696 : Write Addr: 0xc0f08218, Data: 0x 8 [ 0 8] PreProc
-48694 : Write Addr: 0xc0f08214, Data: 0x 0 [ 0 0] PreProc
-48692 : Write Addr: 0xc0f08184, Data: 0x 367 [ 0 871] PreProc
-48691 : Write Addr: 0xc0f08188, Data: 0x 537 [ 0 1335] PreProc
-48689 : Write Addr: 0xc0f0819c, Data: 0x 400 [ 0 1024] PreProc
-48687 : Write Addr: 0xc0f0818c, Data: 0x 0 [ 0 0] PreProc
-48686 : Write Addr: 0xc0f08190, Data: 0x 0 [ 0 0] PreProc
-48684 : Write Addr: 0xc0f08194, Data: 0x 537 [ 0 1335] PreProc
-48683 : Write Addr: 0xc0f08198, Data: 0x 537 [ 0 1335] PreProc
-48681 : Write Addr: 0xc0f081c4, Data: 0x 0 [ 0 0] PreProc
-48679 : Write Addr: 0xc0f081c8, Data: 0x 0 [ 0 0] PreProc
-48678 : Write Addr: 0xc0f081cc, Data: 0x 0 [ 0 0] PreProc
-48677 : Write Addr: 0xc0f081d0, Data: 0x 0 [ 0 0] PreProc
-48675 : Write Addr: 0xc0f081d4, Data: 0x 0 [ 0 0] PreProc
-48673 : Write Addr: 0xc0f081d8, Data: 0x 0 [ 0 0] PreProc
-48672 : Write Addr: 0xc0f081dc, Data: 0x 0 [ 0 0] PreProc
-48670 : Write Addr: 0xc0f081e0, Data: 0x 0 [ 0 0] PreProc
-48668 : Write Addr: 0xc0f081e4, Data: 0x 1 [ 0 1] PreProc
-48667 : Write Addr: 0xc0f081e8, Data: 0x 1 [ 0 1] PreProc
-48665 : Write Addr: 0xc0f081ec, Data: 0x 0 [ 0 0] PreProc
-48664 : Write Addr: 0xc0f081f0, Data: 0x 0 [ 0 0] PreProc
-48662 : Write Addr: 0xc0f081f4, Data: 0x 0 [ 0 0] PreProc
-48660 : Write Addr: 0xc0f081a4, Data: 0x 0 [ 0 0] PreProc
-48659 : Write Addr: 0xc0f081a8, Data: 0x 1 [ 0 1] PreProc
-48658 : Write Addr: 0xc0f081ac, Data: 0x 1 [ 0 1] PreProc
-48655 : Write Addr: 0xc0f081b0, Data: 0x 0 [ 0 0] PreProc
-48654 : Write Addr: 0xc0f081b4, Data: 0x 0 [ 0 0] PreProc
-48653 : Write Addr: 0xc0f082c4, Data: 0x 1 [ 0 1] PreProc
-48651 : Write Addr: 0xc0f08180, Data: 0x 0 [ 0 0] PreProc
-48649 : Write Addr: 0xc0f0820c, Data: 0x 29b0000 [ 667 0] PreProc
-48648 : Write Addr: 0xc0f08208, Data: 0x 11 [ 0 17] PreProc
-48646 : Write Addr: 0xc0f08020, Data: 0x80000000 [32768 0] Preproc REG SHAD ctrl
-48645 : Write Addr: 0xc0f08024, Data: 0x 1008 [ 0 4104] Preproc REG SHAD mode
-48643 : Write Addr: 0xc0f08028, Data: 0x 0 [ 0 0] Preproc REG SHAD pre
-48641 : Write Addr: 0xc0f0802c, Data: 0x 0 [ 0 0] Preproc REG SHAD post
-48640 : Write Addr: 0xc0f08030, Data: 0x 1000 [ 0 4096] Preproc REG SHAD gain
-48639 : Write Addr: 0xc0f08034, Data: 0x 1c00 [ 0 7168] Preproc REG SHAD pre2
-48636 : Write Addr: 0xc0f08038, Data: 0x 400 [ 0 1024] Preproc REG SHAD post2
-48635 : Write Addr: 0xc0f08280, Data: 0x 0 [ 0 0] PreProc
-48634 : Write Addr: 0xc0f08284, Data: 0x 0 [ 0 0] PreProc
-48632 : Write Addr: 0xc0f08288, Data: 0x 0 [ 0 0] PreProc
-48630 : Write Addr: 0xc0f0828c, Data: 0x 1 [ 0 1] PreProc
-48629 : Write Addr: 0xc0f08290, Data: 0x 0 [ 0 0] PreProc
-48627 : Write Addr: 0xc0f082a8, Data: 0x 1 [ 0 1] PreProc
-48626 : Write Addr: 0xc0f080a0, Data: 0x80000000 [32768 0] PreProc
-48624 : Write Addr: 0xc0f080a4, Data: 0x 0 [ 0 0] PreProc
-48622 : Write Addr: 0xc0f080a8, Data: 0x 103 [ 0 259] PreProc
-48621 : Write Addr: 0xc0f080ac, Data: 0x 0 [ 0 0] PreProc
-48620 : Write Addr: 0xc0f080b0, Data: 0x 3670537 [ 871 1335] PreProc
-48617 : Write Addr: 0xc0f080b4, Data: 0x 0 [ 0 0] PreProc
-48616 : Write Addr: 0xc0f080bc, Data: 0x 0 [ 0 0] PreProc
-48615 : Write Addr: 0xc0f080d0, Data: 0x 0 [ 0 0] PreProc
-48613 : Write Addr: 0xc0f080d4, Data: 0x 1 [ 0 1] PreProc
-48611 : Write Addr: 0xc0f08270, Data: 0x 0 [ 0 0] PreProc
-48610 : Write Addr: 0xc0f082b4, Data: 0x 1 [ 0 1] PreProc
-48608 : Write Addr: 0xc0f08114, Data: 0x a [ 0 10] PreProc
-48607 : Write Addr: 0xc0f08398, Data: 0x 0 [ 0 0] PreProc
-48605 : Write Addr: 0xc0f082d4, Data: 0x 0 [ 0 0] PreProc
-48603 : Write Addr: 0xc0f08090, Data: 0x80000000 [32768 0] PreProc
-48602 : Write Addr: 0xc0f08094, Data: 0x 20 [ 0 32] PreProc
-48601 : Write Addr: 0xc0f08268, Data: 0x 0 [ 0 0] PreProc
-48598 : Write Addr: 0xc0f0d000, Data: 0x80000000 [32768 0]
-48597 : Write Addr: 0xc0f0d004, Data: 0x 0 [ 0 0]
-48596 : Write Addr: 0xc0f0d008, Data: 0x77772222 [30583 8738]
-48594 : Write Addr: 0xc0f0d00c, Data: 0x 0 [ 0 0]
-48592 : Write Addr: 0xc0f0d010, Data: 0x 0 [ 0 0]
-48591 : Write Addr: 0xc0f0d014, Data: 0x 3670538 [ 871 1336]
-48589 : Write Addr: 0xc0f0d018, Data: 0x 583 [ 0 1411]
-48588 : Write Addr: 0xc0f0d01c, Data: 0x 0 [ 0 0]
-48586 : Write Addr: 0xc0f0d020, Data: 0x 0 [ 0 0]
-48584 : Write Addr: 0xc0f0d024, Data: 0x 0 [ 0 0]
-48583 : Write Addr: 0xc0f0d028, Data: 0x 0 [ 0 0]
-48582 : Write Addr: 0xc0f0d02c, Data: 0x 0 [ 0 0]
-48579 : Write Addr: 0xc0f0d030, Data: 0x 0 [ 0 0]
-48578 : Write Addr: 0xc0f0d038, Data: 0x 20 [ 0 32]
-48577 : Write Addr: 0xc0f0d03c, Data: 0x 0 [ 0 0]
-48575 : Write Addr: 0xc0f0d040, Data: 0x 0 [ 0 0]
-48573 : Write Addr: 0xc0f0d044, Data: 0x 0 [ 0 0]
-48572 : Write Addr: 0xc0f0d048, Data: 0x 0 [ 0 0]
-48570 : Write Addr: 0xc0f0d04c, Data: 0x 0 [ 0 0]
-48569 : Write Addr: 0xc0f0d050, Data: 0x 0 [ 0 0]
-48567 : Write Addr: 0xc0f0d054, Data: 0x 0 [ 0 0]
-48565 : Write Addr: 0xc0f0d058, Data: 0x 0 [ 0 0]
-48564 : Write Addr: 0xc0f0d05c, Data: 0x 0 [ 0 0]
-48563 : Write Addr: 0xc0f0d060, Data: 0x 0 [ 0 0]
-48560 : Write Addr: 0xc0f0d064, Data: 0x 0 [ 0 0]
-48559 : Write Addr: 0xc0f0d070, Data: 0x 1 [ 0 1]
-48558 : Write Addr: 0xc0f0d074, Data: 0x 103 [ 0 259]
-48556 : Write Addr: 0xc0f0d078, Data: 0x 1 [ 0 1]
-48554 : Write Addr: 0xc0f0d07c, Data: 0x 0 [ 0 0]
-48553 : Write Addr: 0xc0f0d080, Data: 0x 0 [ 0 0]
-48551 : Write Addr: 0xc0f0d084, Data: 0x 0 [ 0 0]
-48550 : Write Addr: 0xc0f0d088, Data: 0x 0 [ 0 0]
-48548 : Write Addr: 0xc0f0d094, Data: 0x 0 [ 0 0]
-48546 : Write Addr: 0xc0f0d02c, Data: 0x 0 [ 0 0]
-48545 : Write Addr: 0xc0f0d040, Data: 0x b0076 [ 11 118]
-48544 : Write Addr: 0xc0f0d044, Data: 0x 367057e [ 871 1406]
-48541 : Write Addr: 0xc0f11004, Data: 0x 0 [ 0 0] Resample ?
-48540 : Write Addr: 0xc0f1108c, Data: 0x 3 [ 0 3] Resample ?
-48539 : Write Addr: 0xc0f112c0, Data: 0x 1 [ 0 1] Resample ?
-48537 : Write Addr: 0xc0f11300, Data: 0x 1 [ 0 1] Resample ?
-48535 : Write Addr: 0xc0f11108, Data: 0x 1 [ 0 1] Resample ?
-48534 : Write Addr: 0xc0f111c0, Data: 0x 1 [ 0 1] Resample ?
-48532 : Write Addr: 0xc0f110c4, Data: 0x 4 [ 0 4] Resample ?
-48531 : Write Addr: 0xc0f11280, Data: 0x 1 [ 0 1] Resample ?
-48529 : Write Addr: 0xc0f11284, Data: 0x 0 [ 0 0] Resample ?
-48527 : Write Addr: 0xc0f11580, Data: 0x 1 [ 0 1] Resample ?
-48526 : Write Addr: 0xc0f11584, Data: 0x 0 [ 0 0] Resample ?
-48525 : Write Addr: 0xc0f11100, Data: 0x 5 [ 0 5] Resample ?
-48522 : Write Addr: 0xc0f11170, Data: 0x 1 [ 0 1] Resample ?
-48521 : Write Addr: 0xc0f11440, Data: 0x 1 [ 0 1] Resample ?
-48520 : Write Addr: 0xc0f11444, Data: 0x 0 [ 0 0] Resample ?
-48518 : Write Addr: 0xc0f11144, Data: 0x 7 [ 0 7] Resample ?
-48516 : Write Addr: 0xc0f11110, Data: 0x 1 [ 0 1] Resample ?
-48515 : Write Addr: 0xc0f11500, Data: 0x 1 [ 0 1] Resample ?
-48513 : Write Addr: 0xc0f11504, Data: 0x 0 [ 0 0] Resample ?
-48512 : Write Addr: 0xc0f11508, Data: 0x 0 [ 0 0] Resample ?
-48510 : Write Addr: 0xc0f1150c, Data: 0x 8000a1 [ 128 161] Resample ?
-48508 : Write Addr: 0xc0f11510, Data: 0x 60200 [ 6 512] Resample ?
-48507 : Write Addr: 0xc0f11514, Data: 0x 0 [ 0 0] Resample ?
-48506 : Write Addr: 0xc0f11518, Data: 0x 3ff [ 0 1023] Resample ?
-48503 : Write Addr: 0xc0f1151c, Data: 0x 35b0507 [ 859 1287] Resample ?
-48502 : Write Addr: 0xc0f11520, Data: 0x 0 [ 0 0] Resample ?
-48501 : Write Addr: 0xc0f11524, Data: 0x 0 [ 0 0] Resample ?
-48499 : Write Addr: 0xc0f11114, Data: 0x b [ 0 11] Resample ?
-48497 : Write Addr: 0xc0f11540, Data: 0x 1 [ 0 1] Resample ?
-48496 : Write Addr: 0xc0f11544, Data: 0x 0 [ 0 0] Resample ?
-48494 : Write Addr: 0xc0f11548, Data: 0x 0 [ 0 0] Resample ?
-48493 : Write Addr: 0xc0f1154c, Data: 0x 22002b [ 34 43] Resample ?
-48491 : Write Addr: 0xc0f11550, Data: 0x 503c4 [ 5 964] Resample ?
-48489 : Write Addr: 0xc0f11554, Data: 0x 0 [ 0 0] Resample ?
-48488 : Write Addr: 0xc0f11558, Data: 0x 2a7 [ 0 679] Resample ?
-48486 : Write Addr: 0xc0f1155c, Data: 0x 35b03ff [ 859 1023] Resample ?
-48484 : Write Addr: 0xc0f11560, Data: 0x 0 [ 0 0] Resample ?
-48483 : Write Addr: 0xc0f11564, Data: 0x 0 [ 0 0] Resample ?
-48482 : Write Addr: 0xc0f11158, Data: 0x c [ 0 12] Resample ?
-48480 : Write Addr: 0xc0f11050, Data: 0x 0 [ 0 0] Resample ?
-48478 : Write Addr: 0xc0f1e000, Data: 0x80000000 [32768 0]
-48477 : Write Addr: 0xc0f1e004, Data: 0x 2 [ 0 2]
-48475 : Write Addr: 0xc0f1e008, Data: 0x 1007f [ 1 127]
-48474 : Write Addr: 0xc0f1e00c, Data: 0x 10001 [ 1 1]
-48472 : Write Addr: 0xc0f1e010, Data: 0x 0 [ 0 0]
-48470 : Write Addr: 0xc0f1e014, Data: 0x 0 [ 0 0]
-48469 : Write Addr: 0xc0f1e018, Data: 0x 0 [ 0 0]
-48467 : Write Addr: 0xc0f1e01c, Data: 0x 0 [ 0 0]
-48465 : Write Addr: 0xc0f03034, Data: 0x80050000 [32773 0]
-48464 : Write Addr: 0xc0f03038, Data: 0x80050004 [32773 4]
-48462 : Write Addr: 0xc0f03024, Data: 0x80020000 [32770 0]
-48461 : Write Addr: 0xc0f03064, Data: 0x80020002 [32770 2]
-48459 : Write Addr: 0xc0f0306c, Data: 0x80020005 [32770 5]
-48457 : Write Addr: 0xc0f03000, Data: 0x80040000 [32772 0]
-48456 : Write Addr: 0xc0f03004, Data: 0x80040002 [32772 2]
-48455 : Write Addr: 0xc0f03008, Data: 0x80040004 [32772 4]
-48453 : Write Addr: 0xc0f0300c, Data: 0x80040006 [32772 6]
-48451 : Write Addr: 0xc0f03020, Data: 0x80070000 [32775 0]
-48450 : Write Addr: 0xc0f03028, Data: 0x80070002 [32775 2]
-48448 : Write Addr: 0xc0f0302c, Data: 0x80070005 [32775 5]
-48446 : Write Addr: 0xc0f03018, Data: 0x800c0000 [32780 0]
-48445 : Write Addr: 0xc0f0301c, Data: 0x800d0000 [32781 0]
-48443 : Write Addr: 0xc0f03090, Data: 0x 1 [ 0 1]
-48442 : Write Addr: 0xc0f04f10, Data: 0x 1 [ 0 1] DMA 15 REG yb | xb
-48440 : Write Addr: 0xc0f03054, Data: 0x 0 [ 0 0]
engio_write end
engio_write start
-48433 : Write Addr: 0xc0f112c4, Data: 0x 10010 [ 1 16] Resample ?
-48431 : Write Addr: 0xc0f112c8, Data: 0x 25aa1 [ 2 23201] Resample ?
-48430 : Write Addr: 0xc0f112cc, Data: 0x 0 [ 0 0] Resample ?
-48429 : Write Addr: 0xc0f112d0, Data: 0x 2cf [ 0 719] Resample ?
-48426 : Write Addr: 0xc0f112d4, Data: 0x 35b0508 [ 859 1288] Resample ?
-48425 : Write Addr: 0xc0f112d8, Data: 0x 0 [ 0 0] Resample ?
-48424 : Write Addr: 0xc0f112dc, Data: 0x 0 [ 0 0] Resample ?
-48422 : Write Addr: 0xc0f11304, Data: 0x 10 [ 0 16] Resample ?
-48420 : Write Addr: 0xc0f11308, Data: 0x 1d6d7 [ 1 54999] Resample ?
-48419 : Write Addr: 0xc0f1130c, Data: 0x 0 [ 0 0] Resample ?
-48417 : Write Addr: 0xc0f11310, Data: 0x 3570000 [ 855 0] Resample ?
-48416 : Write Addr: 0xc0f11314, Data: 0x 35b02cf [ 859 719] Resample ?
-48414 : Write Addr: 0xc0f11318, Data: 0x 0 [ 0 0] Resample ?
-48412 : Write Addr: 0xc0f1131c, Data: 0x 0 [ 0 0] Resample ?
-48411 : Write Addr: 0xc0f1133c, Data: 0x 1bb [ 0 443] Resample ?
-48410 : Write Addr: 0xc0f111c4, Data: 0x 0 [ 0 0] Resample ?
-48407 : Write Addr: 0xc0f111c8, Data: 0x 0 [ 0 0] Resample ?
-48406 : Write Addr: 0xc0f11588, Data: 0x 3 [ 0 3] Resample ?
-48405 : Write Addr: 0xc0f1158c, Data: 0x 0 [ 0 0] Resample ?
-48403 : Write Addr: 0xc0f11590, Data: 0x d502cf [ 213 719] Resample ?
-48401 : Write Addr: 0xc0f11594, Data: 0x 0 [ 0 0] Resample ?
-48400 : Write Addr: 0xc0f11448, Data: 0x 0 [ 0 0] Resample ?
-48398 : Write Addr: 0xc0f1144c, Data: 0x 0 [ 0 0] Resample ?
-48397 : Write Addr: 0xc0f11450, Data: 0x d502cf [ 213 719] Resample ?
-48395 : Write Addr: 0xc0f11454, Data: 0x 0 [ 0 0] Resample ?
engio_write end
-48391 : Write Addr: 0xc0f05040, Data: 0x 0 [ 0 0] edmac connection
-48381 : Write Addr: 0xc0f05004, Data: 0x 4 [ 0 4] edmac connection
-48379 : Write Addr: 0xc0f05010, Data: 0x 0 [ 0 0] edmac connection => this is DMA 4 connected to 0
-48377 : Write Addr: 0xc0f05000, Data: 0x 15 [ 0 21] edmac connection
********************************************************************************************************
Section: one frame of i/o ..
engio_write start/end = engio_write
EngDrvOuts = EngDrvOuts
All others are = EngDrvOut
First value = some timer tick counter
********************************************************************************************************
**************** [DPATH] LV_JPG STOP ---
engio_write start
-61593 : Write Addr: 0xc0f03010, Data: 0x 0 [ 0 0]
-61591 : Write Addr: 0xc0f03014, Data: 0x 0 [ 0 0]
-61590 : Write Addr: 0xc0f0305c, Data: 0x 0 [ 0 0]
-61588 : Write Addr: 0xc0f03060, Data: 0x 0 [ 0 0]
-61586 : Write Addr: 0xc0f113c4, Data: 0x 0 [ 0 0] Resample ?
-61585 : Write Addr: 0xc0f113c0, Data: 0x 1 [ 0 1] Resample ?
-61583 : Write Addr: 0xc0f11008, Data: 0x 0 [ 0 0] Resample ?
-61581 : Write Addr: 0xc0f11180, Data: 0x 1 [ 0 1] Resample ?
-61580 : Write Addr: 0xc0f11404, Data: 0x 0 [ 0 0] Resample ?
-61578 : Write Addr: 0xc0f11400, Data: 0x 1 [ 0 1] Resample ?
-61576 : Write Addr: 0xc0f11040, Data: 0x 0 [ 0 0] Resample ?
-61575 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768 0]
engio_write end
multiple masterclocks (clockout)
-60655 : Write Addr: 0xc0f0500c, Data: 0x 3 [ 0 3] edmac connection
-60652 : Write Addr: 0xc0f0502c, Data: 0x 2 [ 0 2] edmac connection
-60638 : Write Addr: 0xc0f04304, Data: 0x20000000 [ 8192 0] DMA 3 - flags
-60636 : Write Addr: 0xc0f04308, Data: 0x107a9408 [ 4218 37896] DMA 3 - dst
-60629 : Write Addr: 0xc0f04a04, Data: 0x20000000 [ 8192 0] DMA 10 - flags
-60628 : Write Addr: 0xc0f04a08, Data: 0x1079947c [ 4217 38012] DMA 10 - dst
-60626 : Read Addr: 0xc0f04a08, Data: 0x1079947c [ 4217 38012] DMA 10 - dst
-60624 : Read Addr: 0xc0f04308, Data: 0x107a9408 [ 4218 37896] DMA 3 - dst
engio_write start
-60532 : Write Addr: 0xc0f113c4, Data: 0x 0 [ 0 0] Resample ?
-60529 : Write Addr: 0xc0f113c0, Data: 0x 1 [ 0 1] Resample ?
-60527 : Write Addr: 0xc0f11008, Data: 0x 0 [ 0 0] Resample ?
-60526 : Write Addr: 0xc0f11340, Data: 0x 1 [ 0 1] Resample ?
-60524 : Write Addr: 0xc0f11380, Data: 0x 1 [ 0 1] Resample ?
-60522 : Write Addr: 0xc0f11180, Data: 0x 1 [ 0 1] Resample ?
-60521 : Write Addr: 0xc0f11404, Data: 0x 0 [ 0 0] Resample ?
-60519 : Write Addr: 0xc0f11400, Data: 0x 1 [ 0 1] Resample ?
-60517 : Write Addr: 0xc0f04f10, Data: 0x 1 [ 0 1] DMA 15 - yb | xb
-60516 : Write Addr: 0xc0f04a0c, Data: 0x 0 [ 0 0] DMA 10 - yn | xn
-60514 : Write Addr: 0xc0f04a10, Data: 0x 2a70030 [ 679 48] DMA 10 - yb | xb => 680 * 48 = 32640
-60512 : Write Addr: 0xc0f04a14, Data: 0x 0 [ 0 0] DMA 10 - ya | xa
-60510 : Write Addr: 0xc0f04a18, Data: 0x 0 [ 0 0] DMA 10 - off1
-60509 : Write Addr: 0xc0f04a1c, Data: 0x 0 [ 0 0] DMA 10 - off2b
-60507 : Write Addr: 0xc0f04a20, Data: 0x 0 [ 0 0] DMA 10 - off1a
-60505 : Write Addr: 0xc0f04a24, Data: 0x 0 [ 0 0] DMA 10 - off2a
-60504 : Write Addr: 0xc0f04a28, Data: 0x 0 [ 0 0] DMA 10 - off3
-60502 : Write Addr: 0xc0f11084, Data: 0x 1 [ 0 1] Resample ?
-60500 : Write Addr: 0xc0f113c8, Data: 0x 400 [ 0 1024] Resample ?
-60499 : Write Addr: 0xc0f113cc, Data: 0x 0 [ 0 0] Resample ?
-60497 : Write Addr: 0xc0f113d0, Data: 0x 2a7001f [ 679 31] Resample ?
-60495 : Write Addr: 0xc0f113d4, Data: 0x 0 [ 0 0] Resample ?
-60494 : Write Addr: 0xc0f11090, Data: 0x 0 [ 0 0] Resample ?
-60492 : Write Addr: 0xc0f1110c, Data: 0x 2 [ 0 2] Resample ?
-60490 : Write Addr: 0xc0f11344, Data: 0x 10100 [ 1 256] Resample ?
-60489 : Write Addr: 0xc0f11348, Data: 0x 0 [ 0 0] Resample ?
-60487 : Write Addr: 0xc0f1134c, Data: 0x 0 [ 0 0] Resample ?
-60486 : Write Addr: 0xc0f11350, Data: 0x 0 [ 0 0] Resample ?
-60484 : Write Addr: 0xc0f11354, Data: 0x 0 [ 0 0] Resample ?
-60482 : Write Addr: 0xc0f11358, Data: 0x 0 [ 0 0] Resample ?
-60481 : Write Addr: 0xc0f1135c, Data: 0x 0 [ 0 0] Resample ?
-60479 : Write Addr: 0xc0f11388, Data: 0x 0 [ 0 0] Resample ?
-60477 : Write Addr: 0xc0f1138c, Data: 0x 0 [ 0 0] Resample ?
-60476 : Write Addr: 0xc0f11394, Data: 0x 0 [ 0 0] Resample ?
-60474 : Write Addr: 0xc0f1139c, Data: 0x 0 [ 0 0] Resample ?
-60472 : Write Addr: 0xc0f113bc, Data: 0x 3 [ 0 3] Resample ?
-60471 : Write Addr: 0xc0f110c0, Data: 0x 5 [ 0 5] Resample ?
-60469 : Write Addr: 0xc0f11184, Data: 0x 1f [ 0 31] Resample ?
-60467 : Write Addr: 0xc0f11188, Data: 0x10000778 [ 4096 1912] Resample ?
-60466 : Write Addr: 0xc0f11140, Data: 0x 4 [ 0 4] Resample ?
-60464 : Write Addr: 0xc0f11408, Data: 0x 800 [ 0 2048] Resample ?
-60463 : Write Addr: 0xc0f1140c, Data: 0x 0 [ 0 0] Resample ?
-60461 : Write Addr: 0xc0f11410, Data: 0x 2a7 [ 0 679] Resample ?
-60459 : Write Addr: 0xc0f11414, Data: 0x 0 [ 0 0] Resample ?
-60458 : Write Addr: 0xc0f0430c, Data: 0x 0 [ 0 0] DMA 3 - yn | xn
-60456 : Write Addr: 0xc0f04310, Data: 0x 2a8 [ 0 680] DMA 3 - yb | xb
-60454 : Write Addr: 0xc0f04314, Data: 0x 0 [ 0 0] DMA 3 - ya | xa
-60452 : Write Addr: 0xc0f04318, Data: 0x 0 [ 0 0] DMA 3 - off1
-60451 : Write Addr: 0xc0f0431c, Data: 0x 0 [ 0 0] DMA 3 - off2b
-60449 : Write Addr: 0xc0f04320, Data: 0x 0 [ 0 0] DMA 3 - off1a
-60447 : Write Addr: 0xc0f04324, Data: 0x 0 [ 0 0] DMA 3 - off2a
-60445 : Write Addr: 0xc0f04328, Data: 0x 0 [ 0 0] DMA 3 - off3
engio_write end
-60434 : Write Addr: 0xc0f04304, Data: 0x20000000 [ 8192 0] DMA 3 - flags
-60433 : Write Addr: 0xc0f04300, Data: 0x 1 [ 0 1] DMA 3 - ctrl
engio_write start
-60430 : Write Addr: 0xc0f11400, Data: 0x 0 [ 0 0] Resample ?
-60429 : Write Addr: 0xc0f11404, Data: 0x 1 [ 0 1] Resample ?
-60427 : Write Addr: 0xc0f11180, Data: 0x 0 [ 0 0] Resample ?
-60425 : Write Addr: 0xc0f11340, Data: 0x 0 [ 0 0] Resample ?
-60424 : Write Addr: 0xc0f11380, Data: 0x 0 [ 0 0] Resample ?
-60422 : Write Addr: 0xc0f11008, Data: 0x 1 [ 0 1] Resample ?
-60421 : Write Addr: 0xc0f113c0, Data: 0x 0 [ 0 0] Resample ?
-60419 : Write Addr: 0xc0f113c4, Data: 0x 1 [ 0 1] Resample ?
engio_write end
-60416 : Write Addr: 0xc0f04a04, Data: 0x20030000 [ 8195 0] DMA 10 - flags
-60415 : Write Addr: 0xc0f04a00, Data: 0x 1 [ 0 1] DMA 10 - ctrl
-60205 : Read Addr: 0xc0f04330, Data: 0x 2 [ 0 2] DMA 3 - intr
-60197 : Write Addr: 0xc0f04304, Data: 0x 0 [ 0 0] DMA 3 - flags
-60196 : Write Addr: 0xc0f04300, Data: 0x 4 [ 0 4] DMA 3 - ctrl
-60093 : Read Addr: 0xc0f04a30, Data: 0x 2 [ 0 2] DMA 10 - intr
-60084 : Write Addr: 0xc0f04a04, Data: 0x 0 [ 0 0] DMA 10 - flags
-60083 : Write Addr: 0xc0f04a00, Data: 0x 4 [ 0 4] DMA 10 - ctrl
-60018 : Read Addr: 0xc0f04a08, Data: 0x107a13fc [ 4218 5116] DMA 10 - dst
-60017 : Read Addr: 0xc0f04308, Data: 0x107a96b0 [ 4218 38576] DMA 3 - dst
engio_write start
-59928 : Write Addr: 0xc0f113c4, Data: 0x 0 [ 0 0] Resample ?
-59924 : Write Addr: 0xc0f113c0, Data: 0x 1 [ 0 1] Resample ?
-59922 : Write Addr: 0xc0f11008, Data: 0x 0 [ 0 0] Resample ?
-59920 : Write Addr: 0xc0f11340, Data: 0x 1 [ 0 1] Resample ?
-59918 : Write Addr: 0xc0f11380, Data: 0x 1 [ 0 1] Resample ?
-59917 : Write Addr: 0xc0f11180, Data: 0x 1 [ 0 1] Resample ?
-59915 : Write Addr: 0xc0f11404, Data: 0x 0 [ 0 0] Resample ?
-59913 : Write Addr: 0xc0f11400, Data: 0x 1 [ 0 1] Resample ?
engio_write end
mltiple masterclocks (clockout)
engio_write start
-57709 : Write Addr: 0xc0f07148, Data: 0x 4 [ 0 4] HEAD timer
engio_write end
engio_write start
-57507 : Write Addr: 0xc0f0714c, Data: 0x 0 [ 0 0] HEAD timer
-57503 : Write Addr: 0xc0f07148, Data: 0x 4 [ 0 4] HEAD timer
engio_write end
engio_write start
-56684 : Write Addr: 0xc0f08180, Data: 0x 0 [ 0 0] PreProc
-56679 : Write Addr: 0xc0f0820c, Data: 0x 29b0000 [ 667 0] PreProc
-56677 : Write Addr: 0xc0f08208, Data: 0x 11 [ 0 17] PreProc
engio_write end
EngDrvOuts start
-56662 : Write Addr: 0xc0f0490c, Data: 0x 0 [ 0 0] DMA 9 - yn | xn
-56661 : Write Addr: 0xc0f04910, Data: 0x a60020 [ 166 32] DMA 9 - yb | xb 167 * 32 = 5344
-56660 : Write Addr: 0xc0f04914, Data: 0x 0 [ 0 0] DMA 9 - ya | xa
-56659 : Write Addr: 0xc0f04918, Data: 0x 0 [ 0 0] DMA 9 - off1
-56658 : Write Addr: 0xc0f0491c, Data: 0x 0 [ 0 0] DMA 9 - off2b
-56657 : Write Addr: 0xc0f04920, Data: 0x 0 [ 0 0] DMA 9 - off1a
-56656 : Write Addr: 0xc0f04924, Data: 0x 0 [ 0 0] DMA 9 - off2a
-56655 : Write Addr: 0xc0f04928, Data: 0x 0 [ 0 0] DMA 9 - off3
EngDrvOuts end
-56651 : Write Addr: 0xc0f04904, Data: 0x40000000 [16384 0] DMA 9 - flags
-56649 : Write Addr: 0xc0f04908, Data: 0x102b1f2c [ 4139 7980] DMA 9 - dst
-56643 : Write Addr: 0xc0f0505c, Data: 0x 1 [ 0 1] edmac connection
-56634 : Write Addr: 0xc0f04904, Data: 0x40010000 [16385 0] DMA 9 - flags
-56633 : Write Addr: 0xc0f04900, Data: 0x 1 [ 0 1] DMA 9 - ctrl
EngDrvOuts start
-56614 : Write Addr: 0xc0f0410c, Data: 0x 0 [ 0 0] DMA 1 - yn | xn
-56612 : Write Addr: 0xc0f04110, Data: 0x d50438 [ 213 1080] DMA 1 - yb | xb 214 * 1080 = 231120
-56611 : Write Addr: 0xc0f04114, Data: 0x 0 [ 0 0] DMA 1 - ya | xa
-56610 : Write Addr: 0xc0f04118, Data: 0x 0 [ 0 0] DMA 1 - off1
-56608 : Write Addr: 0xc0f0411c, Data: 0x 0 [ 0 0] DMA 1 - off2b
-56607 : Write Addr: 0xc0f04120, Data: 0x 0 [ 0 0] DMA 1 - off1a
-56592 : Read Addr: 0xc0f04930, Data: 0x 2 [ 0 2] DMA 9 - intr
-56586 : Write Addr: 0xc0f04904, Data: 0x 0 [ 0 0] DMA 9 - flags
-56585 : Write Addr: 0xc0f04900, Data: 0x 4 [ 0 4] DMA 9 - ctrl
-56569 : Write Addr: 0xc0f04124, Data: 0x 0 [ 0 0] DMA 1 - off2a
-56567 : Write Addr: 0xc0f04128, Data: 0x 0 [ 0 0] DMA 1 - off3
EngDrvOuts end
-56564 : Write Addr: 0xc0f04104, Data: 0x20000000 [ 8192 0] DMA 1 - flags
-56562 : Write Addr: 0xc0f04108, Data: 0x1dbc0064 [ 7612 100] DMA 1 - dst LiveView Image address
-56558 : Write Addr: 0xc0f04104, Data: 0x20000000 [ 8192 0] DMA 1 - flags
-56557 : Write Addr: 0xc0f04100, Data: 0x 1 [ 0 1] DMA 1 - ctrl
EngDrvOuts start
-56552 : Write Addr: 0xc0f0400c, Data: 0x 0 [ 0 0] DMA 0 - yn | xn
-56551 : Write Addr: 0xc0f04010, Data: 0x 2a70800 [ 679 2048] DMA 0 - yb | xb LiveView Image YUV (680 * 1024 * 2) = 1392640
-56550 : Write Addr: 0xc0f04014, Data: 0x 0 [ 0 0] DMA 0 - ya | xa
-56549 : Write Addr: 0xc0f04018, Data: 0x 0 [ 0 0] DMA 0 - off1
-56548 : Write Addr: 0xc0f0401c, Data: 0x 0 [ 0 0] DMA 0 - off2b
-56547 : Write Addr: 0xc0f04020, Data: 0x 0 [ 0 0] DMA 0 - off1a
-56546 : Write Addr: 0xc0f04024, Data: 0x 0 [ 0 0] DMA 0 - off2a
-56545 : Write Addr: 0xc0f04028, Data: 0x 0 [ 0 0] DMA 0 - off3
EngDrvOuts end
-56543 : Write Addr: 0xc0f04004, Data: 0x20000000 [ 8192 0] DMA 0 - flags
-56542 : Write Addr: 0xc0f04008, Data: 0x1de43c64 [ 7652 15460] DMA 0 - dst
-56540 : Write Addr: 0xc0f04004, Data: 0x20000000 [ 8192 0] DMA 0 - flags
-56539 : Write Addr: 0xc0f04000, Data: 0x 1 [ 0 1] DMA 0 - ctrl
engio_write start
-56534 : Write Addr: 0xc0f08114, Data: 0x 1 [ 0 1] PreProc
engio_write end
EngDrvOuts start
-56527 : Write Addr: 0xc0f0440c, Data: 0x 0 [ 0 0] DMA 4 - yn | xn
-56526 : Write Addr: 0xc0f04410, Data: 0x 3670922 [ 871 2338] DMA 4 - yb | xb Bayer raw image 872 * 1336 * (14/8) = 2038736
-56525 : Write Addr: 0xc0f04414, Data: 0x 0 [ 0 0] DMA 4 - ya | xa
-56524 : Write Addr: 0xc0f04418, Data: 0x 0 [ 0 0] DMA 4 - off1
-56523 : Write Addr: 0xc0f0441c, Data: 0x 0 [ 0 0] DMA 4 - off2b
-56522 : Write Addr: 0xc0f04420, Data: 0x 0 [ 0 0] DMA 4 - off1a
-56521 : Write Addr: 0xc0f04424, Data: 0x 0 [ 0 0] DMA 4 - off2a
-56520 : Write Addr: 0xc0f04428, Data: 0x 0 [ 0 0] DMA 4 - off3
EngDrvOuts end
-56518 : Write Addr: 0xc0f04404, Data: 0x20000000 [ 8192 0] DMA 4 - flags
-56517 : Write Addr: 0xc0f04408, Data: 0x1df97c6c [ 7673 31852] DMA 4 - dst
-56515 : Write Addr: 0xc0f04404, Data: 0x20000080 [ 8192 128] DMA 4 - flags
-56513 : Write Addr: 0xc0f04400, Data: 0x 1 [ 0 1] DMA 4 - ctrl
-56511 : Write Addr: 0xc0f08030, Data: 0x 1e00 [ 0 7680] Preproc - SHAD gain
engio_write start
-56507 : Write Addr: 0xc0f1108c, Data: 0x 3 [ 0 3] Resample ?
engio_write end
EngDrvOuts start
-56503 : Write Addr: 0xc0f0480c, Data: 0x 0 [ 0 0] DMA 8 - yn | xn
-56502 : Write Addr: 0xc0f04810, Data: 0x 4e10020 [ 1249 32] DMA 8 - yb | xb 1250 * 32 = 40000
-56501 : Write Addr: 0xc0f04814, Data: 0x 0 [ 0 0] DMA 8 - ya | xa
-56500 : Write Addr: 0xc0f04818, Data: 0x 0 [ 0 0] DMA 8 - off1
-56499 : Write Addr: 0xc0f0481c, Data: 0x 0 [ 0 0] DMA 8 - off2b
-56498 : Write Addr: 0xc0f04820, Data: 0x 0 [ 0 0] DMA 8 - off1a
-56497 : Write Addr: 0xc0f04824, Data: 0x 0 [ 0 0] DMA 8 - off2a
-56496 : Write Addr: 0xc0f04828, Data: 0x 0 [ 0 0] DMA 8 - off3
EngDrvOuts end
-56494 : Write Addr: 0xc0f04804, Data: 0x40000000 [16384 0] DMA 8 - flags
-56493 : Write Addr: 0xc0f04808, Data: 0x10283268 [ 4136 12904] DMA 8 - dst
engio_write start
-56491 : Write Addr: 0xc0f03048, Data: 0x 2 [ 0 2]
-56489 : Write Addr: 0xc0f03048, Data: 0x 0 [ 0 0]
-56487 : Write Addr: 0xc0f03050, Data: 0x 2 [ 0 2]
-56486 : Write Addr: 0xc0f03050, Data: 0x 0 [ 0 0]
-56484 : Write Addr: 0xc0f03074, Data: 0x 2 [ 0 2]
-56483 : Write Addr: 0xc0f03074, Data: 0x 0 [ 0 0]
-56481 : Write Addr: 0xc0f03088, Data: 0x 0 [ 0 0]
-56479 : Write Addr: 0xc0f0308c, Data: 0x 0 [ 0 0]
-56478 : Write Addr: 0xc0f11050, Data: 0x 1 [ 0 1] Resample ?
-56477 : Write Addr: 0xc0f1e000, Data: 0x 1 [ 0 1]
-56474 : Write Addr: 0xc0f11540, Data: 0x 0 [ 0 0] Resample ?
-56473 : Write Addr: 0xc0f11544, Data: 0x 1 [ 0 1] Resample ?
-56472 : Write Addr: 0xc0f11500, Data: 0x 0 [ 0 0] Resample ?
-56470 : Write Addr: 0xc0f11504, Data: 0x 1 [ 0 1] Resample ?
-56468 : Write Addr: 0xc0f11440, Data: 0x 0 [ 0 0] Resample ?
-56467 : Write Addr: 0xc0f11444, Data: 0x 1 [ 0 1] Resample ?
-56465 : Write Addr: 0xc0f11580, Data: 0x 0 [ 0 0] Resample ?
-56464 : Write Addr: 0xc0f11584, Data: 0x 1 [ 0 1] Resample ?
-56462 : Write Addr: 0xc0f111c0, Data: 0x 0 [ 0 0] Resample ?
-56460 : Write Addr: 0xc0f112c0, Data: 0x 0 [ 0 0] Resample ?
-56459 : Write Addr: 0xc0f11300, Data: 0x 0 [ 0 0] Resample ?
-56458 : Write Addr: 0xc0f11004, Data: 0x 1 [ 0 1] Resample ?
-56455 : Write Addr: 0xc0f0d000, Data: 0x 1 [ 0 1]
-56454 : Write Addr: 0xc0f08090, Data: 0x 1 [ 0 1] PreProc
-56453 : Write Addr: 0xc0f080a0, Data: 0x 1 [ 0 1] PreProc
-56451 : Write Addr: 0xc0f08020, Data: 0x 1 [ 0 1] Preproc - SHAD ctrl
-56449 : Write Addr: 0xc0f08208, Data: 0x 10 [ 0 16] PreProc
-56448 : Write Addr: 0xc0f08208, Data: 0x 0 [ 0 0] PreProc
-56446 : Write Addr: 0xc0f08180, Data: 0x 1 [ 0 1] PreProc
-56445 : Write Addr: 0xc0f08130, Data: 0x 1 [ 0 1] PreProc
engio_write end
-56441 : Write Addr: 0xc0f04804, Data: 0x40010000 [16385 0] DMA 8 - flags
-56440 : Write Addr: 0xc0f04800, Data: 0x 1 [ 0 1] DMA 8 - ctrl
engio_write start
-52761 : Write Addr: 0xc0f07048, Data: 0x 4 [ 0 4] HEAD timer
engio_write end
engio_write start
-52552 : Write Addr: 0xc0f0713c, Data: 0x 370 [ 0 880] HEAD timer
-52548 : Write Addr: 0xc0f07134, Data: 0x 4 [ 0 4] HEAD timer
-52546 : Write Addr: 0xc0f07138, Data: 0x c [ 0 12] HEAD timer
engio_write end
engio_write start
-52528 : Write Addr: 0xc0f07150, Data: 0x 59c [ 0 1436] HEAD timer
-52526 : Write Addr: 0xc0f07148, Data: 0x 4 [ 0 4] HEAD timer
-52525 : Write Addr: 0xc0f0714c, Data: 0x c [ 0 12] HEAD timer
engio_write end
-28634 : Read Addr: 0xc0f04530, Data: 0x 2 [ 0 2] DMA 5 - intr
-28622 : Write Addr: 0xc0f04504, Data: 0x 0 [ 0 0] DMA 5 - flags
-28620 : Write Addr: 0xc0f04500, Data: 0x 4 [ 0 4] DMA 5 - ctrl
-28507 : Write Addr: 0xc0f0b0c4, Data: 0x 0 [ 0 0]
-28505 : Read Addr: 0xc0f0c804, Data: 0x 0 [ 0 0]
-28503 : Write Addr: 0xc0f0b0c4, Data: 0x 1 [ 0 1]
engio_write start
-28500 : Write Addr: 0xc0f09000, Data: 0x80000000 [32768 0]
-28498 : Write Addr: 0xc0f0b000, Data: 0x 1 [ 0 1]
-28497 : Write Addr: 0xc0f0b004, Data: 0x 0 [ 0 0]
engio_write end
-28164 : Read Addr: 0xc0f04030, Data: 0x 2 [ 0 2] DMA 0 - intr
-28161 : Write Addr: 0xc0f04004, Data: 0x 0 [ 0 0] DMA 0 - flags
-28160 : Write Addr: 0xc0f04000, Data: 0x 4 [ 0 4] DMA 0 - ctrl
-28148 : Read Addr: 0xc0f04130, Data: 0x 2 [ 0 2] DMA 1 - intr
-28147 : Write Addr: 0xc0f04104, Data: 0x 0 [ 0 0] DMA 1 - flags
-28146 : Write Addr: 0xc0f04100, Data: 0x 4 [ 0 4] DMA 1 - ctrl
-28134 : Read Addr: 0xc0f04430, Data: 0x 2 [ 0 2] DMA 4 - intr
-28133 : Write Addr: 0xc0f04404, Data: 0x 0 [ 0 0] DMA 4 - flags
-28132 : Write Addr: 0xc0f04400, Data: 0x 4 [ 0 4] DMA 4 - ctrl
engio_write start
-27968 : Write Addr: 0xc0f07134, Data: 0x 4 [ 0 4] HEAD timer
engio_write end
engio_write start
-27735 : Write Addr: 0xc0f07138, Data: 0x 0 [ 0 0] HEAD timer
-27733 : Write Addr: 0xc0f07134, Data: 0x 4 [ 0 4] HEAD timer
engio_write end
engio_write start
-27463 : Write Addr: 0xc0f08130, Data: 0x80000000 [32768 0] PreProc
-27460 : Write Addr: 0xc0f08180, Data: 0x80000000 [32768 0] PreProc
-27459 : Write Addr: 0xc0f08020, Data: 0x80000000 [32768 0] Preproc - SHAD ctrl
-27456 : Write Addr: 0xc0f080a0, Data: 0x80000000 [32768 0] PreProc
-27455 : Write Addr: 0xc0f08090, Data: 0x80000000 [32768 0] PreProc
-27453 : Write Addr: 0xc0f08114, Data: 0x a [ 0 10] PreProc
-27452 : Write Addr: 0xc0f0d000, Data: 0x80000000 [32768 0]
-27449 : Write Addr: 0xc0f11004, Data: 0x 0 [ 0 0] Resample ?
-27447 : Write Addr: 0xc0f112c0, Data: 0x 1 [ 0 1] Resample ?
-27446 : Write Addr: 0xc0f11300, Data: 0x 1 [ 0 1] Resample ?
-27444 : Write Addr: 0xc0f111c0, Data: 0x 1 [ 0 1] Resample ?
-27442 : Write Addr: 0xc0f11280, Data: 0x 1 [ 0 1] Resample ?
-27440 : Write Addr: 0xc0f11284, Data: 0x 0 [ 0 0] Resample ?
-27439 : Write Addr: 0xc0f11440, Data: 0x 1 [ 0 1] Resample ?
-27437 : Write Addr: 0xc0f11444, Data: 0x 0 [ 0 0] Resample ?
-27434 : Write Addr: 0xc0f11500, Data: 0x 1 [ 0 1] Resample ?
-27433 : Write Addr: 0xc0f11504, Data: 0x 0 [ 0 0] Resample ?
-27431 : Write Addr: 0xc0f11540, Data: 0x 1 [ 0 1] Resample ?
-27430 : Write Addr: 0xc0f11544, Data: 0x 0 [ 0 0] Resample ?
-27427 : Write Addr: 0xc0f1e000, Data: 0x80000000 [32768 0]
engio_write end
-27418 : Write Addr: 0xc0f04834, Data: 0x 3 [ 0 3] DMA 8 - abort
-27409 : Read Addr: 0xc0f04830, Data: 0x 0 [ 0 0] DMA 8 - intr
-27399 : Write Addr: 0xc0f04804, Data: 0x 0 [ 0 0] DMA 8 - flags
-27398 : Write Addr: 0xc0f04834, Data: 0x 0 [ 0 0] DMA 8 - abort
-27396 : Write Addr: 0xc0f04800, Data: 0x 4 [ 0 4] DMA 8 - ctrl
-26240 : Write Addr: 0xc0f1a000, Data: 0x 1 [ 0 1]
-26238 : Write Addr: 0xc0f1a004, Data: 0x 0 [ 0 0]
multiple masterclocks (clockout)
-23710 : Read Addr: 0xc0e00000, Data: 0x 1010000 [ 257 0] JPEG
-23707 : Read Addr: 0xc0e00030, Data: 0xffffffff [65535 65535] JPEG
-23646 : Write Addr: 0xc0f0500c, Data: 0x 5 [ 0 5] edmac connection
-23645 : Write Addr: 0xc0f05008, Data: 0x 3 [ 0 3] edmac connection
-23643 : Write Addr: 0xc0f0502c, Data: 0x 2 [ 0 2] edmac connection
EngDrvOuts start
-23574 : Write Addr: 0xc0f0430c, Data: 0x 0 [ 0 0] DMA 3 - yn | xn
-23572 : Write Addr: 0xc0f04310, Data: 0x fff01fe [ 4095 510] DMA 3 - yb | xb 4096 * 510 = 2088960
-23571 : Write Addr: 0xc0f04314, Data: 0x 0 [ 0 0] DMA 3 - ya | xa
-23570 : Write Addr: 0xc0f04318, Data: 0x 0 [ 0 0] DMA 3 - off1
-23569 : Write Addr: 0xc0f0431c, Data: 0x 0 [ 0 0] DMA 3 - off2b
-23568 : Write Addr: 0xc0f04320, Data: 0x 0 [ 0 0] DMA 3 - off1a
-23567 : Write Addr: 0xc0f04324, Data: 0x 0 [ 0 0] DMA 3 - off2a
-23566 : Write Addr: 0xc0f04328, Data: 0x 0 [ 0 0] DMA 3 - off3
EngDrvOuts end
-23562 : Write Addr: 0xc0f04304, Data: 0x20000001 [ 8192 1] DMA 3 - flags
-23560 : Write Addr: 0xc0f04308, Data: 0x1ca700c8 [ 7335 200] DMA 3 - dst
-23543 : Write Addr: 0xc0f04204, Data: 0x20000000 [ 8192 0] DMA 2 - flags
-23542 : Write Addr: 0xc0f04208, Data: 0x1079947c [ 4217 38012] DMA 2 - dst
-23540 : Write Addr: 0xc0f04a04, Data: 0x20000000 [ 8192 0] DMA 10 - flags
-23539 : Write Addr: 0xc0f04a08, Data: 0x1de43c64 [ 7652 15460] DMA 10 - dst
-23535 : Read Addr: 0xc0f04a08, Data: 0x1de43c64 [ 7652 15460] DMA 10 - dst
-23534 : Read Addr: 0xc0f04308, Data: 0x1ca700c8 [ 7335 200] DMA 3 - dst
-23533 : Read Addr: 0xc0f04208, Data: 0x1079947c [ 4217 38012] DMA 2 - dst
********* [DPATH] LV_JPG ....
engio_write start
-23413 : Write Addr: 0xc0f113c4, Data: 0x 0 [ 0 0] Resample ?
-23410 : Write Addr: 0xc0f113c0, Data: 0x 1 [ 0 1] Resample ?
-23409 : Write Addr: 0xc0f11008, Data: 0x 0 [ 0 0] Resample ?
-23407 : Write Addr: 0xc0f11180, Data: 0x 1 [ 0 1] Resample ?
-23405 : Write Addr: 0xc0f11040, Data: 0x 0 [ 0 0] Resample ?
-23404 : Write Addr: 0xc0f11404, Data: 0x 0 [ 0 0] Resample ?
-23402 : Write Addr: 0xc0f11400, Data: 0x 1 [ 0 1] Resample ?
-23401 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768 0]
-23399 : Write Addr: 0xc0f03010, Data: 0x80000000 [32768 0]
-23397 : Write Addr: 0xc0f03014, Data: 0x80000002 [32768 2]
-23396 : Write Addr: 0xc0f0305c, Data: 0x80000004 [32768 4]
-23394 : Write Addr: 0xc0f03060, Data: 0x80000006 [32768 6]
-23392 : Write Addr: 0xc0f03090, Data: 0x 1 [ 0 1]
-23391 : Write Addr: 0xc0f04f10, Data: 0x 1 [ 0 1] DMA 15 - yb | xb
-23389 : Write Addr: 0xc0f04a0c, Data: 0x 540003 [ 84 3] DMA 10 - yn | xn
-23387 : Write Addr: 0xc0f04a10, Data: 0x 70200 [ 7 512] DMA 10 - yb | xb =
-23385 : Write Addr: 0xc0f04a14, Data: 0x 70200 [ 7 512] DMA 10 - ya | xa
-23384 : Write Addr: 0xc0f04a18, Data: 0x 600 [ 0 1536] DMA 10 - off1
-23382 : Write Addr: 0xc0f04a1c, Data: 0x fffc800 [ 4095 51200] DMA 10 - off2b
-23380 : Write Addr: 0xc0f04a20, Data: 0x 600 [ 0 1536] DMA 10 - off1a
-23379 : Write Addr: 0xc0f04a24, Data: 0x fffc800 [ 4095 51200] DMA 10 - off2a
-23377 : Write Addr: 0xc0f04a28, Data: 0x 0 [ 0 0] DMA 10 - off3
-23375 : Write Addr: 0xc0f11084, Data: 0x 1 [ 0 1] Resample ?
-23374 : Write Addr: 0xc0f113c8, Data: 0x 1000 [ 0 4096] Resample ?
-23372 : Write Addr: 0xc0f113cc, Data: 0x 540003 [ 84 3] Resample ?
-23370 : Write Addr: 0xc0f113d0, Data: 0x 700ff [ 7 255] Resample ?
-23369 : Write Addr: 0xc0f113d4, Data: 0x 700ff [ 7 255] Resample ?
-23367 : Write Addr: 0xc0f11090, Data: 0x 0 [ 0 0] Resample ?
-23365 : Write Addr: 0xc0f11148, Data: 0x 2 [ 0 2] Resample ?
-23364 : Write Addr: 0xc0f13008, Data: 0x 101 [ 0 257]
-23362 : Write Addr: 0xc0f1300c, Data: 0x 400 [ 0 1024]
-23361 : Write Addr: 0xc0f13010, Data: 0x 600 [ 0 1536]
-23359 : Write Addr: 0xc0f13014, Data: 0x 3 [ 0 3]
-23357 : Write Addr: 0xc0f13018, Data: 0x 2a700ff [ 679 255]
-23356 : Write Addr: 0xc0f1301c, Data: 0x ff [ 0 255]
-23354 : Write Addr: 0xc0f13020, Data: 0x 1 [ 0 1]
-23352 : Write Addr: 0xc0f13050, Data: 0x 0 [ 0 0]
-23351 : Write Addr: 0xc0f13054, Data: 0x 0 [ 0 0]
-23349 : Write Addr: 0xc0f110c0, Data: 0x 2 [ 0 2] Resample ?
-23347 : Write Addr: 0xc0f11184, Data: 0x 1f [ 0 31] Resample ?
-23346 : Write Addr: 0xc0f11188, Data: 0x10000778 [ 4096 1912] Resample ?
-23344 : Write Addr: 0xc0f11140, Data: 0x 4 [ 0 4] Resample ?
-23343 : Write Addr: 0xc0f11408, Data: 0x 0 [ 0 0] Resample ?
-23341 : Write Addr: 0xc0f1140c, Data: 0x 540003 [ 84 3] Resample ?
-23339 : Write Addr: 0xc0f11410, Data: 0x 70007 [ 7 7] Resample ?
-23338 : Write Addr: 0xc0f11414, Data: 0x 70007 [ 7 7] Resample ?
-23336 : Write Addr: 0xc0f0420c, Data: 0x 540003 [ 84 3] DMA 2 - yn | xn
-23334 : Write Addr: 0xc0f04210, Data: 0x 7000c [ 7 12] DMA 2 - yb | xb
-23333 : Write Addr: 0xc0f04214, Data: 0x 7000c [ 7 12] DMA 2 - ya | xa
-23331 : Write Addr: 0xc0f04218, Data: 0x 24 [ 0 36] DMA 2 - off1
-23329 : Write Addr: 0xc0f0421c, Data: 0x ffffeb0 [ 4095 65200] DMA 2 - off2b
-23327 : Write Addr: 0xc0f04220, Data: 0x 24 [ 0 36] DMA 2 - off1a
-23326 : Write Addr: 0xc0f04224, Data: 0x ffffeb0 [ 4095 65200] DMA 2 - off2a
-23324 : Write Addr: 0xc0f04228, Data: 0x 0 [ 0 0] DMA 2 - off3
engio_write end
-23311 : Write Addr: 0xc0f04304, Data: 0x20000001 [ 8192 1] DMA 3 - flags
-23310 : Write Addr: 0xc0f04300, Data: 0x 1 [ 0 1] DMA 3 - ctrl
-23306 : Write Addr: 0xc0f04204, Data: 0x20000000 [ 8192 0] DMA 2 - flags
-23305 : Write Addr: 0xc0f04200, Data: 0x 1 [ 0 1] DMA 2 - ctrl
engio_write start
-23303 : Write Addr: 0xc0f03040, Data: 0x 2 [ 0 2]
-23301 : Write Addr: 0xc0f03040, Data: 0x 0 [ 0 0]
-23299 : Write Addr: 0xc0f13000, Data: 0x 0 [ 0 0]
engio_write end
-23296 : Write Addr: 0xc0f13000, Data: 0x 0 [ 0 0]
-23294 : Write Addr: 0xc0f13048, Data: 0x 3 [ 0 3]
-23293 : Write Addr: 0xc0f1304c, Data: 0x 0 [ 0 0]
-23291 : Write Addr: 0xc0f13004, Data: 0x 1 [ 0 1]
-23283 : Read Addr: 0xc0e00000, Data: 0x 1010000 [ 257 0] JPEG
-23280 : Read Addr: 0xc0e00030, Data: 0xffffffff [65535 65535] JPEG
-23277 : Read Addr: 0xc0e00000, Data: 0x 1010000 [ 257 0] JPEG
engio_write start
-23273 : Write Addr: 0xc0f11040, Data: 0x 1 [ 0 1] Resample ?
-23270 : Write Addr: 0xc0f11400, Data: 0x 0 [ 0 0] Resample ?
-23268 : Write Addr: 0xc0f11404, Data: 0x 1 [ 0 1] Resample ?
-23267 : Write Addr: 0xc0f11180, Data: 0x 0 [ 0 0] Resample ?
-23265 : Write Addr: 0xc0f11008, Data: 0x 1 [ 0 1] Resample ?
-23263 : Write Addr: 0xc0f113c0, Data: 0x 0 [ 0 0] Resample ?
-23261 : Write Addr: 0xc0f113c4, Data: 0x 1 [ 0 1] Resample ?
engio_write end
-23257 : Write Addr: 0xc0f04a04, Data: 0x20030000 [ 8195 0] DMA 10 - flags
-23256 : Write Addr: 0xc0f04a00, Data: 0x 1 [ 0 1] DMA 10 - ctrl
-16661 : Read Addr: 0xc0f04230, Data: 0x 2 [ 0 2] DMA 2 - intr
-16648 : Write Addr: 0xc0f04204, Data: 0x 0 [ 0 0] DMA 2 - flags
-16646 : Write Addr: 0xc0f04200, Data: 0x 4 [ 0 4] DMA 2 - ctrl
-16583 : Read Addr: 0xc0f04a30, Data: 0x 2 [ 0 2] DMA 10 - intr
-16576 : Write Addr: 0xc0f04a04, Data: 0x 0 [ 0 0] DMA 10 - flags
-16575 : Write Addr: 0xc0f04a00, Data: 0x 4 [ 0 4] DMA 10 - ctrl
-16539 : Read Addr: 0xc0e00044, Data: 0x 400 [ 0 1024] JPEG
-16533 : Read Addr: 0xc0e00024, Data: 0x 4aa36 [ 4 43574] JPEG
-16399 : Write Addr: 0xc0f04304, Data: 0x20000006 [ 8192 6] DMA 3 - flags
-16381 : Read Addr: 0xc0f04330, Data: 0x 4 [ 0 4] DMA 3 - intr
-16376 : Write Addr: 0xc0f04304, Data: 0x 2 [ 0 2] DMA 3 - flags
-16374 : Write Addr: 0xc0f04300, Data: 0x 4 [ 0 4] DMA 3 - ctrl
-16372 : Write Addr: 0xc0f04304, Data: 0x 0 [ 0 0] DMA 3 - flags
-16276 : Read Addr: 0xc0f04a08, Data: 0x1df97c64 [ 7673 31844] DMA 10 - dst
-16275 : Read Addr: 0xc0f04308, Data: 0x1cabaafe [ 7339 43774] DMA 3 - dst
-16273 : Read Addr: 0xc0f04208, Data: 0x107a13fc [ 4218 5116] DMA 2 - dst
-16009 : Write Addr: 0xc0f13048, Data: 0x 0 [ 0 0]
-16008 : Write Addr: 0xc0f1304c, Data: 0x 0 [ 0 0]
-16006 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768 0]
************** [DPATH] LV_JPG STOP ....
Thanks for your big effort!!!
Up with the great job!!
Thanks ilex, theses days are really wierd, working from home with the kids running around me all days long (im in Denmark), they've been out of school since thursday, our goverment locked down all schools last week. Quite difficult to get real work done when I'v got to be teacher and programmer at the same time.
But with regards to Magic lantern we will see raw video on the 40D, it just a matter of time now. Iv got 3 other issue to fix before I can work on mlv-lite module, too bad the CF card is only 20 MB/second, that ruins the raw performance, but getting raw video working is a step towards mjpeg streaming which will be the prime feature of this camera. If im lucky we will see raw video within the next 10 days.
Nice work! How close are you to mjpeg stream? How would that work in practice? mv1080p compressed into mjpeg? Recorded as single images? Curious.
Great Job @heder , I've been watching your progress with great interest :D
One of my long term goals in to have Mjpeg compression -> .avi (4.2.2 8bit)
I know the stream is there but was unable to fully understand it to be implemented in d4 cams
this something that All ML cams can use specially the older d4 e.g. 500d etc. ...
On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ? spec. say it can use either one .
There is a branch that has to do with CF bus clocking or overclocking ,
I've been looking in to this for the 5d2 & 50d .
Some useful link from previous conversation's about CF card speed
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206010#msg206010
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206011#msg206011
https://www.magiclantern.fm/forum/index.php?topic=19336.msg206067#msg206067
Quote from: a1ex on April 10, 2018, 08:12:13 AM
.....
@reddeercity: more details after I'll get a new card (it *is* possible to overclock the 5D2 CF interface).
Quote from: a1ex on October 11, 2018, 07:43:58 AM
https://bitbucket.org/hudson/magic-lantern/branch/hdparm
Might be useful for overclocking, too.
etc. .....
Quote from: reddeercity on March 22, 2020, 12:30:47 AM
On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ?
"Type" = Physical dimension (thickness) of a CF-card. Type II is thicker (5 mm) and was used for rotational media (as in harddisks, see MicroDrive).
Here is some info about CF modes
Quote
Explanations
The CF interface is derived from the ATA Interface. The CF 2.0 specification allowed PIO-4 mode that has a theoretical limit of about 15.9MB/s. CF 3.0 introduced two additional PIO modes that are not part of the original ATA specification: PIO-5 and PIO-6, where PIO-6 has a theoretical limit of about 23.8MB/s. Most CF cards with speed ratings from 80x to 166x use PIO-6 to achieve this speed. However, there is currently no FireWire reader with support for PIO-5 or PIO-6. This means that PIO-6 cards run in the slower PIO-4 mode, and therefore run slower than with current USB 2.0 readers. Support for MDMA modes is most likely not that popular, but you can't really tell the difference between PIO-4 and MDMA-2 when a card reader is used, because PIO only occupies the card reader controller, not the host CPU. CF 3.0 also introduced two additional MDMA modes, MDMA-3 and MDMA-4 using the same timing as PIO-5 and PIO-6.
CF 1.0: Max. PIO-2 (240ns), 7.95MB/s.
CF 2.0: Max. PIO-4 (120ns), 15.89MB/s.
CF 3.0: The new CF PIO modes PIO-5 and PIO-6 and the ATA UDMA modes UDMA-0 to UDMA-4 were introduced, offering a theoretical limit of about 63MB/s for UDMA-4.
CF 4.0: The remaining ATA UDMA modes UDMA-5 and UDMA-6 were added, allowing up to about 127MB/s.
CF 5.0: 48-bit commands were added. This command set allows a transfer block size of up to 32MB compared to 128kB with the previous command set. This will allow actual transfer rates to come closer to the theoretical limit.
CF 6.0: The new CF UDMA mode UDMA-7 (24ns/166M) was added, allowing up to about 158MB/s transfer rate.
In case you have plans on using CF cards as regular ATA device: For all timings of 100ns or faster (UDMA-5, UDMA-6 and UDMA-7), the CompactFlash specification only allows one device per bus with a maximum distance of 0.15m (6in) from the card connector to the host controller, at 3.3V supply voltage! In addition to that, 80-wire cables must be used for all UDMA modes.
Current UDMA CF Cards and UDMA CF readers support UDMA-5 or UDMA-6, with real-world transfer rates of more than 80MB/s. This is already beyond the theoretical transfer rate of UDMA-4. Current USB 2.0 UDMA CF readers are maxed out at about 32MB/s, less than 40% of the actual card performance.
Source: Late and lamented http://www.hjreggel.net/cardspeed/index.html (Current = Years and years ago)
Quote from: Danne on March 21, 2020, 10:18:27 AM
Nice work! How close are you to mjpeg stream? How would that work in practice? mv1080p compressed into mjpeg? Recorded as single images? Curious.
Danne, Atleast the older cameras like 40d,450d,1000d were built with jpeg streaming capabilities, were each images is downsampled, mjpeg compressed and finally tranfered to the pc. We can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream. A tool like ffmpeg supports this non-standard format. The interessing features is that each frame is a full image.
Quote from: reddeercity on March 22, 2020, 12:30:47 AM
Great Job @heder , I've been watching your progress with great interest :D
One of my long term goals in to have Mjpeg compression -> .avi (4.2.2 8bit)
I know the stream is there but was unable to fully understand it to be implemented in d4 cams
this something that All ML cams can use specially the older d4 e.g. 500d etc. ...
On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ? spec. say it can use either one .
There is a branch that has to do with CF bus clocking or overclocking ,
I've been looking in to this for the 5d2 & 50d .
Some useful link from previous conversation's about CF card speed
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206010#msg206010
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206011#msg206011
https://www.magiclantern.fm/forum/index.php?topic=19336.msg206067#msg206067etc. .....
eddeercity, as far as I can tell the 40d only support pio-6 mode but seems to be underclocked (14 mb/s), I wasted alot of time digging into the firmware code looking for UDMA, without success, I used 4 different new card from sandisk, kingstons, transcend (ranging from 866x down to 166x). I did alot of blackbox testing with the timing and ended with approx 20 mb/s which the pio-6 specification support. These are approx 3mm cards so I guess CF-1. The firmware supports CompactFlash Specification Revision 3.0 (found "CFA3.0" strings in firmware) http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf (http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf)
I documented some of my finding here https://magiclantern.fandom.com/wiki/Register_Map/40D
---
Theoretically: the sensor was a readout rate of 96Mpixel/sec, thats 4004004 pixels per second at 23.976 or ~9 fps at full sensor size. Both should be doable with the CF limited bandwidth (jpeg compression), but there is along list of issue to be solved. I need to understand the yuv-mjpeg livemode "chain" inorder to beable to change the width and height of the images and many many other issues. The yuv-mjpeg chains seem to be is abit more complex that "raw video", this one really needs alot of cache hijacking.
Quote from: heder on March 22, 2020, 10:13:51 AM
Danne, Atleast the older cameras like 40d,450d,1000d were built with jpeg streaming capabilities, were each images is downsampled, mjpeg compressed and finally tranfered to the pc. We can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream. A tool like ffmpeg supports this non-standard format. The interessing features is that each frame is a full image.
Sounds like a game changer to me :).
Quote from: heder on March 22, 2020, 10:13:51 AMWe can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream.
https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429 (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429)
Quote from: Ant123 on March 22, 2020, 07:07:40 PM
https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429 (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429)
Yes exatly.
Quote from: a1ex on February 23, 2019, 09:34:06 AM
The JPEG buffer is is populated *and* freed in lvcdevResourceGet, so... that's pretty much the only place for a hook, if you want to reuse Canon's approach. You could place a hook (patchmgr: patch_hook_function) directly into 0xFFAD5870, but that won't solve much (the hook code will only execute when needed, so it will be a bit cleaner). You should also speed up the copying process with either dma_memcpy (HPCopy) or edmac_memcpy; that should get rid of dropped frames.
On newer models (DIGIC 5, IIRC also 60D and newer DIGIC 4), this function no longer runs automagically while in LiveView, so this approach is only valid for older models.
There is another drawback of this JPEG stream: it's not using the full LiveView resolution. On 450D, CR2 resolution is 4312x2876 (with dcraw), so I'd expect something close to 1436x958 in LiveView. On 5D2, CR2 resolution is 5634x3753, LiveView resolution is 1880x1248, LV-JPEG resolution is 1024x680. I'm pretty sure the hardware can deliver MJPEG at full LiveView resolution; "just" need to figure out how to how to request a full-size YUV buffer (most Canons do this while recording H.264) and how to call the JPEG encoder on an arbitrarily-sized YUV buffer (likely very similar to the lossless encoder).
BTW - disabling this JPEG stream on old models could be useful for reducing power consumption. Nothing measured; just theory.
This is the real challenge
When running with call("lv_save_raw",1) the raw EDMAC channel has the following sizes
LiveView x1 = raw bayer format = 1336 x 872
LiveView x5 = raw bayer format = 1952 x 814
LiveView x10 = raw bayer format = 1952 x 814
Did you manage to get the image using "lv_save_raw" ?
No, i didnt borther yet, i just analysed the RAW edmac register values.
Im stuck in gui stuff, menus in liveview isnt working, which is needed for raw video.
* Menus in livemode is now working :)
* mlv_lite framework is up and running :D
- modules vsync is called from my own 40d vsync task (hmm, should use the commonm vsync func, but ok for now)
- module version structs "VERS" in output header turns into alot of garbage => disabled for now.
- small hacks set to 0
- SRM_job set to 0
- Maximum memory set to 40MB
- edmac_copy_rectangle_cbr_start fails for now ... :(
The camera save correctly and mlv_dump accepts the and decodes the output file correctly 8) (if I skips dmac_copy_rectangle_cbr_start and just put in dummy data using memset), so I need to get dmac_copy_rectangle_cbr_start verified.
Yay .. finally a nice looking raw recorded frame from mlv_lite ! .. (without edmac support).
1 fps at 1312x872 (x1 mode) using memcpy(), approx each 20th frame is ok. Had to use memcpy to copy line of line. I need to hack the raw edmac system more before I can use it. My current hijacked vsync function is in the wrong spot, and the 40d contnuesly writes the raw edmac destionation register before performing the raw tranfers, and that pointer changes. mlv_lite overwrites this pointer, but without proper timing the camera just overwrites mlv_lites address again, stupid 40d, surrender.
(https://lh3.googleusercontent.com/fDmLlRVcxHdGCBkqe8Klc4nBTzqlvOItH6dRb0hUpWeG8zacnaDZPykaz_zVrLtQAhOjrbtc3y6YVmtCE_NnbRWftO1H5SueNlXXEQwPAUi1dgBA8Ps1fl5mF7OMbJJNApCxaZZLREPvIGm6JK4LY78BlIdn5ak7GC7rdJ1fsrOFzprNGXmprqFA1GT7MutTsr6np7NYKoLh50G_ZDZCupFmCJUeCjUM9VzS-nBcXpuy0ZdRInplUEOrjNmx4V3pdSJzJY2q09OItU_0AfjNhBiJV9pzJlKfOZaskk2CR32W_lCvE0d8uzOZWoLlimzbDOXmojSCIM8f4zJ3jNep973fYyQZLQKE9IZ6-cPwzPEjPdMnLH90akO0emDLojOo4XLEwWGW1pnae9aM7SNNERTmspCNNQH5wzWgj51WFMTly-qtVhwP7pst5JL1KUHqwdiq3LYMGGfFh-HbWr7DspOFEJrw0Rx5NQDfoRSpeov5Y4koIJiReOsAPs9AOq1Z6oYss5Cpw6SGI52WLSnRw5kwMPU6QKqRCEqDiRABebVMIyNP92ZJWz9ErxlExOpboSrwGZzcQgpAY64w7SHWPl0VFtjd8ajNUWhbJajXA0LbZR-f2jhBS0X21pApldo2O1cxCgHyam0gsq9ZpNkHcaAMAdiiieu5OMtm6BgiN7IdVPzR_ftlRO9QGNPwfGLEjFDcp2JWBVenR4q9VUDJolFI_fhNI0Z2rC4-WZkx-5rIXrayeNaY9IA=w1312-h872-no)
MLV on 40D 8) Even if that's single frame, congrats. I'll check it just for fun, after whole covid crap ends (dad has pristine 40D with only ~10k frames).
Wish I had enough knowledge to move R forward, but with time that I can spent, I'll maybe finally upgrade my cam to latest FW and update the stubs...
Updated open beta to 1.0.2
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Fixes =
Menu's are now working in LiveMode (use joystick instead of scrollwheel)
I'll be "out of office" for the next 10 days, corona is driving the kids nuts, easter vaccation @ home. mlv_lite will take some more time, its abit more complex than I thought.
Hi, I am a new member and I have a problem. How do I download from this link?
https://bitbucket.org/jmheder/magic-lantern/branch/vxworks
Another thing, does focus peaking work for vintage lenses?
sorry, I hope to be helped. Happy Easter.
Hi JackV88, welcome.
I assume you wish to download the source code for the 40d. You need mercurial command "hg" and download my master branch https://bitbucket.org/jmheder/magic-lantern and then switch to vxworks branch. If you were only looking for binaries, then look in the https://bitbucket.org/jmheder/magic-lantern/downloads folder.
The unified master branch for all cameras are here https://bitbucket.org/hudson/magic-lantern
I cant answer you regarding focus peaking, i have not used any time in that, im spending time om video atm.
I realized why I can't get every raw frame. The raw save EDMAC functionallity system does'nt run on each frame :(, but only sometimes, and even more stange ... the interval between each raw frame is'nt even consistent, really odd. So now I need to create my own sync/hook function, that tranfers each frame.
So, this camera wouldn't be able to output the full speed raw video stream (*.mlv)?
Quote from: Wlad81 on April 16, 2020, 08:47:42 PM
So, this camera wouldn't be able to output the full speed raw video stream (*.mlv)?
I don't think this is a raw issue aka. speed bottleneck, but the digic 3 cameras are old and abit different from the digic 4 cameras.
The sensor readout rate is really high = 96 Mpixel (like 5D2) and the internal EDMAC is above 300 MB/s, so there plenty of room for
raw tranfers. The only bottleneck I see is CF card 20 MB/s (and this is with modified timing), but ofc this one had nothing to do with
raw trafering. Perhaps the developers did'nt need raw tranfers while debugging, and did'nt implement raw tranfers on each frame ?,
or due to battery usage or some other reason.
I have tracked down the specific function and code that executes the raw tranfers. This function also tranfers the yuv interpolated image
for displaying on the screen. In fact there a function for each mode x1,x5,x10. In all 3 tranfer functions - only when some conditions are
correct will the raw edmac tranfer be allowed. I'm currently working on using cache tricks to force raw tranfers on each frame, when we will
know for sure.
Raw video using single buffer is now running, all frames are good
8) :) ;) ;D :D :P
Thanks so much for the continued work! It almost seems as if the finish line is becoming visible on the horizon now.
Once you collect your trophy, might I interest you in running the 80D marathon afterward? ;)
Quote from: Theta Sigma on April 21, 2020, 02:52:34 PM
Thanks so much for the continued work! It almost seems as if the finish line is becoming visible on the horizon now.
Once you collect your trophy, might I interest you in running the 80D marathon afterward? ;)
It was quite a nice experience to see each frame was good, finally, like getting a birthday present :) I think I'll be done
with 40D in 2021 (oh dear), still so much to do. But the future ? there are so many cameras that are interessing, I can't
say were I want to go after 40d, we will see, but im only interessed in cameras that is missing ML. For now it's the 40d
(and properly helping 1300D users abit).
Nice progress @heder. Not many around here nowadays that can accomplish these things. How many frames per second are you getting?
Quote from: heder on April 21, 2020, 03:08:56 PM
(and properly helping 1300D users abit).
Thank you for taking the time to help us move on.
Quote from: Danne on April 21, 2020, 03:14:59 PM
Nice progress @heder. Not many around here nowadays that can accomplish these things. How many frames per second are you getting?
I have not yet begun to do fps testing. I only have the basic system running : single buffer, no edmac and only in x1 mode, but completing these
is only a question of time, no additional hacks needed. The CF Card is however only 20 mb/s, so this one sets the limit. Raw edmac is however only
a stepping stone, mjpeg video in x5/x10 mode is primary target, but that one is even harder than raw video.
heder
Maybe you will commit changes to your repository?
Quote from: Ant123 on April 21, 2020, 04:51:18 PM
heder
Maybe you will commit changes to your repository?
Ok, they're updated on bitbucket, but it aint pretty at all, it's currently one big spagetti hack. I will work on making in more pretty, anyways
* The raw tranfering is started with call("lv_save_raw",1).
* mlv_lite set the image buffer via a fake call EngDrvOut(0xFFFFFFFF,mlv_lite_buffer);
* The raw tranfering is stopped with call("lv_save_raw",0) and a fake call EngDrvOut(0xFFFFFFF0,0);
* mlv_lite is also currently a big mess
On each frame Canon calls the same function which perform multiple dma tranfer (including YUV), sometimes is also issues a raw tranfer, but always writes a value 0xc0f08030.
1. If canon writes the edmac 4 destination, then I know that a raw frame will be tranfered, and I set an internal raw flag, and the only thing I will do it change the edmac 4 destination the mlv_lite buffer
2. A write to 0xc0f08030 will always occur AFTER a possible edmac 4 destination write, so here I check that the internal raw flag is set, if not set, then canon did not start the tranfer, and I will start the raw tranfering myself with the correct mlv_lite buffer pointer.
Now I *just* need to redo all the spagetti mess :o
Quote from: heder on April 21, 2020, 03:08:56 PM
But the future ? there are so many cameras that are interessing, I can't
say were I want to go after 40d, we will see, but im only interessed in cameras that is missing ML. For now it's the 40d
(and properly helping 1300D users abit).
You don't mean there's already a version of ML that works on the 80D, do you?
Quote from: Theta Sigma on April 21, 2020, 09:35:34 PM
You don't mean there's already a version of ML that works on the 80D, do you?
No. My point was that the next camera i buy next should not have a working ml, but there are alot og those.
There is the possibility to show the procedure to download and install on the memory card with a tutorial on YouTube, for those like me who have not understood anything? (I'm Italian and I don't know English well :-[
Reply #485
Reply #513
I don't understand your answer.
Youtube tutorial linked in reply #485
Download linked in reply #513
Im trying to run the 40d dump from my camera in qemu-eos but is not working, it goes in a loop, does it work for you guys? It seems to boot though..
Also manage to get the Magic Lantern boot screen with boot=1 option.
Is it maybe the wrong approach and is the heder magic lantern that I should try and run in qemu?
Do I need to compile magic lantern 40d in some special way for qemu? Or will the last heder build run in it and no need to compile myself?
How do I run the build?
I'm stuck at this point, I want to try and help, but i'd like to load the software in qemu before trying it on my camera.
Any help appreciated, thanks.
Also would like to say thanks and hurray to heder for pushing forward the 40d, been following this thread 10 years and tried to do it myself lol, just not skilled enough. Following your footsteps and learning along the way. :)
Quote from: kidkoala83 on May 04, 2020, 05:13:03 PM
Im trying to run the 40d dump from my camera in qemu-eos but is not working, it goes in a loop, does it work for you guys? It seems to boot though..
Also manage to get the Magic Lantern boot screen with boot=1 option.
Is it maybe the wrong approach and is the heder magic lantern that I should try and run in qemu?
Do I need to compile magic lantern 40d in some special way for qemu? Or will the last heder build run in it and no need to compile myself?
How do I run the build?
I'm stuck at this point, I want to try and help, but i'd like to load the software in qemu before trying it on my camera.
Any help appreciated, thanks.
Also would like to say thanks and hurray to heder for pushing forward the 40d, been following this thread 10 years and tried to do it myself lol, just not skilled enough. Following your footsteps and learning along the way. :)
Hi kidkoala83
I will do my very best to help you with qemu, but QEMU and 40D is a difficult combination, it might just be my "server" pc, but I know even a1ex says is it doesnt run that well. That does not mean it a dead end, no.. you just got to find the right balance. I can not tell you what the specific QEMU issues are, but my feeling are these issues are a combination cf timing and gfx timing which causes the simulator to stop. None have the time to fix this in QEMU, so a workaround is the best option. QEMU runs fine with only the ROM files (i.e. no magic lantern). I did however have a lot of issues with keyboard mapping, but I guess that my mini "server" that was odd (acer revo @atom dual core) with danish keyboard.
Getting magic lantern to run on my pc in QEMU required some additional steps, in order to get past the cf timing and gfx issues. These workarounds are not bullet proof, you will get a lot of situation here QEMU stops anyway, 2-4 crashes for each good run.
Graphic timing.To get a good gfx timing, I have tryed to compile QEMU with all the different gfx layers which are compatible with QEMU. The very best was running QEMU using VNC connecting. Normally you'd use VNC to connect to a different server/pc, but you can also run QEMU on your pc/server display, displaying the QEMU windows on your screen. After you start QEMU (in VNC mode) there will be a small delay before the actual QEMU windows show up, this delay is the "workaround". You can also run QEMU with no gfx/window and it will run even better - but useless without a display. You will need to configure QEMU and recompile with --enable-vnc --enable-sdl and .. remeber to install a vnc server on your pc. Alternatively try sdl.
Cf card issues.The cf card issues are quite annoying. As you compile ML and run QEMU simulations the cf card loopback (cf.img) will slowly become messed up ("fsck" will find a lot of strange and non existing files) and when the card is too messed up, QEMU will not run ML at all. The only workartound I could find was to remove ALL files from the cf card and run fsck on the cf.img until all reported errors was gone, then I made clean cf.img into my master image. Everytime I compiled a new ML version I would delete the cf.img, and make a copy of the clean master cf.img and copy the files into that one. Lots of additional steps, but needed.
Scripts:
https://bitbucket.org/jmheder/magic-lantern/downloads/qemu-scripts.zip
I have put some of the script I have used on bitbucket - my primary command is called "go_command.sh".
You will known that QEMU is running successfully when the console is emitting text constantly (due to inter communication between the digic 3 and mpu - I think). If the console stops then hit break+c and retry, do that until you get an success. I have had good days where QEMU + ML worked all the time, and bad days where I had 9 crashes before I got lucky.
double post :o
Quote from: heder on May 05, 2020, 02:41:03 PM
When everything is working in QEMU (magic lantern loaded) the text that should be written (spammed) into the console by QEMU is:
Lockdown read 2
FF819A28: MRC p15,3,Rd,cr15,cr2,0: DcacheTag -> 0x0
FF819A34: MCR p15, ... : CACHEMAINT x1 (omitted)
FF819A34: MCR p15,3,Rd,cr15,cr0,0: CacheDbgIdx <- 0xC0000780
Lockdown read 2
FF819A28: MRC p15,3,Rd,cr15,cr2,0: DcacheTag -> 0x0
FF819A28: MCR p15, ... : CACHEMAINT x1 (omitted)
FF819A28: MCR p15,3,Rd,cr15,cr0,0: CacheDbgIdx <- 0xC00007A0
Lockdown read 2
FF819A28: MRC p15,3,Rd,cr15,cr2,0: DcacheTag -> 0x0
FF819A28: MCR p15, ... : CACHEMAINT x1 (omitted)
FF819A28: MCR p15,3,Rd,cr15,cr0,0: CacheDbgIdx <- 0xC00007C0
Lockdown read 2
FF819A28: MRC p15,3,Rd,cr15,cr2,0: DcacheTag -> 0x0
FF819A34: MCR p15, ... : CACHEMAINT x1 (omitted)
FF819A34: MCR p15,3,Rd,cr15,cr0,0: CacheDbgIdx <- 0xC00007E0
Lockdown read 2
FF819A28: MRC p15,3,Rd,cr15,cr2,0: DcacheTag -> 0x0
If you get the magic lantern to run (press delete button) but text is missing, PM me and tell me text in QEMU is missing, I have not worked with QEMU since januar.
As it turns out the canon dump was working on qemu, my terminal screen was printing what you posted, I was just not pushing the right buttons, when i pushed menu (M key) and I saw the canon interface couldn't believe it.
Now I got to play a bit more with it and run/load the 40d magic.
When I press backspace key (delete button?) nothing seems to happen, I've tried also D key for direct printing, how do I load the magic lantern?
Hopefully at some point I might be able to do some debugging and/or find some calls and stubs to help your effort.
Quote from: kidkoala83 on May 06, 2020, 10:13:17 AM
As it turns out the canon dump was working on qemu, my terminal screen was printing what you posted, I was just not pushing the right buttons, when i pushed menu (M key) and I saw the canon interface couldn't believe it.
Now I got to play a bit more with it and run/load the 40d magic.
When I press backspace key (delete button?) nothing seems to happen, I've tried also D key for direct printing, how do I load the magic lantern?
Hopefully at some point I might be able to do some debugging and/or find some calls and stubs to help your effort.
Good to hear QEMU is running with the ROM files, when you just need to last steps. Regarding ML+QEMU, You need to check and verify the following:
1. Do ensure keys are correct, load only ROM files, boot = 0, and verify that
pressing P key will give you an "No Image" text screen.
pressing W will give you picture settings
pressing I will give you the information overview
2. Did you mount the cf.img image as a loopback device and copy ML files onto that ? (use mtools to do that or look in my scripts)
3. Did you start QEMU with boot option = 1 (i.e. load magic lantern) ? I use my own command for starting qemu, here is my with SDL (alternativly look in my scripts).
qemu-2.5.0/arm-softmmu/qemu-system-arm -drive if=ide,format=raw,file=cf.img -chardev socket,server,nowait,path=qemu.monitor,id=monsock -mon chardev=monsock,mode=readline -sdl -name 40D -M 40D,firmware=boot=14. Analyse the output from QEMU console, with boot=1 you should find the follow text early on in the QEMU startup sequence (yes the text is red and hard to read on some monitors!)
CF LOAD OK.
Open file for read : AUTOEXEC.BIN
Now jump to AUTOEXEC.BIN!!
5. If everything is ok, you should press the delete button twice to get into the menus.
One step closer to a fully working mlv_lite. Finally got mlv_lite and edmac running, that was quite complex to figure out. Raw video transfering was done with edmac 4, and after that I "stole" edmac 4 for internal mlv_lite memory copy operations, but this failed because edmac 4 was not initialized completely on each frame transfer. So after mlv_lite used edmac 4 once, the next raw transfer failed. Edmac 3 is used to perform multiple transfers by canon which means it gets fully initialized on each transfer, so using that gave me a success (few frames, but it worked). Now I just need to figure out which edmac is the best to use, aka. which is used less and at the same time gets fully initialized on each use - there is no free write edmac so we need to steal one temporary. Dual buffering is also working now.
The mlv_lite it running now (x1), Stole and hijacked write edmac-5 (whitebalance) and then everything worked. I now have a raw mlv videos files created with the 40D, the build is absolutly bleeding egde. I still have a couple of problems left to solve.
- Frame order is incorrect, now this is normal, but mlv_dump / MLVApp won't correct it, might be a timestamp issue.
- Changing the CF timing should give me 20 mb/s - but the FIO write file system has a huge penalty when saving smaller files and the 20 mb/s is only reached when the buffer are minimum 8 mb, currently I only get like 13 mb/s save speed. Thus i suspect mlv_lite of using smaller buffers
- I don't get the recording icon because the thread that would call and write this icon, does not call mlv_lite
Ok. I finally got to emulate Magiclantern 40d on qemu-eos. If anyone is following that process you need to use mount.sh script within qemu-eos to mount cf.img (It's the virtual compact flash), so you can copy the ML files in it, otherwise you get permission issues, also but not least the key to launch ML menu in some computers is Supr instead of Del, just saying cause that bit got me stuck for a while.
When i have time i'll play a bit with the ML menu and see where to go from there, once more thanks to everyone that made it posible.
Well done getting it working!
If you want to mount the card images directly in the future, you need to be root / use sudo, and the mount command is a bit weird. It's like this for me on Linux:
mount -o loop,offset=50688 /home/user/code/magiclantern/qemu-eos/cf.img /mnt/
You can then modify however you want, unmount, and a normal user can run qemu and it will see the filesystem changes.
Quote from: kidkoala83 on May 30, 2020, 11:42:16 PM
Ok. I finally got to emulate Magiclantern 40d on qemu-eos. If anyone is following that process you need to use mount.sh script within qemu-eos to mount cf.img (It's the virtual compact flash), so you can copy the ML files in it, otherwise you get permission issues, also but not least the key to launch ML menu in some computers is Supr instead of Del, just saying cause that bit got me stuck for a while.
When i have time i'll play a bit with the ML menu and see where to go from there, once more thanks to everyone that made it posible.
Good work, thumbs up, the qemu and 40D hard to get running correctly, and there so much left to do on the 40D, just to mention a few (assuming you use my branch)
* many modules missing
* few stubs missing (1st memory job function not found)
* auto exposure value not detected
* half shutter not detected :(
* free malloc memory pointer missing (= I have hardcoded it to some static value atm)
* lots of properties not aligned
* and the big task ... digic 3 <=> digic 4 software abstraction layer (~ i.e. make the 40D act like a digic 4 camera)
* zebras in liveview missing
* global draw (zebras,histogram) not shown in photo mode (= crash)
* lots of other stuff I forgot
* ...
And remember to have fun, no stress :D.
Quote from: heder on April 04, 2020, 07:50:57 AM
Updated open beta to 1.0.2
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Getting raw video running will take 2-3 month more. I do have RAW video running, but i have a serious bug and also screwed up photo mode.
Open beta updated to 1.0.3.
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Added : halfshutter supported
I simply could not find the halfshutter memory location, and I'm wasting my time, so the simple solution
was to hijack and re-code GUI_E_Control and check of param1==31 (half shutter pressed) and
param1==32 (half shutter unpressed). End of story.
Added : astro module (https://www.magiclantern.fm/forum/index.php?topic=18515.0)
xaint astro module (https://www.magiclantern.fm/forum/index.php?topic=18515.0) was partly added. The start focus part of the module is enabled and working.
Polar alignment was disabled (drawing is bugged). Tested the star focus part (yesterday) with success.
Had some troubles verifying it because I was using a cheap yongnuo 50mm rather than my telescope, ininity
is'nt ininity on a lens, had to manually move focus back like ½ mm or so.
Hi Heder :) Just letting you know you're not talking to yourself. I really appreciate these documentation posts and think they're a valuable addition to the community. I always turn them over in my mind and see if they might help me with 200D.
Quote from: names_are_hard on July 11, 2020, 02:22:57 AM
Hi Heder :) Just letting you know you're not talking to yourself. I really appreciate these documentation posts and think they're a valuable addition to the community. I always turn them over in my mind and see if they might help me with 200D.
Likewise, although I don't have a 200D (Have an 80D though!) ;D
Thanks Heder. :)
Thanks, to the both og you. I know im not alone and the these beta versions are bring downloaded, so some ppl are using it.
expo override temporarily disabled
Hi all, and thanks for the great work. I am just wonder as of this writing where do things stand as far as Video recording on the 40D?
I bought a SD to CF card adapter:
https://www.walmart.com/ip/Red-Slot-Micro-SD-SDHC-SDXC-TF-to-CF-Adapter-Hight-Quality-Micro-SD-to-Extreme-Compact-Flash-Type-I-Card-Converter/404173230?wmlspartner=wlpa&selectedSellerId=18988&&adid=22222222227355251893&wl0=&wl1=g&wl2=c&wl3=441001397692&wl4=pla-915930924658&wl5=9002493&wl6=&wl7=&wl8=&wl9=pla&wl10=125210027&wl11=online&wl12=404173230&veh=sem
and have been using a 16 gb sd card in it:
https://www.amazon.com/Kingston-16GB-microSDHC-Adapter-SDCS2/dp/B07YGZHSJS
This seems to be working well for photos; so I am wondering what the theoretical limits of this kind of arrangement could be for Video capture and when the functionality in any form will be available?
Thank you
Quote from: mrb on July 22, 2020, 04:22:24 AM
I am just wonder as of this writing where do things stand as far as Video recording on the 40D?
See heder's reply #542
Quote from: mrb on July 22, 2020, 04:22:24 AM
I bought a SD to CF card adapter:
Which are - generally speaking - crap.
Most likely performance is far from modern standards. Should not be a concern with 40D which is - according to heder's experiments - limited to around 20 MByte/s bandwidth.
A more serious problem exists supporting boot from card. Some adapters are not able to act like bootable CF-cards, rendering them pretty useless for Magic Lantern.
You may want to test this with an ML-supported cam hosting CF slot (7D, 5D2, 5D3).
Quote from: mrb on July 22, 2020, 04:22:24 AM
and have been using a 16 gb sd card in it:
https://www.amazon.com/Kingston-16GB-microSDHC-Adapter-SDCS2/dp/B07YGZHSJS
According to Kingston this card should do 45 MByte/s in write mode.
Quote from: mrb on July 22, 2020, 04:22:24 AM
This seems to be working well for photos; so I am wondering what the theoretical limits of this kind of arrangement could be for Video capture and when the functionality in any form will be available?
Take a decent cardreader with CF slot ( www.cameramemoryspeed.com -> Reviews -> Card readers) and do some benchmark runs with tools like CrystalDiskMark (Windows) or Blackmagic Disk Speed Test (macOS).
20 MByte/s translates to around 720p25 for raw/MLV using lossless compression.
RAW video on 40D:
The only good use case I have found for RAW video on the 40D is HD'ish timelapses. Around ~ 1920 x 844 can be used for timelapses, not too bad for such and old camera. RAW video "as in" 24-30 fps is'nt really any good due to limited CF bandwidth. Ant123 is working with 450D trying to create a mjpeg recorder, which would be the best option to get 24 fps video on 450D/40D.
Expo settings don't work in ML. Changed ML digital ISO not have effect to exposure.
Expo sim enabled in Canon menu. Live view active.
Quote from: Dezmond2 on July 22, 2020, 08:34:09 PM
Expo settings don't work in ML. Changed ML digital ISO not have effect to exposure.
Expo sim enabled in Canon menu. Live view active.
Hi Dezmond2
Thanks for reporting that. Do you know if this problem is only in photo or liveview or both ?
Quote from: Walter Schulz on July 22, 2020, 08:14:56 AM
See heder's reply #542
Which are - generally speaking - crap.
Most likely performance is far from modern standards. Should not be a concern with 40D which is - according to heder's experiments - limited to around 20 MByte/s bandwidth.
A more serious problem exists supporting boot from card. Some adapters are not able to act like bootable CF-cards, rendering them pretty useless for Magic Lantern.
You may want to test this with an ML-supported cam hosting CF slot (7D, 5D2, 5D3).
According to Kingston this card should do 45 MByte/s in write mode.
Take a decent cardreader with CF slot ( www.cameramemoryspeed.com -> Reviews -> Card readers) and do some benchmark runs with tools like CrystalDiskMark (Windows) or Blackmagic Disk Speed Test (macOS).
20 MByte/s translates to around 720p25 for raw/MLV using lossless compression.
I have actually been able to use the magic lantern beta build for the 40d with the cf card adapter. I don't really know how to benchmark the actual read write speeds from the camera, but I definetly am able to use the card with no real issues to speak of yet. Thanks by the way about the timeline on video support. I guess thats where things still stand; I was wondering if I missed something.
I am very thankful to all for the support on this old camera haha. I was able to use "EOS camera movie record" to livestream to my laptop and record video that way, but the framerate is still quite choppy so it will be interesting to see what can be done once I can actually record directly to the CF slot. I suppose just recording the audio with my cellphone this could actually be a really nice solution for video if I can figure it out. I picked up a vintage f1.2 50mm lens and have been impressed with the quality so far. Sure beats recording with anything else I own. : )
Both
Quote from: Dezmond2 on July 22, 2020, 08:34:09 PM
Expo sim enabled in Canon menu. Live view active.
Quote from: heder on July 23, 2020, 09:58:11 AM
Do you know if this problem is only in photo or liveview or both ?
description "This feature only works in LiveView"
Quote from: heder on July 23, 2020, 09:58:11 AM
Hi Dezmond2
Can you share raw file with non standart ISO...50 or more than 3200 ?
I dont know, i will investigate, bulb also sttopped working in the lastest beta.
Open beta updated to 1.0.4.
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Fixed: prop request change bug
I introduced a bug in 1.0.1 ::). This bug disabled changing ISO,shutter,White balance,
bulb,Expo lock... and many other features.
Quote from: Dezmond2 on July 22, 2020, 08:34:09 PM
Expo settings don't work in ML. Changed ML digital ISO not have effect to exposure.
Expo sim enabled in Canon menu. Live view active.
Try 1.0.4.
Quote from: Dezmond2 on July 28, 2020, 03:05:10 PM
Can you share raw file with non standart ISO...50 or more than 3200 ?
The only values I found in firmware were 100,200,400,800,1600,3200. I tried to acticate 6400,12800 but the camera crashed. All other non standard values (125,160....) must then be digital ISO amplification from the standard ISO. Lowest ISO 100, highest 3200.
Quote from: heder on July 29, 2020, 06:55:36 PM
Try 1.0.4.
The only values I found in firmware were 100,200,400,800,1600,3200. I tried to acticate 6400,12800 but the camera crashed. All other non standard values (125,160....) must then be digital ISO amplification from the standard ISO. Lowest ISO 100, highest 3200.
Now expo settings work, also ISO 2500 - not available in Canon menu. 125, 160 and etc is present in Canon menu, i mostly shot in ISO 160 with stock FW
Ok, good to know, I never realized 2500 was hidden i stock FW. I will disable 6400,12800 in next beta.
@heder
How does this mode (https://www.magiclantern.fm/forum/index.php?topic=1452.msg221904#msg221904) look in QEMU?
@Ant123
The image your are refering too is saved inside LiveView. AFAIK liveview does not work correctly in QEMU. The simulator does not emulate hardware correctly and the liveview only tries to run but stalls due to timeout or similar, once a while you'll get the QEMU EDMACs trying to tranfer data to canons FW. All you get drawn is canons liveview stuff, but ML overlay does not get drawn. Here is 40D
(https://lh3.googleusercontent.com/yUJThp5-RQpXLqlOQg5TtWUiV-B26YZ5JlKndLbRad3sFRQeOrvmmszCbDEM1SjS3Jpwo4IUcLp7OrsTNAXaywAar5sDARq87G1biESfduZm9eJ6Ge_LTcRj8W8p5cqUvfVy7CpEJ4fxMVgflNNcIfBDaI8ShvDRbvlsaO1O9j0yum9KKAAadbrOr8r4kc5n7QaNJNB58qY-jr27Kz5KyBKhPlyevKTYJqN9ru0I7TPwlikzL1booNfuSkG5yQJr_7IAjrcBqHd7Bm_lrEf6W1GK552Cifmg2lFIgQGYqgPdD4_6WVKDp6BL36oDfrL5TR-i4prdWy6cCYJLz9Q7h0HNzbMSgV7SHvXs6mkcVX9ItRdfh_JA7csNr1CehTgh5ipMSAAo0QuDWTZIOt0Ls_rZS-wWVGQRj0xF71gXjfKVWyrdwZMar-1UQGOKmPA6H9Vad7AdYtt6BigGrDxmMAcWI1inYla7fPQsTmxgkVRsbMWkoFMYgs80sDoLOgJM435rT1CDgPG0V_NMo5-85PclBRevZPH-i3awB1bJqnmdD4jDzJExh8ufMTBCS5o-fyH8W-Ve_JqzQOPJZhWpjwMgLh63ptaAortXHQ1hHBrHIbUnmTzJOGh0H8CPvTIbIDzQyzDEhMC_3Y6Gt4cRccj5gqZGTCOhfiiksgCJKGhOgvUFKKaiN23uX0vdmQ=w1052-h789-no?authuser=0)
OPen beta updated to 1.0.5
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Compiler
- Compiler changed from 4.7-2014q2 to 5.4-2016q3
Changes
- (fix) Disable bogus ISO values 6400/12800
- (fix) Temperatures now correctly visible (debug menu)
- (fix) Included missing call _ml_cbr_init()
- (fix) Config is now loaded at startup
- (fix) ML Restore options now for correctly
- (mlv) Used cache-hack to force RAW video transfers in on each frame and other minor issues (raw.c,mlv_lite.c,...)
- (mlv) White balance EDMAC5 hijacked (cache-hack) while recording RAW video
Modules
- basic mlv_lite module running 8)
For optimal usage:
=> Disable global draw
=> Enabled "use small hacks" (mlv_lite)
=> Convert the mlv file (using mlv_dump.exe) and load this new mlv file into MlvApp and use RAW blacklevel around 800-900
The mlv lite module on the 40D is targeted motion time lapses - not real time video (due to limited bandwidth to the CF card).
The mlv_lite module can be used to record time lapses in (x1) or in zoom mode at (x5/x10) 1920x804 (1:2.39) at around 6 fps.
If you want to record at 24 fps you get a little less than VGA size.
Known issues:
- If you get an EDMAC errors when starting, just restart liveview
- If you inverted colors, shifted image, noisy image, just restart liveview.
- You might get 1 corrupted frames in the beginning of the video
- Digital ISO gain not working.
I only had the time to create one video in x1 mode:
double post ???
nice work for this oldtimer. You put a lot of efforts in this port and as you are already familar with QEMU (https://www.magiclantern.fm/forum/index.php?topic=1452.msg220263#msg220263) I would like to ask if you only plan to work on ML for 40D? maybe some DIGIC6/7/8 port next (once this got finished)?
Quote from: nikfreak on August 24, 2020, 08:38:45 PM
nice work for this oldtimer. You put a lot of efforts in this port and as you are already familar with QEMU (https://www.magiclantern.fm/forum/index.php?topic=1452.msg220263#msg220263) I would like to ask if you only plan to work on ML for 40D? maybe some DIGIC6/7/8 port next (once this got finished)?
Yep, thats the plan.
The only issue is time, I hope I can set aside the 40D somewere in 2021, and start using my time in a different platform. Just need to finish video recording and do some bug fixes.
Hi,
Heder Thanks a lot for your efforts and bringing Magic Lantern to 40d. I left checking 40d Magic Lantern port thread a long time ago. There were many people who started working on it but left incomplete. Thanks a lot that a genius person like you made it reality.
Emaad
Hi imme
Thank you for your kind words. Currently im working on Ant123s mjpeg video module, and this morning I finally got it running in 1024x680x24fps continuesly, very high quality. Im working on releasing the first version of this module next month.
Thanks so much. :)
Hi Heder,
1024x680x24fps woooww
I used this software to record video from 40d https://sourceforge.net/projects/eos-movrec/ (https://sourceforge.net/projects/eos-movrec/) and I was sure that one day someone will enable this feature in camera via Magic Lantern.
Quote from: heder on September 26, 2020, 11:30:44 AM
Hi imme
Thank you for your kind words. Currently im working on Ant123s mjpeg video module, and this morning I finally got it running in 1024x680x24fps continuesly, very high quality. Im working on releasing the first version of this module next month.
Awesomeness.
Quote from: heder on September 26, 2020, 11:30:44 AM
I finally got it running in 1024x680x24fps continuesly, very high quality. Im working on releasing the first version of this module next month.
Is 1024x680 in x5 Mode? I mean . . we can
expand the preview already :D
Waiting the good news, pretty nice!
Quote from: theBilalFakhouri on September 30, 2020, 02:35:29 PM
Is 1024x680 in x5 Mode? I mean . . we can expand the preview already :D
Waiting the good news, pretty nice!
1024x680 in X1 but ...
The mjpeg module compresses the internal YUV422 image. Changing the preview / liveview register will not change the internal YUV size. My rask is to reallocate the YUV buffers, make the CMOS and adtg register correct so 1 raw pixel = 1 YUV pixel. None have done that AFAIK. I need to freeze preview, change All YUV buffers, possibly change CMOS,adtg egister settings, change jpeg core registers, .. and .. headache :o
Expanding the preview is done in YUV HD path, that would mean in x5 Mode you can get less crop in YUV HD stream . . Changing YUV HD buffer is not required to expand the preview .. but
I could change YUV HD buffer size too, in 700D in Idle mv720 and mv1080 YUV HD buffer is 960x540, when recording H.264 video in mv1080 the buffer changes to 1728x1151, in mv720 it changes to 1280x689, and after that H.264 Encoder compresses it , taking a look what's happening between Idle and H.264, I can identify one EDMAC channel register which control the buffer size, and other registers related to it which make the expanded YUV buffer size usable instead of being black.
I got in mv1080 1728x1151 instead of 960x540 in Idle
mv720 1728x540 instead of 960x540 in Idle (1728x689 would be possible)
So now 1 RAW Pixel = 1 YUV Pixel ;D
in x5 Mode Buffer size is 1032x687 which matches 1032x687 of RAW data directly, expanded the processed RAW data in YUV HD stream (Expanding the preview) with increasing the YUV buffer size is possible, I got more than 1032 buffer width matches more than 1032 RAW data :D, but there is a limit at some point.
More Info at LiveView Investigation (https://www.magiclantern.fm/forum/index.php?topic=25287.0).
I don't think you need to change ADTG or CMOS, unless you want to increase the RAW data.
Hi theBilalFakhouri
Thanks for the input, looks really interessing with the YUV changes in your liveview thread, I'll try that out when I am ready. Currently working on the initial release, then afterward expanded the YUV buffer sizes so I can fit more pixels into that. In raw video x5 mode I get max 1920x804, and getting mjpeg 1920x804 would be nice for a camera that was'nt build with video recording capabilities.
That would very cool for 40D, Good Luck, Nice work! I am excited to take a look into MJPEG code :D
Quote from: theBilalFakhouri on October 01, 2020, 12:00:16 PM
I am excited to take a look into MJPEG code :D
You can look into my current version (https://filebin.net/tykbeh2to6sq890t/mj_rec.c)
But:
Quote from: a1ex on February 23, 2019, 09:34:06 AM
On newer models (DIGIC 5, IIRC also 60D and newer DIGIC 4), this function no longer runs automagically while in LiveView, so this approach is only valid for older models.
This is what happens in the main lv jpeg compression function called in liveview
"LVJpegEncodePath":
1. Create a event flag
2. lock used engine resources
3. Setup edmacs, jpeg core registers
4. Start edmac transfers (YUV422 => jpeg core) and start jpeg core
5. Wait for core to complete (wait for event flag)
6. Delete flag
7. unlock used engine resources
Its going to be hard to get that running on other cams, but is not impossible. This actually look 99.99% excat the same as when photo mode does the excat same compression on the 40D ("JpegEncodePath"). It's a single isolated function, called in the LiveView.
Hi all,
So, went through all pages here and just wanted to confirm if I maybe a bit too dumb to understand the codes used here or the LiveView "timeout" is not on the list of mods planned.
Currently my 40D times out at around 30 min and closes LiveView (I am using at work as a webcam to present stuff to the team, so EOS Camera Movie Recorder + OBS), but I could only find the LiveView mentions as being part of the video function, if I got it correctly. Do you know if there is any flag I could maybe change to remove the limit to it?
Thanks!
Quote from: ArchThor on October 17, 2020, 01:00:14 AM
Hi all,
So, went through all pages here and just wanted to confirm if I maybe a bit too dumb to understand the codes used here or the LiveView "timeout" is not on the list of mods planned.
Currently my 40D times out at around 30 min and closes LiveView (I am using at work as a webcam to present stuff to the team, so EOS Camera Movie Recorder + OBS), but I could only find the LiveView mentions as being part of the video function, if I got it correctly. Do you know if there is any flag I could maybe change to remove the limit to it?
Thanks!
Hi ArchThor.
I didn't even know there was a 30 minute limitation, so I will look into this when I have the time. I have LUA scripting
module running (but not released yet), and perhaps I can merge with the LUA fix scripting branch, and using
the LUA module avoid/fix this limitation, but no ETA on when this is ready.
hi,
any updates :)
I'm still working on mjpeg streaming. Ant123's module would not run record smoothly, so I reworking Ant123's module, making it more towards mlv_lite but my reworked module is not working yet. Also due to house renovation progress is a little slow lately, but I have not forgotten the ML project ;)
Managed to boot your build in qemu, now i can boot both canon firmware and your ML build. :)
(https://i.postimg.cc/DJjg9hFJ/Untitled.png) (https://postimg.cc/DJjg9hFJ)
Next I'll try to run it in the camera and dump the RAM.. Also.. How would one go about finding the half shutter button? Id like to try that.
Thanks for your work heder!
Quote from: kidkoala83 on January 01, 2021, 09:14:33 PM
Managed to boot your build in qemu, now i can boot both canon firmware and your ML build. :)
(https://i.postimg.cc/DJjg9hFJ/Untitled.png) (https://postimg.cc/DJjg9hFJ)
Next I'll try to run it in the camera and dump the RAM.. Also.. How would one go about finding the half shutter button? Id like to try that.
Thanks for your work heder!
Hi, your qemu looks really good 8) (mine is crap)
My lastest build is here my lastest build (source code) is here
https://github.com/jmheder/ml/raw/master/vxworks_1.0.5.zip The half shutter fix is included, but only lightly tested. The source that fixes the half shutter is platform/40D.111/sal-digic4/sal-gui.c (the function is called sal_GUI_E_Control). Basically i'm hijacking the GUI_E_Control function and checking for half shutter. It's not the best solution, but because the half shutter on Digic3 is not like on the Digic4 platform, hijacking GUI_E_Control was the easy way of getting "the job done".
If you get stuck, just ask, there's no bad questions, just bad answers.
I'm still working on mjpeg, totally stuck, fighting with odd errors, I dont understand.
A new incomplete list of stuff todo
* edmac module fails (edmac is working, but module fails)
* beep sound not implemented
* auto exposure value not detected (I gave up on this one)
* ants mjpeg module is not recording correctly (working on this)
* get 40D branch on heptapod
* compile and test 40D with gcc 6.x compiler.
* Lua module is loading and working, but is it useable ??
* 1st memory job stub function not found.
* lots of PROP_ (properties) not aligned.
* zebras in liveview missing
* global draw (zebras,histogram) not shown in photo mode (= crash)
* Better SW1/SW2 activation
* continue to update https://magiclantern.fandom.com/wiki/Register_Map/40D
* Optimal Mirror lockup not implemented (as minimum the curtain is activated), disable the curtain activation
* 10/12 bits raw video,
=> Theoretical: (10 bits, 23.976 fps, 1:2.39 = 1056x432) & (12 bits, 23.976 fps, 1:2.39 = 960x400)
=> Require merge with 10/12 bit branch
* LV state mashine
=> not re-engineered
=> VSync er performed via EngDrvOut hijack (ok for now)
* FIO_SeekSkipFile does not work at all .. why ?
=> SEEK_CUR,SEEK_END fails.
=> only SEEK_SET seems to work ..
=> could be cache ?
=> could be interface ? / parameter swapped ?
* selftest module fails
=> only a few tests runs as they should
* bench module fails
=> issue with memory allocation,
=> CF card benchmark may not be performed with buffers > 2 MB or the system halts
* memory system allocation
=> still fails on large buffers, bench module fails, selftest modules fails.
=> mlv_lite does not fail. (allocates above 20 MB)
Finally a little progress on the port.
I finally found the missing bugs in the FIO_ system which have been annoying, I found two issues.
The interface on FIO_SeekSkipFile is wrong. The interface in magic lantern (DryOs) is specified as: int64_t FIO_SeekSkipFile(FILE *, int64_t offset, int whence); but VxWorks interface is actually: int32_t FIO_SeekSkipFile(FILE *, int32_t offset, int whence); No wonder I could'nt seek inside a file at all! (all seeks was SEEK_SET due to wrong parameter sizes)
The other bug was the O_SYNC flag screws up operations. FIO_CreateFileOrAppend would not perform correctly when seeking inside a file because if was opended with O_SYNC. It seems like O_SYNC is'nt supported (?). I tryed with both cache and uncache memory, both fails with O_SYNC. Removing O_SYNC from opening file solved the issue.
And with console.c writing console.log correctly (now) I can assume hunting the last fio_malloc() bugs ..
Quote from: a1ex on March 09, 2019, 08:05:05 AM
FIO_SeekSkipFile: should be testable in QEMU, with a large SD image and the test code from selftest.mo. That test will create a large file (2GB) and seek within that file.
There are two versions in Canon firmware: one that accepts 32 bits for the position and another one that accepts 64 bits. They are not interchangeable at binary level.
Quote from: Ant123 on January 16, 2021, 01:23:00 PM
Yep, using the 32 bits worked, but I also needed O_SYNC removed.
Good news. Memory management on the 40D soon complete
SRM allocation is up and running in QEMU and camera :D
(https://lh3.googleusercontent.com/pw/ACtC-3f_HAz8LbsTNVpU3GRw5fwXS2j7pm3bnbmYcinRB-vwNf-2KmLqBQh75F1oXG8zZJpPIg08LX-4-f-r018lQs47qKX7DtOQVCEp4RoWKHXrpKJirm76iTHQlOuCS7yUklauAeeawZisLz_tfhjmx9K7=w652-h461-no?authuser=0)
I have found that SRM_AllocateMemoryResource1stJob functionality is present in the Vxwork firmware, but the code is completely different from the DryOS cameras. Calling call("FA_CreateTestImage") and call("FA_GetCwRawBuf") did however still work like a charm, and I get access to a full Craw buffer = 18153360 bytes. Thus I have created compatible SRM_AllocateMemoryResource1stJob+free functions that uses the call("") functions, this should also work for 400D. SRM_AllocateMemoryResource1stJob on the 40D can actually allocate more or less all memory, outside Liveview I get 14 buffers, inside Liveciew I get 11 buffers. The camera has total 256 MB on board and most can be allocated using SRM_AllocateMemoryResource1stJob and shoot_config(0). I can allocate a total ~240 MB, Mlv_lite will benefit from this (mjpeg recording too - when it is done). Next step is to update mlv_lite to use this memory, so we can start recording less useless formats.
Beside this I found that the largest non-temp block (malloc,AllocateMemory) on 40D that can be allocate is very small :( a little less than 4MB, but the code assumed 20 MB, and this could crash the camera, fixed.
Open beta update (1.0.6).
https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
With the memory system nearly completed, its time for another beta release, as mlv_lite can utilize this. This improves the recording capabilites abit.
Memory system:
* SRM compatible function implemented inorder to avoid new code, I used [SBF]CreateSharedBuffer for allocation.
* malloc fully supported in fio_malloc (get free region fixed)
* Largest shoot malloc block is around 4MB, fio_malloc updated to pass allocation to SRM above 4 MB.
* Disabled memory analysis overlay (debug menu), it will crash the camera (overlay width,height incorrect?)
Bug fixes / minor changes:
* CACHEABLE() & UNCACHEABLE() changed due to incompatible between digic4 and digic3.
* edmac channels now switch automatically between 0x4 and 0x5
* console now uses FONT_MED due to low resolution display, and included more options and buffering
* FIO_SeekSkipFile interface corrected and FIO_CreateFileorAppend corrected.
* FIO_WriteFile wrapper not checking for digic4 uncacheable pointers correctly
mlv_lite:
* mlv_lite can now allocate ~208 MB, instead of ~40 MB
* srm memory allocation enabled (if set true in menu)
* pre-recording disabled - will prevent camera from recording correctly
* Starting and stopping LiveView multiple times may set preview=black, resolve this by power off and on.
Lots of work went into this I'm sure - well done. I think this is the oldest supported cam? You are now a record holder :)
Not quite. 5D (classic) preceeds 40D. https://www.magiclantern.fm/forum/index.php?topic=1010.0
Last update stops at 1.0.6.
Next update will be in 2022/2023. I ran out of luck (time), RL is taking all my time, shit happens once a while.
I'll be watching this thread and ML forum until then.
Hello everyone, I need your help.
After installing this firmware, the camera did not want to start, although everything was done according to the instructions + video. From time to time I can achieve that the red light is on.
I ask for help, can someone tell me how I can forcibly roll back to the old firmware version or install this version correctly?
Quote from: MagicJohny on July 04, 2021, 10:16:29 PM
After installing this firmware, the camera did not want to start, although everything was done according to the instructions + video. From time to time I can achieve that the red light is on.
Magic Ball tells: Don't use SD-to-CF adapters. They are crap and ML doesn't support issues with this kind of adapter.
If Magic Ball is wrong: Remove battery, remove card. Insert battery. Do not insert card. Startup cam and report back.
Quote from: Walter Schulz on July 05, 2021, 10:39:25 AM
Magic Ball tells: Don't use SD-to-CF adapters. They are crap and ML doesn't support issues with this kind of adapter.
If Magic Ball is wrong: Remove battery, remove card. Insert battery. Do not insert card. Startup cam and report back.
It started without a memory card. I do not use SD-to-CF adapters. Thank you.
If I insert a card, it is still busy in the mode and the red indicator is on.
Give some details about the card you are using.
Check card contents. Is autoexec.bin located in card root?
Do you have a spare card to use with ML?
Quote from: Walter Schulz on July 05, 2021, 08:04:38 PM
Give some details about the card you are using.
Check card contents. Is autoexec.bin located in card root?
Do you have a spare card to use with ML?
kingston compact flash cf/16gb-u2
(https://i.ibb.co/KXmrFQd/image.jpg)
Thanks, looks fine!
Heder told he would be busy with other things for quite some time. You may have to wait for thread confirmation by a mod or you want to join ML's discord channel to get some support. ATM Heder is the only one working on this port.
I Guess I need to do a better install video next week, currently im om Mallorca ;D
Heder
We are waiting for more updates....... :) :)
Do not use plural form to express your own expectations.
https://mikemcquaid.com/2018/03/19/open-source-maintainers-owe-you-nothing/
Also, nice work @heder!
(https://kitor.pl/eos_r/img/40d.jpg)
Happy new year !I fought in 2021 Q3/Q4 with Ant123's jpeg motion video module, spend days on getting it to run, but could'nt resolve a bug causing drops, but now it's running in a prototype version. Current capabilities on 40D is 1024x680@max 30 fps, here a teaser at 1024x680@24fps:
SD (rubbish) resolution youtube video:I will work toward a minor release with this module, ETA somehere in 2022@Q1. There still alot todo, stay tuned ..
What a beautiful, clean image. Bravo.
Hi.
Some interessing info regarding the process on mjpeg recording.
After alot of testing, I have finally completed a proof of concept that I can change the HD image (YUV Path) and 40D's internal JPEG path in such away that we can get proper MJPEG video recording at a bitrate of approx 12-14 MB/s. The previous video (see posts above) was using standard HD images 1024 x 680 in x1 mode (binning x3), but by changing the YUV path into it's real original size I now have a format of 1288 x 820 (non-stretched). I known this is'nt going to make any real different, but the real goal is'nt x1 mode, the real goal is zoom mode where we don't have any binning (x5,x10) and where we can read the sensor pixel by pixel. On top of that, zoom mode x5 and x10 have by default set into 1944x806 mode, that FULL HD 1:2.39. The only thing I have not been able to test/control yet is the jpeg quality, which is really important when I reach FULL HD quality. Currently the quality on the HD image is really too high (lossless ?) and I need learn to lower it, inorder to get enought recording time at 1944x806.
To get 1288 x 820 I changed the following registers (including hijacking YUV buffers pointer and EDMAC's):
0xc0f1154c // HD stretch register format (xxxx | yyyy), when xxxx=yyyy, ratio => 1.00
0xc0f1150c // HD stretch register format (xxxx | yyyy), when xxxx=yyyy, ratio => 1.00
0xc0f11518 // HD width = 1288-1
0xc0f1155c // 850 | HD width
I will work towards a release with 1288 x 820 MJPEG recording capabilities and after that I will go for 1920x806.
Here is a 1288 x 820 luminance test image, the image has some artifacts, but I was using singlebuffering and the save function was really slow, but still proof of concept 8), click on the image to expand to full size.
(https://lh3.googleusercontent.com/pw/AM-JKLXKIaT31YamA88Qki0RcGj43LVyZB73TuQjLeHQ5bf7OvIgQ3AbXjhf2KxFu8E2E1DweuP_MWAxowQCiSSG7J4KEAzw2ZCeTj2rH_XHQ7Xv1l9XlmV1rqeHFPUsSLCKi8yZk0nK69WFplopnvwEqaSP=w1241-h789-no?authuser=0)
Hi heder! :)
I finally got ballsy and went beyond qemu to test your 40d port in my camera, it works and I am able to play Arkanoid and mess a bit with the intervalometer.
Been trying the raw video but don't understand very well how it works, it seems to stop automatically after short periods, and also then after I don't know what to do with those files, how to play those raw vid files, looking at my CF card I think the are the ones with .mlv extension..
If someone knows how to play them that be great.
Those mjpeg new features are looking great, wish I could help somehow.
Is great to see that finally unfold as we knew the 40d might be able to record video since 2008!
Thanks a lot and a big hooray to heder!!!
Quote from: kidkoala83 on March 08, 2022, 12:25:50 PM
Been trying the raw video but don't understand very well how it works, it seems to stop automatically after short periods, and also then after I don't know what to do with those files, how to play those raw vid files, looking at my CF card I think the are the ones with .mlv extension..
https://www.magiclantern.fm/forum/index.php?topic=20025.0
Stopping: Mostly because write rate is too low to keep up with sensor's data stream. You get a mere 12.5 (give or take) MByte/s with 40D's card interface.
Ok, MLV app is working like a charm, thanks! :)
My vids are quiet buggy though, in the other hand they were my first try with raw video..
Contrast seems really hight, sometimes the screen just fades to black..
Still amazing to have been able to record some vid with the 40D! :)
Looking forward to mjpeg.
Why does my image fade to black when recording raw video? Could that be bad for my CMOS sensor or something? Should I stop the vid when that happens?
Quote from: kidkoala83 on March 08, 2022, 12:36:39 PM
Ok, MLV app is working like a charm, thanks! :)
My vids are quiet buggy though, in the other hand they were my first try with raw video..
Contrast seems really hight, sometimes the screen just fades to black.
Still amazing to have been able to record some vid with the 40D! :)
Looking forward to mjpeg.
Why does my image fade to black when recording raw video? Could that be bad for my CMOS sensor or something? Should I stop the vid when that happens?
Hi kidkoala83.
I did a quick one minute mlv_lite recording test using 1.0.6, format 924x388@24 fps, and did not see any issues. Im shooting in mode "M". Try to record a video with and without "small hacks" option to see if this changes anything.
If I go as low as 640x160 and 5:1 or 4:1 aspect ratio i get continous mode in green letters, that seems good..
Under heavier loads i get blueish cold temperature screen, or snow, or splat screen half-half mirror effect..
How do you get those non standard resolutions of 924x388?
Do you use fps overrride to set the 24 fps?
What do "Use SRM job memory" and "Small hacks" do? How can I load the mlv_play module for playback?
I am enjoying very much testing the video on the 40d. :)
Quote from: kidkoala83 on March 09, 2022, 10:33:46 PM
If I go as low as 640x160 and 5:1 or 4:1 aspect ratio i get continous mode in green letters, that seems good..
Under heavier loads i get blueish cold temperature screen, or snow, or splat screen half-half mirror effect..
How do you get those non standard resolutions of 924x388?
Do you use fps overrride to set the 24 fps?
What do "Use SRM job memory" and "Small hacks" do? How can I load the mlv_play module for playback?
I am enjoying very much testing the video on the 40d. :)
Hi.
Small hacks = disable white balance, disable auto exposure, tweak CF card.
Use SRM job memory = use photo memory for capturing (without SRM you are limited to 40MB buffers, with SRM > 200 MB)
mlv_play = bugged, does'nt work yet, use MLVapp.
Yes I shoot at 24 fps, I can shoot any size that the camera allows without issues.
What happens if you recording zoom mode (x5,x10).
What CF card are you using ? (old or new?)
Does the blueish cold temperature screen or snow, some slowly while recording, or does it appear when you start LiveView ?
Does the blueish cold temperature screen or snow
disapeer if you close and re-open LiveView ?
Blueish cold temperature screen or snow, is a typical indication that the video timing becomes screwed.
The closest I get to 924x388 is 928x388 at 2.39:1 .. What aspect ratio are you using? Or it might have been a typo..
The Blueish cold temperature screen, snow, or half-half screen effect shows on liveview, it does disappear if you turn it off and on again, at least temporarily.
Haven't tried the x5, x10 zoom yet.. Should I be recording with zoom on?
I am using an old 2Gb CF card for testint Magic Lantern, from the year 2008 or so..
Btw, what is binning? What does the SRM acronym stand for?
Quote from: kidkoala83 on March 10, 2022, 11:39:59 AM
Btw, what is binning?
https://wiki.magiclantern.fm/glossary#pixel_binning
Hi
QuoteWhat does the SRM acronym stand for?
No idea, but the "SRM_" name originates from the firmware itself.
QuoteThe closest I get to 924x388 is 928x388 at 2.39:1 .. What aspect ratio are you using? Or it might have been a typo..
The 924x388 is properly just a typo, my mistake.
QuoteThe Blueish cold temperature screen, snow, or half-half screen effect shows on liveview, it does disappear if you turn it off and on again, at least temporarily.
Do you get these effect in LiveView even without recording ?
QuoteHaven't tried the x5, x10 zoom yet.. Should I be recording with zoom on?
When you go into zoom mode, mlv_lite is not recording in "zoom mode", but rather the raw sensor (not binning mode), mlv_lite for 40D can currently recording around 1920(?) x 806(?), but the crop mode is high and aspect ratio around 2.39
1. try to disable Small hacks
2. try to recording in zoom mode.
QuoteNo idea, but the "SRM_" name originates from the firmware itself.
System (Static?) Resource Manager, on newer models you find a lot of RscMgr.c references. It manages most of memory space, "regular" malloc / AllocateMemory are a very limited pool.
SRM_AllocateMemoryResourceFor1stJob is just a nasty hack that uses SRM Factory mode to allocate a lot of memory. There's a ton of other allocators, they behave differently per camera mode.
https://www.magiclantern.fm/forum/index.php?topic=12528.0
I will do further testing when I can, the blueish/snow/half mirror was happening in high resolutions and aspect ratios in liveview but not even recording yet if I recall right, in fact those might had not even been set yet.. Just liveview no recording, quiet sure..
Once more, thanks a lot heder! :)
Ok, Ive checked. The weird effects happen in live view, not recording, without fps override enabled (OFF), turning live view on and off seems to fix it momentarily.
If Im not mistaken it only happens in fps above 24, 29.9 for instance, setting fps override (ON) at 24 fps seems to fix it.
Hi Kidkoala83, thanks for testing the build!.
I have seen the blueish/snow/half mirror snow effect from time to time on my camera, and it's surely my ML build that does it. I also see these issues on test builds where I mess around with timing. I don't see it currently, but it might just be that I have coded the build to fix perfectly to my camera but not yours. Its timing related becuase I have hijacked all driver functions that writes to the peripherals (sensor, cf, display ... ect). I don't have another build currently, but the next build I will optimize and change the code and hopefully the issues will go away.
Currently I'm stuck for the 2-3 weeks, due to the war in Ukraine, my office is occupied by a grow up daugther of one of our friends from Ukraine. I have the YUV path running correctly and "just" need the jpeg path hacked and then the camera can do 1288 x 820 recording.
hey guys
any update
I have been working on getting the mjpeg video recording running at 1336x872 (non crop mode) or similar but it partly fails. The original size 1024x780 is'nt interessing due to the small size. I actually have the YUV conversion path running (sensor->YUV conversion), see post from 6 of March 2022, but the YUV->JPEG path partly fails. I do get a correctly sized image with good pixels, but I also have a green pattern all over the place. I have failed to fix this so far. No one have documented to JPEG engine and registers so it's a black box.
Here is my pattern problem:
(https://lh3.googleusercontent.com/pw/AL9nZEWu3a2SJYxTRlEerL9vLM0avXKuXpgG04RZcfewwg2nZYOdQpbl12OiDxLFxv1v_AOMZOwG9jjMfrh_Qfkw3nnLOi9aTc6e2TXrKI6lRAxZcqe12fjHEb039jv5Kr8gqwmna8wCXcvteFxiOYFA-MGG=w1088-h640-no?authuser=0)
I'll give it another month, and If I fails, I'll try to x5 zoom mode. x5 zoom mode is harder to work on, because I need to change much more registers, but I properly have a slightly higher properbility of success with the YUV->JPEG path as the 40D can save JPEG photo images in 1936x1288 format (small size), and I can utilize this to find the correct registers for a 1936x1288. Max format in crop more (x5,x10) is 1944x806 (full HD 1:2.39)
General note: from own preview experiments on 700D/5D3, LiveView seems to have multiple layers, if one of the layers didn't match horizontal resolution of e.g. YUV path, some artifact would show (similar to your image). But no idea if it the same thing in your case.
Try to compare registers among none crop mode vs x5 mode, tweak registers you found and see if one of the registers causes these kind of artifacts. We usually do this by adtg_gui module on DIGIC 4/5.
If x5 mode works for JPEG recording and you prefer none-crop mode, You can patch 1:1 (x5) mode back to 3x3 (none crop) mode without touching preview registers, see this (https://www.magiclantern.fm/forum/index.php?topic=17021.0). This can be done using CMOS and ADTG registers and it's very simple. We also can do this by adtg_gui module, and it's very simple to do it. Unfortunately no idea how to do it on 40D.
Quote from: theBilalFakhouri on August 07, 2022, 10:05:46 PM
General note: from own preview experiments on 700D/5D3, LiveView seems to have multiple layers, if one of the layers didn't match horizontal resolution of e.g. YUV path, some artifact would show (similar to your image). But no idea if it the same thing in your case.
Try to compare registers among none crop mode vs x5 mode, tweak registers you found and see if one of the registers causes these kind of artifacts. We usually do this by adtg_gui module on DIGIC 4/5.
If x5 mode works for JPEG recording and you prefer none-crop mode, You can patch 1:1 (x5) mode back to 3x3 (none crop) mode without touching preview registers, see this (https://www.magiclantern.fm/forum/index.php?topic=17021.0). This can be done using CMOS and ADTG registers and it's very simple. We also can do this by adtg_gui module, and it's very simple to do it. Unfortunately no idea how to do it on 40D.
Thanks for input.
The YUV Path runs correctly. I don't have any artefacts, and the registers are quite similar to the one you descripted. The image from 6 March is a image from the updated YUV path. (greyscale image, converted from YUV). It's the JPEG "path" compressions that run incorrectly, but the JPEG engine is largely undocumented. The YUV is transferred in macro 8x8 blocks into the JPEG engine in a specific pattern, properly due to JPEG engine ram or similar (and another EDMAC is configured to readout on the fly, this works fine). I had compute re-compute the EDMAC value in order to get image transferred. By looking at the different video/photo modes I was capable of re-computing the new EDMAC values. This works for some image width (1024,1088,1280), but I get those artefacts. I did compare x1 versus x5/x10 inorder to get a feeling for that needs to be updated, EDMAC and JPEG registers.
Basically I'm hijacking the 40D JPEG Path "main" call and changing the image size, and JPEG engine get correctly configured, but the EDMAC value for transferring into the JPEG engine is hardcoded and those is changed on the fly. Also some JPEG related registers needs to be corrected for the entire path to run.
My current assumption is
1. Either I'm missing at update some JPEG related registers
2. or EDMAC is configured incorrectly.
Quote from: heder on August 07, 2022, 08:47:31 PM
No one have documented to JPEG engine and registers so it's a black box.
Have you tried to logging (https://www.magiclantern.fm/forum/index.php?topic=2388.msg197313#msg197313) MMIO traffic through JPCore?
Quote from: Ant123 on August 08, 2022, 11:18:21 AM
Have you tried to logging (https://www.magiclantern.fm/forum/index.php?topic=2388.msg197313#msg197313) MMIO traffic through JPCore?
I'm logging all engio functions, including a special one on the 40D assigned only to JPEG, but since you'r asking .. I suddenly remeber I have seen multiple jpeg registers set directly without call to engio function somewhere, now I must hunt for these value!.
I tracked down the missing hardcoded registers and they seem to be set correctly, these are JPEG engine registers for control, mode, macro block size, etc, all seem correctly set. If they're set incorrectly the JPEG engine wont work at all. Then I realized that one of the EngDrvsOuts functions was'nt being hijacked logged correctly, and the calls did not go into by log. Oddly I can't hijack this address (function entry) but when I hijacked the next address it worked. So I logged all registers again and looked - but without any new result. This EngDrvsOuts function is only used in some rare cases with the jpeg engine.
So I'm, currently back to changing registers. I have gathered various bits of information regarding these, but nothing conclusive yet. I now need to investigate each registers that is used in conjunction with YUV image transfer in blocks into the JPEG engine, this is around 20 registers around 0xc0f11??? and 0xc0f13???.
Pattern is gone, but colours are screwed up, at least proof that I'm on the right track. I fighting 3 registers: 0xC0F13008, 0xC0F1300C, 0xC0F13010
(https://lh3.googleusercontent.com/pw/AL9nZEW39jArVF-LVykX3FN8cVZpoHj9DIWVAIVIuUkItkv0XjtB5a-xxTki6URLiwVtR7zU0kg8_r0z7y0ct3xclghxMfQRM5sfD_bAbI6EoKkr5onIjILY2xsSyyn7w5-OTdKsF_o5pIG1edVv4oBTkC_Y=w1088-h640-no?authuser=0)
Nice work, keep it up!
8)👍👍
OMG .. 8) 8) 8) it's only HUUUEEEEE ! Pimped gimp image (hue-saturation +85 degrees)
(https://lh3.googleusercontent.com/pw/AL9nZEWDRZYeIQT7W74r7R-G-XcPcaH2bpwoshPQGslKShmXyLADEzewGMOfy8vln0PLlZMTE1IXr1nPsD7YY35ZGDby-5XdRXlSVh27vFHthKvcpESmQUF-oqedIOPKtn5EN5_ZYn8--bJLrA_jxYYy9-eo=w1088-h640-no?authuser=0)
congrats! it is very interesting to watch your progress even if I don't have 40D :)
Any update
None, atm. I can't get the motion-jpeg color's correctly. There are so many registers involved and unknowns that I'd sort of put that on hold. I can get the YUV scaled correctly, it's really fine. But when I transfer this YUV image to the jpeg-engine, the jpeg color's become incorrectly. I thought it was just hue shifted but I was wrong. The image above looks pretty, but its wrong.