Messages

I have also learned that the ARM sets up different memory regions with differing permissions in each. Different permissions can be given for user and supervisor mode (ARM mode) for these regions. The permissions can be like this (taken from ARM docs):


UNP = unpredictable


Note: from what I have found, the ARM is put into supervisor mode at FF81008C (during early boot) and isn't changed back to user mode ever. I guess it always runs in supervisor mode while the camera is booted/running. The only thing supervisor mode really does is provide a few extra registers to use, so not very important.

I think that if we use g3gg0's cache hack to boot ML, we may be able to make ML work on all 5dc cameras

I've been working with him trying to make it work, and also studying the ARM documentation for how it all works. In a nutshell:
The ARM (processor) doesn't read instructions and data directly from the ROM/RAM; rather, it reads them from a cache (to provide a lower latency read method). I don't know many details yet, but essentially when VxWorks reads or writes to/from say address 0x123, the ARM uses 0x123 and applies an index to it, to know where in the cache to look for this value.

So, we can modify this cache to essentially re-write parts of the firmware. So, g3gg0's boot hack works like this:
- Replace the pointer to canon's startup task with a pointer to ML startup task (so canon starts ML startup task instead of its own).
- ML initializes and at the end of the ML startup task it calls the Canon startup task to continue booting like normal.

So instead of re-writing all of the boot code (which appears to be the problem with the 5dc, some cameras work some don't. The ones that don't are halting on the bootcode I have written), we call the camera's normal boot procedure directly and hardly have to do a thing

The ARM documentation is actually quite helpful now that I am reading it and not skimming it for key words. We're pretty lucky to have this documentation available to us. The interesting stuff can be found here regarding the Control Coprocessor CP15's registers:
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0201d/index.html

Hello, i tried the firmware. My 5d serial is DS126091 no 470300725.

Got the solid blue LED. After removing the battery it did not work at all. Shutter button disable, but the three small button (iso, af, metering) still work...

Sounds like the others. So, another new new: serial #s can start with 4 as well. So what makes it only work on serial numbers starting with 09 and less (like 08, 07, etc). Hmm..

Heres a thought. I use the Canon SDK to write EOS apps and don't quite understand the difference between how that works and how the ML software works. But heres an idea.

If we could write something using the SDK that queries some camera settings and writes to the logfile. We could run it on the old models and the newer models and see what the difference is.

I could write the app but I have no idea what camera configuration settings to look for.


Make any sense? At lease the app could run and connect to the camera and not hang up. Just not sure what we could look for.

Walt

The main difference is that ML runs with DryOS, instead of just a layer between DryOS and remote computers (like the SDK). ML can intercept remote commands sent to the camera using the SDK. We can really do anything with ML.

The only difference I know between the 5dc models is the screen (i guess they replaced it in later ones). I called a canon tech tough and he assured me that there is absolutely no difference and the serial number isn't significant.

Obviously he didn't know what he was talking about....

[what]

It looks like if your serial number starts with something less than 093, then it will work for you. I just don't get what could be different between 5d classics to make ML not work, if they all use the same firmware version / updates :|

talk about a headache..

so, did that register map help you guys out? 

I've started a minimalist project for the 1000d which runs the VxWorks operating system, it is almost identical to the 450d. Someone with development experience would be able to take over / finish the project (I don't have the time). Especially since I have ported ML to the 5dc, it would not be hard at all to port ML to the 450d and 1000d.

https://bitbucket.org/coutts/1000d_dev

does anyone have a firmware dump of the 650d? I'd like to see how the touch screen works

I like your earlier thought

" I need to figure out where the boot process is being held up at in newer models."

Maybe build a version with debugging output for all the boot process actions to a file on the CF card and one of us with the newer model can run it.

I'm still trying to think up a solution, don't worry
The problem is I can't put LED blinks anywhere in that early boot code, or else the camera doesn't boot.
Also, I can't use file i/o until vxworks is initialized so it's way too early in the boot process to do that. hm..

I heard there are 2 different kinds of 5D around. The first one had a very poor LCD-Screen which was later replaced by another one (same specs but better). For example described in here (http://forum.mflenses.com/canon-5d-mki-with-bad-lcd-display-what-to-do-t16925.html. It could be that there were some minor internal changed made after replacing the screen. This is just an idea, don't know if it's related to your problem with booting on old or new devices.

the problem is this isn't an issue on any other camera, so nobody knows how to fix it (basically how it's been the entire time porting to the 5dc...)

Success! I asked kindly and was awarded a full spec data sheet for the ML26121A. Register map included hope this helps!

http://db.tt/lYtYhsBf

I emailed LAPIS, they are going to send me a datasheet for the ML26121A

Waiting for a reply but I will keep you updated.

Guys, just tested mine - SN 3821300458 DS126091

Got same results as others. Blue light came on solid. I pulled the battery - restarted and the back buttons dont work.

Pulled battery, formatted card, restarted and all is well again.

Walt

It sounds like serial numbers that start with numbers > 092 dont' work, so only the oldest 5dc can run it. Hmm. I need to figure out where the boot process is being held up at in newer models.

I need users who test this to please PM me their serial #s (both the DS one and the longer # one), along with telling me if it worked / didn't work for them.

I'm beginning to think maybe there is some new revision in 5ds and only the old ones work.

"The 40D, 450D, 1000D and 5Dmk1 are similar in hardware they run vxWorks."

CAN I USE THIS BETA ON MY CANON 40D as they are similar in hardware??? 

not at all, there are way too many differences between the cameras. someone with a 40d needs to port ML to it.

I have updated the installer FIR included with the download in the original post. It now calls the bootloader function responsible for setting the card bootflags. So, users will not need to worry about making their cards bootable now. Still not sure why this isn't working on some cameras, I need more testers to try and report how it works.

I wasn't able to compile ptpcam.


>> Entering to core
gui.c -> gui.o
-> main.elf
arm-elf-gcc: error: unrecognized option '--start-group'
arm-elf-gcc: error: unrecognized option '--end-group'

Also what is the right platform?

Default:
PLATFORM=s3is
PLATFORMSUB=100a

I had this problem too, compile with normal gcc not arm-elf

I've only succesfully compiled this under ubuntu (same with alex). BUT, ptp-chdk is broken in the current ML code I have discovered. In past versions of ML, the ptp handler was registered. In the current repo, I couldnt' find any calls to ptp_register_handler, which means it never registers the ML ptp handler.


also, the usb error is because you need to install libusb: http://www.libusb.org/

EOS M

I just tried it, my 5DC is half dead when I make my CF bootable for ML. The all buttons located at the back of the camera does now work (no reaction from LCD nor camera) + the shutter button can focus but won't snap a shot. Pressing the "Trash" button does not display the ML menu.

I followed the instructions on how to install ML + 5DC hack. At first I got a steady blue light and when ML won't work for me I updated the Mod firmware twice to disable then enable bootflag. Same result as before (Half dead state).

And Auto ISO will be the best addition for 5DC as I shoot events more often (light conditions vary)

Oh and my 5DC still works normally, just couldn't get (beta) ML to run.

Keep up the great job!

Sorry about that, this is confirmed an issue now due to the link I had up for making the card bootable. Tomorrow I will make the installer write the bootflags to the cf card (like ML does for other cameras).


Just to clarify, your camera was not bricked there. It is only a "soft brick", pulling the battery and putting a good card in fixes this. I guess the mac program to make bootable cards doesn't write the correct flags.

edit:
i guess it's not working even using the make_bootable.sh script... something is wrong here

Btw, if you are on Mac or Windows (!) you can use the Yagarto toolchain just fine

+1 for yagarto, makes compiling on mac super easy. No waiting for summon-arm, everything is pre-built. Just extract the files somewhere and you're set.

Beta 1 is available for download. Please check the first post of this thread for details.

coutts, thats some very helpful information and should probably go into the wiki!

should be more than enough to get any port started

touch screen may make things hard (they say almost everything is controlled using the touch screen), but we will have to wait and see.

Can someone with a 5d3 please send me a ROM dump from 0xFF0C0000 - 0xFFFF0000 of firmware v1.1.3?

For 500d:
http://www.asahi-kasei.co.jp/akm/en/product/ak4636/ak4636_f01e.pdf

I didn't so much mean to follow the MGAIN stuff, moreso look at how I set individual bits for the MGAIN registers. Thinking of things in binary may make it easier to understand.