Dumb question, what's necessary to customize the video bitrate on the firmware? Not a programmer, but I can script.
The EOS M2 had 50mb which produced beautiful 1080P video and no audio compression which resulted in great fidelity; vs the low bit H264 and AAC that Canon throws on the EOS M3 to neuter it so it doesn't compete with pro offerings since the autofocus and software IS is good on the M3/new APS-C's. I almost want to buy another M2 (sold it once I bought the M3) since it did such a good job with video.
It dumps 32 MB from 0xF7000000, which covers both ROM0 and ROM1 - that's what you need to run ML in QEMU. For analyzing the code, you can load ROM1 (the second half of that file) at 0xFF000000.
Usage: run firmware update, then go to play mode (make sure you have an image there), then look on your card. Keep the dump for yourself, do not publish it online.
does this mean we could start porting ml to eos m2?
Guess the biggest issue would be finding someone to actively work on an M2 build?
Guess the biggest issue would be finding someone to actively work on an M2 build?
Correct.
Current developers are happy to help. But there needs to be someone else to take on the bulk of the development work.
Seems like this one should be one of the "easier" ports.
{
.name = "EOSM2",
.digic_version = 5,
}
./run_canon_fw.sh EOSM2,firmware="boot=0"
...
FFFF3F50: MCR p15,0,Rd,cr6,cr0,0: 946_PRBS0 <- 0x3F (00000000 - FFFFFFFF, 0x100000000)
FFFF3F58: MCR p15,0,Rd,cr6,cr1,0: 946_PRBS1 <- 0x3D (00000000 - 7FFFFFFF, 0x80000000)
FFFF3F60: MCR p15,0,Rd,cr6,cr2,0: 946_PRBS2 <- 0xE0000039 (E0000000 - FFFFFFFF, 0x20000000)
FFFF3F68: MCR p15,0,Rd,cr6,cr3,0: 946_PRBS3 <- 0xC0000039 (C0000000 - DFFFFFFF, 0x20000000)
FFFF3F70: MCR p15,0,Rd,cr6,cr4,0: 946_PRBS4 <- 0xFF00002F (FF000000 - FFFFFFFF, 0x1000000)
FFFF3F78: MCR p15,0,Rd,cr6,cr5,0: 946_PRBS5 <- 0x37 (00000000 - 0FFFFFFF, 0x10000000)
FFFF3F80: MCR p15,0,Rd,cr6,cr6,0: 946_PRBS6 <- 0xF700002F (F7000000 - F7FFFFFF, 0x1000000)
...
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1
...
K355 ICU Firmware Version 1.0.2 ( 6.0.5 )
.serial_flash_size = 0x1000000,
...
10: 46.336 [PROPAD] ERROR Not Exist Valid ComboPackages!! 0x10000
...
14: 56.576 [STARTUP] InitializeIntercom
...
42: 722.688 ERROR [DL] ########## DL ERROR!!!!! ###########
./run_canon_fw.sh EOSM2,firmware="boot=0" -d calls
...
call 0xFFFF0FCC(0, ffffdfff, 2000, ffff0b20) at [ffff09c8:0]
call 0x100000(0, 11836c, 11836c, 100000) at [ffff1010:ffff09cc]
...
return 0 to 0x10013C at [1022f4:ffff1014]
return 1 to 0xFFFF1014 at [1000bc:ffff09cc]
return 0 to 0xFFFF09CC at [ffff101c:0]
Warning: R10 not restored (0xa -> 0x1) at [ffff101c:ffff09cc]
PC jump? 0xF80C0000 lr=ffff09cc at [ffff0a04:ffff09cc]
0xffff0a04: e1a0f000 mov pc, r0
PC jump? 0xFF0C000C lr=ffff09cc at [f80c0000:ffff09cc]
0xf80c0000: e59ff0c4 ldr pc, [pc, #196] ; 0xfffffffff80c00cc
./run_canon_fw.sh EOSM2,firmware="boot=0" -d idc
...
EOSM2.idc saved.
PC jump? 0xFF0C000C lr=ffff09cc at [f80c0000:ffff09cc]
...
call 0xFF0C1BD4(1000, 698, eeeeeeee, 1000) at [ff0c0dbc:0]
call 0x866B4(f88, 74, eeeeeeee, 1000) at [ff0c1be4:ff0c0dc0]
return ffc to 0xFF0C1BE8 at [866f4:ff0c0dc0]
call 0x3168(f88, ff0c57a4, 0, 0) at [ff0c1c80:ff0c0dc0]
...
Corrects a phenomenon in which when using the camera with the EF-S 18-135mm f/3.5-5.6 IS USM or EF 70-300mm f/4-5.6 IS II USM lens, even if lens aberration correction is set to "Enable", correction will not be applied.
Does it help if you follow the instructions in the linked post?
eos_load_image: file not found './EOSM2/ROM0.BIN'
./run_canon_fw.sh: line 35: 16058 Abort trap: 6 $QEMU_PATH/arm-softmmu/qemu-system-arm -drive if=sd,format=raw,file=sd.img -drive if=ide,format=raw,file=cf.img -M $*
It dumps 32 MB from 0xF7000000, which covers both ROM0 and ROM1 - that's what you need to run ML in QEMU. For analyzing the code, you can load ROM1 (the second half of that file) at 0xFF000000.
split -b 16800000 "(NULL)" ROM./run_canon_fw.sh EOSM2,firmware="boot=0"
./run_canon_fw.sh: line 10: losetup: command not found
usage: grep [-abcDEFGHhIiJLlmnOoqRSsUVvwxZ] [-A num] [-B num] [-C[num]]
[-e pattern] [-f file] [--binary-files=value] [--color=when]
[--context[=num]] [--directories=action] [--label] [--line-buffered]
[--null] [pattern] [file ...]
./run_canon_fw.sh: line 10: losetup: command not found
usage: grep [-abcDEFGHhIiJLlmnOoqRSsUVvwxZ] [-A num] [-B num] [-C[num]]
[-e pattern] [-f file] [--binary-files=value] [--color=when]
[--context[=num]] [--directories=action] [--label] [--line-buffered]
[--null] [pattern] [file ...]
CHK version_gen.h
Lockdown read 0
Lockdown read 0
Lockdown read 1
Lockdown read 1
Lockdown read 2
Lockdown read 2
Lockdown read 3
Lockdown read 3
Lockdown read 4
Lockdown read 4
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 1FFFFFFF: eos.ram
40001000 - 5FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror
F2000000 - F2FFFFFF: eos.rom0_mirror
F3000000 - F3FFFFFF: eos.rom0_mirror
F4000000 - F4FFFFFF: eos.rom0_mirror
F5000000 - F5FFFFFF: eos.rom0_mirror
F6000000 - F6FFFFFF: eos.rom0_mirror
F7000000 - F7FFFFFF: eos.rom0_mirror
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
C0000000 - DFFFFFFF: eos.iomem
[EOS] loading './EOSM2/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './EOSM2/ROM1.BIN' to 0xF8000000-0xF8FFA6FF
[MPU] FIXME: no MPU spells for EOSM2.
[MPU] FIXME: no MPU button codes for EOSM2.
Setting BOOTDISK flag to 0
OK, so we've got a rough idea about its memory map (same as other DIGIC 4 models). We also noticed it has a serial flash of size 0x1000000. This is similar to 100D (lookup serial_flash_size in model_list.c), so it may be a good idea to reuse the serial flash data from this model:Code: [Select].serial_flash_size = 0x1000000,
[EOS] loading './EOSM2/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './EOSM2/ROM1.BIN' to 0xF8000000-0xF8FFA6FF
Could not open ./EOSM2/SFDATA.BINff0ba700: e59ff0c4 ldr pc, [pc, #196] ; ff0ba7cc: (ff0c000c)
"gaonisoy":
ff0c0000: e59ff0c4 ldr pc, [pc, #196] ; ff0c00cc: (ff0c000c)
"gaonisoy":
You need two *equal* halves, without any approximation.
(edit: updated QEMU to give better warnings in this case)
-rw-r--r-- 1 rosiefort staff 16800000 May 24 15:15 ROM0.BIN
-rw-r--r-- 1 rosiefort staff 16754432 May 24 15:15 ROM1.BIN
To be continued.
0xFF0C1BD4 is cstart, 0x866B4 is bzero32, 0x3168 must be create_init_task and 0xFF0C57A4 must be init_task. Some of these functions are called from RAM, so we'll have to identify where its contents come from (what is copied where). TODO.
ram EOS: log all RAM reads and writes
rom EOS: log all ROM reads and writes
ramr EOS: log all RAM reads
romr EOS: log all ROM reads
ramw EOS: log all RAM writes
romw EOS: log all ROM writes
./run_canon_fw.sh EOSM2,firmware="boot=0" -d romr,ramw
[rom1] at 0xFF0C000C:FFFF09CC [0xFFD1F02C] -> 0xE92D4010
[ram] at 0xFF0C000C:FFFF09CC [0x00001900] <- 0xE92D4010: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F030] -> 0xE1A04001
[ram] at 0xFF0C00A4:FFFF09CC [0x00001904] <- 0xE1A04001: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F034] -> 0xE59F1040
...
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFDD60C8] -> 0xFFD1EFFC
[ram] at 0xFF0C00A4:FFFF09CC [0x000B899C] <- 0xFFD1EFFC: was 0x0;
dd if=ROM1.BIN of=1900.BIN bs=1 skip=$((0xD1F02C)) count=$((0xB70A0))
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S & arm-none-eabi-gdb -x debug-logging.gdb
(note: we will need to create a GDB file for EOS M2, named EOSM2/debugmsg.gdb to match other models, but since we don't have one yet, we can just use the generic version - which we are going to include in the platform-specific file later)(gdb) disas 0,0x40
Dump of assembler code from 0x0 to 0x40:
0x00000000: nop ; (mov r0, r0)
0x00000004: ldr pc, [pc, #20] ; 0x20
0x00000008: ldr pc, [pc, #20] ; 0x24
0x0000000c: ldr pc, [pc, #20] ; 0x28
0x00000010: ldr pc, [pc, #20] ; 0x2c
0x00000014: nop ; (mov r0, r0)
0x00000018: ldr pc, [pc, #16] ; 0x30
0x0000001c: ldr pc, [pc, #16] ; 0x34
0x00000020: ; <UNDEFINED> instruction: 0xff0c0fec
0x00000024: ; <UNDEFINED> instruction: 0xff0c105c
0x00000028: ; <UNDEFINED> instruction: 0xff0c1000
0x0000002c: ; <UNDEFINED> instruction: 0xff0c1018
0x00000030: ; <UNDEFINED> instruction: 0x000004b0
0x00000034: ; <UNDEFINED> instruction: 0xff0c1060
0x00000038: ; <UNDEFINED> instruction: 0xffff0b08
0x0000003c: ; <UNDEFINED> instruction: 0xffff0b20
disas 0x4B0,0x6B0
(gdb) dump memory 4B0.BIN 0x4B0 0x6B0
(qemu) memsave 0x4B0 0x200 4B0.BIN
# CURRENT_ISR:
# From interrupt handler (PC=0x18), find an expression that evaluates to
# the current interrupt ID if any is running, or 0 if a normal task is running.
# - on DIGIC 4/5, interrupt ID is MEM(0xC0201004) >> 2
# - on DIGIC 6, interrupt ID is MEM(0xD4011000)
./run_canon_fw.sh EOSM2,firmware="boot=0" -d io,int,nochain -singlestep
...
Taking exception 5 [IRQ]
[INT] at 0x00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[INT] at 0x00000594:00000568 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
(gdb) disas 0x4B0,0x6B0
...
0x0000050c: ldr r0, [pc, #368] ; 0x684
0x00000510: ldr r4, [r0]
0x00000514: str r4, [pc, #304] ; 0x64c
...
(gdb) x 0x684
0x684: 0xc0201004
(gdb) x 0x64c
0x64c: 0x00000028
(gdb) print 0x28>>2
$1 = 0xa
0x000004d4: ldr r1, [pc, #364] ; 0x648
0x000004d8: cmp r1, #0
0x000004dc: add r1, r1, #1
0x000004e0: str r1, [pc, #352] ; 0x648
...
0x00000598: ldr r1, [pc, #168] ; 0x648
0x0000059c: sub r1, r1, #1
0x000005a0: str r1, [pc, #160] ; 0x648
./run_canon_fw.sh EOSM2,firmware="boot=0" -d io,int,ram,nochain -singlestep
...
[tcm_code] at 0x000004D4:19980218 [0x00000648] -> 0x0
[tcm_code] at 0x000004E0:19980218 [0x00000648] <- 0x1 : was 0x0;
...
[tcm_code] at 0x0000050C:0000050C [0x00000684] -> 0xC0201004
[INT] at 0x00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[tcm_code] at 0x00000514:0000050C [0x0000064C] <- 0x28 : was 0x0;
...
[INT] at 0x00000594:00000568 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
[tcm_code] at 0x00000598:00000568 [0x00000648] -> 0x1
[tcm_code] at 0x000005A0:00000568 [0x00000648] <- 0x0 : was 0x1;
macro define CURRENT_ISR (*(int*)0x648 ? (*(int*)0x64C) >> 2 : 0)
./run_canon_fw.sh EOSM2,firmware="boot=0" -d callstack,ramw
./run_canon_fw.sh EOSM2,firmware="boot=0" -d callstack,ramw |& grep -B 20 "not restored"
...
[ram] at 0x000019D8:0000E24C [0x0018F8FC] <- 0xE24C : was 0xE24C;
[ram] at 0x00001A04:0000E24C [0x0008FBCC] <- 0x17EED4 : was 0x17EF28;
[ram] at 0xFF0C1064:0000E24C [0x0018F8FC] <- 0xE24C : was 0xE24C;
...
[ram] at 0xFF0C1074:0000E24C [0x0018F8C0] <- 0x60000093: was 0x19980218;
[ram] at 0xFF0C1078:0000E24C [0x0017EF78] <- 0x18F8C0 : was 0x18F8D0;
Warning: R4 not restored (0x17ef28 -> 0x17eed4) at [ff0c1088:e24c]
...
[ram] at 0x000019D8:0000E24C [0x0018E9A4] <- 0xE24C : was 0xE24C;
[ram] at 0x00001A04:0000E24C [0x0008FBCC] <- 0x17EF28 : was 0x17EED4;
[ram] at 0xFF0C1064:0000E24C [0x0018E9A4] <- 0xE24C : was 0xE24C;
...
[ram] at 0xFF0C1074:0000E24C [0x0018E968] <- 0x60000093: was 0x18E9FC;
[ram] at 0xFF0C1078:0000E24C [0x0017EF24] <- 0x18E968 : was 0x18E970;
Warning: R4 not restored (0x17eed4 -> 0x17ef28) at [ff0c1088:e24c]
# ./run_canon_fw.sh EOSM2 -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
source -v debug-logging.gdb
macro define CURRENT_TASK 0x8FBCC
macro define CURRENT_ISR (*(int*)0x648 ? (*(int*)0x64C) >> 2 : 0)
b *0x4398
DebugMsg_log
b *0x7360
task_create_log
./run_canon_fw.sh EOSM2 -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
[ init:ff352264 ] task_create(PowerMgr, prio=20, stack=400, entry=ff352088, arg=0)
[ init:ff1470d4 ] (00:01) [PM] DisablePowerSave (Counter = 1)
[ init:0003671c ] task_create(DbgMgr, prio=1f, stack=0, entry=36628, arg=46e584)
[ init:ff0c3334 ] (8b:16)
K355 ICU Firmware Version 1.0.2 ( 6.0.5 )
[ init:ff0c3348 ] (8b:05)
ICU Release DateTime 2013.12.02 09:28:54
[ init:ff0f5ea0 ] (00:03) [SEQ] CreateSequencer (Startup, Num = 6)
[ init:ff0f5f28 ] task_create(Startup, prio=19, stack=2800, entry=ff0f5d6c, arg=46e880)
[ init:ff0f60f4 ] (00:02) [SEQ] NotifyComplete (Startup, Flag = 0x10000)
[ init:ff0f6158 ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
[ init:ff0c33d4 ] task_create(TaskMain, prio=1d, stack=0, entry=ff0c28d8, arg=0)
[ Startup:ff0f5db4 ] (00:05) [SEQ] seqEventDispatch (Startup, 0)
[ Startup:ff0c373c ] (8b:05) startupEntry
[ Startup:ff0c375c ] task_create(Startup2, prio=11, stack=400, entry=ff0c3604, arg=0)
[ Startup2:ff1310c4 ] (02:16) PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
[ Startup2:ff14a204 ] (00:01) [SF] IsAddressSerialFlash 0x2d0000
...
.current_task_addr = 0x8FBCC,
There are other similar blocks copied into RAM (newer DIGIC 6 and 7 models have plenty of those), and finding them manually can become tedious, so it's a good candidate for automation.
./run_canon_fw.sh EOSM2,firmware="boot=0" -d romcpy |& grep ROMCPY
[ROMCPY] 0xFFFF0000 -> 0x0 size 0x40 at 0xFFFF0980
[ROMCPY] 0xFFFE0000 -> 0x100000 size 0xFF2C at 0xFFFF0FCC
[ROMCPY] 0xFFD1F02C -> 0x1900 size 0xB70A0 at 0xFF0C000C
[ROMCPY] 0xFF0C0E04 -> 0x4B0 size 0x1E8 at 0xFF0C0D70
[ROMCPY] 0xFFA12904 -> 0x4E0E98 size 0xC7C at 0x8645C
We now have task information and debug messages!
./run_canon_fw.sh EOSM2,firmware="boot=0" -d tasks
...
Task switch to idle:ff0c108c at [idle:1db8:ff0c1c84]
Task switch to init:ff0c1064 at [init:1a18:c73c]
K355 READY
128K Sector FROM From BL 0xffff
...
SerialFlash Initialize
Task switch to Startup:ff0c108c at [Startup:1db8:c9e0]
Task switch to Startup2:ff0c1064 at [Startup2:1a18:228c]
...
Task switch to DbgMgr:ff0c1064 at [DbgMgr:1a18:e24c]
4: 54.784 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
Task switch to Startup:ff0c1064 at [Startup:1a18:2e40]
[RTC] !! RTC_TIME_CORRECT_CHANGE! 0x0 ---> 0x9a
[RTC] !! RTC UNDER MIN_YEAR !!
Task switch to PropMgr:ff0c1064 at [PropMgr:1a18:da2c]
...
Code: [Select].serial_flash_size = 0x1000000,
Unfortunately, this step doesn't change anything in the emulation.
Reverse engineering tip: it's perfectly fine to
- have no idea what to do next
- have made wrong assumptions
- take 'too long'
SerialFlash Initialize
[EEPROM-DMA]! [0x2D0000] -> [0x416D5B00] (0x1DC400 bytes)
6: 16.640 [PROPAD] ERROR Not Exist Valid ComboPackages!! 0x2D0000
ROM:FF0C3A9C LDR R2, =0xC020302C
ROM:FF0C3AA0 LDR R0, =0xC022006C
ROM:FF0C3AA4 MOV R1, #0x50 ; 'P'
ROM:FF0C3AA8 BL sub_3AD0
.mpu_request_register = 0xC022006C,
.mpu_status_register = 0xC022006C,
[MPU] Received: 06 04 02 00 00 00 (unknown spell)
[MPU] Received: 0a 08 03 57 10 2f 00 01 00 00 (unknown spell)
[MPU] Received: 08 07 03 6a 01 08 00 00 (unknown spell)
[MPU] FIXME: no MPU spells for EOSM2.
[MPU] FIXME: no MPU button codes for EOSM2.
grep -nr "no MPU spells" qemu-2.5.0/
qemu-2.5.0/hw/eos/mpu.c:742: MPU_EPRINTF("FIXME: no MPU spells for %s.\n", s->model->name);
EOSM/debugmsg.gdb:17:# patch DL to avoid DL ERROR messages
EOSM/debugmsg.gdb-18-set *(int*)0xFF1BE4AC = 0xe3a00015
ROM:FF1BE4AC BL sub_FF1BDFD4
ROM:FF1BE4B0 CMP R0, #0x15
EOSM/debugmsg.gdb:20:# patch localI2C_Write to always return 1 (success)
EOSM/debugmsg.gdb-21-set *(int*)0xFF3460C4 = 0xe3a00001
EOSM/debugmsg.gdb-22-set *(int*)0xFF3460C8 = 0xe12fff1e
61: 203.008 [STARTUP] ERROR SerialFlash Version!! Firm : 6.0.3 SF : 4.2.1
ROM:FF0C4270 MOV R2, #5
ROM:FF0C4274 ADD R1, SP, #0x30
ROM:FF0C4278 ADR R0, a6_0_3 ; "6.0.3"
ROM:FF0C427C BL sub_FF0C8F40
ROM:FF0C4280 CMP R0, #0
ROM:FF0C4284 BEQ loc_FF0C42A4
ROM:FF0C4290 ADR R3, a6_0_3 ; "6.0.3"
ROM:FF0C4294 ADR R2, aErrorSerialfla ; "ERROR SerialFlash Version!! Firm : %s S"...
ROM:FF0C42A0 BL DebugMsg
ROM:FF0C42A4
ROM:FF0C42A4 loc_FF0C42A4
# skip SerialFlash version check
set *(int*)0xFF0C427C = 0xe3a00000
[ Startup:ff0c5138 ] (8b:03) Wait LeoLens Complete
ROM:FF0C512C loc_FF0C512C ; CODE XREF: sub_FF0C4E80+2CCj
ROM:FF0C512C ADR R2, aWaitLeolensCom ; "Wait LeoLens Complete"
...
ROM:FF0C5144 LDR R0, [R4,#0x28]
ROM:FF0C5148 CMP R0, #0
ROM:FF0C514C BEQ loc_FF0C512C
...
(gdb) b *0xFF0C5148
Breakpoint 3 at 0xff0c5148
(gdb) c
Continuing.
Breakpoint 3, 0xff0c5148 in ?? ()
(gdb) info registers
r0 0x0 0x0
r4 0x8fad4 0x8fad4
ROM:FF0C35F4 LDR R1, =dword_8FAD4
ROM:FF0C35F8 MOV R0, #1
ROM:FF0C35FC STR R0, [R1,#(dword_8FAFC - 0x8FAD4)]
ROM:FF0C3600 BX LR
ROM:FF0C3B30 LDR R0, =loc_FF0C35F4
ROM:FF0C3B34 MOV R1, #0
ROM:FF0C3B38 BL sub_FF0F7B18
...
ROM:FF0C3B44 ADRNE R2, aInitializeprop ; "InitializePropertySatellite (%#x)"
(gdb) set *(int*)($r4 + 0x28) = 1
(gdb) c
Continuing.
[ Startup:ff0c5138 ] (8b:03) Wait LeoLens Complete
Breakpoint 3, 0xff0c5148 in ?? ()
(gdb) c
Continuing.
[ Startup:ff0e29a8 ] (30:03) MOVW_Initialize
[ Startup:0003671c ] task_create(MovWriter, prio=15, stack=2000, entry=36628, arg=67262c)
[ Startup:ff0e6f34 ] (2f:03) MVR_Initialize
[ Startup:0003671c ] task_create(MovieRecorder, prio=11, stack=2000, entry=36628, arg=672d4c)
# break infinite loop at Wait LeoLens Complete
b *0xFF0C5148
commands
printf "Patching LeoLens (infinite loop)\n"
set *(int*)($r4 + 0x28) = 1
c
end
167: 851.456 [TCH]Touch IC Ver : 0x0000
1383: 57907.968 WARN [I2C] localI2C_Read : 378 (Task : CEC)
1384: 57927.680 WARN [I2C] localI2C_Read : 378 (Task : CEC)
1385: 57947.392 WARN [I2C] localI2C_Read : 378 (Task : CEC)
1386: 57966.592 WARN [I2C] localI2C_Read : 378 (Task : CEC)
[MPU] FIXME: no MPU button codes for EOSM2.
...One of these covers the functions we are interested in:Code: [Select][rom1] at 0xFF0C000C:FFFF09CC [0xFFD1F02C] -> 0xE92D4010
[ram] at 0xFF0C000C:FFFF09CC [0x00001900] <- 0xE92D4010: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F030] -> 0xE1A04001
[ram] at 0xFF0C00A4:FFFF09CC [0x00001904] <- 0xE1A04001: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F034] -> 0xE59F1040
...
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFDD60C8] -> 0xFFD1EFFC
[ram] at 0xFF0C00A4:FFFF09CC [0x000B899C] <- 0xFFD1EFFC: was 0x0;
In other words, a memory block from 0xFFD1F02C to 0xFFDD60C8 (actually 0xFFDD60CB, since we are looking at 32-bit operations) is copied to 0x1900 - 0xB899F. The size of the copied block is 0xb70a0 bytes. To extract this block, grab the terminal and run this under a Bash prompt:Code: [Select]dd if=ROM1.BIN of=1900.BIN bs=1 skip=$((0xD1F02C)) count=$((0xB70A0))
(please note the above numbers are only valid for firmware 1.0.2)
Now you can disassemble this file starting from 0x1900. In IDA, load this file as Additional binary file. If you use ARM-console, this should auto-detect the above copying operation (so you can simply start browsing the functions copied into RAM).
[rom1] at 0xFF0C000C:FFFF09CC [0xFFD1F0E4] -> 0xE92D4010
[ram] at 0xFF0C000C:FFFF09CC [0x00001900] <- 0xE92D4010: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F0E8] -> 0xE1A04001
[ram] at 0xFF0C00A4:FFFF09CC [0x00001904] <- 0xE1A04001: was 0x0;
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFD1F0EC] -> 0xE59F1040
...
[rom1] at 0xFF0C00A4:FFFF09CC [0xFFDD6180] -> 0xFFD1F0B4
[ram] at 0xFF0C00A4:FFFF09CC [0x000B899C] <- 0xFFD1F0B4: was 0x0;
dd if=ROM1.BIN of=EOSM2.103.0x1900.BIN bs=1 skip=$((0xD1F0E4)) count=$((0xB70A0))I'm not sure how you came up with 0xFFDD60CB from 0xFFDD60C8 to make it conform to a 32-bit operation. I tried looking it up but don't quite get it.
The size of the copied block is 0xB709F but it needs to be rounded up to be evenly divisible by 32 (0x20) right? So if I followed the lesson plan properly it is also 0xB70A0 just like the 1.0.2 firmware.
Alright, so let's start from where we've left off.
For the debugmsg.gdb file, we'll need some basic stubs: DebugMsg and task_create (easy to find - one is used for most debug messages, the other can be easily identified from things that look like task names) and two addresses: CURRENT_TASK and CURRENT_ISR (interrupt service routine). We can find the latter in the interrupt handler - quote from debugmsg.gdb:
If you can find that by examining disassembled code, great. If not, QEMU to the rescue:Code: [Select]./run_canon_fw.sh EOSM2,firmware="boot=0" -d io,int,nochain -singlestep
...
Taking exception 5 [IRQ]
[INT] at 0x00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[INT] at 0x00000594:00000568 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
(note: -d nochain -singlestep gives more precise locations in I/O logs - otherwise, QEMU groups the ARM instructions in blocks for faster execution, so the reported location will be approximate)
(gdb) disas 0x4B0,0x6B0[EOS] trigger int 0x0A (delayed)
Taking exception 5 [IRQ]
[INT] at 0x00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[TIMER] at 0xFF350400:000072A4 [0xC0242014] -> 0x6E900 : DIGIC clock
[INT] at 0x00000594:FF0C1578 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
OK, so the register we are looking for is read at 0x510. Let's disassemble with GDB:Code: [Select](gdb) disas 0x4B0,0x6B0
...
0x0000050c: ldr r0, [pc, #368] ; 0x684
0x00000510: ldr r4, [r0]
0x00000514: str r4, [pc, #304] ; 0x64c
...
(gdb) x 0x684
0x684: 0xc0201004
(gdb) x 0x64c
0x64c: 0x00000028
(gdb) print 0x28>>2
$1 = 0xa
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
./run_canon_fw.sh EOSM2,firmware="boot=0" -d io,int,nochain -singlestep |& grep "Enabled interrupt 0Ah"
Code: [Select]./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S & arm-none-eabi-gdb -x debug-logging.gdb(note: we will need to create a GDB file for EOS M2, named EOSM2/debugmsg.gdb to match other models, but since we don't have one yet, we can just use the generic version - which we are going to include in the platform-specific file later)
Let it run for a while (continue), then hit CTRL-C and examine the exception vector (located at address 0):Code: [Select](gdb) disas 0,0x40
Dump of assembler code from 0x0 to 0x40:
0x00000000: nop ; (mov r0, r0)
0x00000004: ldr pc, [pc, #20] ; 0x20
0x00000008: ldr pc, [pc, #20] ; 0x24
...
[EOS] loading './EOSM2/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './EOSM2/ROM1.BIN' to 0xF8000000-0xF8FFFFFF
[EOS] loading './EOSM2/SFDATA.BIN' as serial flash, size=0x1000000
[MPU] FIXME: no MPU spells for EOSM2.
[MPU] FIXME: no MPU button codes for EOSM2.
Setting BOOTDISK flag to 0
continue
-bash: continue: only meaningful in a `for', `while', or `until' loop
(gdb) disas 0,0x40
Dump of assembler code from 0x0 to 0x40:
0x00000000: Cannot access memory at address 0x0
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S & arm-none-eabi-gdb -x debug-logging.gdb 2> error.txt-bash: arm-none-eabi-gdb: command not found/Users/rosiefort/gcc-arm-none-eabi-4_8-2013q4/bin/arm-none-eabi-gdb
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S & ~/gcc-arm-none-eabi-4_8-2013q4/bin/arm-none-eabi-gdb -x debug-logging.gdbAlright, so let's start from where we've left off.
...
This 0x648 looks like a counter that tells how many nested interrupts we are handling (yes, they can be nested - unfortunately, as this makes it a lot harder to understand, debug, emulate and so on). Let's confirm its functionality with RAM tracing:Code: [Select]./run_canon_fw.sh EOSM2,firmware="boot=0" -d io,int,ram,nochain -singlestep
...
[tcm_code] at 0x000004D4:19980218 [0x00000648] -> 0x0
[tcm_code] at 0x000004E0:19980218 [0x00000648] <- 0x1 : was 0x0;
...
[tcm_code] at 0x0000050C:0000050C [0x00000684] -> 0xC0201004
[INT] at 0x00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[tcm_code] at 0x00000514:0000050C [0x0000064C] <- 0x28 : was 0x0;
...
[INT] at 0x00000594:00000568 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
[tcm_code] at 0x00000598:00000568 [0x00000648] -> 0x1
[tcm_code] at 0x000005A0:00000568 [0x00000648] <- 0x0 : was 0x1;
Looks right!
...
[tcm_code] at TaskM:000004D4:19980218 [0x00000648] -> 0x0
[tcm_code] at TaskM:000004E0:19980218 [0x00000648] <- 0x1 : was 0x0;
...
[tcm_code] at init:0000050C:0000050C [0x00000684] -> 0xC0201004
[INT] at init:00000510:0000050C [0xC0201004] -> 0x28 : Requested int reason 28 (INT 0Ah)
[tcm_code] at init:00000514:0000050C [0x0000064C] <- 0x28 : was 0x0;
...
[INT] at init:00000594:00000568 [0xC0201010] <- 0xA : Enabled interrupt 0Ah
[tcm_code] at init:00000598:00000568 [0x00000648] -> 0x1
[tcm_code] at init:000005A0:00000568 [0x00000648] <- 0x0 : was 0x1;
./run_canon_fw.sh EOSM2,firmware="boot=0" -d callstack,ramw |& grep -B 20 "not restored"
-bash: syntax error near unexpected token `&'GNU bash, version 4.4.12(1)-release (x86_64-apple-darwin16.3.0)./run_canon_fw.sh EOSM2,firmware="boot=0" -d callstack,ramw 2>&1 | grep -B 20 "not restored"
[tcm_data] at 0x0010DA10:00000040 [0x40000F60] <- 0x4 : was 0x4C;
[tcm_data] at 0x0010DA10:00000040 [0x40000F64] <- 0x20 : was 0x4C;
[tcm_data] at 0x0010DA10:00000040 [0x40000F68] <- 0x8 : was 0x4C;
[tcm_data] at 0x0010DA10:00000040 [0x40000F6C] <- 0x40 : was 0x1F;
[tcm_data] at 0x0010DA08:00000100 [0x40000F70] <- 0x10 : was 0x4C;
[tcm_data] at 0x0010DA08:00000100 [0x40000F74] <- 0x80 : was 0x4C;
[tcm_data] at 0x0010DA08:00000100 [0x40000F78] <- 0x20 : was 0x40;
[tcm_data] at 0x0010DA08:00000100 [0x40000F7C] <- 0x100 : was 0x40;
[tcm_data] at 0x0010DA10:00000C00 [0x40000F80] <- 0x40 : was 0x1F;
[tcm_data] at 0x0010DA10:00000C00 [0x40000F84] <- 0x200 : was 0x1;
[tcm_data] at 0x0010DA10:00000C00 [0x40000F88] <- 0x80 : was 0x0;
[tcm_data] at 0x0010DA10:00000C00 [0x40000F8C] <- 0xC00 : was 0x0;
[tcm_data] at 0x0010DA2C:00000C00 [0x40000F90] <- 0xFF : was 0x7;
[tcm_data] at 0x0010DA2C:00000C00 [0x40000F94] <- 0xFFF : was 0x1;
[tcm_data] at 0x0010329C:001000C8 [0x40000F9C] <- 0x1 : was 0x0;
[tcm_data] at 0x0010329C:001000C8 [0x40000FA0] <- 0x1000C8 : was 0x10007C;
[tcm_data] at 0x0010329C:001000F8 [0x40000F9C] <- 0x1 : was 0x1;
[tcm_data] at 0x0010329C:001000F8 [0x40000FA0] <- 0x1000F8 : was 0x1000C8;
[tcm_data] at 0x001022C0:0010013C [0x40000F9C] <- 0x1 : was 0x1;
[tcm_data] at 0x001022C0:0010013C [0x40000FA0] <- 0x10013C : was 0x1000F8;
Warning: R10 not restored (0xa -> 0x1) at [ffff101c:ffff09cc]
Code: [Select]./run_canon_fw.sh EOSM2 -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
[ init:ff352264 ] task_create(PowerMgr, prio=20, stack=400, entry=ff352088, arg=0)
[ init:ff1470d4 ] (00:01) [PM] DisablePowerSave (Counter = 1)
[ init:0003671c ] task_create(DbgMgr, prio=1f, stack=0, entry=36628, arg=46e584)
[ init:ff0c3334 ] (8b:16)
K355 ICU Firmware Version 1.0.2 ( 6.0.5 )
[ init:ff0c3348 ] (8b:05)
ICU Release DateTime 2013.12.02 09:28:54
[ init:ff0f5ea0 ] (00:03) [SEQ] CreateSequencer (Startup, Num = 6)
[ init:ff0f5f28 ] task_create(Startup, prio=19, stack=2800, entry=ff0f5d6c, arg=46e880)
[ init:ff0f60f4 ] (00:02) [SEQ] NotifyComplete (Startup, Flag = 0x10000)
[ init:ff0f6158 ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
[ init:ff0c33d4 ] task_create(TaskMain, prio=1d, stack=0, entry=ff0c28d8, arg=0)
[ Startup:ff0f5db4 ] (00:05) [SEQ] seqEventDispatch (Startup, 0)
[ Startup:ff0c373c ] (8b:05) startupEntry
[ Startup:ff0c375c ] task_create(Startup2, prio=11, stack=400, entry=ff0c3604, arg=0)
[ Startup2:ff1310c4 ] (02:16) PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
[ Startup2:ff14a204 ] (00:01) [SF] IsAddressSerialFlash 0x2d0000
...
./run_canon_fw.sh EOSM2 -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
[ init:ff352260 ] task_create(PowerMgr, prio=20, stack=400, entry=ff352084, arg=0)
[ init:ff1470d0 ] (00:01) [PM] DisablePowerSave (Counter = 1)
[ init:0003671c ] task_create(DbgMgr, prio=1f, stack=0, entry=36628, arg=46e584)
[ init:ff0c3334 ] (8b:16)
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
[ init:ff0c3348 ] (8b:05)
ICU Release DateTime 2016.08.09 13:28:42
[ init:ff0f5e9c ] (00:03) [SEQ] CreateSequencer (Startup, Num = 6)
[ init:ff0f5f24 ] task_create(Startup, prio=19, stack=2800, entry=ff0f5d68, arg=46e880)
[ init:ff0f60f0 ] (00:02) [SEQ] NotifyComplete (Startup, Flag = 0x10000)
[ init:ff0f6154 ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
[ init:ff0c33d4 ] task_create(TaskMain, prio=1d, stack=0, entry=ff0c28d8, arg=0)
[ Startup:ff0f5db0 ] (00:05) [SEQ] seqEventDispatch (Startup, 0)
[ Startup:ff0c373c ] (8b:05) startupEntry
[ Startup:ff0c375c ] task_create(Startup2, prio=11, stack=400, entry=ff0c3604, arg=0)
[ Startup2:ff1310c0 ] (02:16) PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
[ Startup2:ff14a200 ] (00:01) [SF] IsAddressSerialFlash 0x2d0000
...Code: [Select]./run_canon_fw.sh EOSM2,firmware="boot=0" -d romcpy |& grep ROMCPY
[ROMCPY] 0xFFFF0000 -> 0x0 size 0x40 at 0xFFFF0980
[ROMCPY] 0xFFFE0000 -> 0x100000 size 0xFF2C at 0xFFFF0FCC
[ROMCPY] 0xFFD1F02C -> 0x1900 size 0xB70A0 at 0xFF0C000C
[ROMCPY] 0xFF0C0E04 -> 0x4B0 size 0x1E8 at 0xFF0C0D70
[ROMCPY] 0xFFA12904 -> 0x4E0E98 size 0xC7C at 0x8645C
./run_canon_fw.sh EOSM2,firmware="boot=0" -d romcpy 2>&1 | grep ROMCPY
[ROMCPY] 0xFFFF0000 -> 0x0 size 0x40 at 0xFFFF0980
[ROMCPY] 0xFFFE0000 -> 0x100000 size 0xFF2C at 0xFFFF0FCC
[ROMCPY] 0xFFD1F0E4 -> 0x1900 size 0xB70A0 at 0xFF0C000C
[ROMCPY] 0xFF0C0E04 -> 0x4B0 size 0x1E8 at 0xFF0C0D70
Binary file (standard input) matches
Changing '|&' to '2>&1 |' still didn't give me the same results a1ex posted.
Binary file (standard input) matches
echo $BASH_VERSION
3.2.57(1)-release
echo $BASH_VERSION
4.4.12(1)-release
ln -s ~/gcc-arm-none-eabi-4_8-2013q4/bin/* /usr/local/bin/Anyway, let's continue figuring out the emulation.Code: [Select].serial_flash_size = 0x1000000,Oops, I was wrong here.
./run_canon_fw.sh EOSM2,firmware="boot=0" -d sflash
...
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1
[SF] Bufcon Base 0xc022c0d4
[EEPROM] CS = 1
SerialFlash Initialize
[EEPROM] CS = 0
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x2D0000
...
0: 3.072 [STARTUP]
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
4: 3.328 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
5: 3.840 [PROPAD] SerialFlash Packages!! 0x2d0000
[SFIO] sfio_trigger_int_DMA
[SFIO] eos_handle_sfio (copying now)
[EEPROM-DMA]! [0x2D0000] -> [0x416D5B00] (0x1DC400 bytes)
...
6: 9.216 [PROPAD] SerialFlash Packages!! 0x7
7: 9.216 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x41435b00
8: 9.728 [PROPAD] SerialFlash Packages!! 0x10000
[SFIO] sfio_trigger_int_DMA
[SFIO] eos_handle_sfio (copying now)
error: ‘button_codes_EOSM2’ defined but not used [-Werror=unused-variable]
static int button_codes_EOSM2[] = {
^
Simply look in mpu.c to see how it's done on other models.
# patch localI2C_Write to always return 1 (success)
set *(int*)0xFF356DE0 = 0xe3a00001
set *(int*)0xFF356DE8 = 0xe12fff1e
Exercises:
- (easy) patch the loop that times out (probably when initializing the touch IC) and the localI2C_Read loop;
- (easy) print Hello World with the minimal ML target;
- (moderate) print Hello World with the regular ML source code;
- (moderate) implement touch screen emulation;
- (moderate) bring ML menu in QEMU;
- (harder) full ML port, with most features working;
- (extreme) LiveView emulation.
The second screen should be as easy as specifying "boot=1".
Updated prop_diag to only parse the active blocks (recovery branch). You can build the display test from that branch, from platform/portable.000...
./run_canon_fw.sh EOSM2,firmware="boot=1"(https://c1.staticflickr.com/5/4232/35278925112_5a8d253997.jpg)MD5 (/Users/rosiefort/qemu/EOSM2/ROM0.BIN) = f1712be00d98f8cea522f32da216cf96
MD5 (/Volumes/EOS_DIGITAL/ROM0.BIN) = f1712be00d98f8cea522f32da216cf96
MD5 (/Users/rosiefort/qemu/EOSM2/ROM1.BIN) = 3788c332c4a8b2a6b3f521cc92c508ce
MD5 (/Volumes/EOS_DIGITAL/ROM1.BIN) = 5a78ec64480d11275dd064da2cedd136
However, the MD5 values from the "original" ROM1 and the new QEMU dump don't match. Is this expected?
Wow--big progress! Did you already try it on your M2?
# from ML directory
hg update qemu -C
cd platform/EOSM2.103
make clean; make
# mount the SD image
make install
# breakpoint on autoexec.bin
b *0x800000
# breakpoint on autoexec.bin (cstart)
symbol-file ../magic-lantern/platform/EOSM2.103/autoexec
b cstart
# from QEMU directory (assuming default paths and bash)
. ./export_ml_syms.sh EOSM2.103
./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
Now jump to AUTOEXEC.BIN!!
...
Breakpoint 3, 0x00800000 in _start ()
=> 0x00800000 <_start+0>: 0c 40 8f e2 add r4, pc, #12
Breakpoint 4, cstart () at ../../src/reboot.c:215
215 int s = compute_signature((int*)SIG_START, SIG_LEN);
b reboot.c:216. ./export_ml_syms.sh EOSM2.103
./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S & nemiver --gdb-binary=$(which arm-none-eabi-gdb) --remote="localhost:1234" ../magic-lantern/platform/EOSM2.103/autoexec
. ./export_ml_syms.sh EOSM2.103
./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S & gdbgui -g "arm-none-eabi-gdb"
source EOSM2/debugmsg.gdb
#!/usr/bin/env bash
. ./export_ml_syms.sh $1.$2
tmux new-session -d "./run_canon_fw.sh $1,firmware='boot=1' -s -S"
tmux split-window -h "cgdb -d arm-none-eabi-gdb -x $1/debugmsg.gdb"
tmux attach-session -d
./splitgdb.sh EOSM2 103
. ./export_ml_syms.sh EOSM2.103
./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S & ddd --debugger "arm-none-eabi-gdb -x EOSM2/debugmsg.gdb"
Code: [Select]# from ML directory
hg update qemu -C
cd platform/EOSM2.103
Code: [Select]Now jump to AUTOEXEC.BIN!!
...
Breakpoint 3, 0x00800000 in _start ()
=> 0x00800000 <_start+0>: 0c 40 8f e2 add r4, pc, #12
Type "continue" ("c") to reach cstart:Code: [Select]Breakpoint 4, cstart () at ../../src/reboot.c:215
215 int s = compute_signature((int*)SIG_START, SIG_LEN);
Breakpoint 1 at 0x4398
Breakpoint 2 at 0x7360
Breakpoint 3 at 0xff0c5144
Breakpoint 4 at 0x800000
Breakpoint 5 at 0x8646ec: file ../../src/fw-signature.h, line 47.
(gdb) c
Continuing.
...
Now jump to AUTOEXEC.BIN!!
0010E5F4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E5F4: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
Breakpoint 4, 0x00800000 in _start ()
(gdb) c
Continuing.
Breakpoint 5, cstart () at ../../src/reboot.c:215
215 int s = compute_signature((int*)SIG_START, SIG_LEN);
(gdb)
Type "layout src". Now you are debugging on the original source code.
Let's try nemiver:
pip install gdbgui --upgradesudo pip install gdbgui --upgrade --userbrew tap homebrew/core
brew install dddSetting BOOTDISK flag to FFFFFFFF
Error: Unresolved inheritance operation
Xt error (Unresolved inheritance operation).
Oops! You have found a bug in DDD.
If you can reproduce this bug, please send a bug report
to <[email protected]>, giving a subject like
DDD 3.3.12 (i386-apple-darwin16.3.0) gets Xt error
To enable us to fix the bug, you should include the following information:
* What you were doing to get this message. Report all the facts.
* The contents of the `~/.ddd/log' file as generated by this session.
Please read also the section "Reporting Bugs" in the DDD manual.
We thank you for your support.
ddd: Cannot save options
[1] Done ./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S
brew install cgdb│Breakpoint 2 at 0x7360
│Breakpoint 3 at 0xff0c5144
│Breakpoint 4 at 0x800000
│Breakpoint 5 at 0x8646ec: file ../../src/fw-signature.h, line 47.
│(gdb) c
│Continuing.
│
│Breakpoint 4, 0x00800000 in _start ()
│(gdb) c
│Continuing.
│
│Breakpoint 5, cstart () at ../../src/reboot.c:215
│(gdb) print s
│$1 = 0xceeeeeec
│(gdb) print _signature
│$2 = 0x2d7c6dcf
│(gdb)
│Breakpoint 5, cstart () at ../../src/reboot.c:211
│(gdb) print s
│No symbol "s" in current context.
│(gdb) print _signature
│No symbol "_signature" in current context.
│(gdb) DRYOS PANIC: Module Code = 1, Panic Code = 2Why isn't this version of splitgdb.sh by nkls in the qemu branch?
Is the firmware signature it displayed to be trusted?
Oops! You have found a bug in DDD.
DRYOS PANIC: Module Code = 1, Panic Code = 2
-d calls or callstack
-d ramw (RAM writes)
-d autoexec (to avoid verbose messages from the bootloader)
(big bunch of zeroing out some RAM - zero_bss)
(big bunch of copying from ROM to RAM - blob_memcpy)
[ram] at 0x0004D4D4:000B8818 [0x000BB300] <- 0xE12FFF1E: was 0xEBFFF769;
[ram] at 0x0004D4DC:000B8818 [0x000B9154] <- 0xCB400 : was 0x4C5C4;
[ram] at 0x0004D4E4:000B8818 [0x000B8704] <- 0x7E400 : was 0x0;
[ram] at 0x0004D4FC:000B8818 [0x000B90BC] <- 0xEBCCCAFD: was 0xEB0F6D03;
[ram] at 0x0004D514:000B8818 [0x000B9144] <- 0xEBBD78E5: was 0xEB001AEB;
[ram] at 0x0004D51C:000B8818 [0x000B9160] <- 0x4D010 : was 0xFF011DBC;
call 0xB8824(0, c00003e0, 400, b8824) at [4d560:86ba30] (copy_and_restart)
[FlashIF] at 0x000B882C:0004D564 [0xC0000010] <- 0xD9C5D9C5: 'Write enable' enabled
[*unk*] at 0x000B8838:0004D564 [0xC020010C] <- 0x1 : ???
...
(more startup activity follows)
The version from nkls is there (https://bitbucket.org/hudson/magic-lantern/src/9912f99c674c81c89ee77e81704439c304d753e1/contrib/qemu/scripts/splitgdb.sh?at=qemu&fileviewer=file-view-default). What I wrote above was something I came up with at the time of writing; I didn't use this approach before.
Would be nice to improve it to accept any number of command-line options (and pass all of them to QEMU).
...I have not set up an EOSM2 platform directory yet (so it's untested).
// http://magiclantern.wikia.com/wiki/VRAM_ADDR_from_code
// stateobj_disp[1]
int i;
unsigned int *bmp_ram_addr = bmp_vram_info;
for (i=0; i<2; i++)
DebugMsg( DM_MAGIC, 3, "bmp_vram[]=0x%08x, 0x%08x, 0x%08x",
bmp_ram_addr[3*i+0], bmp_ram_addr[3*i+1], bmp_ram_addr[3*i+2] );
unsigned int *vram_info_addr = vram_info;
for (i=0; i<3; i++)
DebugMsg( DM_MAGIC, 3, "vram_info[]=0x%08x, w=%4d, h=%4d, p=%4d, n=%4d",
vram_info_addr[5*i+0], vram_info_addr[5*i+1],
vram_info_addr[5*i+2], vram_info_addr[5*i+3], vram_info_addr[5*i+4] );
unsigned int *stateobj_disp = 0x90494+0x128; // see ff137acc SetBitmapVramAddress
DebugMsg( DM_MAGIC, 3, "stateobj_disp+0xb0[]=0x%08x,0x%08x,0x%08x,",
stateobj_disp[0], stateobj_disp[1], stateobj_disp[2]);
. ./export_ml_syms.sh 60D.111 # needed for DebugMsg
./run_canon_fw.sh 60D,firmware="boot=1" -d debugmsg
...
[ run_test:1fe0bc9c ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000000, 0x03f87100
[ run_test:1fe0bcc0 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000000, 0x03f87100
[ run_test:1fe0bce8 ] (32:03) stateobj_disp+0xbc[]=0x43f80008,0x5c307800,0x40a8e470,
# 60D 1.1.1, 0x2458+0xBC
bmp_vram[]=0xc0f140d0, 0x00000000, 0x03f87100
bmp_vram[]=0xc0f140d4, 0x00000000, 0x03f87100
stateobj_disp+0xbc[]=0x43f80008,0x41b07800,0x48a902c4
# 5D3 1.1.3, 0x246A4+0x118, regular photo mode
[ run_test:000753ec ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000000, 0x00dc3100
[ run_test:00075410 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000000, 0x00dc3100
[ run_test:00075438 ] (32:03) stateobj_disp+0x118[]=0x40dbc008,0x00000000,0x40881520,
# 5D3 1.1.3, 0x246A4+0x118, playback mode (not exactly working well in QEMU)
[ run_test:000753ec ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000000, 0x00d43100
[ run_test:00075410 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000000, 0x00d43100
[ run_test:00075438 ] (32:03) stateobj_disp+0x118[]=0x00000000,0x40881414,0x00000000,
# 700D 1.1.4, 0x23C20+0x118 (in QEMU it starts in movie mode and asks for a lens)
[ ml_init:0007f1d0 ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000000, 0x01307100
[ ml_init:0007f1f4 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000000, 0x01307100
[ ml_init:0007f21c ] (32:03) stateobj_disp+0x118[]=0x41300008,0x00000000,0x4092e400,
# 700D 1.1.4, 0x23C20+0x118, playback mode
[ ml_init:0007f1ec ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000000, 0x01387100
[ ml_init:0007f210 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000000, 0x01387100
[ ml_init:0007f238 ] (32:03) stateobj_disp+0x118[]=0x41380008,0x00000000,0x4092e3a8
# EOSM 2.0.2, 0x3E650+0x114 (no GUI in QEMU)
[ ml_init:0009e70c ] (32:03) bmp_vram[]=0xc0f140d0, 0x00000001, 0x01387100
[ ml_init:0009e730 ] (32:03) bmp_vram[]=0xc0f140d4, 0x00000001, 0x01387100
[ ml_init:0009e758 ] (32:03) stateobj_disp+0x114[]=0x41380008,0x00000000,0x00000000,
In any case, this test does not reveal any new addresses, so you don't really need to run it; matching the stub with other models should be enough.
"[LVEVF] evVdInterrupt LastRamClear Start!![4f1d7800]":#define YUV422_LV_BUFFER_1 0x4F1D7800
#define YUV422_LV_BUFFER_2 0x4F5E7800
#define YUV422_LV_BUFFER_3 0x4F9F7800
"evVdInterrupt LastRamClear Start!![%lx]":#define CURRENT_GUI_MODE (*(int*)0x928BC) // in SetGUIRequestMode
#define ISO_ADJUSTMENT_ACTIVE ((*(int*)0x96388) == 0xF) // dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)
#define CURRENT_GUI_MODE (*(int*)(0x92860+0x5C)) // in SetGUIRequestMode
#define ISO_ADJUSTMENT_ACTIVE ((*(int*)(0x96338+0x50)) == 0xF) // dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)
#define ISO_ADJUSTMENT_ACTIVE ((*(int*)(0x4BE28+0x44)) == 0xF) // dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)
// #define ISO_ADJUSTMENT_ACTIVE ((*(int*)(0x6B930)) == 0xF) // dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)#define ISO_ADJUSTMENT_ACTIVE ((*(int*)(0x6B810+0x50)) == 0xF) // dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)I am unsure myself why it's commented out but the "wrong" value was correct one of the older A/B/C revision on 1.00 firmware. I was mainly doing copy&paste for the revisions as well while upgrading support for fw 1.01. Anyways thx for pointing it out as it has tbd for 70D too (942C0+50).Code: [Select]#define ISO_ADJUSTMENT_ACTIVE ((*(int*)(0x6B810+0x50)) == 0xF)
// dec ptpNotifyOlcInfoChanged and look for: if arg1 == 1: MEM(0x79B8) = *(arg2)
for (i = 0; i < MOV_RES_AND_FPS_COMBINATIONS; i++) // 7 combinations of resolution / fps
| 1- | 1920 | 24 | NTSC/PAL |
| 2- | 1920 | 25 | PAL |
| 3- | 1920 | 30 | NTSC |
| 4- | 1280 | 50 | PAL |
| 5- | 1280 | 60 | NTSC |
| 5- | 640 | 25 | PAL |
| 7- | 640 | 30 | NTSC |
#define MOV_RES_AND_FPS_COMBINATIONS 5 // 3 fullhd, 2 hd, not changing the two VGA modes; worth trying with 9
#define MOV_RES_AND_FPS_COMBINATIONS 4 // 2FHD, 1HD, 1VGA
#define MOV_RES_AND_FPS_COMBINATIONS 9#define AE_STATE (*(int8_t*)(0x366B8 + 0x1C))
#define AE_VALUE (*(int8_t*)(0x366B8 + 0x1D))#define AE_STATE (*(int8_t*)(0x366B4 + 0x1C))
#define AE_VALUE (*(int8_t*)(0x366B4 + 0x1D))#define AE_STATE (*(int8_t*)(0x367B4 + 0x1C))
#define AE_VALUE (*(int8_t*)(0x367B4 + 0x1D))
...
100D is crippled by Canon. It really only has 4 movie modes to select in Canon menu
On 60D there are 2 additional VGA modes Crop 640x480 NTSC and Crop 640x480 PAL. So here you get in total 9. Just an idea (even though it is another cam generation)
...
Take this for 700D.114:
...
#define HALFSHUTTER_PRESSED (*(int*)0x24884) is ok [0x2486C+0x18].
| 5D3 | [0x251C4+0x10] |
| 100D | [0x6674C+0x18] |
| 700D | [0x2486C+0x18] |
| EOSM | [0x3F204+0x20] |
| EOSM2 | [0x910A8+0x??] |
[MC] permit LV instant - all D4 and D5 models have it.
Take this for 700D.114:Code: [Select]#define AE_STATE (*(int8_t*)(0x367B4 + 0x1C))
#define AE_VALUE (*(int8_t*)(0x367B4 + 0x1D))
...
The AE_VALUEs are for the autoexpo module. Not sure how to use it, couldn't figure it out...
Hello,
I have download this module for the 700D and it doesn't work.
Then I will instal cygwin and check out the code source and after read this post, see by debug that the AE_STATE is never set (always 0).
So I change the consts.h file for the 700D platform in replacement of the constants AE_STATE ans VALUE as written somewhere in a topic page after having check in hexa code. It will be then the following :
#define EXPO_COMP (*(int16_t*)(0x367B4+0x1C))
#define AE_VALUE (EXPO_COMP-1) * 8 / 2048
#define AE_STATE (*(int8_t*)(0x367B4+0x1C))
It works (I check by printing the values of ae, iso, and so on).
I can check in if you want.
Just a question, what it is the use of AE_STATE ?
Xav
Pretty sure that on the EOSM2 disassembly it shows up as - judge_permit_lv.
Key event: 2a -> 0e0e002d
[MPU] Sending : 06 05 06 26 01 00
[ PowerMgr:ff1470d4 ] (00:01) <0 0 0 0 0 0 7> [PM] DisablePowerSave (Counter = 2)
[ PowerMgr:ff147144 ] (00:01) <0 0 0 0 0 0 7> [PM] EnablePowerSave (Counter = 1)
[ MainCtrl:ff0d01c0 ] (9c:01) <0 0 0 0 0 0 7> ID:26(30)
[ MainCtrl:ff0cd8ac ] (89:03) <0 0 0 0 0 0 7> bindReceiveSwitch (38, 1)
[ MainCtrl:ff0cdd88 ] (89:03) <0 0 0 0 0 0 7> COM_SW_SOMETHING
[ MainCtrl:ff0d8ba0 ] (85:03) <0 0 0 0 0 0 7> GUI_Control:84 0x0
[ GuiMainTask:ff0d8f54 ] (84:01) <0 0 0 0 0 0 7> GUI_CONTROL:84
[MPU] Sending : 06 04 05 00 00 00
[ GuiMainTask:ff1470d4 ] (00:01) <0 0 0 0 0 0 7> [PM] DisablePowerSave (Counter = 2)
[ GuiMainTask:ff147144 ] (00:01) <0 0 0 0 0 0 7> [PM] EnablePowerSave (Counter = 1)
[ GuiMainTask:ff1c0728 ] (84:03) <0 0 0 0 0 0 7> GUICMD_PRESS_BUTTON_SOMETHING(0x0)
[ EventMgr:ff224a04 ] (8d:01) <0 0 0 0 0 0 7> emDeliverMulticastEvent : SW1ON
[ MainCtrl:ff0d01c0 ] (9c:01) <0 0 0 0 0 0 7> ID:0(31)
[ MainCtrl:ff154660 ] (9c:03) <0 0 0 0 0 0 7> MeteringStart
[ MainCtrl:ff3da3b0 ] (c0:03) <1 0 0 0 0 0 7> MainCtrl GuiCancelMoviePlay(4151)
[ MainCtrl:ff3e3814 ] (c0:02) <1 0 0 0 0 0 7> [G_P]PC:0xff3e3804 LR:0xff154718 SP:0x197f38
[ MainCtrl:ff0dffe4 ] (2c:03) <1 0 0 0 0 0 7> MVP_CancelMoviePlay
[ MainCtrl:ff0d8ba0 ] (85:03) <1 0 0 0 0 0 7> GUI_Control:80 0x0
[ MainCtrl:ff1549a4 ] (89:03) <1 0 0 0 0 0 7> EVENTID_METERING_START
[ RscMgr:ff0e87dc ] (80:02) <1 0 0 0 0 0 7> srmEventDispatch: Current = 0, dwEventID = 12, dwParam = -442503148 S
[ RscMgr:ff0e89e4 ] (80:02) <1 0 0 0 0 0 7> srmEventDispatch: Current = 0, dwEventID = 12, dwParam = -442503148 E
[ GuiMainTask:ff1c1880 ] (84:01) <1 0 0 0 0 0 7> gui control end
[ GuiMainTask:ff1c18a0 ] (84:01) <1 0 0 0 0 0 7> 0msec = 47810 - 47810
[ GuiMainTask:ff1c18bc ] (84:01) <1 0 0 0 0 0 7> 3584msec = 776448 - 780032
[ GuiMainTask:ff0d8f54 ] (84:01) <1 0 0 0 0 0 7> GUI_CONTROL:80
[ GuiMainTask:ff1c1880 ] (84:01) <1 0 0 0 0 0 7> gui control end
[ GuiMainTask:ff1c18a0 ] (84:01) <1 0 0 0 0 0 7> 0msec = 47810 - 47810
[ GuiMainTask:ff1c18bc ] (84:01) <1 0 0 0 0 0 7> 0msec = 780544 - 780544
[ CtrlSrv:ff3ab264 ] (83:03) <1 0 0 0 0 0 7> IDLEHandler PRESS_SW1_BUTTON
[ Fstorage:ff1c8fac ] (9e:03) <1 0 0 0 0 0 7> fssSW1On
[ CEC:ff347750 ] (c2:01) <1 0 0 0 0 0 7> cecCompleteStart Start
[ CEC:ff357118 ] (00:26) <1 0 0 0 0 0 7> [I2C] localI2C_Read : 378 (Task : CEC)
980: 47851.520 WARN [I2C] localI2C_Read : 378 (Task : CEC)
[ CEC:ff347750 ] (c2:01) <1 0 0 0 0 0 7> cecCompleteStart Start
[ CEC:ff357118 ] (00:26) <1 0 0 0 0 0 7> [I2C] localI2C_Read : 378 (Task : CEC)
981: 47868.416 WARN [I2C] localI2C_Read : 378 (Task : CEC)
[ CEC:ff347750 ] (c2:01) <1 0 0 0 0 0 7> cecCompleteStart Start
[ CEC:ff357118 ] (00:26) <1 0 0 0 0 0 7> [I2C] localI2C_Read : 378 (Task : CEC)
982: 47888.640 WARN [I2C] localI2C_Read : 378 (Task : CEC)
Key event: aa -> 0e0e002e
[MPU] Sending : 06 04 05 0b 00 00
[ PowerMgr:ff1470d4 ] (00:01) <1 0 0 0 0 0 7> [PM] DisablePowerSave (Counter = 2)
[ PowerMgr:ff147144 ] (00:01) <1 0 0 0 0 0 7> [PM] EnablePowerSave (Counter = 1)
[ EventMgr:ff224b7c ] (8d:01) <1 0 0 0 0 0 7> emDeliverMulticastEvent : SW1OFF
[ MainCtrl:ff0d01c0 ] (9c:01) <1 0 0 0 0 0 7> ID:B(32)
[ MainCtrl:ff154748 ] (9c:03) <1 0 0 0 0 0 7> MeteringTimerStart
[ MainCtrl:ff0d8ba0 ] (85:03) <0 0 0 0 0 0 7> GUI_Control:81 0x0
[ MainCtrl:ff1549a4 ] (89:03) <0 0 0 0 0 0 7> EVENTID_METERING_TIMER_START
[ RscMgr:ff0e87dc ] (80:02) <0 0 0 0 0 0 7> srmEventDispatch: Current = 0, dwEventID = 13, dwParam = -442503148 S
[ RscMgr:ff0e89e4 ] (80:02) <0 0 0 0 0 0 7> srmEventDispatch: Current = 0, dwEventID = 13, dwParam = -442503148 E
[ GuiMainTask:ff0d8f54 ] (84:01) <0 0 0 0 0 0 7> GUI_CONTROL:81
[ GuiMainTask:ff1c1880 ] (84:01) <0 0 0 0 0 0 7> gui control end
[ GuiMainTask:ff1c18a0 ] (84:01) <0 0 0 0 0 0 7> 0msec = 47880 - 47880
[ GuiMainTask:ff1c18bc ] (84:01) <0 0 0 0 0 0 7> 0msec = 844032 - 844032
[ CtrlSrv:ff3ab2f4 ] (83:03) <0 0 0 0 0 0 7> IDLEHandler UNPRESS_SW1_BUTTON
[ CEC:ff347750 ] (c2:01) <0 0 0 0 0 0 7> cecCompleteStart Start
[ CEC:ff357118 ] (00:26) <0 0 0 0 0 0 7> [I2C] localI2C_Read : 378 (Task : CEC)
APPEND("(%02x:%02x) <%x %x %x %x %x %x %x> ", r0, r1, MEM(0x910C8), MEM(0x910CC), MEM(0x910D4), MEM(0x910F8), MEM(0x910FC), MEM(0x91100), MEM(0x91178));
static uint32_t MEM(uint32_t addr)
{
uint32_t buf;
cpu_physical_memory_read(addr, &buf, sizeof(buf));
return buf;
}
... would have saved a lot of work if we had that earlier :D
Which buttons are missing?Looks ok now though, you can change lower limits with left-right and upper values with rotating wheel, strange that (IIRC) this was not possible in the past, albeit the sourcode was not modified since forever. :-\ ::) :o
autoexpo.mo appears to be working on the EOSM though I have no idea how to work it.
// http://magiclantern.wikia.com/wiki/Fonts
#define BFNT_CHAR_CODES 0xffcb9c04
#define BFNT_BITMAP_OFFSET 0xffcbcb88
#define BFNT_BITMAP_DATA 0xffcbfb0c
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex
0xff1e4838: FNT
0xff1e483c: (+0x04) 0xffd8
0xff1e483e: (+0x06) font_width = 40
0xff1e4840: (+0x08) charmap_offset = 0x24
0xff1e4844: (+0x0c) charmap_size = 0x31b4
0xff1e4848: (+0x10) bitmap_size = 0x8ab3e
0xff1e484c: (+0x14) font name = 'HCanonGothic///'
0xff1e485c: (+0x24) char_codes[]. 3181 chars
0xff1e7a10: (+0x31d8) offsets[]. Last offset value = 0x8ab08
0xff1eabc4: (+0x638c) bitmaps[]
0xff2756cc: (+0x90e94) last bitmap
+0x00: bitmap width = 28
+0x02: bitmap height = 28
+0x04: char width = 36
+0x06: X offset = 4
+0x08: Y offset = 16
bitmap size = 0x70
0xff275704: FNT
0xff275708: (+0x04) 0xffd8
0xff27570a: (+0x06) font_width = 40
0xff27570c: (+0x08) charmap_offset = 0x24
0xff275710: (+0x0c) charmap_size = 0x188
0xff275714: (+0x10) bitmap_size = 0x31c4
0xff275718: (+0x14) font name = 'CanonMonospace'
0xff275728: (+0x24) char_codes[]. 98 chars
0xff2758b0: (+0x1ac) offsets[]. Last offset value = 0x3142
0xff275a38: (+0x334) bitmaps[]
0xff278b7a: (+0x3476) last bitmap
+0x00: bitmap width = 22
+0x02: bitmap height = 22
+0x04: char width = 22
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0x42
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror
F2000000 - F2FFFFFF: eos.rom0_mirror
F3000000 - F3FFFFFF: eos.rom0_mirror
F4000000 - F4FFFFFF: eos.rom0_mirror
F5000000 - F5FFFFFF: eos.rom0_mirror
F6000000 - F6FFFFFF: eos.rom0_mirror
F7000000 - F7FFFFFF: eos.rom0_mirror
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
// http://magiclantern.wikia.com/wiki/Fonts
#define BFNT_CHAR_CODES 0xf71e485c
#define BFNT_BITMAP_OFFSET 0xf71e7a10
#define BFNT_BITMAP_DATA 0xf71eabc40xff423a50: (+0x24) char_codes[]. 3165 chars#define BFNT_CHAR_CODES 0xF7363A50Therefore, 0xF[0-7][3B]63A50 should all be valid choices for BFNT_CHAR_CODES.
So confused -- why doesn't find_fnt.py just spit out the right numbers?
python find_fnt.py ROM0.BIN 0xF0000000
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex
0xf0124838: FNT
0xf012483c: (+0x04) 0xffd8
0xf012483e: (+0x06) font_width = 40
0xf0124840: (+0x08) charmap_offset = 0x24
0xf0124844: (+0x0c) charmap_size = 0x31b4
0xf0124848: (+0x10) bitmap_size = 0x8ab3e
0xf012484c: (+0x14) font name = 'HCanonGothic///'
0xf012485c: (+0x24) char_codes[]. 3181 chars
0xf0127a10: (+0x31d8) offsets[]. Last offset value = 0x8ab08
0xf012abc4: (+0x638c) bitmaps[]
0xf01b56cc: (+0x90e94) last bitmap
+0x00: bitmap width = 28
+0x02: bitmap height = 28
+0x04: char width = 36
+0x06: X offset = 4
+0x08: Y offset = 16
bitmap size = 0x70
0xf01b5704: FNT
0xf01b5708: (+0x04) 0xffd8
0xf01b570a: (+0x06) font_width = 40
0xf01b570c: (+0x08) charmap_offset = 0x24
0xf01b5710: (+0x0c) charmap_size = 0x188
0xf01b5714: (+0x10) bitmap_size = 0x31c4
0xf01b5718: (+0x14) font name = 'CanonMonospace'
0xf01b5728: (+0x24) char_codes[]. 98 chars
0xf01b58b0: (+0x1ac) offsets[]. Last offset value = 0x3142
0xf01b5a38: (+0x334) bitmaps[]
0xf01b8b7a: (+0x3476) last bitmap
+0x00: bitmap width = 22
+0x02: bitmap height = 22
+0x04: char width = 22
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0x42
// http://magiclantern.wikia.com/wiki/Fonts
#define BFNT_CHAR_CODES 0xf012485c
#define BFNT_BITMAP_OFFSET 0xf0127a10
#define BFNT_BITMAP_DATA 0xf012abc4
#define BFNT_CHAR_CODES 0xf7c5E9C0if (len(sys.argv)>2):
base = int(sys.argv[2], 16)
else:
base = 0xff010000P.S. Here's an easy coding task - print the name of the buttons in the logs.
... that script assumes the ROM dump loads at 0xff010000 (this was the main firmware start address for DIGIC 4 models, so in the early days, ROM files were saved from that address)
You mean in the mem_spy module interpret the button codes to print out the names of the buttons?
static void backup_rom_task()
{
backup_region("ML/LOGS/ROM1.BIN", 0xF8000000, 0x01000000);
backup_region("ML/LOGS/ROM0.BIN", 0xF0000000, 0x01000000);
}
if (len(sys.argv)>2):
base = int(sys.argv[2], 16)
else:
base = 0xf0000000
...QEMU logs...instead of "Key event: 2a -> 0e0e002d", print something human-readable.
the bin can be parsed with the python script in the module directory ;)
python parse_bin.py -f ROM1.BIN#define FRAME_SHUTTER_BLANKING_ZOOM (*(uint16_t*)0x40481B20) // ADTG register 805f
#define FRAME_SHUTTER_BLANKING_NOZOOM (*(uint16_t*)0x40481B24) // ADTG register 8061
Exercises:
- (easy) patch the loop that times out (probably when initializing the touch IC) and the localI2C_Read loop;
- (easy) print Hello World with the minimal ML target;
- (moderate) print Hello World with the regular ML source code;
- (moderate) implement touch screen emulation;
- (moderate) bring ML menu in QEMU;
- (harder) full ML port, with most features working;
- (extreme) LiveView emulation.
MODEL=EOSM2 make
...
[ LD ] magiclantern
stdio.o: In function `my_fprintf':
/Users/rosiefort/magic-lantern/minimal/qemu-frsp/../../src/stdio.c:32: undefined reference to `FIO_WriteFile'
make: *** [magiclantern] Error 1
MODEL=EOSM2 make
...
magiclantern.bin: 3052 bytes
[ CC ] reboot.o
[ CC ] disp_direct.o
[ CC ] footer.o
[ LD ] autoexec
[ OBJCOPY ] autoexec.bin
[ XOR_CHK ] autoexec.bin
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000060 0x0009e1e0 0x0009e1e0 0x00bec 0x10c20 RWE 0x10
./run_canon_fw.sh EOSM2,firmware="boot=1" -s -S -d autoexec,ramw,calls,io,v & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
Lockdown read 0
Lockdown read 0
Lockdown read 1
Lockdown read 1
Lockdown read 2
Lockdown read 2
Lockdown read 3
Lockdown read 3
Lockdown read 4
Lockdown read 4
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 1FFFFFFF: eos.ram
40001000 - 5FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror
F2000000 - F2FFFFFF: eos.rom0_mirror
F3000000 - F3FFFFFF: eos.rom0_mirror
F4000000 - F4FFFFFF: eos.rom0_mirror
F5000000 - F5FFFFFF: eos.rom0_mirror
F6000000 - F6FFFFFF: eos.rom0_mirror
F7000000 - F7FFFFFF: eos.rom0_mirror
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
C0000000 - DFFFFFFF: eos.iomem
[EOS] enabling code execution logging.
[EOS] enabling memory access logging.
[EOS] enabling singlestep.
[EOS] disabling verbose logging until autoexec.bin starts...
[EOS] loading './EOSM2/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './EOSM2/ROM1.BIN' to 0xF8000000-0xF8FFFFFF
[EOS] loading './EOSM2/SFDATA.BIN' as serial flash, size=0x1000000
[MPU] warning: non-empty spell #31 (08 06 03 1f) has duplicate(s): #40
[MPU] warning: non-empty spell #41 (0a 08 01 3b) has duplicate(s): #37 #38
[MPU] warning: non-empty spell #45 (26 24 01 4e) has duplicate(s): #46
[MPU] Available keys:
- Arrow keys : Navigation
- [ and ] : Main dial (top scrollwheel)
- SPACE : SET
- DELETE : guess
- M : MENU
- P : PLAY
- I : INFO/DISP
- Q : guess
- L : LiveView
- Shift : Half-shutter
- B : Open battery cover
- F1 : show this help
Setting BOOTDISK flag to FFFFFFFF
0xffff0000 in ?? ()
+macro define CURRENT_TASK ((int)0xFFFFFFFF)
+macro define CURRENT_ISR ((int)0xFFFFFFFF)
+macro define RTC_VALID_FLAG ((int)0xFFFFFFFF)
+macro define NUM_CORES 1
+macro define PRINT_CALLSTACK 0
+set pagination off
+set output-radix 16
+define hook-quit
+define KRED
+define KCYN
+define KBLU
+define KGRN
+define KYLW
+define KRESET
+macro define CURRENT_TASK_NAME (((int*)CURRENT_TASK)[0] ? ((char***)CURRENT_TASK)[0][9] : CURRENT_TASK)
+define print_callstack
+define print_current_location
+define print_current_location_with_callstack
+define print_formatted_string
+define DebugMsg_log
+define DebugMsg1_log
+define printf_log
+define task_create_log
+define task_switch_log
+define msleep_log
+define assert_log
+define assert0_log
+define create_semaphore_log
+define delete_semaphore_log
+define print_sem_name
+define take_semaphore_log
+define give_semaphore_log
+define create_msg_queue_log
+define print_mq_name
+define post_msg_queue_log
+define try_receive_msg_queue_log
+define receive_msg_queue_log
+define register_interrupt_log
+define register_func_log
+define mpu_decode
+define mpu_send_log
+define mpu_recv_log
+define try_expand_ram_struct
+define try_post_event_log
+define delayed_call_print_name
+define delayed_call_log
+define SetTimerAfter_log
+define SetHPTimerAfterNow_log
+define SetHPTimerNextTick_log
+define CancelTimer_log
+define engine_resource_description
+define engine_resources_list
+define CreateResLockEntry_log
+define LockEngineResources_log
+define AsyncLockEngineResources_log
+define UnLockEngineResources_log
+define StartEDmac_log
+define SetEDmac_log
+define print_date_time
+define set_date_time
+define load_default_date_time_log
+define log_result
Breakpoint 1 at 0x4398
Breakpoint 2 at 0x7360
Breakpoint 3 at 0xff0c5144
FFFF096C: MCR p15,0,Rd,cr9,cr1,0: XSCALE_LOCK_ICACHE_LINE <- 0x40000006 (40000000 - 40000FFF, 0x1000)
FFFF0970: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0x2078
FFFF0978: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0x12078
FFFF3F54: MCR p15,0,Rd,cr6,cr0,0: 946_PRBS0 <- 0x3F (00000000 - FFFFFFFF, 0x100000000)
FFFF3F5C: MCR p15,0,Rd,cr6,cr1,0: 946_PRBS1 <- 0x3D (00000000 - 7FFFFFFF, 0x80000000)
FFFF3F64: MCR p15,0,Rd,cr6,cr2,0: 946_PRBS2 <- 0xE0000039 (E0000000 - FFFFFFFF, 0x20000000)
FFFF3F6C: MCR p15,0,Rd,cr6,cr3,0: 946_PRBS3 <- 0xC0000039 (C0000000 - DFFFFFFF, 0x20000000)
FFFF3F74: MCR p15,0,Rd,cr6,cr4,0: 946_PRBS4 <- 0xFF00002F (FF000000 - FFFFFFFF, 0x1000000)
FFFF3F7C: MCR p15,0,Rd,cr6,cr5,0: 946_PRBS5 <- 0x37 (00000000 - 0FFFFFFF, 0x10000000)
FFFF3F84: MCR p15,0,Rd,cr6,cr6,0: 946_PRBS6 <- 0xF700002F (F7000000 - F7FFFFFF, 0x1000000)
FFFF3F8C: MCR p15,0,Rd,cr2,cr0,0: DCACHE_CFG <- 0x70
FFFF3F90: MCR p15,0,Rd,cr3,cr0,0: DACR <- 0x70
FFFF3F94: MCR p15,0,Rd,cr2,cr0,1: ICACHE_CFG <- 0x70
FFFF3F9C: MCR p15,0,Rd,cr5,cr0,0: DATA_AP <- 0x3FFF
FFFF3FA0: MCR p15,0,Rd,cr5,cr0,1: INSN_AP <- 0x3FFF
FFFF3FA4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0x12078
FFFF3FC8: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC001307D
FFFF0984: MCR p15,0,Rd,cr9,cr1,1: XSCALE_UNLOCK_ICACHE <- 0x6 (00000000 - 00000FFF, 0x1000)
FFFF0988: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC001307D
FFFF0990: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005307D
FFFF09B8: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005307D
FFFF09C0: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
SD: CMD12 in a wrong state
[SDIO] Error
SD: CMD12 in a wrong state
[SDIO] Error
SD LOAD OK.
Open file for read : AUTOEXEC.BIN
SD: CMD12 in a wrong state
[SDIO] Error
SD: CMD12 in a wrong state
[SDIO] Error
File size : 0x671C0
Now jump to AUTOEXEC.BIN!!
0010E5F8: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E600: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[EOS] enabling verbose logging for autoexec.bin...
PC jump? 0x800000 lr=10e65c at [10e674:10e65c]
0x0010e674: e1a0f001 mov pc, r1
[EOS] enabling verbose logging for autoexec.bin...
[BOOT] changing user_mem_start from 0x17ec74 (1567860) to 0x117940 (1145152)
[BOOT] changing init_task from 0xff0c57a0 (-15968352) to 0x9e1f0 (647664)
DRYOS PANIC: Module Code = 1, Panic Code = 2
^C
Program received signal SIGINT, Interrupt.
0xff0c19f4 in ?? ()
(gdb)
[BOOT] changing user_mem_start from 0x17ec74 (1567860) to 0x117940 (1145152)
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
(wait until it boots)
CTRL-C
set $pc = 0xFF0C6E70
continue
...
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00100d80
user_mem_max 515828
...
# DryOS memory map
# RESTARTSTART is selected to be at user_mem_start
# (aka heap start / DRY_HEAP_START / malloc memory pool)
#
RESTARTSTART = 0x001CC400
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00104580
user_mem_max 501492
Malloc Information (onetime type)
Start Address = 0x00100d88
End Address = 0x0017ea60
Total Size = 0x0007dcd8 ( 515288)
Allocated Size = 0x00015ab0 ( 88752)
Allocated Peak = 0x00015ab0 ( 88752)
Allocated Count = 0x0000005a ( 90)
Free Size = 0x00068228 ( 426536)
Free Block Max Size = 0x000681f0 ( 426480)
Free Block Count = 0x00000002 ( 2)
Malloc Information (onetime type)
Start Address = 0x00104588
End Address = 0x0017ea60
Total Size = 0x0007a4d8 ( 500952)
Allocated Size = 0x00015ab0 ( 88752)
Allocated Peak = 0x00015ab0 ( 88752)
Allocated Count = 0x0000005a ( 90)
Free Size = 0x00064a28 ( 412200)
Free Block Max Size = 0x000649f0 ( 412144)
Free Block Count = 0x00000002 ( 2)
(after returning from that function, there will be dragons)
The world is a paradise-and then, in a moment, it ends.
#Makefile.setup.platform for EOS M2
ifeq ($(FW_VERSION),103)
CANON_NAME_FIR=EOSM2103.FIR
ROMBASEADDR = 0xFF0C0000
# DryOS memory map
# RESTARTSTART is selected to be at user_mem_start
# (aka heap start / DRY_HEAP_START / malloc memory pool)
# (actually 0x00100d80 but make it a little bit higher)
#
RESTARTSTART = 0x100E00
endif
Having fixed RESTARTSTART and the (misnamed) HIJACK_INSTR_BSS_END...
#define HIJACK_INSTR_BSS_END 0xFF0C1C94 //BSS_END is 0x17EC74; ff0c1c90: (00100d80)
; ff0c1c94: (0017ec74)
...let's check the memory map again, this time loading some minimal ML:
b *0x1900
assert_log
The 7D2 source contains 3 important hints: malloc_info, sysmem_info and smemShowFix (all easily found in the firmware).
Let's call the first one (from GDB, to avoid recompiling):
Exercises:
- (easy) patch the loop that times out (probably when initializing the touch IC) and the localI2C_Read loop;
- (easy) print Hello World with the minimal ML target;
...
[ TouchMgr:ff346008 ] (c1:16) Touch IC Ver : 0x0000
154: 993.280 [TCH]Touch IC Ver : 0x0000
[ TouchMgr:ff345160 ] (c1:03) ExecuteSIO32 err
...
[ TouchMgr:ff344f58 ] (c1:03) ExecuteSIO8 err
...
[ TouchMgr:ff34602c ] (c1:06) TouchPanelIC Ack Error
[ Startup:0003671c ] task_create(DisplayMgr, prio=12, stack=0, entry=36628, arg=8ce0e8)
# patch TouchMgr to avoid err messages and loop timeout
# ExecuteSIO8
set *(int*)0xff344f?? = 0xe???????
# ExecuteSIO32
set *(int*)0xff3451?? = 0xe???????
Took a closer look at the firmware signature - it's affected by our QEMU patches. So, to find it, either debug it without enabling other ROM patches (those with SET), or find it out outside GDB (e.g. print it on the screen), or just keep it commented out.
static int compute_signature(int* start, int num)
{
int c = 0;
int* p;
for (p = start; p < start + num; p++)
{
c += *p;
}
return c;
}
The world is a paradise-and then, in a moment, it ends.
...let's check the memory map again, this time loading some minimal ML:
...
The hackish way to do this doesn't work when loading the QEMU minimal autoexec.bin so this probably requires doing it via debugmsg.gbd, right? Uh, how?
The closest I could find in the EOSM2 source is: "Malloc Information (%s type)", "ShowWinsysMemory" and "..smemShowFix"
shouldn't this work on the EOSM2?Code: [Select]b *0x1900
assert_log
So shouldn't it be possible to write a rather simple script to find the firmware signature from ROM1.BIN or would that be short circuiting the porting process?
I'm still at a loss at how to print Hello World with the minimal ML target.
Exercises:
- (easy) patch the loop that times out (probably when initializing the touch IC) and the localI2C_Read loop;
# patch TouchMgr to avoid loop timeout
# ExecuteSIO8
set *(int*)0xFF344F40 = 0xe1a0000b
# ExecuteSIO32
set *(int*)0xFF345148 = 0xe1a0000b
154: 824.832 [TCH]ERROR TouchPanelIC Ack Error
155: 760.576 WARN [I2C] localI2C_Read : 378 (Task : Startup)
156: 760.832 WARN [I2C] localI2C_Read : 378 (Task : Startup)
157: 761.088 WARN [I2C] localI2C_Read : 378 (Task : Startup)
158: 761.344 WARN [I2C] localI2C_Read : 378 (Task : Startup)
159: 761.600 WARN [I2C] localI2C_Read : 378 (Task : Startup)
160: 761.856 WARN [I2C] localI2C_Read : 378 (Task : Startup)
161: 761.856 WARN [I2C] localI2C_Read : 378 (Task : Startup)
162: 762.112 WARN [I2C] localI2C_Read : 378 (Task : Startup)
163: 762.368 WARN [I2C] localI2C_Read : 378 (Task : Startup)
164: 833.536 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
165: 833.536 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
172: 836.608 [STARTUP] startupInitializeComplete
173: 841.216 [MR] mvrChangeAckCBR : Video - Mode=0, Type=2, Rate=30, GOP=15
174: 850.176 [MR] mvrChangeAckCBR : Video - Mode=0, Type=2, Rate=30, GOP=15
180: 863.232 [CEC]CEC OFF
182: 882.176 [RTC] !! RTC CHECK ERROR !!
^C
Program received signal SIGINT, Interrupt.
0xff352318 in ?? ()
(gdb) set $pc = 0xFF0C6E70
(gdb) continue
Continuing.
...
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00100d80
user_mem_max 14336
...
^C
Program received signal SIGINT, Interrupt.
0xff352318 in ?? ()
(gdb) set $pc = 0xFF0C750C
(gdb) continue
Continuing.
Malloc Information (onetime type)
Start Address = 0x00100d88
End Address = 0x00104370
Total Size = 0x000035e8 ( 13800)
Allocated Size = 0x000025c0 ( 9664)
Allocated Peak = 0x000025c0 ( 9664)
Allocated Count = 0x00000011 ( 17)
Free Size = 0x00001028 ( 4136)
Free Block Max Size = 0x00001028 ( 4136)
Free Block Count = 0x00000001 ( 1)
At least it doesn't slow down to a crawl when it hits the TouchMgr section.
... it no longer boots the GUI ...
# ./run_canon_fw.sh EOSM2 -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
source -v debug-logging.gdb
macro define CURRENT_TASK 0x8FBCC
macro define CURRENT_ISR (*(int*)0x648 ? (*(int*)0x64C) >> 2 : 0)
b *0x4398
DebugMsg_log
b *0x1900
assert_log
b *0x7360
task_create_log
# patch DL to avoid DL ERROR messages
set *(int*)0xFF156348 = 0xe3a00015
# patch localI2C_Write to always return 1 (success)
set *(int*)0xFF356E24 = 0xe3a00001
set *(int*)0xFF356E28 = 0xe12fff1e
# patch TouchMgr to avoid loop timeout
# ExecuteSIO8
set *(int*)0xFF344F40 = 0xe1a0000b
# ExecuteSIO32
set *(int*)0xFF345148 = 0xe1a0000b
# skip SerialFlash version check
set *(int*)0xFF0C4278 = 0xe3a00000
# break infinite loop at Wait LeoLens Complete
b *0xFF0C5144
commands
printf "Patching LeoLens (infinite loop)\n"
set *(int*)($r4 + 0x28) = 1
c
end
continue
185: 2214.144 [WINSYS] allocated=44140 max_region=412876
[ PowerMgr:ff13432c ] (04:16) allocated=0 max_region=1066808
(gdb) set $pc = 0xff133b80
(gdb) c
Continuing.
[SVG] Free/Total:3229904/8118272
[SVG] SVG Alloc:0
[SVG] Max Region:2763608
[SVG] number of allocated block:4863
[SVG] dslr_malloc ResetAllocatePointer!!!!!!
[SVG] Memory Allocation Error at :429392408
[SVG] svg_malloc(size:0, pFileName, lineNo)
MaxRegion = 2763608
[SVG] Free/Total:3229904/8118272
[SVG] Max Region:2763608
[SVG] number of allocated block:4863
[SVG] Free/Total:6431420/8118272
[SVG] SVG Alloc:0
[SVG] Max Region:6427636
[SVG] number of allocated block:1537
[SVG] dslr_malloc ResetAllocatePointer!!!!!!
[SVG] Memory Allocation Error at :429392408
[SVG] svg_malloc(size:0, pFileName, lineNo)
MaxRegion = 6427636
[SVG] Free/Total:6431420/8118272
[SVG] Max Region:6427636
[SVG] number of allocated block:1537
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg & arm-none-eabi-gdb -x EOSM2/debugmsg.gdbenv QEMU_EOS_DEBUGMSG=0x5b90 ./run_canon_fw.sh 5D3,firmware="boot=0" -d debugmsg,callstack,vcd minimal/5D3.113/
RosieFoComputer:5D3.113 rosiefort$ make
../../platform/Makefile.platform.base:46: *** ROMBASEADDR is not defined. Stop.
I've got minimal hello world working on M2...
File size : 0x1940
Now jump to AUTOEXEC.BIN!!
0010DCCC: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010DCCC: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
Hello from task init
K285 READY
[ init:ff3014ac ] create_semaphore('EventProcedure', 1)
Temporary breakpoint 10 at 0xff3014b0
Program received signal SIGTRAP, Trace/breakpoint trap.
0xff3014b0 in ?? ()
(gdb)
./run_canon_fw.sh 5D3,firmware="boot=1"[DM] FROM Write Complete!!!Took a closer look at the firmware signature - it's affected by our QEMU patches. So, to find it, either debug it without enabling other ROM patches (those with SET), or find it out outside GDB (e.g. print it on the screen), or just keep it commented out.
Exercises:
- (easy) patch the loop that times out (probably when initializing the touch IC) and the localI2C_Read loop; Check?
- (easy) print Hello World with the minimal ML target; Maybe check this off too?
- (moderate) print Hello World with the regular ML source code; Next exercise?
- (moderate) implement touch screen emulation;
- (moderate) bring ML menu in QEMU;
- (harder) full ML port, with most features working;
- (extreme) LiveView emulation.
OK, so we don't have enough space to load the entire ML (maybe only if you compile it without any features). We'll have move somewhere else.
...
Note: I wouldn't call random stuff on a real camera without triple-checking the stub, the number of arguments, any prerequisites that might be and so on. Here we are on a virtual machine, so there's nothing to break - feel free to experiment away.
[DM] FROM Write Complete!!!
Maybe I already have a working EOSM2 minimal ML and don't know it?
CONFIG_HELLO_WORLD
...the minimal hello world requires very little RAM, so it should work (under GDB, with firmware signature commented out).
./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb > log_file.txt 2> err_file.txt
…
This GDB was configured as "--host=x86_64-apple-darwin10 --target=arm-none-eabi".
…
Breakpoint 1 at 0x408660d4: file ../../src/reboot.c, line 211.
Breakpoint 2 at 0x1900
Breakpoint 3 at 0x7360
Breakpoint 4 at 0xff0c5144
[0m[[1;36m init:ff352260 [0m] [1;34mtask_create(PowerMgr, prio=20, stack=400, entry=ff352084, arg=0)
[0m[0m[[1;36m init:0003671c [0m] [1;34mtask_create(DbgMgr, prio=1f, stack=0, entry=36628, arg=46e584)
[0m[0m[[1;36m init:ff0f5f24 [0m] [1;34mtask_create(Startup, prio=19, stack=2800, entry=ff0f5d68, arg=46e880)
[0m[0m[[1;36m init:ff0c33d4 [0m] [1;34mtask_create(TaskMain, prio=1d, stack=0, entry=ff0c28d8, arg=0)
[0m[0m[[1;36m Startup:ff0c375c [0m] [1;34mtask_create(Startup2, prio=11, stack=400, entry=ff0c3604, arg=0)
[0m[0m[[1;36m Startup:0003671c [0m] [1;34mtask_create(PropMgr, prio=14, stack=0, entry=36628, arg=4d7ca8)
[0m[0m[[1;36m Startup:ff0d261c [0m] [1;34mtask_create(DL, prio=f, stack=400, entry=ff0d23fc, arg=0)
[0m[0m[[1;36m Startup:0003671c [0m] [1;34mtask_create(EventMgr, prio=f, stack=0, entry=36628, arg=4e3898)
[0m[0m[[1;36m Startup:0003671c [0m] [1;34mtask_create(FileCache, prio=14, stack=0, entry=36628, arg=603d08)
[0m[0m[[1;36m Startup:0003671c [0m] [1;34mtask_create(RscMgr, prio=12, stack=0, entry=36628, arg=604110)
[0m[0m[[1;36m Startup:ff129dbc [0m] [[1;31mASSERT[0m] this at ./FileMgr/FileMgr.c:2279, ff129dc0FF0C11BC: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
FF0C11BC: MCR p15, ... : CACHEMAINT x2456 (omitted)
FF0C11BC: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC0051079
FF0C11F0: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC0051079
FF0C11DC: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C11F0: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC0050079
FF0C113C: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC0050079
...
FF0C1194: MCR p15, ... : CACHEMAINT x257 (omitted)
FF0C1194: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC0051079
FF0C11F0: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC0051079
FF0C1180: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C11F0: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC0050079
FF0C113C: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC0050079
FF0C1120: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C113C: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005007D
FF0C1168: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005007D
FF0C1120: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C1168: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[DM] FROM Write Complete!!!
This message usually follows some sort of error (assert). The log has many DL messages, which means it was not run under GDB.
[0m[0m[[1;36m Startup:ff129dbc [0m] [[1;31mASSERT[0m] this at ./FileMgr/FileMgr.c:2279, ff129dc0# FM_RegisterSpaceNotifyCallback
set *(int*)0xff129d94 = 0xe3a00001
OK, so we don't have enough space to load the entire ML (maybe only if you compile it without any features). We'll have move somewhere else.
...
One option is to try the AllocateMemory (like 550D or 1100D)...
./run_canon_fw.sh 550D,firmware="boot=1"// Used in boot-hack.c with CONFIG_ALLOCATE_MEMORY_POOL
#define ROM_ITASK_START 0xff0c57a0
#define ROM_ITASK_END 0xffc45984 // kinda iffy
#define ROM_CREATETASK_MAIN_START 0xff0c3064
#define ROM_CREATETASK_MAIN_END 0xff0c33dc
#define ROM_ALLOCMEM_END 0xff0c3074 // kinda iffy
#define ROM_ALLOCMEM_INIT 0xff0c307c // kinda iffy
#define ROM_B_CREATETASK_MAIN 0xff0c5814
/** This camera loads ML into the AllocateMemory pool **/
#define CONFIG_ALLOCATE_MEMORY_POOL
now you have to patch the DATA for the LDR. this is the address where the LDR R3, =0x1F300000 gets the 1F3000000 from.
should be right below the function.
> #define RSCMGR_MEMORY_PATCH_END 0xF80..... (yes, 0xF800!!! also on your cameras)
interesting that the 650D has 0x1F2C4000 bytes only.... hmm
after you defined that struct, make sure you set RESTARTSTART to 0x1FE00100 (original value minus 2MiB)
...
[ LD ] magiclantern
boot-hack.o: In function `init_task_patched':
/Users/rosiefort/magic-lantern/platform/EOSM2.103/../../src/boot-hack.c:642: undefined reference to `reloc'
/Users/rosiefort/magic-lantern/platform/EOSM2.103/../../src/boot-hack.c:650: undefined reference to `reloc'
make: *** [magiclantern] Error 1
EOS M2, QEMU:
(https://a1ex.magiclantern.fm/bleeding-edge/RscMgr/EOSM2.png)Code: [Select]1062: 48619.520 [RSC] --- Common Top ----
1063: 48619.520 [RSC] [TOP1] 0x40C2A000
1064: 48619.776 [RSC] REPLACE_IMAGE_VRAM 0x40C2A000 0x00032000 204800
1065: 48623.104 [RSC] SSS_DEVELOP_WORK 0x40C5C000 0x00038000 229376
1066: 48626.432 [RSC] SDS_DEVELOP_WORK 0x40C94000 0x00038000 229376
1067: 48629.760 [RSC] DARKCUR_COMP_WORK 0x40CCC000 0x00020000 131072
1069: 48637.440 [RSC] FENCING_WORK 0x40CEC000 0x00010000 65536
1070: 48640.768 [RSC] DCFNO 0x40CFC000 0x00004000 16384
1071: 48644.096 [RSC] LVMARGE_P_DEF_DATA_1 0x40D00000 0x0000A000 40960
1072: 48647.424 [RSC] LVMARGE_P_DEF_DATA_2 0x40D0A000 0x0000A000 40960
1074: 48654.848 [RSC] LVMARGE_P_DEF_DATA_3 0x41FF0000 0x0000A000 40960
1075: 48657.920 [RSC] LVMARGE_P_DEF_DATA_ZOOM 0x40D14000 0x0000C000 49152
1076: 48661.504 [RSC] FILE_HEADER 0x40D20000 0x00240000 2359296
1077: 48664.320 [RSC] SAF WORK 0x40FA0000 0x00200000 2097152
1078: 48667.136 [RSC] BMPVRAM1 0x411A0000 0x00080000 524288
1080: 48676.864 [RSC] BMPVRAM2 0x41220000 0x00080000 524288
1081: 48680.704 [RSC] ENGINE_MIRROR 0x412A0000 0x00044000 278528
1082: 48688.640 [RSC] VSHADING_COMP_WORK 0x412E4000 0x000DC000 901120
1084: 48692.992 [RSC] STILL SCAR 0x413C0000 0x00075B00 482048
1085: 48692.992 [RSC] TUNEDATA 0x41435B00 0x00140000 1310720
1086: 48692.992 [RSC] TUNEDATA2 0x41575B00 0x00160000 1441792
1087: 48693.504 [RSC] FIXDATA 0x416D5B00 0x0021E500 2221312
1088: 48693.504 [RSC] LVMARGE_P_DEF_DATA_CROP 0x418F4000 0x0000C000 49152
1089: 48693.760 [RSC] WIRELESS_WORK2 0x41900000 0x00300000 3145728
1090: 48699.648 [RSC] WIRELESS_WORK1 * 0x41C00000 0x00200000 2097152
1091: 48702.464 [RSC] ADAPTER_TRANSFER * 0x0 0x00000000 0
1092: 48702.464 [RSC] EEKO 0x41E00000 0x001E0000 1966080
1093: 48702.720 [RSC] SHOOTING_CREATIVEFILTER 0x41FE0000 0x00010000 65536
1094: 48704.512 [RSC] EXMEM3_AREA_4 0x0 0x00000000 0
1095: 48706.304 [RSC] --- Usually Mode ----
1096: 48708.352 [RSC] MEMORY_MGR 0x42000000 0x04000000 67108864
1098: 48715.520 [RSC] ONLY MEM1 1 0x46000000 0x02000000 33554432
1099: 48717.568 [RSC] ONLY MEM1 2 0x48000000 0x02000000 33554432
1100: 48721.152 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
1101: 48724.736 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
1102: 48727.808 [RSC] SS_DEVELOP1 0x4A000000 0x00E00000 14680064
1104: 48734.976 [RSC] EXMEM3_AREA_2 0x4AE00000 0x000EA000 958464
1105: 48738.816 [RSC] AVERAGE_WORK_TOP 0x4AEEA000 0x01116000 17915904
1106: 48742.144 [RSC] AVERAGE_WORK_BOTTOM 0x4C000000 0x01116000 17915904
1107: 48745.472 [RSC] SS_DEVELOP_OTHER_WORK 0x4D116000 0x00400000 4194304
1109: 48752.384 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
1110: 48753.920 [RSC] CAPTURE_WORK1 0x4D600000 0x00240000 2359296
1111: 48760.576 [RSC] EXMEM3_AREA_1 0x4DD16000 0x016BA000 23830528
1112: 48764.416 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
1113: 48764.928 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
1114: 48765.184 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
1116: 48771.584 [RSC] --- GIS Mode ----
1117: 48772.352 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432
1118: 48775.680 [RSC] WORK 0x4A000000 0x08600000 140509184
1119: 48775.680 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
1120: 48775.680 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
1121: 48779.520 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000
1122: 48779.520 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064
1123: 48782.848 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
1124: 48787.200 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520
1126: 48790.528 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
1127: 48796.160 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
1128: 48796.160 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
1129: 48797.696 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296
1130: 48800.256 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848
1131: 48802.304 [RSC] --- HDR Mode ----
1133: 48806.912 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432
1134: 48808.192 [RSC] WORK 0x4800000 0x0A600000 174063616
1135: 48813.312 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
1136: 48815.360 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
1137: 48815.360 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000
1138: 48815.360 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064
1139: 48815.872 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
1140: 48816.896 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520
1141: 48817.920 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
1142: 48817.920 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
1143: 48817.920 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
1144: 48820.224 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296
1145: 48823.808 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848
1146: 48824.320 [RSC] --- NR Mode ----
1148: 48829.952 [RSC] NR_MEMORY_MGR 0x42000000 0x08000000 134217728
1149: 48833.024 [RSC] COMPOSITION_WORK_TOP 0x0 0x00000000 0
1150: 48836.096 [RSC] COMPOSITION_WORK_BOTTOM 0x0 0x00000000 0
1151: 48839.424 [RSC] --- DP Mode ----
1152: 48841.216 [RSC] DP_SINGLE 0x42000000 0x05E00000 98566144
1153: 48841.216 [RSC] DP_MULTI 0x47E00000 0x04D94000 81346560
1154: 48843.520 [RSC] DP_CAPTURE_WORK1 0x4CB94000 0x00040000 262144
1155: 48844.288 [RSC] DP_AVERAGE_TOP 0x4DBD4000 0x01116000 17915904
1157: 48848.128 [RSC] DP_AVERAGE_BOTTOM 0x4ECEA000 0x01116000 17915904
1158: 48849.408 [RSC] --- Indev Mode ----
1159: 48851.200 [RSC] [INDVMGR] 0x0
1160: 48852.480 [RSC] YUV 0x4AEEA000 0x0222C000 35831808
1161: 48852.480 [RSC] YUV_OUT 0x42000000 0x0222C000 35831808
1162: 48853.760 [RSC] INDV_WORK 0x0 0x00000000 0
256MB. Note the WORK region has invalid size (it would overflow), so I've patched it to get a proper graph.
No unused areas for us.
# DryOS memory map
# RESTARTSTART is selected to be at user_mem_start
# (aka heap start / DRY_HEAP_START / malloc memory pool)
# (actually 0x00100d80 but make it a little bit higher)
#
RESTARTSTART = 0x100E00
sed -i 's/0xFF0C1C94/0xFF0C1C90/' platform/EOSM2.103/consts.h
Will explain CONFIG_ALLOCATE_MEMORY_POOL later.
/** This camera loads ML into the AllocateMemory pool **/
#define CONFIG_ALLOCATE_MEMORY_POOL #if defined(CONFIG_550D)
// change end limit to 0xc60000 => reserve 640K for ML
*addr_AllocMem_end = MOV_R1_0xC60000_INSTR;
ml_reserved_mem = 640 * 1024;
#elif defined(CONFIG_EOSM2) // experimenting - Hello World autoexec.bin is 425K
*addr_AllocMem_end = MOV_R1_0xC80000_INSTR;
ml_reserved_mem = 512 * 1024;
#else
// change end limit to 0xc80000 => reserve 512K for ML
*addr_AllocMem_end = MOV_R1_0xC80000_INSTR;
ml_reserved_mem = 512 * 1024;
#endif
However, according to this post (http://www.magiclantern.fm/forum/index.php?topic=5071.msg186874#msg186874) from the "placing ML into shoot memory" topic the EOSM2 only has 256MB, same with the 1300D, so does this mean trying to get ML running on these cameras is a lost cause [...] ?
How much memory does the 1100D have?
One option is to try the AllocateMemory (like 550D or 1100D), and another is to hunt for possibly unused memory areas (smemShowFix - FF222B68) - see http://www.magiclantern.fm/forum/index.php?topic=5071.0.
/* here we are patching RscMgr/SRM initialisation to use less memory */
// used on 7D and 60D - found values for EOSM2 but haven't figured out how to implement it yet
// #define HIJACK_CACHE_HACK
// #define RSCMGR_MEMORY_PATCH_END 0xff0c4a8c
// #define HIJACK_CACHE_HACK_INITTASK_ADDR 0xff0c1c98
in canon's firmware we have three options how to allocate memory and where to place data.
1) malloc
2) AllocateMemory (MemoryManager)
3) AllocateMemoryResource (RscMgr, Srm)
...I'm thinking to move autoexec.bin to AllocateMemory, and use the 7MB block as general-purpose memory for ML, using some custom allocator (maybe Canon's).
- compile the dm-spy-experiments branch, with CONFIG_DEBUG_INTERCEPT=y in Makefile.user
- put this in don't click me...
void debug_intercept();
debug_intercept();
void (*smemShowFix)(void) = 0xff222b6c;
smemShowFix();
debug_intercept();/** Low-level allocators */
NSTUB(0x79fc, init_memory_pool)
NSTUB(0x8080, allocate_memory_from_pool)
NSTUB(0x83ec, free_memory_to_pool)
NSTUB(0x7ea0, get_max_region_of_pool)
Now how did you run that?
./run_canon_fw.sh EOSM2,firmware="boot=0" -d debugmsg -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
CTRL-C
(gdb) set $pc = 0xff222b64
(gdb) continue
Is that two ways of looking at the same thing?Yes.
Before and after memory allocation?No.
Ok--so what are we looking at here?
^C
Program received signal SIGINT, Interrupt.
0xff352318 in ?? ()
(gdb) set $pc = 0xff222b6c
(gdb) continue
Continuing.
[ PowerMgr:ff222b78 ] (80:16)
185: 3179.520 [RSC]
[ PowerMgr:ff222b94 ] (80:16) --- Common Top ----
186: 3179.520 [RSC] --- Common Top ----
[ PowerMgr:ff222bb0 ] (80:16) [TOP1] 0x40C2A000
187: 3179.776 [RSC] [TOP1] 0x40C2A000
[ PowerMgr:ff222bd4 ] (80:16) REPLACE_IMAGE_VRAM 0x40C2A000 0x00032000 204800
188: 3179.776 [RSC] REPLACE_IMAGE_VRAM 0x40C2A000 0x00032000 204800
[ PowerMgr:ff222bfc ] (80:16) SSS_DEVELOP_WORK 0x40C5C000 0x00038000 229376
189: 3180.032 [RSC] SSS_DEVELOP_WORK 0x40C5C000 0x00038000 229376
...
[ PowerMgr:ff223f78 ] (80:16) INDV_WORK 0x0 0x00000000 0
274: 3187.712 [RSC] INDV_WORK 0x0 0x00000000 0
[ PowerMgr:ff0c2994 ] (8b:16) ###exceptionhandlercbr 0xda2c 0
275: 3187.712 [STARTUP] ###exceptionhandlercbr 0xda2c 0
< Error Exception>
TYPE : 4
ISR : 0
TASK IDSR : 1835011
TASK Name : PowerMgr
R 0 : 0
R 1 : 19980218
R 2 : 0
R 3 : 0
R 4 : 19980218
R 5 : 19980218
R 6 : 19980218
R 7 : 19980218
R 8 : 19980218
R 9 : ca18
R10 : 19980218
R11 : 19980218
R12 : 1008
R13 : b89a0
R14 : da2c
PC : da2c
CPSR : 600000d3
[ PowerMgr:ff0c2ac4 ] (8b:16) #####exceptionhandlercbr 0xda2c
276: 3188.480 [STARTUP] #####exceptionhandlercbr 0xda2c
[ PowerMgr:ff0c2ad4 ] (8b:03) < Error Exception>
[ PowerMgr:ff0c2ae8 ] (8b:03) TYPE : 4
[ PowerMgr:ff0c2afc ] (8b:03) ISR : 0
[ PowerMgr:ff0c2b10 ] (8b:03) TASK IDSR : 1835011
[ PowerMgr:ff0c2b24 ] (8b:03) TASK Name : PowerMgr
[ PowerMgr:ff0c2b38 ] (8b:03) R 0 : 0
[ PowerMgr:ff0c2b4c ] (8b:03) R 1 : 19980218
[ PowerMgr:ff0c2b60 ] (8b:03) R 2 : 0
[ PowerMgr:ff0c2b74 ] (8b:03) R 3 : 0
[ PowerMgr:ff0c2b88 ] (8b:03) R 4 : 19980218
[ PowerMgr:ff0c2b9c ] (8b:03) R 5 : 19980218
[ PowerMgr:ff0c2bb0 ] (8b:03) R 6 : 19980218
[ PowerMgr:ff0c2bc4 ] (8b:03) R 7 : 19980218
[ PowerMgr:ff0c2bd8 ] (8b:03) R 8 : 19980218
[ PowerMgr:ff0c2bec ] (8b:03) R 9 : ca18
[ PowerMgr:ff0c2c00 ] (8b:03) R10 : 19980218
[ PowerMgr:ff0c2c14 ] (8b:03) R11 : 19980218
[ PowerMgr:ff0c2c28 ] (8b:03) R12 : 1008
[ PowerMgr:ff0c2c3c ] (8b:03) R13 : b89a0
[ PowerMgr:ff0c2e7c ] (8b:03) R14 : da2c
[ PowerMgr:ff0c2e90 ] (8b:03) PC : da2c
[ PowerMgr:ff0c2ea4 ] (8b:03) CPSR : 600000d3
[ PowerMgr:ff0c2ee8 ] (8b:16) Exception : Time 2000/1/1 0:0:3
277: 3188.736 [STARTUP] Exception : Time 2000/1/1 0:0:3
[ DbgMgr:ff1470d0 ] (00:01) [PM] DisablePowerSave (Counter = 2)
FF0C11BC: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
FF0C11BC: MCR p15, ... : CACHEMAINT x11722 (omitted)
FF0C11BC: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC0051079
FF0C11F0: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC0051079
...
FF0C1120: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C113C: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005007D
FF0C1168: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005007D
FF0C1120: MCR p15, ... : CACHEMAINT x1 (omitted)
FF0C1168: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[DM] FROM Write Complete!!!
[ DbgMgr:ff147140 ] (00:01) [PM] EnablePowerSave (Counter = 1)
186: 3179.520 [RSC] --- Common Top ----
187: 3179.776 [RSC] [TOP1] 0x40C2A000
188: 3179.776 [RSC] REPLACE_IMAGE_VRAM 0x40C2A000 0x00032000 204800
189: 3180.032 [RSC] SSS_DEVELOP_WORK 0x40C5C000 0x00038000 229376
190: 3180.032 [RSC] SDS_DEVELOP_WORK 0x40C94000 0x00038000 229376
191: 3180.032 [RSC] DARKCUR_COMP_WORK 0x40CCC000 0x00020000 131072
192: 3180.288 [RSC] FENCING_WORK 0x40CEC000 0x00010000 65536
193: 3180.288 [RSC] DCFNO 0x40CFC000 0x00004000 16384
194: 3180.544 [RSC] LVMARGE_P_DEF_DATA_1 0x40D00000 0x0000A000 40960
195: 3180.544 [RSC] LVMARGE_P_DEF_DATA_2 0x40D0A000 0x0000A000 40960
196: 3180.800 [RSC] LVMARGE_P_DEF_DATA_3 0x41FF0000 0x0000A000 40960
197: 3180.800 [RSC] LVMARGE_P_DEF_DATA_ZOOM 0x40D14000 0x0000C000 49152
198: 3180.800 [RSC] FILE_HEADER 0x40D20000 0x00240000 2359296
199: 3181.056 [RSC] SAF WORK 0x40FA0000 0x00200000 2097152
200: 3181.056 [RSC] BMPVRAM1 0x411A0000 0x00080000 524288
201: 3181.056 [RSC] BMPVRAM2 0x41220000 0x00080000 524288
202: 3181.312 [RSC] ENGINE_MIRROR 0x412A0000 0x00044000 278528
203: 3181.568 [RSC] VSHADING_COMP_WORK 0x412E4000 0x000DC000 901120
204: 3181.568 [RSC] STILL SCAR 0x413C0000 0x00075B00 482048
205: 3181.568 [RSC] TUNEDATA 0x41435B00 0x00140000 1310720
206: 3181.824 [RSC] TUNEDATA2 0x41575B00 0x00160000 1441792
207: 3181.824 [RSC] FIXDATA 0x416D5B00 0x0021E500 2221312
208: 3181.824 [RSC] LVMARGE_P_DEF_DATA_CROP 0x418F4000 0x0000C000 49152
209: 3182.080 [RSC] WIRELESS_WORK2 0x41900000 0x00300000 3145728
210: 3182.080 [RSC] WIRELESS_WORK1 * 0x41C00000 0x00200000 2097152
211: 3182.080 [RSC] ADAPTER_TRANSFER * 0x0 0x00000000 0
212: 3182.336 [RSC] EEKO 0x41E00000 0x001E0000 1966080
213: 3182.336 [RSC] SHOOTING_CREATIVEFILTER 0x41FE0000 0x00010000 65536
214: 3182.336 [RSC] EXMEM3_AREA_4 0x0 0x00000000 0
215: 3182.592 [RSC] --- Usually Mode ----
216: 3182.592 [RSC] MEMORY_MGR 0x42000000 0x04000000 67108864
217: 3182.592 [RSC] ONLY MEM1 1 0x46000000 0x02000000 33554432
218: 3182.848 [RSC] ONLY MEM1 2 0x48000000 0x02000000 33554432
219: 3182.848 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
220: 3182.848 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
221: 3183.104 [RSC] SS_DEVELOP1 0x4A000000 0x00E00000 14680064
222: 3183.104 [RSC] EXMEM3_AREA_2 0x4AE00000 0x000EA000 958464
223: 3183.104 [RSC] AVERAGE_WORK_TOP 0x4AEEA000 0x01116000 17915904
224: 3183.360 [RSC] AVERAGE_WORK_BOTTOM 0x4C000000 0x01116000 17915904
225: 3183.360 [RSC] SS_DEVELOP_OTHER_WORK 0x4D116000 0x00400000 4194304
226: 3183.360 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
227: 3183.616 [RSC] CAPTURE_WORK1 0x4D600000 0x00240000 2359296
228: 3183.616 [RSC] EXMEM3_AREA_1 0x4DD16000 0x016BA000 23830528
229: 3183.872 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
230: 3183.872 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
231: 3183.872 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
232: 3183.872 [RSC] --- GIS Mode ----
233: 3184.128 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432
234: 3184.128 [RSC] WORK 0x4A000000 0x08600000 140509184
235: 3184.128 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
236: 3184.384 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
237: 3184.384 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000
238: 3184.384 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064
239: 3184.640 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
240: 3184.640 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520
241: 3184.640 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
242: 3184.896 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
243: 3184.896 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
244: 3185.152 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296
245: 3185.152 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848
246: 3185.152 [RSC] --- HDR Mode ----
247: 3185.152 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432
248: 3185.408 [RSC] WORK 0x4800000 0x0A600000 174063616
249: 3185.408 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
250: 3185.408 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
251: 3185.664 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000
252: 3185.664 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064
253: 3185.664 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
254: 3185.920 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520
255: 3185.920 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840
256: 3185.920 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840
257: 3186.176 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840
258: 3186.176 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296
259: 3186.176 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848
260: 3186.432 [RSC] --- NR Mode ----
261: 3186.688 [RSC] NR_MEMORY_MGR 0x42000000 0x08000000 134217728
262: 3186.688 [RSC] COMPOSITION_WORK_TOP 0x0 0x00000000 0
263: 3186.688 [RSC] COMPOSITION_WORK_BOTTOM 0x0 0x00000000 0
264: 3186.688 [RSC] --- DP Mode ----
265: 3186.944 [RSC] DP_SINGLE 0x42000000 0x05E00000 98566144
266: 3186.944 [RSC] DP_MULTI 0x47E00000 0x04D94000 81346560
267: 3186.944 [RSC] DP_CAPTURE_WORK1 0x4CB94000 0x00040000 262144
268: 3187.200 [RSC] DP_AVERAGE_TOP 0x4DBD4000 0x01116000 17915904
269: 3187.200 [RSC] DP_AVERAGE_BOTTOM 0x4ECEA000 0x01116000 17915904
270: 3187.200 [RSC] --- Indev Mode ----
271: 3187.456 [RSC] [INDVMGR] 0x0
272: 3187.456 [RSC] YUV 0x4AEEA000 0x0222C000 35831808
273: 3187.456 [RSC] YUV_OUT 0x42000000 0x0222C000 35831808
274: 3187.712 [RSC] INDV_WORK 0x0 0x00000000 0[ PowerMgr:ff223a54 ] (80:16) --- HDR Mode ----
[ PowerMgr:ff223a74 ] (80:16) TEMPMEM1 0x48000000 0x02000000 33554432
[ PowerMgr:ff223a94 ] (80:16) WORK 0x4800000 0x0A600000 174063616
[ PowerMgr:ff223ab4 ] (80:16) IMGPLAY_WORK 0x4A000000 0x00A00000 10485760
[ PowerMgr:ff223ad4 ] (80:16) IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304
[ PowerMgr:ff223af4 ] (80:16) MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000
[ PowerMgr:ff223b14 ] (80:16) MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064
[ PowerMgr:ff223b34 ] (80:16) SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608
[ PowerMgr:ff223b54 ] (80:16) MOVIE_STREAM 0x4DD16000 0x01400000 20971520
[ PowerMgr:ff223b74 ] (80:16) IMGVRAM1 0x4F3D0000 0x00410000 4259840
[ PowerMgr:ff223d90 ] (80:16) IMGVRAM2 0x4F7E0000 0x00410000 4259840
[ PowerMgr:ff223db0 ] (80:16) IMGVRAM3 0x4FBF0000 0x00410000 4259840
[ PowerMgr:ff223dd0 ] (80:16) EXMEM3_1_AREA 0x42000000 0x06000000 100663296
[ PowerMgr:ff223dec ] (80:16) EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848
Exercise: draw a similar memory map for DryOS (the first ~13 MB), based on the info from this post (http://www.magiclantern.fm/forum/index.php?topic=15895.msg186872#msg186872). Find out where the minimal ML is loaded (draw the map before and after). Find out the memory pool used by AllocateMemory. Find out where it's initialized (hint: check QEMU source). Patch it.
[ PowerMgr:ff222b94 ] (80:16) --- Common Top ----
186: 3179.520 [RSC] --- Common Top ----
SD LOAD OK.
Open file for read : AUTOEXEC.BIN
...
File size : 0x67A00
Now jump to AUTOEXEC.BIN!!
0010E5F4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E5F4: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[BOOT] patching init_task from 0xff0c57a0 (-15968352)
[BOOT] autoexec.bin loaded at 100E00 - 178140.
[ FileMgr:ff304f9c ] (24:02) PROP_TFT_STATUS = 0
[ FileMgr:ff304fb4 ] (24:03) LED Permit
[MPU] Received: 06 05 03 19 00 00 (spell #52)
[ PowerMgr:ff13826c ] (82:01) VdInterruptHandler bmp=ff136384 img=0 localWaitBmpCBR=ff136384
[ PowerMgr:ff136398 ] (82:01) WaitBmpCBR(local) pParam=0
[ DisplayMgr:ff13a118 ] (82:03) MuteOffDisplay finish Type=0
[ DisplayMgr:ff1790cc ] (9a:02) fTunOnDisp = On
[ init:0010137c ] task_create(ml_init, prio=1e, stack=4000, entry=101510, arg=0)
[ ml_init:ff696760 ] (23:01) sdReadBlk: st=73344, num=32, buf=0x4035e000
[ ml_init:ff6951bc ] (23:01) sdDMAReadBlk: st=73344, num=32
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
R00=ffffffff R01=00987c0a R02=001f3912 R03=00000000
R04=19980030 R05=00000000 R06=596f0ae0 R07=19980218
R08=1998002e R09=19980218 R10=19980218 R11=19980218
R12=00000007 R13=001f3918 R14=00101cc0 R15=20000000
PSR=60000013 -ZC- A svc32
FPSCR: 00000000
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
# No ML
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00100d80
user_mem_max 515828
# Minimal ML
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00104580
user_mem_max 501492
# Current almost working full ML Hello World
sys_mem_start 0x0018ac00
sys_mem_max 1179648
user_mem_start 0x00100d80
user_mem_max 515828
# No ML
Malloc Information (onetime type)
Start Address = 0x00100d88
End Address = 0x0017ea60
Total Size = 0x0007dcd8 ( 515288)
Allocated Size = 0x00015ab0 ( 88752)
Allocated Peak = 0x00015ab0 ( 88752)
Allocated Count = 0x0000005a ( 90)
Free Size = 0x00068228 ( 426536)
Free Block Max Size = 0x000681f0 ( 426480)
Free Block Count = 0x00000002 ( 2)
# Minimal ML
Malloc Information (onetime type)
Start Address = 0x00104588
End Address = 0x0017ea60
Total Size = 0x0007a4d8 ( 500952)
Allocated Size = 0x00015ab0 ( 88752)
Allocated Peak = 0x00015ab0 ( 88752)
Allocated Count = 0x0000005a ( 90)
Free Size = 0x00064a28 ( 412200)
Free Block Max Size = 0x000649f0 ( 412144)
Free Block Count = 0x00000002 ( 2)
# Current almost working full ML Hello World
Malloc Information (onetime type)
Start Address = 0x00100d88
End Address = 0x0017ea60
Total Size = 0x0007dcd8 ( 515288)
Allocated Size = 0x00015ab0 ( 88752)
Allocated Peak = 0x00015ab0 ( 88752)
Allocated Count = 0x0000005a ( 90)
Free Size = 0x00068228 ( 426536)
Free Block Max Size = 0x000681f0 ( 426480)
Free Block Count = 0x00000002 ( 2)
# No ML
189: 1284.352 [WINSYS] allocated=44140 max_region=412876
# Minimal ML
185: 1840.896 [WINSYS] allocated=44140 max_region=412876
# Current almost working full ML Hello World
185: 1042.176 [WINSYS] allocated=44140 max_region=412876
# No change in the above but when experimenting with CONFIG_ALLOCATE_MEMORY_POOL this came up:
[ PowerMgr:ff13432c ] (04:16) allocated=0 max_region=1568300
# No ML
[ PowerMgr:ff134450 ] (04:02) current=44140 max_reg=412876 allocate_size=0
185: 1667.328 [MEM] NG AllocateMemory 0
186: 1667.584 [MEM] Total = 0x7be000, Free = 0x3148b8, MaxReg = 0x2a320c
187: 1667.840 [MEM] Num Alloc = 4864, Num Free = 460
# Minimal ML
[ PowerMgr:ff134450 ] (04:02) current=44140 max_reg=412876 allocate_size=0
185: 2236.928 [MEM] NG AllocateMemory 0
186: 2236.928 [MEM] Total = 0x7be000, Free = 0x3148b8, MaxReg = 0x2a31a0
187: 2237.184 [MEM] Num Alloc = 4864, Num Free = 460
# Current almost working full ML Hello World
[ PowerMgr:ff134450 ] (04:02) current=44140 max_reg=412876 allocate_size=0
185: 1226.752 [MEM] NG AllocateMemory 0
186: 1227.008 [MEM] Total = 0x7be000, Free = 0x3148b8, MaxReg = 0x2a31f0
187: 1227.264 [MEM] Num Alloc = 4864, Num Free = 460
Find out where the minimal ML is loaded (draw the map before and after). Find out the memory pool used by AllocateMemory. Find out where it's initialized (hint: check QEMU source). Patch it.
assert(addr < 0x20000000);~/gcc-arm-none-eabi-4_8-2013q4/bin/arm-none-eabi-readelf ~/magic-lantern/platform/EOSM2.103/magiclantern -a | grep " memcpy$"
5694: 00148c94 360 FUNC GLOBAL DEFAULT 1 memcpy
186: 1221.888 [RSC] --- Common Top ---- No ML Minimal ML Almost working full ML Hello World AllocateMemory (not working)
187: 1221.888 [RSC] [TOP1] 0x40C2A000 0x40C2A000 0x40C2A000 0x0
188: 1222.144 [RSC] REPLACE_IMAGE_VRAM 0x40C2A000 0x00032000 204800 0x40C2A000 0x00032000 204800 0x40C2A000 0x00032000 204800 0x0 0x00032000 204800
189: 1222.144 [RSC] SSS_DEVELOP_WORK 0x40C5C000 0x00038000 229376 0x40C5C000 0x00038000 229376 0x40C5C000 0x00038000 229376 0x32000 0x00038000 229376
190: 1222.400 [RSC] SDS_DEVELOP_WORK 0x40C94000 0x00038000 229376 0x40C94000 0x00038000 229376 0x40C94000 0x00038000 229376 0x6A000 0x00038000 229376
191: 1222.400 [RSC] DARKCUR_COMP_WORK 0x40CCC000 0x00020000 131072 0x40CCC000 0x00020000 131072 0x40CCC000 0x00020000 131072 0xA2000 0x00020000 131072
192: 1222.656 [RSC] FENCING_WORK 0x40CEC000 0x00010000 65536 0x40CEC000 0x00010000 65536 0x40CEC000 0x00010000 65536 0xC2000 0x00010000 65536
193: 1222.656 [RSC] DCFNO 0x40CFC000 0x00004000 16384 0x40CFC000 0x00004000 16384 0x40CFC000 0x00004000 16384 0xD2000 0x00004000 16384
194: 1222.912 [RSC] LVMARGE_P_DEF_DATA_1 0x40D00000 0x0000A000 40960 0x40D00000 0x0000A000 40960 0x40D00000 0x0000A000 40960 0xD6000 0x0000A000 40960
195: 1223.168 [RSC] LVMARGE_P_DEF_DATA_2 0x40D0A000 0x0000A000 40960 0x40D0A000 0x0000A000 40960 0x40D0A000 0x0000A000 40960 0xE0000 0x0000A000 40960
196: 1223.168 [RSC] LVMARGE_P_DEF_DATA_3 0x41FF0000 0x0000A000 40960 0x41FF0000 0x0000A000 40960 0x41FF0000 0x0000A000 40960 0x41FF0000 0x0000A000 40960
197: 1223.424 [RSC] LVMARGE_P_DEF_DATA_ZOOM 0x40D14000 0x0000C000 49152 0x40D14000 0x0000C000 49152 0x40D14000 0x0000C000 49152 0xEA000 0x0000C000 49152
198: 1223.424 [RSC] FILE_HEADER 0x40D20000 0x00240000 2359296 0x40D20000 0x00240000 2359296 0x40D20000 0x00240000 2359296 0xF6000 0x00240000 2359296
199: 1223.680 [RSC] SAF WORK 0x40FA0000 0x00200000 2097152 0x40FA0000 0x00200000 2097152 0x40FA0000 0x00200000 2097152 0x376000 0x00200000 2097152
200: 1223.936 [RSC] BMPVRAM1 0x411A0000 0x00080000 524288 0x411A0000 0x00080000 524288 0x411A0000 0x00080000 524288 0x576000 0x00080000 524288
201: 1223.936 [RSC] BMPVRAM2 0x41220000 0x00080000 524288 0x41220000 0x00080000 524288 0x41220000 0x00080000 524288 0x5F6000 0x00080000 524288
202: 1224.192 [RSC] ENGINE_MIRROR 0x412A0000 0x00044000 278528 0x412A0000 0x00044000 278528 0x412A0000 0x00044000 278528 0x676000 0x00044000 278528
203: 1224.192 [RSC] VSHADING_COMP_WORK 0x412E4000 0x000DC000 901120 0x412E4000 0x000DC000 901120 0x412E4000 0x000DC000 901120 0x6BA000 0x000DC000 901120
204: 1224.192 [RSC] STILL SCAR 0x413C0000 0x00075B00 482048 0x413C0000 0x00075B00 482048 0x413C0000 0x00075B00 482048 0x413C0000 0x00075B00 482048
205: 1224.448 [RSC] TUNEDATA 0x41435B00 0x00140000 1310720 0x41435B00 0x00140000 1310720 0x41435B00 0x00140000 1310720 0x41435B00 0x00140000 1310720
206: 1224.704 [RSC] TUNEDATA2 0x41575B00 0x00160000 1441792 0x41575B00 0x00160000 1441792 0x41575B00 0x00160000 1441792 0x41575B00 0x00160000 1441792
207: 1224.704 [RSC] FIXDATA 0x416D5B00 0x0021E500 2221312 0x416D5B00 0x0021E500 2221312 0x416D5B00 0x0021E500 2221312 0x416D5B00 0x0021E500 2221312
208: 1224.704 [RSC] LVMARGE_P_DEF_DATA_CROP 0x418F4000 0x0000C000 49152 0x418F4000 0x0000C000 49152 0x418F4000 0x0000C000 49152 0x418F4000 0x0000C000 49152
209: 1224.960 [RSC] WIRELESS_WORK2 0x41900000 0x00300000 3145728 0x41900000 0x00300000 3145728 0x41900000 0x00300000 3145728 0x41900000 0x00300000 3145728
210: 1224.960 [RSC] WIRELESS_WORK1 * 0x41C00000 0x00200000 2097152 0x41C00000 0x00200000 2097152 0x41C00000 0x00200000 2097152 0x41C00000 0x00200000 2097152
211: 1224.960 [RSC] ADAPTER_TRANSFER * 0x0 0x00000000 00x0 0x00000000 00x0 0x0000000 00x0 0x00000000 0
212: 1225.216 [RSC] EEKO 0x41E00000 0x001E0000 1966080 0x41E00000 0x001E0000 1966080 0x41E00000 0x001E0000 1966080 0x41E00000 0x001E0000 1966080
213: 1225.216 [RSC] SHOOTING_CREATIVEFILTER 0x41FE0000 0x00010000 65536 0x41FE0000 0x00010000 65536 0x41FE0000 0x00010000 65536 0x41FE0000 0x00010000 65536
214: 1225.216 [RSC] EXMEM3_AREA_4 0x0 0x00000000 00x0 0x00000000 00x0 0x00000000 00x0 0x00000000 0
215: 1225.472 [RSC] --- Usually Mode ----
216: 1225.472 [RSC] MEMORY_MGR 0x42000000 0x04000000 67108864 0x42000000 0x04000000 67108864 0x42000000 0x04000000 67108864 0x42000000 0x04000000 67108864
217: 1225.472 [RSC] ONLY MEM1 1 0x46000000 0x02000000 33554432 0x46000000 0x02000000 33554432 0x46000000 0x02000000 33554432 0x46000000 0x02000000 33554432
218: 1225.728 [RSC] ONLY MEM1 2 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432
219: 1225.728 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760
220: 1225.728 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304
221: 1225.984 [RSC] SS_DEVELOP1 0x4A000000 0x00E00000 14680064 0x4A000000 0x00E00000 14680064 0x4A000000 0x00E00000 14680064 0x4A000000 0x00E00000 14680064
222: 1225.984 [RSC] EXMEM3_AREA_2 0x4AE00000 0x000EA000 958464 0x4AE00000 0x000EA000 958464 0x4AE00000 0x000EA000 958464 0x4AE00000 0x000EA000 958464
223: 1225.984 [RSC] AVERAGE_WORK_TOP 0x4AEEA000 0x01116000 17915904 0x4AEEA000 0x01116000 17915904 0x4AEEA000 0x01116000 17915904 0x4AEEA000 0x01116000 17915904
224: 1226.240 [RSC] AVERAGE_WORK_BOTTOM 0x4C000000 0x01116000 17915904 0x4C000000 0x01116000 17915904 0x4C000000 0x01116000 17915904 0x4C000000 0x01116000 17915904
225: 1226.240 [RSC] SS_DEVELOP_OTHER_WORK 0x4D116000 0x00400000 4194304 0x4D116000 0x00400000 4194304 0x4D116000 0x00400000 4194304 0x4D116000 0x00400000 4194304
226: 1226.496 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608
227: 1226.496 [RSC] CAPTURE_WORK1 0x4D600000 0x00240000 2359296 0x4D600000 0x00240000 2359296 0x4D600000 0x00240000 2359296 0x4D600000 0x00240000 2359296
228: 1226.496 [RSC] EXMEM3_AREA_1 0x4DD16000 0x016BA000 23830528 0x4DD16000 0x016BA000 23830528 0x4DD16000 0x016BA000 23830528 0x4DD16000 0x016BA000 23830528
229: 1226.752 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840
230: 1226.752 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840
231: 1226.752 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840
232: 1227.008 [RSC] --- GIS Mode ----
233: 1227.008 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432
234: 1227.008 [RSC] WORK 0x4A000000 0x08600000 140509184 0x4A000000 0x08600000 140509184 0x4A000000 0x08600000 140509184 0x4A000000 0x08600000 140509184
235: 1227.264 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760
236: 1227.264 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304
237: 1227.264 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000
238: 1227.520 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064
239: 1227.520 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608
240: 1227.776 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520
241: 1227.776 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840
242: 1228.032 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840
243: 1228.032 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840
244: 1228.032 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296
245: 1228.288 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848
246: 1228.288 [RSC] --- HDR Mode ----
247: 1228.288 [RSC] TEMPMEM1 0x48000000 0x02000000 33554432 0x48000000 0x02000000 33554432 0x48000000 0x02000000 3355443 20x48000000 0x02000000 33554432
248: 1228.544 [RSC] WORK 0x4800000 0x0A600000 174063616 0x4800000 0x0A600000 174063616 0x4800000 0x0A600000 174063616 0x4800000 0x0A600000 174063616
249: 1228.544 [RSC] IMGPLAY_WORK 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760 0x4A000000 0x00A00000 10485760
250: 1228.544 [RSC] IMGPLAY_WORK2 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304 0x4AA00000 0x00400000 4194304
251: 1228.800 [RSC] MOVIE_REC_WORK 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000 0x4AE00000 0x00FA0000 16384000
252: 1228.800 [RSC] MOVIE_PLAY_WORK 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064 0x4BE00000 0x00E00000 14680064
253: 1228.800 [RSC] SLIDE_SHOW_WORK 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608 0x4D516000 0x00800000 8388608
254: 1229.056 [RSC] MOVIE_STREAM 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520 0x4DD16000 0x01400000 20971520
255: 1229.312 [RSC] IMGVRAM1 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840 0x4F3D0000 0x00410000 4259840
256: 1229.312 [RSC] IMGVRAM2 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840 0x4F7E0000 0x00410000 4259840
257: 1229.568 [RSC] IMGVRAM3 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840 0x4FBF0000 0x00410000 4259840
258: 1229.568 [RSC] EXMEM3_1_AREA 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296 0x42000000 0x06000000 100663296
259: 1229.824 [RSC] EXMEM3_2_AREA 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848 0x4CC40000 0x004D6000 5070848
260: 1229.824 [RSC] --- NR Mode ----
261: 1229.824 [RSC] NR_MEMORY_MGR 0x42000000 0x08000000 134217728 0x42000000 0x08000000 134217728 0x42000000 0x08000000 134217728 0x42000000 0x08000000 134217728
262: 1230.080 [RSC] COMPOSITION_WORK_TOP 0x0 0x00000000 00x0 0x00000000 00x0 0x00000000 00x0 0x00000000 0
263: 1230.080 [RSC] COMPOSITION_WORK_BOTTOM 0x0 0x00000000 00x0 0x00000000 00x0 0x00000000 00x0 0x00000000 0
264: 1230.080 [RSC] --- DP Mode ----
265: 1230.336 [RSC] DP_SINGLE 0x42000000 0x05E00000 98566144 0x42000000 0x05E00000 98566144 0x42000000 0x05E00000 98566144 0x42000000 0x05E00000 98566144
266: 1230.336 [RSC] DP_MULTI 0x47E00000 0x04D94000 81346560 0x47E00000 0x04D94000 81346560 0x47E00000 0x04D94000 81346560 0x47E00000 0x04D94000 81346560
267: 1230.336 [RSC] DP_CAPTURE_WORK1 0x4CB94000 0x00040000 262144 0x4CB94000 0x00040000 262144 0x4CB94000 0x00040000 262144 0x4CB94000 0x00040000 262144
268: 1230.592 [RSC] DP_AVERAGE_TOP 0x4DBD4000 0x01116000 17915904 0x4DBD4000 0x01116000 17915904 0x4DBD4000 0x01116000 17915904 0x4DBD4000 0x01116000 17915904
269: 1230.592 [RSC] DP_AVERAGE_BOTTOM 0x4ECEA000 0x01116000 17915904 0x4ECEA000 0x01116000 17915904 0x4ECEA000 0x01116000 17915904 0x4ECEA000 0x01116000 17915904
270: 1230.848 [RSC] --- Indev Mode ----
271: 1230.848 [RSC] [INDVMGR] 0x00x00x00x0
272: 1230.848 [RSC] YUV 0x4AEEA000 0x0222C000 35831808 0x4AEEA000 0x0222C000 35831808 0x4AEEA000 0x0222C000 35831808 0x4AEEA000 0x0222C000 35831808
273: 1230.848 [RSC] YUV_OUT 0x42000000 0x0222C000 35831808 0x42000000 0x0222C000 35831808 0x42000000 0x0222C000 35831808 0x42000000 0x0222C000 35831808
274: 1231.104 [RSC] INDV_WORK 0x0 0x00000000 00x0 0x00000000 00x0 0x00000000 00x0 0x00000000 0
// We shrink the AllocateMemory (system memory) pool in order to make space for ML binary
// Example for the 1100D firmware
// ff0197d8: init_task:
// ff01984c: b CreateTaskMain
//
// ff0123c4 CreateTaskMain:
// ff0123e4: mov r1, #13631488 ; 0xd00000 <-- end address
// ff0123e8: mov r0, #3997696 ; 0x3d0000 <-- start address
// ff0123ec: bl allocatememory_init_pool
// So... we need to patch CreateTaskMain, which is called by init_task.
//
// First we use Trammell's reloc.c code to relocate init_task and CreateTaskMain...
EOSM2 stub:
NSTUB(0xFF0C57A0, init_task)
ff0c57a0: push {r4, lr}
ff0c5814: b loc_ff0c3064 <-- call CreateTaskMain
...
ff0c3064: push {r1, r2, r3, r4, r5, lr}
...
ff0c30a4: ldr r1, [pc, #344] ; ff0c3204: (00c2a000) <-- end address??
ff0c30a8: ldr r0, [pc, #344] ; ff0c3208: (0046c000) <-- start address??
...
ff0c30c4: bl loc_ff146d3c <-- allocatememory_init_pool?
// Used in boot-hack.c with CONFIG_ALLOCATE_MEMORY_POOL
#define ROM_ITASK_START 0xff0c57a0
#define ROM_ITASK_END 0xff0cb994
#define ROM_CREATETASK_MAIN_START 0xff0c3064
#define ROM_CREATETASK_MAIN_END 0xff0c33dc
#define ROM_ALLOCMEM_END 0xff0c4a8c // 0xff0c30a8 0xff0c30a4 // kinda iffy
#define ROM_ALLOCMEM_INIT 0xff0c30c4
#define ROM_B_CREATETASK_MAIN 0xff0c5814
So other cameras don't need this or is the 500D supported better in QEMU than any other camera?
ff0c30a4: ldr r1, [pc, #344] ; ff0c3204: (00c2a000) <-- end address??
ff0c30a8: ldr r0, [pc, #344] ; ff0c3208: (0046c000) <-- start address??
...
ff0c30c4: bl loc_ff146d3c <-- allocatememory_init_pool?
FF0C30AC BL 0x7ABC <-- this one
00007ABC
... ; nothing else touching R0=start and R1=end
00007AD0 SUB R1, R1, R0
00007AD4 BL sub_79FC
(gdb) set $pc=0xFF0C77EC
System Memory Information
Start Address = 0x0018ac08
End Address = 0x002aac00
Total Size = 0x0011fff8 ( 1179640)
Allocated Size = 0x00062328 ( 402216)
Allocated Peak = 0x00064b30 ( 412464)
Allocated Count = 0x00000051 ( 81)
Free Size = 0x000bdcd0 ( 777424)
Free Block Max Size = 0x000bb240 ( 766528)
Free Block Count = 0x00000003 ( 3)
arm-none-eabi-gdb -x EOSM2/patches.gdb & ./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg,v |& grep "Current stack" | sort | cut -d ' ' -f 1-3 | uniq
...
Current stack: [18af38-18acb8]
...
Current stack: [1ed9b0-1ec9b0]
extern int GetMemoryInformation(int* total, int* free);
(gdb) set $r0 = 4
(gdb) set $r1 = 8
(gdb) set $pc = 0xFFD25774
(gdb) b *$lr
Breakpoint 2 at 0xff352220
(gdb) c
Continuing.
Breakpoint 2, 0xff352220 in ?? ()
(gdb) x/2 4
0x4: 0x7be000 0x3148d0
TODO: I'd like to update 100D to use the "classic" boot process as well.
...I am able to load 100d into malloc but the interesting part I can only bring up ML menu with the task related changes from this PR in addition with a fixed task_dispatch_hook and undefining hijack_task_addr as instructed earlier. Otherwise ML menu wouldn't come up.
Almost there - start and end address are correct, but allocatememory_init_pool is not.
...
...allocatememory_init_pool is the one called right after loading the parameters into registers:Code: [Select]FF0C30AC BL 0x7ABC <-- this one
0x7ABC + RAM_OFFSETCode: [Select]00007ABC
... ; nothing else touching R0=start and R1=end
00007AD0 SUB R1, R1, R0
00007AD4 BL sub_79FC
In other words, the AllocateMemory pool is from 0x46c000 to 0xc2a000. Note that, unlike my previous comments (je me suis trompé)...
Let's check:Code: [Select]arm-none-eabi-gdb -x EOSM2/patches.gdb & ./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg,v |& grep "Current stack" | sort | cut -d ' ' -f 1-3 | uniq
...
Current stack: [18af38-18acb8]
...
Current stack: [1ed9b0-1ec9b0]
arm-none-eabi-gdb -x EOSM2/patches.gdb & ./run_canon_fw.sh EOSM2,firmware="boot=0" -s -S -d debugmsg,v |& grep "Current stack" | sort | cut -d ' ' -f 1-3 | uniq
[8] 28220
./run_canon_fw.sh EOSM2,firmware=boot=0 -s -S -d debugmsg,v
DebugMsg=0x4398 (from GDB script)
Lockdown read 0
Lockdown read 0
Lockdown read 1
Lockdown read 1
Lockdown read 2
Lockdown read 2
Lockdown read 3
Lockdown read 3
Lockdown read 4
Lockdown read 4
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 1FFFFFFF: eos.ram
40001000 - 5FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror
F2000000 - F2FFFFFF: eos.rom0_mirror
F3000000 - F3FFFFFF: eos.rom0_mirror
F4000000 - F4FFFFFF: eos.rom0_mirror
F5000000 - F5FFFFFF: eos.rom0_mirror
F6000000 - F6FFFFFF: eos.rom0_mirror
F7000000 - F7FFFFFF: eos.rom0_mirror
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
C0000000 - DFFFFFFF: eos.iomem
[EOS] enabling code execution logging.
[EOS] loading './EOSM2/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './EOSM2/ROM1.BIN' to 0xF8000000-0xF8FFFFFF
[EOS] loading './EOSM2/SFDATA.BIN' as serial flash, size=0x1000000
[MPU] warning: non-empty spell #31 (08 06 03 1f) has duplicate(s): #40
[MPU] warning: non-empty spell #41 (0a 08 01 3b) has duplicate(s): #37 #38
[MPU] warning: non-empty spell #45 (26 24 01 4e) has duplicate(s): #46
[MPU] Available keys:
- Arrow keys : Navigation
- [ and ] : Main dial (top scrollwheel)
- SPACE : SET
- DELETE : guess
- M : MENU
- P : PLAY
- I : INFO/DISP
- Q : guess
- L : LiveView
- Shift : Half-shutter
- B : Open battery cover
- F1 : show this help
Setting BOOTDISK flag to 0
Finding the allocator for the system memory would be good for cameras with very little RAM (such as 1100D).
(gdb) set $r0 = 4
(gdb) set $r1 = 8
(gdb) set $pc = 0xFFD25774
(gdb) b *$lr
Breakpoint 2 at 0xff352220
(gdb) c
Continuing.
Breakpoint 2, 0xff352220 in ?? ()
(gdb) x/2 4
0x4: 0x7be000 0x3148d0end address - start address = free spaceFile size : 0x686A0
0x7be000 - 0x686A0 = 0x755960So, that's what we have to patch in order to load ML.
#elif defined(CONFIG_EOSM2)
// change end limit to 0xc2a000 => reserve 512K for ML
*addr_AllocMem_end = MOV_R1_0xC2A000_INSTR;
ml_reserved_mem = 512 * 1024;
#define MOV_R0_0_INSTR 0xe3a00000
#define MOV_R1_0xC2A000_INSTR 0xe3a0???? // mov r1, 0xc2a000
Now jump to AUTOEXEC.BIN!!
0010E5F4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E5F4: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[BOOT] changing init_task from 0xff0c57a0 (-15968352) to 0x1015f8 (1054200)
[BOOT] autoexec.bin loaded at 100E00 - 181840.
ff0c8314: !!!! can not fixup jump from 0016dc9c to fd77ab1c (offset -00a7cc62)
...
ff0c8948: !!!! can not fixup jump from 0016e2d0 to fd77b150 (offset -00a7cc62)
Fixups=cd4730 entry=cd4740 free_space=10
[BOOT] changing sys_mem_end:
0x00cd4760: e3a0160d mov r1, #13631488 ; 0xd00000
0x00cd4760: e3a018c6 mov r1, #12976128 ; 0xc60000
K270 READY
[ init:ff1d3b58 ] create_semaphore('EventProcedure', 1)
Temporary breakpoint 15 at 0xff1d3b5c
Fixups=171390 entry=17135c free_space=ffffffcc
In order to follow along on my disassembly I'm doing this:Code: [Select]0x7ABC + RAM_OFFSET
Ok--this works but how did you know to give r0 = 4 and r1 = 8?
Code: [Select]#define MOV_R1_0xC2A000_INSTR 0xe3a0???? // mov r1, 0xc2a000
You don't need to hardcode a MOV here - it uses PC-relative addressing. Look at ff0c3204.
File size : 0x67D40
Now jump to AUTOEXEC.BIN!!
0010E5F4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E5F4: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[BOOT] changing init_task from 0xff0c57a0 (-15968352) to 0x1015e0 (1054176)
[BOOT] autoexec.bin loaded at 100E00 - 181840.
Fixing from ff0c57a0 to ff0cb994
ff0c8314: 3b9aca00 BL ff9aca00 => fd77ab1c
ff0c8314: !!!! can not fixup jump from 0016dc9c to fd77ab1c (offset -00a7cc62)
...
ff0c8948: 3b9aca00 BL ff9aca00 => fd77b150
ff0c8948: !!!! can not fixup jump from 0016e2d0 to fd77b150 (offset -00a7cc62)
[BOOT] changing sys_mem_end:
#Makefile for 700D
CONFIG_LVAPP_HACK_RELOC = y
// Used in boot-hack.c with CONFIG_ALLOCATE_MEMORY_POOL
#define ROM_ITASK_START 0xff0c5408
#define ROM_ITASK_END 0xff0ca68c
#define ROM_CREATETASK_MAIN_START 0xff0c3000
#define ROM_CREATETASK_MAIN_END 0xff0c339c
#define ROM_ALLOCMEM_END 0xff0c304c
#define ROM_ALLOCMEM_INIT 0x6fc4
#define ROM_B_CREATETASK_MAIN 0xff0c547c
/** This camera loads ML into the AllocateMemory pool **/
#define CONFIG_ALLOCATE_MEMORY_POOL
File size : 0x701C0
Now jump to AUTOEXEC.BIN!!
0010E920: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E920: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[BOOT] changing init_task from 0xff0c5408 (-15969272) to 0x7f3e8 (521192)
[BOOT] autoexec.bin loaded at 7EC00 - 106940.
Fixing from ff0c5408 to ff0ca68cff0c85cc: 3b9aca00 BL ff9aca00 => fd77add4
ff0c85cc: !!!! can not fixup jump from 000f3dec to fd77add4 (offset -00a5e408)
...
ff0c8c00: 3b9aca00 BL ff9aca00 => fd77b408
ff0c8c00: !!!! can not fixup jump from 000f4420 to fd77b408 (offset -00a5e408)
as discussed here (https://bitbucket.org/hudson/magic-lantern/pull-requests/672/dryos-task-hooks-for-newer-cameras-6d-70d/diff) I failed to use AllocateMemory pool but:
I'm ready If you want to give it another go.
Hopefully this time I'll get the confirmation from 6D
File size : 0x67D40
Now jump to AUTOEXEC.BIN!!
0010E5F4: MRC p15,0,Rd,cr1,cr0,0: SCTLR -> 0xC005107D
0010E5F4: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0xC005107D
[BOOT] changing init_task from 0xff0c57a0 (-15968352) to 0x44c984 (4508036)
[BOOT] autoexec.bin loaded at 44C100 - 4C6940.
Fixing from ff0c57a0 to ff0c5978
...
Fixups=4b6638 entry=4b6640 free_space=8
[BOOT] changing AllocMem limits:
0x004b6680: e59f1158 ldr r1, [pc, #344] ; 0x4b67e0
0x004b6684: e59f0158 ldr r0, [pc, #344] ; 0x4b67e4
0x004b6680: e59f1158 ldr r1, [pc, #344] ; 0x4b67e0
0x004b6684: e3a0084e mov r0, #5111808 ; 0x4e0000
: %x
READY
128K Sector FROM From BL 0xffff
[ init:0044cb84 ] task_create(ml_init, prio=1e, stack=4000, entry=44c528, arg=0)
[ ml_init:ff696760 ] (23:01) sdReadBlk: st=256, num=32, buf=0x4035e000
[ ml_init:ff6951bc ] (23:01) sdDMAReadBlk: st=256, num=32
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
R00=ffffffff R01=009fbc5a R02=001f3912 R03=00000000
R04=19980030 R05=00000000 R06=597375e6 R07=19980218
R08=1998002e R09=19980218 R10=19980218 R11=19980218
R12=0000000f R13=001f3918 R14=0044d1d0 R15=20000000
PSR=60000013 -ZC- A svc32
FPSCR: 00000000
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
Then it gets ugly:Code: [Select][ init:0010137c ] task_create(ml_init, prio=1e, stack=4000, entry=101510, arg=0)
[ ml_init:ff696760 ] (23:01) sdReadBlk: st=73344, num=32, buf=0x4035e000
[ ml_init:ff6951bc ] (23:01) sdDMAReadBlk: st=73344, num=32
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
R00=ffffffff R01=00987c0a R02=001f3912 R03=00000000
R04=19980030 R05=00000000 R06=596f0ae0 R07=19980218
R08=1998002e R09=19980218 R10=19980218 R11=19980218
R12=00000007 R13=001f3918 R14=00101cc0 R15=20000000
PSR=60000013 -ZC- A svc32
FPSCR: 00000000
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
[ ml_init:ff74c988 ] (23:01) sdReadBlk: st=256, num=32, buf=0x402fe000
[ ml_init:ff74b3e4 ] (23:01) sdDMAReadBlk: st=256, num=32
[ ml_init:ff74c988 ] (23:01) sdReadBlk: st=320, num=32, buf=0x40306000
[ ml_init:ff74b3e4 ] (23:01) sdDMAReadBlk: st=320, num=32
...
[ CSMgrTask:ff6978ec ] (23:03) ---- SDEventHandler(ID=1:Event=8) ----
64: 129.536 [MR] mvrChangeAckCBR : Video - Mode=0, Type=2, Rate=30, GOP=15
82: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050038
83: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050041
84: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050042
85: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050043
86: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050044
87: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105004F
88: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050050
89: 71.936 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050051
90: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050052
91: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010E
92: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010F
93: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050110
94: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050111
95: 72.192 [PROPAD] ERROR GetPropertyData ID (1) = 0x0104000B
96: 72.192 [LVCOM] InitializeLiveViewDefectDetection
97: 72.192 [LVCOM] ExecuteDefectMarge Start
98: 72.448 [LVCOM] ExecuteDefectMarge End
100: 76.800 [LV] PROP_LV_BLOCK PROP_LV_UNBLOCKING 0
102: 78.336 [AUDIO] RegisterCBRSDIOCableConnect
103: 85.248 [WFT] InitializeAdapterControl END
./run_canon_fw.sh EOSM2,firmware="boot=0" -d debugmsg -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
[ DisplayMgr:ff1790cc ] (9a:02) fTunOnDisp = On
^C
Program received signal SIGINT, Interrupt.
0xff352318 in ?? ()
(gdb) set $pc=0xff697870
(gdb) c
Continuing.
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
R00=c0400000 R01=00000080 R02=19980218 R03=19980218
R04=0000021c R05=0017ee2c R06=19980218 R07=19980218
R08=19980218 R09=19980218 R10=19980218 R11=19980218
R12=19980218 R13=0018b330 R14=ff352220 R15=20000000
PSR=600000d3 -ZC- A svc32
FPSCR: 00000000
qemu: fatal: Trying to execute code outside RAM or ROM at 0x20000000
ff6978dc: e28f2f6e add r2, pc, #440 ; ff697a9c: (2d2d2d2d) *"---- SDEventHandler(ID=%d:Event=%d) ----"
(gdb) set $pc = 0xff6978ac
(gdb) c
Continuing.
[ PowerMgr:ff51d13c ] (1e:01) MapLogToPhysic: pLStorage=0x19980218
[ PowerMgr:ff51d184 ] (1e:06) MapLogToPhysic: Logical Storage Not Found(BAD_LOGICAL_STORAGE)
185: 1118.720 [CSMGR] ERROR MapLogToPhysic: Logical Storage Not Found(BAD_LOGICAL_STORAGE
[ PowerMgr:ff6978ec ] (23:03) ---- SDEventHandler(ID=429392408:Event=128) ----
[ PowerMgr:ff697dfc ] (23:06) Invalid Event(Event=128)
186: 1118.976 [SD] ERROR Invalid Event(Event=128)
...the graphs on the placing ML into shoot memory (http://www.magiclantern.fm/forum/index.php?topic=5071.0) topic have disappeared when using the Chrome browser. Looking into the issue it seems that Google has been implementing stricter rules that is affecting the link...
/* This runs ML initialization routines and starts user tasks.
* Unlike init_task, from here we can do file I/O and others.
*/
static void my_big_init_task()
{
_find_ml_card();
_load_fonts();
static void my_big_init_task()
{
// _find_ml_card();
_load_fonts();
#ifdef CONFIG_HELLO_WORLD
hello_world();
/** File I/O **/
NSTUB(0xFF357704, FIO_CloseFile)
-NSTUB(0xFF3576FC, FIO_FindClose)
+NSTUB(0xFF3586FC, FIO_FindClose)
NSTUB(0xFF35861C, FIO_FindNextEx)
NSTUB(0xFF3574B4, _FIO_ReadFile)
-NSTUB(0xFF357704, FIO_SeekSkipFile)
+NSTUB(0xff357564, FIO_SeekSkipFile)
NSTUB(0xFF357654, _FIO_WriteFile)
NSTUB(0xFF357F60, _FIO_CreateDirectory)
NSTUB(0xFF357360, _FIO_CreateFile)
Error loading 'ML/MODULES/EOSM2_103.sym': File does not exist
...
ML ASSERT:
streq(stateobj->type, "StateObject")
at ../../src/state-object.c:251 (stateobj_start_spy), task ml_init
lv:0 mode:3
ls -la /Volumes/EOS_DIGITAL/ML/modules/
total 1824
drwxrwxrwx 1 rosiefort staff 16384 Jul 27 16:07 .
drwxrwxrwx 1 rosiefort staff 16384 Jul 27 16:06 ..
-rwxrwxrwx 1 rosiefort staff 36278 Jul 27 16:06 EOSM2_103.sym
-rwxrwxrwx 1 rosiefort staff 96 Dec 31 1999 LOADING.LCK
-rwxrwxrwx 1 rosiefort staff 21876 Jul 27 16:07 adv_int.mo
-rwxrwxrwx 1 rosiefort staff 13200 Jul 27 16:07 arkanoid.mo
-rwxrwxrwx 1 rosiefort staff 18804 Jul 27 16:07 autoexpo.mo
-rwxrwxrwx 1 rosiefort staff 18128 Jul 27 16:07 bench.mo
-rwxrwxrwx 1 rosiefort staff 8536 Jul 27 16:07 deflick.mo
-rwxrwxrwx 1 rosiefort staff 15916 Jul 27 16:07 dual_iso.mo
-rwxrwxrwx 1 rosiefort staff 32372 Jul 27 16:07 ettr.mo
-rwxrwxrwx 1 rosiefort staff 15668 Jul 27 16:07 file_man.mo
-rwxrwxrwx 1 rosiefort staff 305600 Jul 27 16:07 lua.mo
-rwxrwxrwx 1 rosiefort staff 41680 Jul 27 16:07 mlv_lite.mo
-rwxrwxrwx 1 rosiefort staff 45272 Jul 27 16:07 mlv_play.mo
-rwxrwxrwx 1 rosiefort staff 64384 Jul 27 16:07 mlv_rec.mo
-rwxrwxrwx 1 rosiefort staff 11248 Jul 27 16:07 mlv_snd.mo
-rwxrwxrwx 1 rosiefort staff 6916 Jul 27 16:07 pic_view.mo
-rwxrwxrwx 1 rosiefort staff 83852 Jul 27 16:07 selftest.mo
-rwxrwxrwx 1 rosiefort staff 21952 Jul 27 16:07 silent.moError loading 'ML/MODULES/EOSM2_103.sym': File does not exist
But wait, it is there!
I believe that LOADING.LCK file is because I don't know how to exit from QEMU cleanly.
# Definitions for version 103
ML_MODULES_SYM_NAME=m2_$(FW_VERSION).sym
ML ASSERT:
streq(stateobj->type, "StateObject")
at ../../src/state-object.c:251 (stateobj_start_spy), task ml_init
lv:0 mode:3
ml_init stack: 1f3978 [1f39c8-1ef9c8]
0xUNKNOWN @ 44c8dc:1f39b0
0x0044CA04 @ 477e28:1f39a8
0x0044C468 @ 44ca64:1f3978
Magic Lantern version : Nightly.2017Jul28.EOSM2103
Mercurial changeset : 69d91c7c4317 (qemu-wip) tip
Built on 2017-07-28 15:40:15 UTC by [email protected]
Free Memory : 344K + 1158K
/**
* State object hooks are pieces of code that run in Canon tasks (state objects). See state-object.c .
* They might slow down Canon code, so here you can disable all of them (useful for debugging or early ports)
*/
#define CONFIG_STATE_OBJECT_HOOKS
[ menu_task:0044db24 ] (32:03) read_entire_file:736: failed
uint8_t* read_entire_file(const char * filename, int* buf_size)
...
getfilesize_fail:
DEBUG("failed");
return NULL;
ml_init stack: 1f3978 [1f39c8-1ef9c8]
0xUNKNOWN @ 44c8dc:1f39b0
0x0044CA04 @ 477e28:1f39a8
0x0044C468 @ 44ca64:1f3978
hg clone https://bitbucket.org/daniel_fort/magic-lantern/
cd magic-lantern
hg up 69d91c7c4317 -C # changeset from the stack trace log
# all options and source code modifications are visible in autoexec.bin, but as I don't have it, I'm just guessing
echo "CONFIG_QEMU=y" > Makefile.user
sed -i 's!#define CONFIG_HELLO_WORLD!//#define CONFIG_HELLO_WORLD!' src/config-defines.h
cd platform/EOSM2.103
make clean; make
eu-addr2line -s -S --pretty-print -e magiclantern 0x44c8dc 0x477e28 0x44ca64
my_big_init_task+0x58 at boot-hack.c:307
stateobj_start_spy.constprop.0+0x2c at state-object.c:251
ml_assert_handler+0x60 at boot-hack.c:539
eu-addr2line -s -S --pretty-print -e magiclantern 0x0044CA04 0x0044C468
ml_assert_handler at boot-hack.c:530
backtrace_getstr at backtrace.c:877
. ./export_ml_syms.sh EOSM2.103
./run_canon_fw.sh EOSM2,firmware="boot=1" -d debugmsg,callstack -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
...
CTRL-C before the error
(gdb) symbol-file ../magic-lantern/platform/EOSM2.103/magiclantern
(gdb) b ml_assert_handler
(gdb) continue
...
Breakpoint 4, ml_assert_handler (...)
(gdb) bt
#0 ml_assert_handler ([email protected]=0x4a5ad8 "streq(stateobj->type, \"StateObject\")", [email protected]=0x4a5afd "../../src/state-object.c", [email protected]=0xfb, [email protected]=0x49ca48 <__func__.7031> "stateobj_start_spy") at ../../src/boot-hack.c:530
#1 0x00477e2c in stateobj_start_spy (stateobj=0xe51f3e14, spy=0x477cd0 <stateobj_lv_spy>) at ../../src/state-object.c:251
#2 0x0044c8e0 in call_init_funcs () at ../../src/boot-hack.c:307
#3 my_big_init_task () at ../../src/boot-hack.c:448
#4 0x0000ca18 in ?? ()
(gdb) print_current_location_with_callstack
Current stack: [1f39c8-1ef9c8] sp=1f39a8 at [ml_init:44ca04:477e2c] (ml_assert_handler)
0x44C884 my_big_init_task(0, 44c884 my_big_init_task, 19980218, 19980218) at [ml_init:ca14:1f39c0] (pc:sp)
0x477E80 state_init(32, 3, 49d60d "Calling init_func %s (%x)", 477e80 state_init)
at [ml_init:44c8dc:1f39b0] (my_big_init_task) (pc:sp)
0x44CA04 ml_assert_handler(4a5ad8 "streq(stateobj->type, "StateObject")", 4a5afd "../../src/state-object.c", fb, 49ca48 "stateobj_start_spy")
at [ml_init:477e28:1f39a8] (stateobj_start_spy.constprop.0) (pc:sp)
[...] -d debugmsg,callstack,tail [...]
[...]
(gdb) print_current_location_with_callstack
Current stack: [1f39c8-1ef9c8] sp=1f39a8 at [ml_init:44ca04:477e2c] (ml_assert_handler)
0x44C884 my_big_init_task(0, 44c884 my_big_init_task, 19980218, 19980218) at [ml_init:ca14:1f39c0] (pc:sp)
0x477E80 state_init(32, 3, 49d60d "Calling init_func %s (%x)", 477e80 state_init)
at [ml_init:44c8dc:1f39b0] (my_big_init_task) (pc:sp)
0x477DFC stateobj_start_spy.constprop.0(e51f3e14, 4bd9a4, 0, 477e80 state_init)
at [ml_init:477e9c:1f39b0] (state_init) (pc:sp)
0x44CA04 ml_assert_handler(4a5ad8 "streq(stateobj->type, "StateObject")", 4a5afd "../../src/state-object.c", fb, 49ca48 "stateobj_start_spy")
at [ml_init:477e28:1f39a8] (stateobj_start_spy.constprop.0) (pc:sp)
(gdb) disas state_init
0x00477e80 <+0>: push {r3, lr}
0x00477e84 <+4>: mov r3, #589824 ; 0x90000
0x00477e88 <+8>: ldr r0, [r3, #1456] ; 0x5b0
0x00477e8c <+12>: bl 0x477dfc <stateobj_start_spy>
0x00477e90 <+16>: mov r3, #262144 ; 0x40000
0x00477e94 <+20>: ldr r0, [r3, #1252] ; 0x4e4
0x00477e98 <+24>: pop {r3, lr}
0x00477e9c <+28>: b 0x477dfc <stateobj_start_spy>
(gdb) disas disas stateobj_start_spy
...
0x00477e58 <+92>: ldr r3, [pc, #28] ; 0x477e7c <stateobj_start_spy+128>
0x00477e5c <+96>: str r3, [r4, #12]
0x00477e60 <+100>: mov r0, #0
0x00477e64 <+104>: pop {r4, pc}
(gdb) x 0x477e7c
0x477e7c <stateobj_start_spy+128>: 0x00477cd0
This is all very exciting progress so far and keep them rolling along!+1
The error from read_entire_file is unrelated. Exercise: find out where it comes from (using the same technique).
#0 read_entire_file ([email protected]=0x49f806 "ML/SETTINGS/CURRENT.SET", [email protected]=0x1f38f4) at ../../src/fio-ml.c:707
#1 0x0045e704 in config_choose_startup_preset () at ../../src/config.c:771
#2 config_load () at ../../src/config.c:903
#3 0x0044c910 in my_big_init_task () at ../../src/boot-hack.c:458
#4 0x0000ca18 in ?? ()
...
#0 read_entire_file ([email protected]=0x1f38f8 "ML/SETTINGS/magic.cfg", [email protected]=0x4ba78c <config_file_size>) at ../../src/fio-ml.c:707
#1 0x0045e2cc in config_parse_file (filename=0x1f38f8 "ML/SETTINGS/magic.cfg", [email protected]=0x1f38f0 "\023") at ../../src/config.c:316
#2 0x0045ea1c in config_load () at ../../src/config.c:913
#3 0x0044c910 in my_big_init_task () at ../../src/boot-hack.c:458
#4 0x0000ca18 in ?? ()
...
#0 read_entire_file (filename=0x18e2a0 "ML/SETTINGS/MENU.CFG", [email protected]=0x18e298 "\030\002\230\031", buf_size=0x18e29c, [email protected]=0x18e294) at ../../src/fio-ml.c:707
#1 0x00454a50 in menu_load_flags (filename=0x18e298 "\030\002\230\031") at ../../src/menu.c:5600
#2 config_menu_load_flags () at ../../src/menu.c:5633
#3 menu_task (unused=<optimized out>) at ../../src/menu.c:4982
#4 0x0000ca18 in ?? ()
[ ml_init:0044db24 ] (32:03) read_entire_file:736: failed
[ ml_init:0045e344 ] (32:03) config_parse: Read 0 config values
[****] task_hook(141b34) 13fb60() -> 13fb60(), from 141b34
[****] task_hook(13fb60) 0(????????) -> 141b34(T ??), from 13fb60
[****] task_hook(141b34) 13fb60() -> 13fb60(), from 141b34
[****] task_hook(141990) 0(????????) -> 141b34(T ??), from 141990
[****] task_hook(13fb60) 0(????????) -> 141990(), from 13fb60
gaddr2line -sf --pretty-print -b elf32-littlearm -e magiclantern 0x44c8dc 0x477e28 0x44ca64
call_init_funcs at boot-hack.c:307
stateobj_start_spy at state-object.c:251
ml_assert_handler at boot-hack.c:539
gaddr2line -sf --pretty-print -b elf32-littlearm -e magiclantern 0x0044CA04 0x0044C468
ml_assert_handler at boot-hack.c:530
backtrace_getstr at backtrace.c:877One question -- if the the state objects message is not a problem, why is it printing an error message and saving a crash log?
-NSTUB(0xFF702A3C, PlayMain_handler)
+NSTUB(0xFF3B9E94, PlayMain_handler)
cd platform/700D.114
hg blame -c stubs.S | grep PlayMain_handler
3c718689749d: NSTUB(0xFF702A3C, PlayMain_handler)
hg log -r 3c718689749d
changeset: 14427:3c718689749d
branch: 700D
parent: 14406:96ca71e19bf1
user: [email protected]
date: Sat Aug 13 09:23:49 2016
summary: 700D: fix PlayMain_handler stub (fixes SET+MainDial and others)
hg export 3c718689749d
...
-NSTUB(0xFF3B9E94, PlayMain_handler)
+NSTUB(0xFF702A3C, PlayMain_handler)
There are a few more camera-specific files under the platform directory.
#ifndef __platform_state_object_h
#define __platform_state_object_h
#define DISPLAY_STATE DISPLAY_STATEOBJ
#define INPUT_SET_IMAGE_VRAM_PARAMETER_MUTE_FLIP_CBR 26 // need to verify
#define INPUT_ENABLE_IMAGE_PHYSICAL_SCREEN_PARAMETER 27 // need to verify
#define EVF_STATE (*(struct state_object **)0x91CF0)
#define MOVREC_STATE (*(struct state_object **)0x93AF8)
#define SSS_STATE (*(struct state_object **)0x9169C)
#endif // __platform_state_object_hYou should be able to work around it by allowing the menu to come up in any GUI state, not just when "idle".
if (gui_state == GUISTATE_IDLE || (gui_menu_shown() && !beta_should_warn()))
{
give_semaphore( gui_sem );
return 0;
}
BTW--if I brick the camera it would probably disappoint the two EOSM2 owners who are following this topic more than it does me. At least I could move on to other projects!
I check in every other day I don't known what's going on but I'm eggerly waiting for this to finally work on EOS m2 lol
BTW--if I brick the camera it would probably disappoint the two EOSM2 owners who are following this topic more than it does me. At least I could move on to other projects!
I'm eggerly waiting
That's probably because the M2 does not show the "idle" Canon screen (the one with shooting settings); as soon as you close the date/time dialog, it will go to LiveView (which doesn't work in QEMU).
You should be able to work around it by allowing the menu to come up in any GUI state, not just when "idle".
13: 34.304 [SEQ ERROR] NotifyComplete (Cur = 1, 0x2, Flag = 0x20000000)
14: 38.400 [PROPAD] ERROR GetPropertyData ID (0) = 0x00030048
15: 38.400 ERROR [RTC] PROPAD_GetPropertyData : PROP_RTC
16: 42.752 [RTC] ChangePropertyCBR 0x0, 0x0
17: 43.520 [RTC] RTC_Permit 0x0
...
83: 253.952 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050038
84: 254.464 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050041
85: 254.720 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050042
86: 254.720 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050043
87: 254.976 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050044
88: 255.232 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105004F
89: 255.232 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050050
90: 255.488 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050051
91: 190.208 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050052
92: 190.720 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010E
93: 190.976 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010F
94: 190.976 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050110
95: 190.976 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050111
96: 191.232 [PROPAD] ERROR GetPropertyData ID (1) = 0x0104000B
[ debug_task:ff0d8b9c ] (85:03) GUI_Control:-7 0x0
[ GuiMainTask:ff0d8f50 ] (84:01) GUI_CONTROL:-7
[ GuiMainTask:ff1c1638 ] (84:06) ***** GUI_Control_Post(-7)
[ GuiMainTask:ff1c187c ] (84:01) gui control end
[ GuiMainTask:ff1c189c ] (84:01) 0msec = 5550 - 5550
[ GuiMainTask:ff1c18b8 ] (84:01) 256msec = 563456 - 563712
187: 5609.984 [GUI_M] ERROR ***** GUI_Control_Post(-7)
ML ASSERT:
mem_sem
at ../../src/mem.c:854 (__mem_malloc), task ml_init
lv:0 mode:3
ml_init stack: 1f38d0 [1f39c8-1ef9c8]
0xUNKNOWN @ 44c7f0:1f39b0
0x00453F44 @ 49468c:1f39a8
0x004501E0 @ 45423c:1f3968
0x0044F124 @ 450260:1f3950
0x0044C914 @ 44f15c:1f3900
0x0044C468 @ 44c974:1f38d0
Magic Lantern version : Nightly.2017Aug05.EOSM2103
Mercurial changeset : d538e46a12aa+2214781fcb95+ (dm-spy-experiments-EOSM2.103) tip
Built on 2017-08-05 22:41:51 UTC by [email protected]
Free Memory : 344K + 1158K
NSTUB(0xff0d7830, GUI_ChangeMode)
...
NSTUB(0xff1c4670, gui_massive_event_loop)
ML ASSERT:
mem_sem
at ../../src/mem.c:854 (__mem_malloc), task ml_init
...
Magic Lantern version : Nightly.2017Aug06.700D114
Mercurial changeset : 2c1d19295d9f (dm-spy-experiments-EOSM2.103)
ML ASSERT:
mem_sem
at ../../src/mem.c:854 (__mem_malloc), task ml_init
...
Magic Lantern version : Nightly.2017Aug06.550D109
Mercurial changeset : 2c1d19295d9f (dm-spy-experiments-EOSM2.103)
hg diff -r 495f8c25235c -r de9f09df06e7 src/boot-hack.c
(no output)
diff -r 63d4b3396a5f -r 501eb2ccd140 src/boot-hack.c
--- a/src/boot-hack.c
+++ b/src/boot-hack.c
@@ -660,31 +660,32 @@
uint32_t* addr_AllocMem_end = (void*)(CreateTaskMain_reloc_buf + ROM_ALLOCMEM_END + CreateTaskMain_offset);
uint32_t* addr_BL_AllocMem_init = (void*)(CreateTaskMain_reloc_buf + ROM_ALLOCMEM_INIT + CreateTaskMain_offset);
+ uint32_t* addr_B_CreateTaskMain = (void*)(init_task_reloc_buf + ROM_B_CREATETASK_MAIN + init_task_offset);
- #if defined(CONFIG_550D) || defined(CONFIG_60D) || defined(CONFIG_7D)
- // change end limit to 0xc60000 => reserve 640K for ML
+ #if defined(CONFIG_EOSM2)
+ /* R0: 0x44C000 (start address, easier to patch, change to 0x4E0000 => reserve 592K for ML) */
+ /* R1: 0xD3C000 [6D, 700D] / 0xC3C000 [100D] / 0xD6C000 [EOSM] / 0xC2A000 [EOSM2] (end address, unchanged) */
+ addr_AllocMem_end[1] = MOV_R0_0x4E0000_INSTR;
+ ml_reserved_mem = 0x4E0000 - RESTARTSTART;
+ #elif defined(CONFIG_550D) || defined(CONFIG_60D) || defined(CONFIG_7D)
+ // change end limit from 0xd00000 to 0xc60000 => reserve 640K for ML
*addr_AllocMem_end = MOV_R1_0xC60000_INSTR;
- ml_reserved_mem = 640 * 1024;
+ ml_reserved_mem = 0xD00000 - RESTARTSTART;
#else
- // change end limit to 0xc80000 => reserve 512K for ML
+ // change end limit from 0xd00000 to 0xc80000 => reserve 512K for ML
*addr_AllocMem_end = MOV_R1_0xC80000_INSTR;
- ml_reserved_mem = 512 * 1024;
+ ml_reserved_mem = 0xD00000 - RESTARTSTART;
#endif
// relocating CreateTaskMain does some nasty things, so, right after patching,
// we jump back to ROM version; at least, what's before patching seems to be relocated properly
*addr_BL_AllocMem_init = B_INSTR(addr_BL_AllocMem_init, ROM_ALLOCMEM_INIT);
- uint32_t* addr_B_CreateTaskMain = (void*)init_task_reloc_buf + ROM_B_CREATETASK_MAIN + init_task_offset;
+ // replace call to CreateMainTask (last sub in init_task)
*addr_B_CreateTaskMain = B_INSTR(addr_B_CreateTaskMain, new_CreateTaskMain);
-
- /* FIO_RemoveFile("B:/dump.hex");
- FILE* f = FIO_CreateFile("B:/dump.hex");
- FIO_WriteFile(f, UNCACHEABLE(new_CreateTaskMain), CreateTaskMain_len);
- FIO_CloseFile(f);
-
- NotifyBox(10000, "%x ", new_CreateTaskMain); */
+ /* before we execute code, make sure a) data caches are drained and b) instruction caches are clean */
+ sync_caches();
// Well... let's cross the fingers and call the relocated stuff
return new_init_task;
hg diff -r 63d4b3396a5f -r de9f09df06e7
# only recompiles and installs autoexec.bin, without modules
cd platform/EOSM2.103; make installq ML_MODULES_DYNAMIC=
# requires a tiny change from latest unified (g3gg0 found out yesterday)
make -j4
If the dm-spy-experiments branch saves a valid log in QEMU with CONFIG_DEBUG_INTERCEPT_STARTUP=y and CONFIG_QEMU=n, that means we are already there and I'll enable the boot flag.
We'll also need the sf_dump module - that should re-create the SFDATA.BIN file, although I've never tested it that way (todo: include this in the test suite).
I can't get to the Magic Lantern menu to check it out.
That's probably because the M2 does not show the "idle" Canon screen (the one with shooting settings); as soon as you close the date/time dialog, it will go to LiveView (which doesn't work in QEMU).
You should be able to work around it by allowing the menu to come up in any GUI state, not just when "idle".
make -j4 installq ML_MODULES_DYNAMIC=Those errors are likely just imperfect emulation (we are using properties from 100D, not from a real camera).
However, we should be close to getting these things from real hardware. If the dm-spy-experiments branch saves a valid log in QEMU with CONFIG_DEBUG_INTERCEPT_STARTUP=y and CONFIG_QEMU=n, that means we are already there and I'll enable the boot flag.
We'll also need the sf_dump module - that should re-create the SFDATA.BIN file, although I've never tested it that way (todo: include this in the test suite).
@bookemdano -- are you able to use Mercurial (command line or through a GUI like SourceTree) and compile ML? That would be the best way to test, once the camera boot flag is enabled of course. So while we're waiting for that, take the time to set up a testing/development environment. It isn't that hard. I've got a few tutorials on how to get something up quickly on Mac or Windows. If you're on Linux you don't need a tutorial.
...I know each body's ML port is like a crying puppy badly needing love and there aren't enough devs here to tend to them all. And the M2 would definitely be the runt of the litter given how few of them were sold...
The EOSM and EOSM2 work the same when it comes to starting the camera with the play button. They start up in playback mode which is not LiveView.
I've been busy on other projects so I haven't been able to look into it but the problems with the new DryOS task hooks that are causing problems on the 100D are likely a problem on the EOSM2 because these cameras are very similar. I'll follow the "fix" on the 100D when it is ready.
In the meantime you might look into doing a firmware dump and running it in QEMU. Yeah, I know it is a challenge. Just start here (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084), take it a step at a time and follow what was already posted. Note that compiling ML and getting QEMU up and running is much easier these days.
...find some configuration (Canon settings) on both the original M and on the M2 where the camera doesn't go directly in LiveView when powering on, and ML menu can be started from that screen (not sure if there is such screen on these cameras), dump the ROM in that state...
What the M2 requires is new DryOS task hooks (https://bitbucket.org/hudson/magic-lantern/pull-requests/672/dryos-task-hooks-for-newer-cameras-6d-70d). That's not a QEMU limitation; the DryOS internals changed on recent models - if I enable the boot flag now, you'll have the same issue on the real camera. If you haven't been able to solve it in the emulator (where you have debugging tools available), I doubt you'll be able to solve it on the physical camera.
...
Of course, you can try the method meanwhile (just merge new-dryos-task-hooks)...
make -C ../magic-lantern/platform/EOSM2.103 install_qemu
./run_canon_fw.sh EOSM2,firmware="boot=1" -d debugmsg -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
Finally got around to trying out the new DryOS task hooks but still no luck getting to the ML menus. Haven't tried the other suggestions yet.
On the Mac "fn delete" brings up the ML menu on the 700D but nothing on the EOSM2. In fact the EOSM2 still goes into the black abyss when leaving the Canon menu and the "M" key doesn't bring it back to life.
I've been trying out the EOSM2 on various branches and here is what I'm doing in QEMU:Code: [Select]make -C ../magic-lantern/platform/EOSM2.103 install_qemu
./run_canon_fw.sh EOSM2,firmware="boot=1" -d debugmsg -s -S & arm-none-eabi-gdb -x EOSM2/debugmsg.gdb
Don't have to bother mounting and unmounting the sd disk image. Nice!
-#define SIG_EOSM2_103 0x17D200D6
+#define SIG_EOSM2_103 0x1f321405
Yes, it would be great to end the year with at least "Hello World" running on the M2 but that requires an ML-SETUP.FIR file and a1ex decides who's been naughty or nice enough to get that present.
./run_canon_fw.sh EOSM2 -s -S &
arm-none-eabi-gdb -x EOSM2/patches.gdb -ex quit
...
Breakpoint 1, 0xff0c5144 in ?? ()
Patching LeoLens (infinite loop)
[MPU] Received: 06 05 09 11 01 00 (PROP_LV_DISPSIZE - spell #22)
[MPU] Received: 12 11 09 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (PROP 80050020 - spell #23)
[MPU] Received: 14 13 09 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (unnamed - spell #24)
[MPU] Received: 06 05 01 5a 00 00 (PROP_CONTINUOUS_AF_VALID - spell #25)
[MPU] Sending : 06 05 01 59 01 00 (PROP_MOVIE_SERVO_AF)
[MPU] Received: 06 05 09 2f 01 00 (unnamed - spell #26)
[MPU] Received: 06 05 0e 22 1e 00 (unknown - unnamed)
70: 121.344 [MR] mvrChangeAckCBR : Video - Mode=0, Type=2, Rate=30, GOP=15
88: 125.440 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050038
89: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050041
90: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050042
91: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050043
92: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050044
93: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105004F
94: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050050
95: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050051
96: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050052
97: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010E
98: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x0105010F
99: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050110
100: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x01050111
101: 60.160 [PROPAD] ERROR GetPropertyData ID (1) = 0x0104000B
102: 60.160 [LVCOM] InitializeLiveViewDefectDetection
103: 60.416 [LVCOM] ExecuteDefectMarge Start
104: 60.416 [LVCOM] ExecuteDefectMarge End
106: 61.184 [LV] PROP_LV_BLOCK PROP_LV_UNBLOCKING 0
108: 62.208 [AUDIO] RegisterCBRSDIOCableConnect
109: 64.256 [WFT] InitializeAdapterControl END
SD: Unknown CMD1
[SDIO] Error
SD: Unknown CMD1
[SDIO] Error
SD: Unknown CMD1
[SDIO] Error
124: 151.808 [SD] ERROR SDINTREP=0x00000000
125: 151.808 [SD] ERROR UNEXPECTED ERROR
131: 113.152 [RSC] WARN ILLEGAL SUBFREECLUSTERCOUNT ShootStorage.c 686
157: 184.832 [DISP] ERROR PROP_TFT_SETTING_PARAM DON'T FIND
158: 184.832 [DISP] ERROR Factory Adjust For TftCom
159: 185.088 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
160: 142.336 [TCH]Touch IC Ver : 0x0000
161: 569.600 [TCH]ERROR TouchPanelIC Ack Error
162: 569.856 WARN [I2C] localI2C_Read : 378 (Task : Startup)
163: 570.112 WARN [I2C] localI2C_Read : 378 (Task : Startup)
164: 570.112 WARN [I2C] localI2C_Read : 378 (Task : Startup)
165: 570.112 WARN [I2C] localI2C_Read : 378 (Task : Startup)
166: 570.368 WARN [I2C] localI2C_Read : 378 (Task : Startup)
167: 570.368 WARN [I2C] localI2C_Read : 378 (Task : Startup)
168: 570.368 WARN [I2C] localI2C_Read : 378 (Task : Startup)
169: 570.624 WARN [I2C] localI2C_Read : 378 (Task : Startup)
170: 570.624 WARN [I2C] localI2C_Read : 378 (Task : Startup)
171: 572.672 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
172: 572.672 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
179: 578.816 [STARTUP] startupInitializeComplete
185: 580.864 [CEC]CEC OFF
(does this (http://www.magiclantern.fm/forum/index.php?topic=15895.msg186872#msg186872) make any more sense now?)
Didn't test on Mac though; I'll try later if it still doesn't work. Without loading ML, is the Canon menu still working?
---Type <return> to continue, or q <return> to quit---..a tiny hack in menu.c to bring menu in QEMU (not needed for camera), and if there are any buttons not recognized, just print their codes.
Yeah, looks like there is a Mac issue, but only with patches.gdb.
One other observation - on Mac it pauses for user input while on WSL it doesn't:
A tiny hint on how to print out the button codes?
Next steps were covered before: new-dryos-task-hooks (done for 1300D (http://www.magiclantern.fm/forum/index.php?topic=17969.msg195883#msg195883), some stubs apparently wrong on M2)
You can now see DryOS tasks switching if you compile with CONFIG_QEMU=y and you enable DEBUG_TASK_HOOK in boot-hack.c. Without the latter, only new tasks will be displayed.
/** Tasks **/
NSTUB( 0x8FBE0, task_dispatch_hook) // changed from 0x8FAB4 - now it doesn't work on the camera.
NSTUB(0xFFD24B44 - RAM_OFFSET, task_create)
NSTUB(0xFFD2A1D8 - RAM_OFFSET, task_trampoline)
...a tiny hack in menu.c to bring menu in QEMU (not needed for camera), and if there are any buttons not recognized, just print their codes.
module.console = 1
SF_DUMP.EN// menu_add("Debug", sf_dump_menu, COUNT(sf_dump_menu));
sf_dump_task();
return 0;
Fixed task_dispatch_hook so it matches the changes on the 1300D and 6D. I couldn't follow the comments on the task_dispatch_hook for those cameras but I used my best pattern matching skills and also checked against the 100D and 70D so I'm pretty confident that I've got this right.
1D88 LDR R0, =0x8FBE0
1D90 LDR R3, [R0]
1D94 CMP R3, #0
1DA4 BLXNE R3
By the way, the EOSM doesn't fall into the same pattern as the other cameras. Is new-dryos-task-hooks working properly on the EOSM?
However, as you can see from my comment it no longer works on the camera. LED turns on and camera won't boot up.
Now how to get the console to show button events? I'll bet the answer is to get the task hooks working properly.
I've just refactored it to use CONFIG_NEW_DRYOS_TASK_HOOKS in internals.h.
252: 6418.176 WARN [I2C] localI2C_Write : 317 (Task : Startup)
[ Startup:ff349fd8 ] (14:02) I2C > [01] 02
[ Startup:ff356f04 ] (00:26) [I2C] localI2C_Write : 317 (Task : Startup)
[ Startup:ff34a020 ] (14:06) I2C abort 0(1020000)
253: 6466.816 WARN [I2C] localI2C_Write : 317 (Task : Startup)
254: 6466.816 [AUDIO] ERROR I2C abort 0(1020000)
[ Startup:ff349fd8 ] (14:02) I2C > [01] 02
[ Startup:ff356f04 ] (00:26) [I2C] localI2C_Write : 317 (Task : Startup)
[ Startup:ff34a0a4 ] (14:03) I2C_Write retry 1 1 c3
The lock up problem also happened on the EOSM [...]
static struct { uint32_t addr; char* name; } common_addresses[] = {
{ RESTARTSTART, "RST"},
{ YUV422_HD_BUFFER_1, "HD1"},
{ YUV422_HD_BUFFER_1, "HD2"},
{ YUV422_LV_BUFFER_1, "LV1"},
{ YUV422_LV_BUFFER_2, "LV2"},
{ YUV422_LV_BUFFER_3, "LV3"},
};
{ YUV422_HD_BUFFER_2, "HD2"},
// http://magiclantern.wikia.com/wiki/ASM_Zedbra
// skipped for now, will come up with a way to autodetect these values
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_HD_BUFFER_1 0x44000080
#define YUV422_HD_BUFFER_2 0x46000080
270: 3187.200 [RSC] --- Indev Mode ----
271: 3187.456 [RSC] [INDVMGR] 0x0
272: 3187.456 [RSC] YUV 0x4AEEA000 0x0222C000 35831808
273: 3187.456 [RSC] YUV_OUT 0x42000000 0x0222C000 35831808
274: 3187.712 [RSC] INDV_WORK 0x0 0x00000000 0
// Started out by using the one found value (0x4f3d7800)for all three as a workaround
// then adding 0x410000 to determine the other two.
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_LV_BUFFER_1 0x4F3D7800
#define YUV422_LV_BUFFER_2 0x4F7E7800
#define YUV422_LV_BUFFER_3 0x4FBF7800
These addresses all visible from the EDMAC channels screenshot (edmac.mo); can be guessed from their size.
The LV buffer is 720x480..
int i;
unsigned int *bmp_ram_addr = bmp_vram_info;
for (i=0; i<2; i++)
DebugMsg( DM_MAGIC, 3, "bmp_vram[]=0x%08x, 0x%08x, 0x%08x",
bmp_ram_addr[3*i+0], bmp_ram_addr[3*i+1], bmp_ram_addr[3*i+2] );
unsigned int *vram_info_addr = vram_info;
for (i=0; i<3; i++)
DebugMsg( DM_MAGIC, 3, "vram_info[]=0x%08x, w=%4d, h=%4d, p=%4d, n=%4d",
vram_info_addr[5*i+0], vram_info_addr[5*i+1],
vram_info_addr[5*i+2], vram_info_addr[5*i+3], vram_info_addr[5*i+4] );
unsigned int *stateobj_disp = 0x90494+0x128; // see FF137ACC SetBitmapVramAddress
DebugMsg( DM_MAGIC, 3, "stateobj_disp+0xb0[]=0x%08x,0x%08x,0x%08x,",
stateobj_disp[0], stateobj_disp[1], stateobj_disp[2]);
void vram_init()
{
menu_add("VRAM", vram_menus, COUNT(vram_menus));
old_buffer_pos = YUV422_LV_BUFFER_1;
}
// code goes in here
INIT_FUNC(__FILE__, vram_init);
#endif
2109: 9760.005 [MAGIC] bmp_vram[]=0xc0f140d0, 0x00000000, 0x02087100
2110: 9760.045 [MAGIC] bmp_vram[]=0xc0f140d4, 0x00000000, 0x02087100
2111: 9760.082 [MAGIC] vram_info[]=0x40d07800, w= 720, h= 720, p= 480, n= 2
2112: 9760.116 [MAGIC] vram_info[]=0x4c233800, w= 720, h= 720, p= 480, n= 0
2113: 9760.149 [MAGIC] vram_info[]=0x4f11d800, w= 720, h= 720, p= 480, n= 0
2114: 9760.194 [MAGIC] stateobj_disp+0xb0[]=0x42080008,0x40d07800,0x40958c3c,// Get back to this after figuring out how parse_bin.py works
// not used on 700D and 100D so maybe it can wait until adtg_gui is working on EOSM2
//#define FRAME_SHUTTER_BLANKING_ZOOM (*(uint16_t*)0x40481B20) // ADTG register 805f
//#define FRAME_SHUTTER_BLANKING_NOZOOM (*(uint16_t*)0x40481B24) // ADTG register 8061
//#define FRAME_SHUTTER_BLANKING_READ (lv_dispsize > 1 ? FRAME_SHUTTER_BLANKING_NOZOOM : FRAME_SHUTTER_BLANKING_ZOOM) /* when reading, use the other mode, as it contains the original value (not overriden) */
//~ #define FRAME_SHUTTER_BLANKING_WRITE (lv_dispsize > 1 ? &FRAME_SHUTTER_BLANKING_ZOOM : &FRAME_SHUTTER_BLANKING_NOZOOM)
#define LV_DISP_MODE (MEM(0xDF1BC + 0x7C) != 3)
adtg_log: python script to parse binary log file. "parse_bin.py -f TEST.BIN > out.txt"
#include <beep.h>CONFIG_GDB = y
CONFIG_GDBSTUB = y
#define FRAME_SHUTTER_BLANKING_ZOOM (*(uint16_t*)0x416D7B7C) // ADTG register 805f
#define FRAME_SHUTTER_BLANKING_NOZOOM (*(uint16_t*)0x416D7B80) // ADTG register 8061
/* when reading, use the other mode, as it contains the original value (not overriden) */
#define FRAME_SHUTTER_BLANKING_READ (lv_dispsize > 1 ? FRAME_SHUTTER_BLANKING_NOZOOM : FRAME_SHUTTER_BLANKING_ZOOM)
#define FRAME_SHUTTER_BLANKING_WRITE (lv_dispsize > 1 ? &FRAME_SHUTTER_BLANKING_ZOOM : &FRAME_SHUTTER_BLANKING_NOZOOM)
#define LV_DISP_MODE (MEM(0xDF1BC + 0x7C) != 3)
Sorry EOSM2 enthusiasts, this needs some more work before releasing a test build.
// stub_test_malloc_n_allocmem(); stub_test_save_log(); // fails and doesn't save log
// stub_test_exmem(); stub_test_save_log(); // fails and doesn't save log
[Pass] is_play_mode() => 0x1
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[FAIL] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[FAIL] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[Pass] MENU_MODE => 0x1
[Pass] PLAY_MODE => 0x0
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[FAIL] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[FAIL] PLAY_MODE => 0x0
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[FAIL] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
[FAIL] dialog->type => ''
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
SW1(1,100)
[FAIL] HALFSHUTTER_PRESSED => 0x0
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[FAIL] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
...
[Pass] ABS(MOD(t1-t0, 1048576)/1000 - 250) => 0x4
LoadCalendarFromRTC( &now )
s0 = now.tm_sec => 0x26
Date/time: 2018/01/29 08:36:38
msleep(1500)
LoadCalendarFromRTC( &now )
s1 = now.tm_sec => 0x28
[Pass] MOD(s1-s0, 60) => 0x2
[Pass] MOD(s1-s0, 60) => 0x2
m0 = MALLOC_FREE_MEMORY => 0x516c0
[Pass] p = (void*)_malloc(50*1024) => 0x12ecf8
[Pass] CACHEABLE(p) => 0x12ecf8
m1 = MALLOC_FREE_MEMORY => 0x44eb0
_free(p)
m2 = MALLOC_FREE_MEMORY => 0x516c0
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m0 = GetFreeMemForAllocateMemory() => 0x200014
[Pass] p = (void*)_AllocateMemory(256*1024) => 0xaa72d8
[Pass] CACHEABLE(p) => 0xaa72d8
m1 = GetFreeMemForAllocateMemory() => 0x1c0008
_FreeMemory(p)
m2 = GetFreeMemForAllocateMemory() => 0x200014
[Pass] ABS((m0-m1) - 256*1024) => 0xc
[Pass] ABS(m0-m2) => 0x0
m01 = MALLOC_FREE_MEMORY => 0x516c0
m02 = GetFreeMemForAllocateMemory() => 0x200014
[Pass] p = (void*)_alloc_dma_memory(256*1024) => 0x40aa7318
[Pass] UNCACHEABLE(p) => 0x40aa7318
[Pass] CACHEABLE(p) => 0xaa7318
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40aa7318
_free_dma_memory(p)
[FAIL] p = (void*)_shoot_malloc(24*1024*1024) => 0x0
[FAIL] UNCACHEABLE(p) => 0x40000000
_shoot_free(p)
m11 = MALLOC_FREE_MEMORY => 0x516a0
m12 = GetFreeMemForAllocateMemory() => 0x1fffbc
[Pass] ABS(m01-m11) => 0x20
[Pass] ABS(m02-m12) => 0x58
[FAIL] p = (void*)_shoot_malloc(24*1024*1024) => 0x0
[FAIL] UNCACHEABLE(p) => 0x40000000
[FAIL] p = (void*)_shoot_malloc(24*1024*1024) => 0x0
[FAIL] UNCACHEABLE(p) => 0x40000000
...
shoot buffer: 4dd16064 ... 4f3ce063
shoot buffer: 4ae00064 ... 4aee8063
shoot buffer: 45f240e4 ... 45ffc0e3
shoot buffer: 44000064 ... 45e88063
srm_malloc_suite(0)...
[MPU] Received: 06 05 04 01 01 00 (PROP_ICU_UILOCK - spell #56)
[MPU] Sending : 06 05 04 01 01 00 (PROP_ICU_UILOCK)
UILock: 00000000 -> 41000001 => 41000001
< Error Exception>
TYPE : 4
ISR : 0
TASK IDSR : 5111821
TASK Name : RscMgr
Checked on EOSM - in the Free Memory dialog, shoot_total is only 23MB. Do you get different value on the camera?
On M2, I believe SRM_AllocateMemoryResourceFor1stJob is at FF0E9660 (unless I'm looking at the wrong firmware version :D )
On M2, patch handle_ml_menu_erase so it doesn't check for GUISTATE_IDLE, and define BGMT_TRASH as 0xD (probably a button not physically present on the camera). That was the easy coding task mentioned earlier.
So it doesn't go into the abyss when you get into LiveView in QEMU?
You can include dm-spy-experiments in your current wip branch and use it for reverse engineering (understanding how things work). This branch breaks things on some cameras...so let's not include this one in the PR yet.
new-dryos-task-hooks..., qemu, lua_fix... I think it's best to start a clean branch starting from unified, with the first 3 branches merged.
You could also consider including 100D, which is very similar to EOSM2 and also waits for the first 3 backends to reach the mainline (otherwise it's pretty much ready)...
SRM_BUFFER_SIZE 0x1F24000// Started out by using the one found value (0x4f3d7800)for all three as a workaround
// then adding 0x410000 to determine the other two.
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_LV_BUFFER_1 0x4F3D7800
#define YUV422_LV_BUFFER_2 0x4F7E7800
#define YUV422_LV_BUFFER_3 0x4FBF7800
EOSM 1,2,3
700D 2,1,3
6D 2,3,1
650D 2,1,3
100D 2,1,3
5D3.113 1,2,3
5D3.123 3,2,1,4 (quad buffered)#define CURRENT_GUI_MODE (*(int*)(0x92860+0x5C)) // in SetGUIRequestMode
#define CURRENT_GUI_MODE (*(int*)0x928BC) // in SetGUIRequestMode (0x92860+0x5C)
===============================================================================
ML/SCRIPTS/API_TEST.LUA - 2018-2-6 11:20:00
===============================================================================
Strict mode tests...
Strict mode tests passed.
Generic tests...
camera = table:
shutter = table:
raw = 96
apex = 5
ms = 31
value = 0.03125
aperture = table:
raw = 40
apex = 4
value = 4
min = table:
raw = 24
apex = 2
value = 2
max = table:
raw = 80
apex = 9
value = 22.6
iso = table:
raw = 72
apex = 5
value = 100
ec = table:
raw = 0
value = 0
flash_ec = table:
raw = 0
value = 0
kelvin = 6500
mode = 20
metering_mode = 5
drive_mode = 0
model = "Canon EOS M2"
model_short = "EOSM2"
firmware = "1.0.3"
temperature = 196
state = 0
shoot = function: p
bulb = function: p
reboot = function: p
event = table:
pre_shoot = nil
post_shoot = nil
shoot_task = nil
seconds_clock = nil
keypress = nil
custom_picture_taking = nil
intervalometer = nil
config_save = nil
console = table:
write = function: p
hide = function: p
clear = function: p
show = function: p
lv = table:
enabled = true
paused = false
running = true
zoom = 1
pause = function: p
stop = function: p
start = function: p
resume = function: p
wait = function: p
info = function: p
lens = table:
name = "EF-M22mm f/2 STM"
focal_length = 22
focus_distance = 190
hyperfocal = 6412
dof_near = 186
dof_far = 193
af = true
af_mode = 0
focus = function: p
display = table:
idle = false
height = 480
width = 720
line = function: p
circle = function: p
on = function: p
off = function: p
load = function: p
clear = function: p
notify_box = function: p
rect = function: p
draw = function: p
pixel = function: p
screenshot = function: p
print = function: p
key = table:
last = 0
press = function: p
wait = function: p
menu = table:
visible = false
new = function: p
block = function: p
set = function: p
open = function: p
get = function: p
close = function: p
testmenu = userdata:
value = 0
name = "Script API tests"
help = "Various tests for the Lua scripting API."
help2 = "When adding new Lua APIs, tests for them should go here."
advanced = 0
depends_on = 0
edit_mode = 0
hidden = false
icon_type = 5
jhidden = false
max = 0
min = 0
selected = true
shidden = false
starred = false
submenu_height = 0
submenu_width = 0
unit = 0
works_best_in = 0
run_in_separate_task = 0
select = function: p
update = nil
info = nil
rinfo = nil
warning = nil
movie = table:
recording = false
stop = function: p
start = function: p
dryos = table:
clock = 20
ms_clock = 20650
prefix = "IMG_"
dcim_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
config_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "ML/"
path = "ML/SETTINGS/"
ml_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7211
folder_number = 100
free_space = 31112864
type = "SD"
_card_ptr = userdata
path = "B:/"
shooting_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7211
folder_number = 100
free_space = 31112864
type = "SD"
_card_ptr = userdata
path = "B:/"
date = table:
sec = 2
min = 20
month = 2
yday = 37
isdst = false
hour = 11
day = 6
year = 2018
wday = 3
call = function: p
remove = function: p
directory = function: p
interval = table:
time = 10
count = 0
running = 0
stop = function: p
battery = table:
function not available on this camera
stack traceback:
[C]: in ?
[C]: in for iterator 'for iterator'
ML/SCRIPTS/LIB/logger.lua:125: in function 'logger.serialize'
ML/SCRIPTS/API_TEST.LUA:30: in function <ML/SCRIPTS/API_TEST.LUA:29>
[C]: in function 'xpcall'
ML/SCRIPTS/API_TEST.LUA:29: in function 'print_table'
ML/SCRIPTS/API_TEST.LUA:75: in function 'generic_tests'
ML/SCRIPTS/API_TEST.LUA:634: in function 'api_tests'task = table:
yield = function: p
create = function: p
property = table:
Generic tests completed.
Module tests...
Copy test: autoexec.bin -> tmp.bin
Copy test OK
Append test: tmp.txt
Append test OK
Testing exposure settings, module 'camera'...
Camera : Canon EOS M2 (EOSM2) 1.0.3
Lens : EF-M22mm f/2 STM
Shoot mode: 20
Shutter : Ç30 (raw 96, 0.03125s, 31ms, apex 5)
Aperture : Å4.0 (raw 40, f/4, apex 4)
Av range : Å2.0..Å22 (raw 24..80, f/2..f/22.6, apex 2..9)
ISO : 100 (raw 72, 100, apex 5)
EC : 0.0 (raw 0, 0 EV)
Flash EC : 0.0 (raw 0, 0 EV)
Please switch to M mode.
Setting shutter to random values...
Setting ISO to random values...
Setting aperture to random values...
Please switch to Av mode.
Setting EC to random values...
Setting Flash EC to random values...
Exposure tests completed.
Testing module 'lv'...
Starting LiveView...
Setting zoom to x1...
Setting zoom to x5...
Setting zoom to x10...
Setting zoom to x5...
Setting zoom to x1...
Setting zoom to x10...
Setting zoom to x1...
Pausing LiveView...
Resuming LiveView...
Stopping LiveView...
LiveView tests completed.
Focus distance: 170
Focusing backward...
Focus distance: 655350
Focusing forward with step size 3, wait=true...
...
Focus distance: 140
Focusing backward with step size 3, wait=true...
................
Focus distance: 655350
Focus range: 173 steps forward, 16 steps backward.
Focusing forward with step size 3, wait=false...
...
Focus distance: 655350
Focusing backward with step size 3, wait=false...
Focus distance: 655350
Focus range: 3 steps forward, 0 steps backward.
Focusing forward with step size 2, wait=true...
Focus distance: 655350
Focusing backward with step size 2, wait=true...
Focus distance: 655350
Focus range: 0 steps forward, 0 steps backward.
Focusing forward with step size 2, wait=false...
Focus distance: 655350
Focusing backward with step size 2, wait=false...
Focus distance: 655350
Focus range: 0 steps forward, 0 steps backward.
Focusing forward with step size 1, wait=true...
Focus distance: 655350
Focusing backward with step size 1, wait=true...
Focus distance: 655350
Focus range: 0 steps forward, 0 steps backward.
Focusing forward with step size 1, wait=false...
Focus distance: 655350
Focusing backward with step size 1, wait=false...
Focus distance: 655350
Focus range: 0 steps forward, 0 steps backward.
Focus test completed.
Done!
#define VIDEO_PARAMETERS_SRC_3 MEM(0x91CD4) // (0x91CC8+0xC)
#define FRAME_ISO (*(uint8_t*)(VIDEO_PARAMETERS_SRC_3+0))
#define FRAME_APERTURE (*(uint8_t*)(VIDEO_PARAMETERS_SRC_3+1))
#define FRAME_SHUTTER (*(uint8_t*)(VIDEO_PARAMETERS_SRC_3+2))
#define FRAME_SHUTTER_TIMER (*(uint16_t*)(VIDEO_PARAMETERS_SRC_3+6))
#define FRAME_BV ((int)FRAME_SHUTTER + (int)FRAME_APERTURE - (int)FRAME_ISO)
NotifyBox(10000, "VIDEO_PARAMETERS_SRC_3 0x%x", VIDEO_PARAMETERS_SRC_3);
#define DISPLAY_STATE DISPLAY_STATEOBJ
#define INPUT_SET_IMAGE_VRAM_PARAMETER_MUTE_FLIP_CBR 23 // need to verify
#define INPUT_ENABLE_IMAGE_PHYSICAL_SCREEN_PARAMETER 24 // need to verify
#define RAW_DEBUG /* define it to help with porting */
...
Modules loaded
Save configs . . .
Save configs . . .
raw update update from lv_playback
Photo raw size error...
Modules loaded
raw update from livev_hiprio_task
LV RAW size too small
raw update from livev_hiprio_task
LV RAW size too small
... /* the raw edmac might be used by something else, and wrong numbers may be still there */
/* e.g. 5D2: 1244x1, obviously wrong */
if (width < 320 || height < 160)
{
dbg_printf("LV RAW size too small\n");
+ dbg_printf("width x height = %d x %d\n", width,height);
return 0;
}
raw update from livev_hiprio_task
LV RAW size too small
width x height = -16 x 727
uint32_t top_left = shamem_read(0xC0F06800);
uint32_t bot_right = shamem_read(0xC0F06804);
char msg[64];
snprintf(msg, sizeof(msg), "%x %x", top_left, bot_right); // copy it from stdio.c
font_draw(..., msg);
Can you print the raw values of top_left and bot_right?
top_left = 4
bot_right = 0
width x height = -16 x 727top_left = 65552
bot_right = 77988308
width x height = 1808 x 1189static int
my_init_task(int a, int b, int c, int d)
{
init_task(a,b,c,d);
/* wait for display to initialize */
while (!bmp_vram_info[1].vram2)
{
msleep(100);
}
while(1)
{
MEM(CARD_LED_ADDRESS) = LEDON;
msleep(500);
MEM(CARD_LED_ADDRESS) = LEDOFF;
msleep(500);
// font_draw(100, 75, COLOR_WHITE, 3, "Hello, World!");
uint32_t top_left = shamem_read(0xC0F06800);
uint32_t bot_right = shamem_read(0xC0F06804);
char msg[64];
snprintf(msg, sizeof(msg), "%x %x", top_left, bot_right); // copy it from stdio.c
font_draw(100, 75, COLOR_WHITE, 3, msg);
}
return 0;
}
CONFIG_DEBUG_INTERCEPT_STARTUP = y
CONFIG_MMIO_TRACE=y
static ASM_VAR uint32_t protected_region = REGION(0xC0F06000, 0x1000);
if (fmt[0] != 'e') return;
static void run_test()
{
msleep(1000);
SetGUIRequestMode(GUIMODE_PLAY); // go to PLAY mode
msleep(1000);
debug_intercept(); // start logging
SetGUIRequestMode(0); // back to LiveView
msleep(1000);
debug_intercept(); // stop logging
}
#include "dm-spy.h"[ LD ] magiclantern
debug.o: In function `run_test':
/Users/rosiefort/magic-lantern/platform/EOSM2.103/../../src/debug.c:290: undefined reference to `debug_intercept'
/Users/rosiefort/magic-lantern/platform/EOSM2.103/../../src/debug.c:293: undefined reference to `debug_intercept'
io_trace.o: In function `io_trace_log_message':
/Users/rosiefort/magic-lantern/platform/EOSM2.103/../../src/io_trace.c:451: undefined reference to `debug_format_msg'
make: *** [magiclantern] Error 1
.....// This fixes "dirty" LCD output for 100D
0.027.660 Evf:ff2c6f58:MMIO : [0xC0F06800] <- 0x00010013
0.027.661 Evf:ff2c6f58:MMIO : [0xC0F06804] <- 0x02D801D7
*reg = value;
*(reg & 0x3FFFF | shadow_addr) = value;
0x35F20(6109f0 &"StageClass", 35f20, 19980218, 19980218) at [ShootCapture:ca14:19dfc8] (pc:sp)
0xFF0D38C0(406108e8 &"ShootCapture", 0, ff0c5724, 40000) at [ShootCapture:35f7c:19dfa0] (pc:sp)
0x3637C(61096c &"StateObject", 406108e8 &"ShootCapture", 0, ff0c5724) at [ShootCapture:ff0d38ec:19df88] (pc:sp)
0x363B4(61096c &"StateObject", 406108e8 &"ShootCapture", 0, ff0c5724) at [ShootCapture:363ac:19df78] (pc:sp)
0xFF1567B4(406108e8 &"ShootCapture", ff0c5724, 40000, ff1567b4) at [ShootCapture:36434:19df58] (pc:sp)
0xFF23398C(412a0000, 44000, 1, ff1567b4) at [ShootCapture:ff156810:19df20] (pc:sp)
0xFF4ADB84(412a0000, 44000, 1, 0) at [ShootCapture:ff2339cc:19dee0] (pc:sp)
0xFF2C6BE8(412a0000, 44000, 1, 0) at [ShootCapture:ff4adb8c:19ded8] (pc:sp)
ENGINE_MIRROR 0x412A0000 0x00044000 278528
FF2C6C40 (in EngDrvOut)
FF2C6CD8 (in EngDrvIn)
FF2C6D30 (in EngDrvBits)
FF2C6D3C not
FF2C6DA4 (in EngDrvOuts)
FF2C6F64 ORRNE (in engio_write)
FF2C6F94 (in EngDrvOut_mirror)
FF2C6FC4 (in EngDrvBits_mirror)
FF2C6FD0 not
FF2C6FF4 (in engio_memcpy_maybe)
FF2C6C40 02 00 80 E1 ORR R0, R0, R2
FF2C6C40 02 00 80 E0 ADD R0, R0, R2
patch_instruction(0xFF2C6C40, 0xE1800002, 0xE0800002, "engio");
#if defined(CONFIG_EOSM2)
// patch ENGIO routines to use ADD instead of ORR, to make them able to work on unaligned buffers
// https://www.magiclantern.fm/forum/index.php?topic=15895.msg197682#msg197682
#include "patch.h" // if not already included
patch_instruction(0xFF2C6C40, 0xE1800002, 0xE0800002, "engio");
patch_instruction(0xFF2C6CD8, 0xE1800001, 0xE0800001, "engio");
patch_instruction(0xFF2C6D30, 0xE1822001, 0xE0822001, "engio");
patch_instruction(0xFF2C6D3C, 0xE1811005, 0xE0811005, "engio");
patch_instruction(0xFF2C6DA4, 0xE1807001, 0xE0807001, "engio");
patch_instruction(0xFF2C6F64, 0x1181100C, 0x1081100C, "engio");
patch_instruction(0xFF2C6F94, 0xE1800002, 0xE0800002, "engio");
patch_instruction(0xFF2C6FC4, 0xE1811002, 0xE0811002, "engio");
patch_instruction(0xFF2C6FD0, 0xE1822004, 0xE0822004, "engio");
patch_instruction(0xFF2C6FF4, 0xE1800003, 0xE0800003, "engio");
#endif
../../src/lv-img-engio.c:23:24: error: expected declaration specifiers or '...' before numeric constant
patch_instruction(0xFF2C6C40, 0xE1800002, 0xE0800002, "engio");
^
...that's the entire point of this patch, to allow you to open ML menu before entering LiveView (for example, while you are on Canon menu). Will commit it, as I don't expect LiveView emulation anytime soon.
#elif defined(CONFIG_EOSM2)
/* R0: 0x44C000 (start address, easier to patch, change to 0x4E0000 => reserve 592K for ML) */
/* R1: 0xD3C000 [6D, 700D] / 0xC3C000 [100D] / 0xD6C000 [EOSM] / 0xC2A000 [EOSM2] (end address, unchanged) */
addr_AllocMem_end[1] = MOV_R0_0x4E0000_INSTR;
ml_reserved_mem = 0x4E0000 - RESTARTSTART;
patch_instruction(0xFF2C6C40, 0xE1800002, 0xE0800002, "engio");
patch_instruction(0xFF2C6CD8, 0xE1800001, 0xE0800001, "engio");
patch_instruction(0xFF2C6D30, 0xE1822001, 0xE0822001, "engio");
patch_instruction(0xFF2C6D3C, 0xE1811005, 0xE0811005, "engio");
patch_instruction(0xFF2C6DA4, 0xE1807001, 0xE0807001, "engio");
patch_instruction(0xFF2C6F64, 0x1181100C, 0x1081100C, "engio");
patch_instruction(0xFF2C6F94, 0xE1800002, 0xE0800002, "engio");
patch_instruction(0xFF2C6FC4, 0xE1811002, 0xE0811002, "engio");
patch_instruction(0xFF2C6FD0, 0xE1822004, 0xE0822004, "engio");
patch_instruction(0xFF2C6FF4, 0xE1800003, 0xE0800003, "engio");
[FAIL] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] src = fio_malloc(size) => 0x4de1a084
[Pass] dst = fio_malloc(size) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0x10
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0x0
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0x84
[Pass] edmac_memcpy(dst, src, size) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0x0
[Pass] memcmp(dst, src, size) => 0x19
[Pass] edmac_memcpy_start(dst, src, size) => 0x4e61e090
dt => 0x296f
[Pass] copied => 0x400b70
[Pass] copied => 0x400b70
[Pass] copied => 0x400b70
[Pass] memcmp(dst, src, copied) => 0x0
[Pass] memcmp(dst, src, copied + 16) => 0xfffffff3
edmac_memcpy_finish()
free(src)
free(dst)
Cache test A (EDMAC on BMP buffer)...
[Pass] bmp = bmp_load("ML/CROPMKS/CINESCO2.BMP", 1) => 0xa9f4a4
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x80f
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x0
Cache test B (FIO on 8K buffer)...
[Pass] tries[0] => 0xef
[Pass] tries[1] => 0x103
[Pass] tries[2] => 0xfc
[Pass] tries[3] => 0xfa
[Pass] failr[0] => 0x47
[Pass] failw[0] => 0x88
[Pass] failr[1] => 0x4b
[Pass] failw[1] => 0x0
[Pass] failr[2] => 0x0
[Pass] failw[2] => 0x8c
[Pass] failr[3] => 0x0
[Pass] failw[3] => 0x0
times[0] / tries[0] => 0x1d
times[1] / tries[1] => 0x1f
times[2] / tries[2] => 0x1e
times[3] / tries[3] => 0x20
Cache tests finished.
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x1
[Pass] lv_focus_status => 0x3
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x2
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x2
[Pass] f = FIO_CreateFile("test.dat") => 0x5
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
FIO_CloseFile(f)
[Pass] FIO_GetFileSize("test.dat", &size) => 0x0
[Pass] size => 0x20000
[Pass] p = (void*)_alloc_dma_memory(0x20000) => 0x40aa121c
[Pass] f = FIO_OpenFile("test.dat", O_RDONLY | O_SYNC) => 0x5
[Pass] FIO_ReadFile(f, p, 0x20000) => 0x20000
FIO_CloseFile(f)
_free_dma_memory(p)
[Pass] count => 0x3a98
[Pass] buf = fio_malloc(0x1000000) => 0x4de1a084
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000000
[Pass] f = FIO_OpenFile("test.dat", O_RDWR | O_SYNC) => 0x5
[Pass] FIO_SeekSkipFile(f, 0, SEEK_END) => 0x82000000
[Pass] FIO_WriteFile(f, buf, 0x10) => 0x10
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_END) => 0x81fffff0
[Pass] FIO_WriteFile(f, buf, 0x30) => 0x30
[Pass] FIO_SeekSkipFile(f, 0x20, SEEK_SET) => 0x20
[Pass] FIO_SeekSkipFile(f, 0x30, SEEK_CUR) => 0x50
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_CUR) => 0x30
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000020
[Pass] is_file("test.dat") => 0x1
[Pass] FIO_RemoveFile("test.dat") => 0x0
[Pass] is_file("test.dat") => 0x0
[Pass] SetTimerAfter(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x8c78
msleep(900)
[Pass] timer_func => 0x0
msleep(200)
[Pass] timer_func => 0x1
[Pass] ABS((timer_time/1000 - t0) - 1000) => 0x6
[Pass] ABS((timer_arg - ta0) - 1000) => 0xa
[Pass] timer = SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x8ca6
msleep(400)
CancelTimer(timer)
[Pass] timer_func => 0x0
msleep(1500)
[Pass] timer_func => 0x0
[Pass] SetHPTimerAfterNow(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetHPTimerAfterNow(100000, timer_cbr, overrun_cbr, 0) => 0x330dc
msleep(90)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 100000) => 0x11a
[Pass] ABS(DeltaT(timer_arg, ta0) - 100000) => 0xff
[Pass] ABS((get_us_clock() - t0) - 110000) => 0x15b
[Pass] SetHPTimerAfterNow(90000, next_tick_cbr, overrun_cbr, 0) => 0x330de
msleep(80)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x3
msleep(80)
[Pass] timer_func => 0x3
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 300000) => 0x1ea
[Pass] ABS(DeltaT(timer_arg, ta0) - 300000) => 0x1d0
[Pass] ABS((get_us_clock() - t0) - 310000) => 0x145
t0 = GET_DIGIC_TIMER() => 0x27d7f
msleep(250)
t1 = GET_DIGIC_TIMER() => 0x641e7
[Pass] ABS(MOD(t1-t0, 1048576)/1000 - 250) => 0x4
LoadCalendarFromRTC( &now )
s0 = now.tm_sec => 0x4
Date/time: 2018/02/25 10:54:04
msleep(1500)
LoadCalendarFromRTC( &now )
s1 = now.tm_sec => 0x6
[Pass] MOD(s1-s0, 60) => 0x2
[Pass] MOD(s1-s0, 60) => 0x2
m0 = MALLOC_FREE_MEMORY => 0x60448
[Pass] p = (void*)_malloc(50*1024) => 0x11e768
[Pass] CACHEABLE(p) => 0x11e768
m1 = MALLOC_FREE_MEMORY => 0x53c38
_free(p)
m2 = MALLOC_FREE_MEMORY => 0x60448
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m0 = GetFreeMemForAllocateMemory() => 0x1ee0e8
[Pass] p = (void*)_AllocateMemory(128*1024) => 0xaa11dc
[Pass] CACHEABLE(p) => 0xaa11dc
m1 = GetFreeMemForAllocateMemory() => 0x1ce0dc
_FreeMemory(p)
m2 = GetFreeMemForAllocateMemory() => 0x1ee0e8
[Pass] ABS((m0-m1) - 128*1024) => 0xc
[Pass] ABS(m0-m2) => 0x0
m01 = MALLOC_FREE_MEMORY => 0x60448
m02 = GetFreeMemForAllocateMemory() => 0x1ee0e8
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40aa121c
[Pass] UNCACHEABLE(p) => 0x40aa121c
[Pass] CACHEABLE(p) => 0xaa121c
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40aa121c
_free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4de1a074
[Pass] UNCACHEABLE(p) => 0x4de1a074
_shoot_free(p)
m11 = MALLOC_FREE_MEMORY => 0x60448
m12 = GetFreeMemForAllocateMemory() => 0x1ee0e8
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0x102390
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1023b8
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0x102390
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x14b4000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1023b8
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x14b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
largest_shoot_block = suite->size => 0x14b4000
[INFO] largest_shoot_block: 21MB
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0x102390
[Pass] suite->signature => 'MemSuite'
[FAIL] suite->num_chunks => 0x1
[Pass] suite->size => 0x15b4000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1023b8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x15b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x15b4000
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0x102390
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x3
[Pass] suite->size => 0x1700000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1023b8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x15b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x1023f0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x169c000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4ae00064
[Pass] UNCACHEABLE(p) => 0x4ae00064
chunk = GetNextMemoryChunk(suite, chunk) => 0x117458
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1700000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x45f240e4
[Pass] UNCACHEABLE(p) => 0x45f240e4
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x1700000
shoot_free_suite(suite); suite = 0; chunk = 0;
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x205a8c
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x205a60
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x205a40
[Pass] bar => '*****hjkl;'
bzero32(bar + 5, 5)
[Pass] bar => '****'
EngDrvOut(LCD_Palette[0], 0x1234)
[Pass] shamem_read(LCD_Palette[0]) => 0x1234
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
call("TurnOffDisplay")
[Pass] DISPLAY_IS_ON => 0x0
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
task_create("test", 0x1c, 0x1000, test_task, 0) => 0xdb2e00ea
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[Pass] get_task_name_from_id(current_task->taskId) => 'run_test'
[Pass] task_max => 0x84
[Pass] task_max => 0x84
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0xdb3000ba
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0xdb320088
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0xdb3400fe
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0xf
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[FAIL] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 11366 passed, 24 failed.
.===============================================================================
ML/SCRIPTS/API_TEST.LUA - 2018-2-25 11:18:02
===============================================================================
Strict mode tests...
Strict mode tests passed.
Generic tests...
arg = table:
[0] = "API_TEST.LUA"
camera = table:
shutter = table:
raw = 96
apex = 5.
ms = 31
value = 0.03125
aperture = table:
raw = 24
apex = 2.
value = 2.
min = table:
raw = 24
apex = 2.
value = 2.
max = table:
raw = 80
apex = 9.
value = 22.6
iso = table:
raw = 88
apex = 7.
value = 400
ec = table:
raw = 0
value = 0
flash_ec = table:
raw = 0
value = 0
kelvin = 6500
mode = 3
metering_mode = 3
drive_mode = 0
model = "Canon EOS M2"
model_short = "EOSM2"
firmware = "1.0.3"
temperature = 211
gui = table:
menu = false
play = false
play_photo = false
play_movie = false
qr = false
idle = false
bulb = function: p
reboot = function: p
burst = function: p
wait = function: p
shoot = function: p
event = table:
pre_shoot = nil
post_shoot = nil
shoot_task = nil
seconds_clock = nil
keypress = nil
custom_picture_taking = nil
intervalometer = nil
config_save = nil
console = table:
hide = function: p
show = function: p
clear = function: p
write = function: p
lv = table:
enabled = true
paused = false
running = true
zoom = 1
overlays = false
pause = function: p
start = function: p
resume = function: p
info = function: p
wait = function: p
stop = function: p
lens = table:
name = "EF-M22mm f/2 STM"
focal_length = 22
focus_distance = 210
hyperfocal = 12780
dof_near = 207
dof_far = 212
af = true
af_mode = 0
focus = function: p
autofocus = function: p
display = table:
idle = nil
height = 480
width = 720
circle = function: p
rect = function: p
screenshot = function: p
notify_box = function: p
off = function: p
draw = function: p
line = function: p
print = function: p
on = function: p
pixel = function: p
clear = function: p
load = function: p
key = table:
last = 10
press = function: p
wait = function: p
menu = table:
visible = false
new = function: p
close = function: p
set = function: p
block = function: p
select = function: p
open = function: p
get = function: p
movie = table:
recording = false
start = function: p
stop = function: p
dryos = table:
clock = 76
ms_clock = 76256
image_prefix = "IMG_"
dcim_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
config_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "ML/"
path = "ML/SETTINGS/"
ml_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7263
folder_number = 100
free_space = 31064288
type = "SD"
path = "B:/"
_card_ptr = userdata
shooting_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7263
folder_number = 100
free_space = 31064288
type = "SD"
path = "B:/"
_card_ptr = userdata
date = table:
wday = 1
day = 25
min = 18
hour = 11
isdst = false
sec = 3
year = 2018
yday = 56
month = 2
rename = function: p
directory = function: p
call = function: p
remove = function: p
interval = table:
time = 10
count = 0
running = false
stop = function: p
battery = table:
function not available on this camera
stack traceback:
[C]: in ?
[C]: in for iterator 'for iterator'
ML/SCRIPTS/LIB/logger.lua:125: in function 'logger.serialize'
ML/SCRIPTS/API_TEST.LUA:36: in function <ML/SCRIPTS/API_TEST.LUA:35>
[C]: in function 'xpcall'
ML/SCRIPTS/API_TEST.LUA:35: in function 'print_table'
ML/SCRIPTS/API_TEST.LUA:81: in function 'generic_tests'
ML/SCRIPTS/API_TEST.LUA:1338: in function 'api_tests'
ML/SCRIPTS/API_TEST.LUA:1364: in main chunktask = table:
yield = function: p
create = function: p
property = table:
Generic tests completed.
Module tests...
Testing file I/O...
Copy test: autoexec.bin -> tmp.bin
Copy test OK
Append test: tmp.txt
Append test OK
Rename test: apple.txt -> banana.txt
Rename test OK
Rename test: apple.txt -> ML/banana.txt
Rename test OK
File I/O tests completed.
Testing Canon GUI functions...
Enter MENU mode...
Exit MENU mode...
Enter MENU mode...
Enter PLAY mode...
Enter MENU mode...
Exit MENU mode...
Enter MENU mode...
Exit MENU mode...
Pause LiveView...
Enter MENU mode...
Exit MENU mode...
Pause LiveView...
Resume LiveView...
Enter PLAY mode...
Enter MENU mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter MENU mode...
Enter MENU mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Exit PLAY mode...
else if (is_camera("EOSM", "2.0.2"))
{
CMOS_WRITE = 0x2998C;
MEM_CMOS_WRITE = 0xE92D41F0;
ADTG_WRITE = 0x2986C;
MEM_ADTG_WRITE = 0xE92D43F8;
else if (is_camera("EOSM2", "1.0.3"))
{
CMOS_WRITE = 0x432A4;
MEM_CMOS_WRITE = 0xE92D41F0;
ADTG_WRITE = 0x42E34;
MEM_ADTG_WRITE = 0xE51F7224;
[Pass] is_play_mode() => 0x1
[Pass] src = fio_malloc(size) => 0x4de3609c
[Pass] dst = fio_malloc(size) => 0x4e63a0a8
[Pass] memcmp(dst, src, 4097) => 0xffffffd5
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e63a0a8
[Pass] memcmp(dst, src, 4097) => 0x0
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e63a0a8
[Pass] memcmp(dst, src, size) => 0x61
[Pass] edmac_memcpy(dst, src, size) => 0x4e63a0a8
[Pass] memcmp(dst, src, size) => 0x0
[Pass] memcmp(dst, src, size) => 0xffffffee
[Pass] edmac_memcpy_start(dst, src, size) => 0x4e63a0a8
dt => 0x2946
[Pass] copied => 0x400358
[Pass] copied => 0x400358
[Pass] copied => 0x400358
[Pass] memcmp(dst, src, copied) => 0x0
[Pass] memcmp(dst, src, copied + 16) => 0xffffffe1
edmac_memcpy_finish()
free(src)
free(dst)
Cache test A (EDMAC on BMP buffer)...
[Pass] bmp = bmp_load("ML/CROPMKS/CINESCO2.BMP", 1) => 0xaa0708
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x7bf
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x0
Cache test B (FIO on 8K buffer)...
[Pass] tries[0] => 0xe3
[Pass] tries[1] => 0xf5
[Pass] tries[2] => 0x109
[Pass] tries[3] => 0x107
[Pass] failr[0] => 0x44
[Pass] failw[0] => 0x8e
[Pass] failr[1] => 0x41
[Pass] failw[1] => 0x0
[Pass] failr[2] => 0x0
[Pass] failw[2] => 0xaa
[Pass] failr[3] => 0x0
[Pass] failw[3] => 0x0
times[0] / tries[0] => 0x1e
times[1] / tries[1] => 0x1d
times[2] / tries[2] => 0x1e
times[3] / tries[3] => 0x1e
Cache tests finished.
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] f = FIO_CreateFile("test.dat") => 0x5
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
FIO_CloseFile(f)
[Pass] FIO_GetFileSize("test.dat", &size) => 0x0
[Pass] size => 0x20000
[Pass] p = (void*)_alloc_dma_memory(0x20000) => 0x40aa2480
[Pass] f = FIO_OpenFile("test.dat", O_RDONLY | O_SYNC) => 0x5
[Pass] FIO_ReadFile(f, p, 0x20000) => 0x20000
FIO_CloseFile(f)
_free_dma_memory(p)
[Pass] count => 0x3a98
[Pass] buf = fio_malloc(0x1000000) => 0x4de3609c
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000000
[Pass] f = FIO_OpenFile("test.dat", O_RDWR | O_SYNC) => 0x5
[Pass] FIO_SeekSkipFile(f, 0, SEEK_END) => 0x82000000
[Pass] FIO_WriteFile(f, buf, 0x10) => 0x10
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_END) => 0x81fffff0
[Pass] FIO_WriteFile(f, buf, 0x30) => 0x30
[Pass] FIO_SeekSkipFile(f, 0x20, SEEK_SET) => 0x20
[Pass] FIO_SeekSkipFile(f, 0x30, SEEK_CUR) => 0x50
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_CUR) => 0x30
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000020
[Pass] is_file("test.dat") => 0x1
[Pass] FIO_RemoveFile("test.dat") => 0x0
[Pass] is_file("test.dat") => 0x0
[Pass] SetTimerAfter(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x8738
msleep(900)
[Pass] timer_func => 0x0
msleep(200)
[Pass] timer_func => 0x1
[Pass] ABS((timer_time/1000 - t0) - 1000) => 0x2
[Pass] ABS((timer_arg - ta0) - 1000) => 0xa
[Pass] timer = SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x875c
msleep(400)
CancelTimer(timer)
[Pass] timer_func => 0x0
msleep(1500)
[Pass] timer_func => 0x0
[Pass] SetHPTimerAfterNow(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetHPTimerAfterNow(100000, timer_cbr, overrun_cbr, 0) => 0x31aae
msleep(90)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 100000) => 0x117
[Pass] ABS(DeltaT(timer_arg, ta0) - 100000) => 0xf9
[Pass] ABS((get_us_clock() - t0) - 110000) => 0x29e
[Pass] SetHPTimerAfterNow(90000, next_tick_cbr, overrun_cbr, 0) => 0x31ab0
msleep(80)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x3
msleep(80)
[Pass] timer_func => 0x3
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 300000) => 0x32d
[Pass] ABS(DeltaT(timer_arg, ta0) - 300000) => 0x312
[Pass] ABS((get_us_clock() - t0) - 310000) => 0x285
t0 = GET_DIGIC_TIMER() => 0xd4406
msleep(250)
t1 = GET_DIGIC_TIMER() => 0x106ac
[Pass] ABS(MOD(t1-t0, 1048576)/1000 - 250) => 0x4
LoadCalendarFromRTC( &now )
s0 = now.tm_sec => 0xa
Date/time: 2018/02/27 02:57:10
msleep(1500)
LoadCalendarFromRTC( &now )
s1 = now.tm_sec => 0xb
[Pass] MOD(s1-s0, 60) => 0x1
[Pass] MOD(s1-s0, 60) => 0x1
m0 = MALLOC_FREE_MEMORY => 0x602f8
[Pass] p = (void*)_malloc(50*1024) => 0x11e798
[Pass] CACHEABLE(p) => 0x11e798
m1 = MALLOC_FREE_MEMORY => 0x53ae8
_free(p)
m2 = MALLOC_FREE_MEMORY => 0x602f8
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m0 = GetFreeMemForAllocateMemory() => 0x1edb64
[Pass] p = (void*)_AllocateMemory(128*1024) => 0xaa2440
[Pass] CACHEABLE(p) => 0xaa2440
m1 = GetFreeMemForAllocateMemory() => 0x1cdb58
_FreeMemory(p)
m2 = GetFreeMemForAllocateMemory() => 0x1edb64
[Pass] ABS((m0-m1) - 128*1024) => 0xc
[Pass] ABS(m0-m2) => 0x0
m01 = MALLOC_FREE_MEMORY => 0x602f8
m02 = GetFreeMemForAllocateMemory() => 0x1edb64
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40aa2480
[Pass] UNCACHEABLE(p) => 0x40aa2480
[Pass] CACHEABLE(p) => 0xaa2480
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40aa2480
_free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4de3608c
[Pass] UNCACHEABLE(p) => 0x4de3608c
_shoot_free(p)
m11 = MALLOC_FREE_MEMORY => 0x602f8
m12 = GetFreeMemForAllocateMemory() => 0x1edb64
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0x11e798
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x11e7c0
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de36088
[Pass] UNCACHEABLE(p) => 0x4de36088
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0x117380
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1498000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1173a8
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1498000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
largest_shoot_block = suite->size => 0x1498000
[INFO] largest_shoot_block: 21MB
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0x117380
[Pass] suite->signature => 'MemSuite'
[FAIL] suite->num_chunks => 0x1
[Pass] suite->size => 0x1598000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1173a8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1598000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x1598000
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0x117380
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x3
[Pass] suite->size => 0x1700000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x1173a8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x15b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x1173e0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x169c000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4ae00064
[Pass] UNCACHEABLE(p) => 0x4ae00064
chunk = GetNextMemoryChunk(suite, chunk) => 0x117418
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1700000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x45f240e4
[Pass] UNCACHEABLE(p) => 0x45f240e4
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x1700000
shoot_free_suite(suite); suite = 0; chunk = 0;
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x233714
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x2336e0
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x2336c0
[Pass] bar => '*****hjkl;'
bzero32(bar + 5, 5)
[Pass] bar => '****'
EngDrvOut(LCD_Palette[0], 0x1234)
[Pass] shamem_read(LCD_Palette[0]) => 0x1234
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
call("TurnOffDisplay")
[Pass] DISPLAY_IS_ON => 0x0
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
task_create("test", 0x1c, 0x1000, test_task, 0) => 0xec2400ea
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[Pass] get_task_name_from_id(current_task->taskId) => 'run_test'
[Pass] task_max => 0x84
[Pass] task_max => 0x84
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0xec2600ba
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0xec280252
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0xec2a004c
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0xf
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[FAIL] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 11346 passed, 44 failed.
.[Pass] is_play_mode() => 0x1
[Pass] src = fio_malloc(size) => 0x4de1a084
[Pass] dst = fio_malloc(size) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0x75
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0x0
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0x63
[Pass] edmac_memcpy(dst, src, size) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0x0
[Pass] memcmp(dst, src, size) => 0x3e
[Pass] edmac_memcpy_start(dst, src, size) => 0x4e61e090
dt => 0x294d
[Pass] copied => 0x400470
[Pass] copied => 0x400470
[Pass] copied => 0x400470
[Pass] memcmp(dst, src, copied) => 0x0
[Pass] memcmp(dst, src, copied + 16) => 0x17
edmac_memcpy_finish()
free(src)
free(dst)
Cache test A (EDMAC on BMP buffer)...
[Pass] bmp = bmp_load("ML/CROPMKS/CINESCO2.BMP", 1) => 0x80ea18
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0xa00
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x0
Cache test B (FIO on 8K buffer)...
[Pass] tries[0] => 0xfa
[Pass] tries[1] => 0xf9
[Pass] tries[2] => 0xfe
[Pass] tries[3] => 0xf7
[Pass] failr[0] => 0x72
[Pass] failw[0] => 0xe3
[Pass] failr[1] => 0x7b
[Pass] failw[1] => 0x0
[Pass] failr[2] => 0x0
[Pass] failw[2] => 0xe4
[Pass] failr[3] => 0x0
[Pass] failw[3] => 0x0
times[0] / tries[0] => 0x1d
times[1] / tries[1] => 0x1d
times[2] / tries[2] => 0x1e
times[3] / tries[3] => 0x1f
Cache tests finished.
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] f = FIO_CreateFile("test.dat") => 0x3
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
FIO_CloseFile(f)
[Pass] FIO_GetFileSize("test.dat", &size) => 0x0
[Pass] size => 0x20000
[Pass] p = (void*)_alloc_dma_memory(0x20000) => 0x40863270
[Pass] f = FIO_OpenFile("test.dat", O_RDONLY | O_SYNC) => 0x3
[Pass] FIO_ReadFile(f, p, 0x20000) => 0x20000
FIO_CloseFile(f)
_free_dma_memory(p)
[Pass] count => 0x3a98
[Pass] buf = fio_malloc(0x1000000) => 0x4de1a084
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000000
[Pass] f = FIO_OpenFile("test.dat", O_RDWR | O_SYNC) => 0x3
[Pass] FIO_SeekSkipFile(f, 0, SEEK_END) => 0x82000000
[Pass] FIO_WriteFile(f, buf, 0x10) => 0x10
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_END) => 0x81fffff0
[Pass] FIO_WriteFile(f, buf, 0x30) => 0x30
[Pass] FIO_SeekSkipFile(f, 0x20, SEEK_SET) => 0x20
[Pass] FIO_SeekSkipFile(f, 0x30, SEEK_CUR) => 0x50
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_CUR) => 0x30
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000020
[Pass] is_file("test.dat") => 0x1
[Pass] FIO_RemoveFile("test.dat") => 0x0
[Pass] is_file("test.dat") => 0x0
[Pass] SetTimerAfter(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0xb51e
msleep(900)
[Pass] timer_func => 0x0
msleep(200)
[Pass] timer_func => 0x1
[Pass] ABS((timer_time/1000 - t0) - 1000) => 0xa
[Pass] ABS((timer_arg - ta0) - 1000) => 0x14
[Pass] timer = SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0xb58c
msleep(400)
CancelTimer(timer)
[Pass] timer_func => 0x0
msleep(1500)
[Pass] timer_func => 0x0
[Pass] SetHPTimerAfterNow(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetHPTimerAfterNow(100000, timer_cbr, overrun_cbr, 0) => 0x32238
msleep(90)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 100000) => 0x111
[Pass] ABS(DeltaT(timer_arg, ta0) - 100000) => 0xf0
[Pass] ABS((get_us_clock() - t0) - 110000) => 0xffffffd7
[Pass] SetHPTimerAfterNow(90000, next_tick_cbr, overrun_cbr, 0) => 0x3223a
msleep(80)
[Pass] timer_func => 0x0
msleep(20)
[Pass] timer_func => 0x3
msleep(80)
[Pass] timer_func => 0x3
msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 300000) => 0x76
[Pass] ABS(DeltaT(timer_arg, ta0) - 300000) => 0x55
[Pass] ABS((get_us_clock() - t0) - 310000) => 0xffffffc0
t0 = GET_DIGIC_TIMER() => 0xf5496
msleep(250)
t1 = GET_DIGIC_TIMER() => 0x31cfe
[Pass] ABS(MOD(t1-t0, 1048576)/1000 - 250) => 0x3
LoadCalendarFromRTC( &now )
s0 = now.tm_sec => 0x1f
Date/time: 2018/02/27 14:09:31
msleep(1500)
LoadCalendarFromRTC( &now )
s1 = now.tm_sec => 0x20
[Pass] MOD(s1-s0, 60) => 0x1
[Pass] MOD(s1-s0, 60) => 0x1
m0 = MALLOC_FREE_MEMORY => 0x38a18
[Pass] p = (void*)_malloc(50*1024) => 0x136e30
[Pass] CACHEABLE(p) => 0x136e30
m1 = MALLOC_FREE_MEMORY => 0x2c208
_free(p)
m2 = MALLOC_FREE_MEMORY => 0x38a18
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m0 = GetFreeMemForAllocateMemory() => 0x335284
[Pass] p = (void*)_AllocateMemory(128*1024) => 0x863230
[Pass] CACHEABLE(p) => 0x863230
m1 = GetFreeMemForAllocateMemory() => 0x315278
_FreeMemory(p)
m2 = GetFreeMemForAllocateMemory() => 0x335284
[Pass] ABS((m0-m1) - 128*1024) => 0xc
[Pass] ABS(m0-m2) => 0x0
m01 = MALLOC_FREE_MEMORY => 0x38a18
m02 = GetFreeMemForAllocateMemory() => 0x335284
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40863270
[Pass] UNCACHEABLE(p) => 0x40863270
[Pass] CACHEABLE(p) => 0x863270
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40863270
_free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4de1a074
[Pass] UNCACHEABLE(p) => 0x4de1a074
_shoot_free(p)
m11 = MALLOC_FREE_MEMORY => 0x38a18
m12 = GetFreeMemForAllocateMemory() => 0x335284
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0x130648
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x130670
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0x130648
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x12b4000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x130670
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x12b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
largest_shoot_block = suite->size => 0x12b4000
[INFO] largest_shoot_block: 19MB
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0x130648
[Pass] suite->signature => 'MemSuite'
[FAIL] suite->num_chunks => 0x1
[Pass] suite->size => 0x13b4000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x130670
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x13b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x13b4000
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0x130648
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x3
[Pass] suite->size => 0x1700000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x130670
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x13b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
chunk = GetNextMemoryChunk(suite, chunk) => 0x136e58
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x149c000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4ae00064
[Pass] UNCACHEABLE(p) => 0x4ae00064
chunk = GetNextMemoryChunk(suite, chunk) => 0x136e90
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1700000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x419ff0a4
[Pass] UNCACHEABLE(p) => 0x419ff0a4
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x1700000
shoot_free_suite(suite); suite = 0; chunk = 0;
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[FAIL] suite->num_chunks => 0x1
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x213d3c
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x213d20
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x213d00
[Pass] bar => '*****hjkl;'
bzero32(bar + 5, 5)
[Pass] bar => '****'
EngDrvOut(LCD_Palette[0], 0x1234)
[Pass] shamem_read(LCD_Palette[0]) => 0x1234
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
call("TurnOffDisplay")
[Pass] DISPLAY_IS_ON => 0x0
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
task_create("test", 0x1c, 0x1000, test_task, 0) => 0xe96800ca
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[Pass] get_task_name_from_id(current_task->taskId) => 'run_test'
[Pass] task_max => 0x68
[Pass] task_max => 0x68
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0xe96a00b6
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0xe96c0200
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0xe96e00c8
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0xf
SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[Pass] MENU_MODE => 0x1
[Pass] PLAY_MODE => 0x0
[Pass] dialog->type => 'DIALOG'
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 11349 passed, 41 failed.
.===============================================================================
ML/SCRIPTS/API_TEST.LUA - 2018-2-27 03:16:50
===============================================================================
Strict mode tests...
Strict mode tests passed.
Generic tests...
arg = table:
[0] = "API_TEST.LUA"
camera = table:
shutter = table:
raw = 104
apex = 6.
ms = 16
value = 0.015625
aperture = table:
raw = 24
apex = 2.
value = 2.
min = table:
raw = 24
apex = 2.
value = 2.
max = table:
raw = 80
apex = 9.
value = 22.6
iso = table:
raw = 72
apex = 5.
value = 100
ec = table:
raw = 0
value = 0
flash_ec = table:
raw = 0
value = 0
kelvin = 3200
mode = 20
metering_mode = 5
drive_mode = 0
model = "Canon EOS M2"
model_short = "EOSM2"
firmware = "1.0.3"
temperature = 208
gui = table:
menu = false
play = false
play_photo = false
play_movie = false
qr = false
idle = false
reboot = function: p
bulb = function: p
burst = function: p
shoot = function: p
wait = function: p
event = table:
pre_shoot = nil
post_shoot = nil
shoot_task = nil
seconds_clock = nil
keypress = nil
custom_picture_taking = nil
intervalometer = nil
config_save = nil
console = table:
write = function: p
show = function: p
clear = function: p
hide = function: p
lv = table:
enabled = true
paused = false
running = true
zoom = 1
overlays = false
resume = function: p
start = function: p
pause = function: p
info = function: p
stop = function: p
wait = function: p
lens = table:
name = "EF-M22mm f/2 STM"
focal_length = 22
focus_distance = 655350
hyperfocal = 12780
dof_near = 12537
dof_far = 1000000
af = true
af_mode = 0
autofocus = function: p
focus = function: p
display = table:
idle = nil
height = 480
width = 720
on = function: p
screenshot = function: p
print = function: p
load = function: p
pixel = function: p
clear = function: p
notify_box = function: p
line = function: p
rect = function: p
draw = function: p
circle = function: p
off = function: p
key = table:
last = 10
press = function: p
wait = function: p
menu = table:
visible = false
set = function: p
block = function: p
new = function: p
close = function: p
open = function: p
select = function: p
get = function: p
movie = table:
recording = false
stop = function: p
start = function: p
dryos = table:
clock = 19
ms_clock = 19541
image_prefix = "IMG_"
dcim_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
config_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "ML/"
path = "ML/SETTINGS/"
ml_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7274
folder_number = 100
free_space = 30936992
type = "SD"
path = "B:/"
_card_ptr = userdata
shooting_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 7274
folder_number = 100
free_space = 30936992
type = "SD"
path = "B:/"
_card_ptr = userdata
date = table:
year = 2018
sec = 51
min = 16
wday = 3
month = 2
isdst = false
hour = 3
yday = 58
day = 27
rename = function: p
remove = function: p
directory = function: p
call = function: p
interval = table:
time = 10
count = 0
running = false
stop = function: p
battery = table:
function not available on this camera
stack traceback:
[C]: in ?
[C]: in for iterator 'for iterator'
ML/SCRIPTS/LIB/logger.lua:125: in function 'logger.serialize'
ML/SCRIPTS/API_TEST.LUA:36: in function <ML/SCRIPTS/API_TEST.LUA:35>
[C]: in function 'xpcall'
ML/SCRIPTS/API_TEST.LUA:35: in function 'print_table'
ML/SCRIPTS/API_TEST.LUA:81: in function 'generic_tests'
ML/SCRIPTS/API_TEST.LUA:1338: in function 'api_tests'
ML/SCRIPTS/API_TEST.LUA:1364: in main chunktask = table:
yield = function: p
create = function: p
property = table:
Generic tests completed.
Module tests...
Testing file I/O...
Copy test: autoexec.bin -> tmp.bin
Copy test OK
Append test: tmp.txt
Append test OK
Rename test: apple.txt -> banana.txt
Rename test OK
Rename test: apple.txt -> ML/banana.txt
Rename test OK
File I/O tests completed.
Testing Canon GUI functions...
Enter MENU mode...
Enter PLAY mode...
Enter MENU mode...
Enter MENU mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Enter PLAY mode...
Exit PLAY mode...
===============================================================================
ML/SCRIPTS/API_TEST.LUA - 2018-2-27 14:22:39
===============================================================================
Strict mode tests...
Strict mode tests passed.
Generic tests...
arg = table:
[0] = "API_TEST.LUA"
camera = table:
shutter = table:
raw = 104
apex = 6.
ms = 16
value = 0.015625
aperture = table:
raw = 24
apex = 2.
value = 2.
min = table:
raw = 24
apex = 2.
value = 2.
max = table:
raw = 80
apex = 9.
value = 22.6
iso = table:
raw = 72
apex = 5.
value = 100
ec = table:
raw = 0
value = 0
flash_ec = table:
raw = 0
value = 0
kelvin = 6500
mode = 20
metering_mode = 5
drive_mode = 0
model = "Canon EOS M"
model_short = "EOSM"
firmware = "2.0.2"
temperature = 218
gui = table:
menu = false
play = false
play_photo = false
play_movie = false
qr = false
idle = true
wait = function: p
bulb = function: p
burst = function: p
shoot = function: p
reboot = function: p
event = table:
pre_shoot = nil
post_shoot = nil
shoot_task = nil
seconds_clock = nil
keypress = nil
custom_picture_taking = nil
intervalometer = nil
config_save = nil
console = table:
write = function: p
show = function: p
clear = function: p
hide = function: p
lv = table:
enabled = true
paused = false
running = true
zoom = 1
overlays = 2
pause = function: p
stop = function: p
info = function: p
resume = function: p
wait = function: p
start = function: p
lens = table:
name = "EF-M22mm f/2 STM"
focal_length = 22
focus_distance = 320
hyperfocal = 12780
dof_near = 314
dof_far = 326
af = true
af_mode = 0
focus = function: p
autofocus = function: p
display = table:
idle = nil
height = 480
width = 720
pixel = function: p
rect = function: p
clear = function: p
on = function: p
draw = function: p
off = function: p
print = function: p
circle = function: p
screenshot = function: p
line = function: p
load = function: p
notify_box = function: p
key = table:
last = 9
press = function: p
wait = function: p
menu = table:
visible = false
block = function: p
get = function: p
new = function: p
select = function: p
set = function: p
close = function: p
open = function: p
movie = table:
recording = false
start = function: p
stop = function: p
dryos = table:
clock = 18
ms_clock = 18171
image_prefix = "IMG_"
dcim_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
config_dir = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = table:
exists = true
create = function: p
children = function: p
files = function: p
parent = nil
path = "B:/"
path = "ML/"
path = "ML/SETTINGS/"
ml_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 5922
folder_number = 100
free_space = 31071520
type = "SD"
path = "B:/"
_card_ptr = userdata
shooting_card = table:
cluster_size = 32768
drive_letter = "B"
file_number = 5922
folder_number = 100
free_space = 31071520
type = "SD"
path = "B:/"
_card_ptr = userdata
date = table:
sec = 41
month = 2
min = 22
year = 2018
hour = 14
day = 27
wday = 3
isdst = false
yday = 58
directory = function: p
remove = function: p
call = function: p
rename = function: p
interval = table:
time = 10
count = 0
running = false
stop = function: p
battery = table:
function not available on this camera
stack traceback:
[C]: in ?
[C]: in for iterator 'for iterator'
ML/SCRIPTS/LIB/logger.lua:125: in function 'logger.serialize'
ML/SCRIPTS/API_TEST.LUA:36: in function <ML/SCRIPTS/API_TEST.LUA:35>
[C]: in function 'globals.xpcall'
ML/SCRIPTS/API_TEST.LUA:35: in function 'globals.print_table'
ML/SCRIPTS/API_TEST.LUA:81: in function 'globals.generic_tests'
ML/SCRIPTS/API_TEST.LUA:1338: in function 'globals.api_tests'
ML/SCRIPTS/API_TEST.LUA:1364: in main chunktask = table:
create = function: p
yield = function: p
property = table:
Generic tests completed.
Module tests...
Testing file I/O...
Copy test: autoexec.bin -> tmp.bin
Copy test OK
Append test: tmp.txt
Append test OK
Rename test: apple.txt -> banana.txt
Rename test OK
Rename test: apple.txt -> ML/banana.txt
Rename test OK
File I/O tests completed.
Testing Canon GUI functions...
Pause LiveView...
Resume LiveView...
Enter MENU mode...
Enter PLAY mode...
Exit PLAY mode...
# Making sure you are in the directory where you want to install the repository--
# This will install my repository in one named magic-lantern-dfort so it doesn't clobber
# magic-lantern repository you may already have:
hg clone https://bitbucket.org/daniel_fort/magic-lantern magic-lantern-dfort
# Now let's get to the EOSM2 branch and compile it
cd magic-lantern-dfort
hg update EOSM2.103_crop_rec_4k_wip
cd platform/EOSM2.103/
make
# All good? If you have a card reader you can install directly to the SD card like this:
make install
# If you want to make a zip file just like on the nightly downloads do this
make zip
# The file will be named magiclantern-Nightly with the date and camera information in the filename
# Once you are done clean up your mess
make cleanhg pull
hg updateI can't wait for more progress here either.
There has been no progress because I can't figure out how to track down the current issues. It is working quite well in QEMU but it crashes when shooting pictures or video. However, silent stills sort of works. In any case, I hesitantly just posted a test build of the crop_rec_4k branch which is the one that is almost working.
https://bitbucket.org/daniel_fort/magic-lantern/downloads/
BTW--Still welcoming anyone with an M2 willing to set up a development platform and help search for the last few pieces of the puzzle.
Here's hoping for some progress soon.
Hi guys. What is the current status of the port?
Is raw recording working as well?Well, mlv_lite creates an .MLV file but you get the the following assert
ML ASSERT:
0
at mlv_lite.c:2697 (compress_task), task compress_task
lv:1 mode:0
compress_task stack: 216b88 [216c18-215c18]
0x0044C9B0 @ af2fc8:216bb8
0x0044C478 @ 44ca0c:216b88
Magic Lantern version : Nightly.2018Dec07.EOSM2103
Mercurial changeset : 061afdbde1ad+ (crop_rec_4k_mlv_snd_isogain_1x3_presets) tip
Built on 2018-12-07 09:42:05 UTC by [email protected]
Free Memory : 383K + 1846K
I would be so happy to just get focus peaking. I have a lot of old M42 mount lenses and they are hard to focus quickly on the screen. can't wait for a bit more progress here! Thanks again!You should test the latest build Critix published today. Focus peaking seems stable to me.
/* only report compression errors while recording
* some of them appear during video mode switches
* unlikely to cause actual trouble - silence them for now */
if (compressed_size < 0 && !RAW_IS_IDLE)
{
printf("Compression error %d at frame %d\n", compressed_size, frame_count-1);
ASSERT(0);
}Have you tried other compression settings? Maybe uncompressed 14-bit? See if you get a different assert log.You are right dfort. I did not check the default settings, just kicked on mlv_lite to see what would happen.
Also, I noticed that in C2 I can not enter the settings menu, because when I hold the trash button, the Canon ISO selection comes up.Go to Canon Menu C.FnIV Operation/Others (6) "Trash Can button" and change your setting from 2:ISO speed to 0:Normal
Yes @JohanJ! I had that setting and confirm that it works also in C2 now. I think I will keep the custom setting to quickly select the ISO, otherwise I'll need to browse in the menus...Right. That comment was helpful! My first thought was that you are probaly not shooting stills in RAW format. Maybe you do. But the freezing has to do with RAW parameters for certain ML overlays!
MODULE_CBR(CBR_SHOOT_TASK, raw_rec_polling_cbr, 0)Not sure where that leads into(shoot.c) and maybe more places but if I comment out the module mlv_lite won´t freeze when starting RAW video. Then again that is probably because resolution stays at 0x0 so what´s there to freeze. However by sharing this information maybe we can continue trace where raw video is failing? A1ex might have a suggestion or two about what is going on here hopefully. Write channel issues? MODULE_CONFIG(resolution_index_x)and manage to record in 10bit. Probably works with 12 and 14bit too. Lossless giving corrupted files and freezed screen. Screen freezes more less always when recording raw.Block: RAWI
...
Res: 1736x584
raw_info:
api_version 0x00000001
height 727
width 1808
...
Block: RAWC
...
raw_capture_info:
sensor res 5184x3456
sensor crop 1.62 (APS-C)
sampling 5x3 (read 1 line, skip 4, bin 3 columns)
Block: IDNT
...
Camera Name: 'Canon EOS M2'
...
Camera Model: 0x80000355
Question. Are recording in mv1080p already, reason for freezes? Sure looks like it.
ML ASSERT:
0
at ../../src/raw.c:669 (raw_lv_realloc_buffer), task shoot_task
lv:1 mode:3
shoot_task stack: 213a30 [213c08-211c08]
0x00496BA8 @ 4771f8:213ba0
0xUNKNOWN @ 496bfc:213b88
0x00B03948 @ b05194:213b18
0x0048CFA4 @ b03998:213b08
0x0048CF64 @ 48cfa8:213af0
0x0048C598 @ 48cf7c:213ae0
0x0048A3F0 @ 48c638:213a80
0x0044C8CC @ 48a54c:213a60
0x0044C478 @ 44c928:213a30
Magic Lantern version : Nightly.2018Dec12.EOSM2103
Mercurial changeset : 88eba9bdb6c8+ (EOSM2.103_crop_rec_4k_wip)
Built on 2018-12-12 14:55:58 UTC by [email protected]
Free Memory : 379K + 1867KML ASSERT:
0
at mlv_lite.c:2697 (compress_task), task compress_task
lv:1 mode:3
compress_task stack: 216b88 [216c18-215c18]
0x0044C8CC @ b0a698:216bb8
0x0044C478 @ 44c928:216b88
Magic Lantern version : Nightly.2018Dec12.EOSM2103
Mercurial changeset : 88eba9bdb6c8+ (EOSM2.103_crop_rec_4k_wip)
Built on 2018-12-12 14:55:58 UTC by [email protected]
Free Memory : 379K + 1930K
Right. That comment was helpful! My first thought was that you are probaly not shooting stills in RAW format. Maybe you do. But the freezing has to do with RAW parameters for certain ML overlays!
EOSM2.103_dm-spy-experiments 18168:e8396696980f
EOSM2.103_io_trace 18167:d5a0e069c803
EOSM2.103_io_trace_full 18166:4a41ee21b185
NotifyBox(5000, "shamem_read(0xC0F07150) 0x%x", shamem_read(0xC0F07150));static inline uint32_t reg_override_3x3_eosm2(uint32_t reg, uint32_t old_val)
{
switch (reg)
{
case 0xC0F06804: return 0x4a601d4;
case 0xC0F37014: return 0xe;
case 0xC0F0713c: return 0x4a7;
case 0xC0F07150: return 0x475;
}
return 0;
} case CROP_PRESET_3x3_mv1080_EOSM2:
adtg_new[0] = (struct adtg_new) {6, 0x800C, 2};
break;Do we have the correct raw buffer for lossless?
if (is_camera("700D", "*") || is_camera("650D", "*") || is_camera("EOSM", "*") || is_camera("EOSM2", "*") || is_camera("100D", "*"))
{
uint32_t resources[] = {
0x00000 | edmac_channel_to_index(edmac_write_chan),
0x10000 | edmac_channel_to_index(edmac_read_chan),
0x20005,
0x20016,
0x30002,
0x50034,
0x5002d,
0x50010,
0x90001,
0x90000,
0xa0000,
0x160000,
0x260000,
0x260001,
0x260002,
0x260003,
};
TTL_ResLock = CreateResLockEntry(resources, COUNT(resources));
}
else if (is_camera("5D3", "*") || is_camera("6D", "*") || is_camera("70D", "*"))
{
uint32_t resources[] = {
0x00000 | edmac_channel_to_index(edmac_write_chan),
0x10000 | edmac_channel_to_index(edmac_read_chan),
0x30001, /* Read connection 1 (uncompressed input) */
0x2002d, /* Write connection 45 (compressed output) */
//0x20016, /* Write connection 22 (for WR2 - not used) */
0x50034,
0x5002d,
0x50010,
0x90001,
0x230000,
0x160000,
0x260000,
0x260001,
0x260002,
0x260003,
};
#ifdef CONFIG_EOSM2
#define DEFAULT_RAW_BUFFER MEM(0x91CF0 + 0x78)
#define DEFAULT_RAW_BUFFER_SIZE (0x48C00000 - 0x48798100)
#endif#ifdef CONFIG_EDMAC_RAW_SLURP
void FAST raw_lv_vsync()
{
/* where should we save the raw data? */
void* buf = redirected_raw_buffer ? redirected_raw_buffer : raw_get_default_lv_buffer();
if (buf && lv_raw_enabled)
{
/* this needs to be set for every single frame */
EngDrvOut(RAW_TYPE_REGISTER, lv_raw_type);
if (lv_raw_gain)
{
/* optional - adjust digital gain */
/* fixme: hardcoded for 5D3 */
EngDrvOut(RAW_TYPE_REGISTER, 0x12);
EngDrvOut(SHAD_GAIN_REGISTER, lv_raw_gain);
}
/* pull the raw data into "buf" */
int width, height;
int ok = raw_lv_get_resolution(&width, &height);
if (ok)
{
int pitch = width * raw_info.bits_per_pixel / 8;
if (raw_lv_buffer_size >= pitch * height)
{
edmac_raw_slurp(CACHEABLE(buf), pitch, height);
}
}
}
/* overriding the buffer is only valid for one frame */
redirected_raw_buffer = 0;
}/* uncommenting keeps EOSM2 liveview from freezing */
/* pull the raw data into "buf" */
int width, height;
/* int ok = raw_lv_get_resolution(&width, &height); */
/* if (ok) */
/* { */
int pitch = width * raw_info.bits_per_pixel / 8;
/* if (raw_lv_buffer_size >= pitch * height) */
/* { */
/* edmac_raw_slurp(CACHEABLE(buf), pitch, height); */
/* } */
/* } */
}#ifdef CONFIG_EDMAC_RAW_SLURP
void FAST raw_lv_vsync()
{
/* where should we save the raw data? */
void* buf = redirected_raw_buffer ? redirected_raw_buffer : raw_get_default_lv_buffer();
if (buf && lv_raw_enabled)
{
/* this needs to be set for every single frame */
EngDrvOut(RAW_TYPE_REGISTER, lv_raw_type);
if (lv_raw_gain)
{
/* optional - adjust digital gain */
/* fixme: hardcoded for 5D3 */
EngDrvOut(RAW_TYPE_REGISTER, 0x12);
EngDrvOut(SHAD_GAIN_REGISTER, lv_raw_gain);
}
/* uncommenting keeps EOSM2 liveview from freezing */
/* pull the raw data into "buf" */
int width, height;
/* int ok = raw_lv_get_resolution(&width, &height); */
/* if (ok) */
/* { */
int pitch = width * raw_info.bits_per_pixel / 8;
/* if (raw_lv_buffer_size >= pitch * height) */
/* { */
/* edmac_raw_slurp(CACHEABLE(buf), pitch, height); */
/* } */
/* } */
}
/* overriding the buffer is only valid for one frame */
redirected_raw_buffer = 0;
}
/* integer gain used to fix the image darkening caused by lv_raw_gain */
/* this gain must not (!) change the raw data */
int _raw_lv_get_iso_post_gain()
{
if (lv_raw_gain)
{
return 4096 / lv_raw_gain;
}
return 1;
}
}It sometimes has to be updated by pressing canon menu back and forth but it works recording 10bit, 12bit, 14bit files. Lossless is still an issue and so are certain registers from crop_rec which aren´t applied.#ifdef CONFIG_EOSM2
#define DEFAULT_RAW_BUFFER MEM(0x91CF0 + 0x78)
#define DEFAULT_RAW_BUFFER_SIZE (0x48C00000 - 0x48798100)
#endif
void edmac_raw_slurp(void* dst, int w, int h)
{
/* see wiki, register map, EDMAC what the flags mean. they are for setting up copy block size */
#if defined(CONFIG_650D) || defined(CONFIG_700D) || defined(CONFIG_EOSM2) || defined(CONFIG_EOSM) || defined(CONFIG_100D)
uint32_t dmaFlags = EDMAC_2_BYTES_PER_TRANSFER;
#elif defined(CONFIG_6D)
uint32_t dmaFlags = EDMAC_4_BYTES_PER_TRANSFER;
#else
uint32_t dmaFlags = EDMAC_8_BYTES_PER_TRANSFER;
#endif {
/* copy 2 byte per transfer */
data.dmaFlags = 0x20000000;
/* read from YUV connection */
data.dmaSourceConn = 0x1B;
/* no special treatment, save the exact size */
save_data.frameSize = save_data.frameSizeReal;
save_data.bottomDrop = 0;
}About these do not know what to say :Code: [Select]#define DEFAULT_RAW_BUFFER_SIZE (0x48C00000 - 0x48798100)
EOSM2: 48798100 - 48CC40C4
// Started out by using the one found value (0x4f3d7800)for all three as a workaround
// then adding 0x410000 to determine the other two.
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_LV_BUFFER_1 0x4F3D7800
#define YUV422_LV_BUFFER_2 0x4F7E7800
#define YUV422_LV_BUFFER_3 0x4FBF7800
// http://magiclantern.wikia.com/wiki/VRAM_ADDR_from_code
// stateobj_disp[1]
#define YUV422_LV_BUFFER_DISPLAY_ADDR (*(uint32_t*)(0x90494+0x12C))
#define REG_EDMAC_WRITE_LV_ADDR 0xC0F04208 // SDRAM address of LV buffer (aka VRAM)
#define REG_EDMAC_WRITE_HD_ADDR 0xC0F04108 // SDRAM address of HD buffer (aka YUV)
#define YUV422_HD_BUFFER_DMA_ADDR (shamem_read(REG_EDMAC_WRITE_HD_ADDR)) // first line from DMA is dummy
// http://magiclantern.wikia.com/wiki/ASM_Zedbra
// skipped for now, will come up with a way to autodetect these values
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_HD_BUFFER_1 0x44000080
#define YUV422_HD_BUFFER_2 0x46000080EOS M2, QEMU:
...Code: [Select]1160: 48852.480 [RSC] YUV 0x4AEEA000 0x0222C000 35831808
1161: 48852.480 [RSC] YUV_OUT 0x42000000 0x0222C000 35831808
When taking pictures in RAW, I get "RAW error, falling back to YUV overlays" message, but pictures are saved.
If I switch to JPG shooting, this message does not appear.
General comment: to enable overlays I need to enter and exit Canon menu after leaving ML menus.
...
Many overlays work in LiveView in video mode, while in C2 mode I only see these overlays in QuickReview, even if "Global draw" in settings shows "ON, all modes".
Magic zoom
Flickers with all the settings combinations I tested. This happens both in video mode and C2 mode.
#elif defined(CONFIG_EOSM2) // using EOSM values for now
#define TG_FREQ_BASE 32000000
#define FPS_TIMER_A_MIN (ZOOM ? 716 : MV1080CROP ? 532 : 520)
#undef FPS_TIMER_B_MIN
#define FPS_TIMER_B_MIN ( \
RECORDING_H264 ? (MV1080CROP ? 1750 : MV720 ? 990 : 1970) \
: (ZOOM || MV1080CROP ? 1336 : 1970))
#if defined(CONFIG_EOSM) || defined(CONFIG_EOSM2)
if (!RECORDING_H264) return 0; /* EOS-M is stubborn, http://www.magiclantern.fm/forum/index.php?topic=5200.msg104816#msg104816 */
#endif
That's a good hint, I have also seen that on the EOSM2 and other cameras. Turn global draw off and shoot a CR2, does that still bring up the message? Have you tried shooting silent stills? That's where it was showing up when I reported it on the 5D3.113 crop_rec_4k branch (https://www.magiclantern.fm/forum/index.php?topic=18443.msg188744#msg188744).
I tried the silent stills module (both in DNG and MLV): whit half shutter is pressed, LV shows a "Preparing..." message, but stops there and no file is saved on the card.
Next on my list:
1. fps override - let's fix this first so nightly builds will work again. Dunno if anyone has played with overcranking on other builds, but the EOSM shoots up to 45fps 1080p (crop mode, h264, low-light method) it's pretty awesome. So let's get that back working again.
2. magic zoom is useless in crop mode, we need to slow it down to stop the flicker, - this is lower on my list of priorities since I can navigate with my external monitor attached now...
We have 3 ways to proceed:
1) hardcode the resolutions (and get bitten by this Canon bug in other parts of the code)
2) reallocate this buffer from somewhere else (where?)
3) patch ENGIO routines to use ADD instead of ORR, to make them able to work on unaligned buffers
I'd try the last route first.
EOSM2: 48798100 - 48CC40C4
using MD 58 1.4 lens
The temperature is rising fast and I wonder it can be solved or not.
I hope that next vision will fix the high power consumption.
New functions such as digital interpolation zoom and trap focus are expected.
Found the problem. The EOSM2 uses lens properties like the other Digic 5 cameras while the EOSM uses a different set of lens properties. Let's see if the December 20 build that is on my Bitbucket downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/) is any better.I can confirm that lens focal information works perfectly with the new December 20 build! I will continue testing with this build (let's call it D) and will post results asap.
Locking cache
Lens moving (1561, 0)
Scanning modules...
Load modules ...
[i] Load: dual_iso.mo
Linking ..
tcc: error: undefined symbol 'mlv_set_type'
[E] failed to link modules
updating Movie Tweaks -> Movie Logging
updating Movie Tweaks -> Time indicator
else if (is_camera("EOSM2", "1.0.3")) // WIP found movie mode but photo mode is taken from EOSM
CRASHLOG0.LOG
ASSERT: 0
at ./LvCommon/LvGainController.c:893, Evf:17bd0
lv:1 mode:3
Evf stack: 1be758 [1be8a0-1bdca0]
0xUNKNOWN @ ca14:1be898
0xUNKNOWN @ 36684:1be870
0x0003637C @ ff0d6258:1be858
0xUNKNOWN @ 363ac:1be848
0xUNKNOWN @ 478e00:1be820
0xUNKNOWN @ 36434:1be800
0x00017B84 @ 1363c:1be798
0x00001900 @ 17bcc:1be790
0x0044C478 @ 44c57c:1be758
Magic Lantern version : Nightly.2018Dec21.EOSM2103
Mercurial changeset : 577a7023a9f9 (crop_rec_4k_mlv_snd_isogain_1x3_presets_EOSM2) tip
Built on 2018-12-22 01:17:20 UTC by [email protected]
Free Memory : 384K + 1911K
CRASHLOG1.LOG
ASSERT: !IS_ERROR( TryPostEvent( this->hTaskClass, this, EV_READOUTDONE_INTERRUPT_EVF, NULL, 0 ) )
at ./Evf/EvfState.c:520, **INT-D9h**:11bdc
lv:1 mode:3
debug_task stack: 2abfb0 [20fbd8-20dbd8]
0x0044C478 @ 44c57c:2abfb0
CRASHLOG2.LOG = CRASHLOG3.LOG = CRASHLOG4.LOG
ASSERT: !IS_ERROR( TryPostEvent( this->hTaskClass, this, EV_SETPARAM_INTERRUPT_EVF, NULL, 0 ) )
at ./Evf/EvfState.c:503, **INT-E0h**:11b9c
lv:1 mode:3
debug_task stack: 2abfb0 [20fbd8-20dbd8]
0x0044C478 @ 44c57c:2abfb0
CRASHLOG5.LOG
ASSERT: !IS_ERROR( TryPostEvent( this->hTaskClass, this, EV_VD_INTERRUPT_EVF, NULL, 0 ) )
at ./Evf/EvfState.c:545, **INT-6Ah**:11c40
lv:1 mode:3
debug_task stack: 2abfa0 [20fbd8-20dbd8]
0x0044C478 @ 44c57c:2abfa0
==> Pulled battery!
In order to find the addresses missing in dual_iso (https://www.magiclantern.fm/forum/index.php?topic=7139.msg197146#msg197146) we need to use the iso-research branch. Lucky for us the patch manager was recently merged into iso-research (https://bitbucket.org/hudson/magic-lantern/commits/e86e27cd86397ab975c96b5bc0db9f5c440b5796) so we should be able to use the patches needed for the EOSM2 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg197715#msg197715). Not sure if the LiveView hack Danne posted in Reply #330 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209308#msg209308) is needed. You tell me -- iso-research build posted on my downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/).
ISOless PH err(15)About ISOless errors:
https://www.magiclantern.fm/forum/index.php?topic=7139.msg197139#msg197139
You tell me -- iso-research build posted on my downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/).I ran the iso_research bracket and below put the result from the adtg_gui logs:
Canon EOS M2 1.0.3
00f00000: 803 (was 84b) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f0 Analog ISO (most cameras)
00f00003: f08 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f6 Analog ISO on 6D
00f00004: 2 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f8 ISO-related?
00f00006: 78b ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93fc ISO 50 or timing related: FFF => darker image
00028882: 41c (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8640 ISO ADTG gain (per column, mod 4 or mod 8)
00028884: 41e (was 410) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8644 ISO ADTG gain (per column, mod 4 or mod 8)
00028886: 418 (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8648 ISO ADTG gain (per column, mod 4 or mod 8)
00028888: 41c (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d864c ISO ADTG gain (per column, mod 4 or mod 8)
==================================================================
Canon EOS M2 1.0.3
00f00000: 803 (was 84b) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f0 Analog ISO (most cameras)
00f00003: f08 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f6 Analog ISO on 6D
00f00004: 2 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f8 ISO-related?
00f00006: 78b ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93fc ISO 50 or timing related: FFF => darker image
00028882: 41c (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8640 ISO ADTG gain (per column, mod 4 or mod 8)
00028884: 41e (was 410) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8644 ISO ADTG gain (per column, mod 4 or mod 8)
00028886: 418 (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8648 ISO ADTG gain (per column, mod 4 or mod 8)
00028888: 41c (was 40e) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d864c ISO ADTG gain (per column, mod 4 or mod 8)
==================================================================
Canon EOS M2 1.0.3
00f00000: 803 (was 86f) ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f0 Analog ISO (most cameras)
00f00003: f08 ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f6 Analog ISO on 6D
00f00004: 2 ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f8 ISO-related?
00f00006: 78b ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93fc ISO 50 or timing related: FFF => darker image
00028882: 41c (was 400) ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8640 ISO ADTG gain (per column, mod 4 or mod 8)
00028884: 41e (was 400) ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8644 ISO ADTG gain (per column, mod 4 or mod 8)
00028886: 418 (was 400) ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8648 ISO ADTG gain (per column, mod 4 or mod 8)
00028888: 41c (was 400) ISO=0 Tv=125 Av=56 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d864c ISO ADTG gain (per column, mod 4 or mod 8)
==================================================================
Canon EOS M2 1.0.3
0002c002: 190 (was 19f) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=4ac30 addr=416d8f04
0002c080: 0 (was ff) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=4ac30 addr=416d8f08
0002c0c1: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46374 addr=416d977c
0002c517: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46140 addr=416d9734
0002c518: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46140 addr=416d9738
0002c519: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46140 addr=416d973c
0002c026: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46140 addr=416d9730
00028830: 1 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46160 addr=416d85f8 Only slightly changes the color of the image (g3gg0)
000288b0: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46160 addr=416d85fc
0002805f: c1 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b7c Shutter blanking for x5/x10 zoom
00028061: c1 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b80 Shutter blanking for LiveView 1x
00028172: 3b7 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b84 PowerSaveTiming 'on', set to Line count + 1
00028173: 46a ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b88 PowerSaveTiming 'off', should be slightly below FPS timer B
00f00000: 86f ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9456 Analog ISO (most cameras)
00f00001: 4ce ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9458 Vertical offset
00f00002: 742 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d945a Horizontal offset / column skipping
00f00003: f08 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d945c Analog ISO on 6D
00f00004: 2 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d945e ISO-related?
00f00005: 20 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9460 Fine vertical offset, black area maybe
00f00006: 78b ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9462 ISO 50 or timing related: FFF => darker image
00f00007: 800 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9464 5D3: image fading out; 6D, 700D: vertical offset
00f00008: 800 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9466 Unknown, used on 6D
00f00009: 81 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9468
0006c079: 525 (was 929) ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=445d4 addr=1be2d4
0002c082: 0 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c78
0002c09b: 177 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c7c
0002c00d: 5249 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c80
0002c00e: 7 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c84
0002c00f: 7 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c88
0002c010: 7 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c8c
0002c011: 7 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46338 addr=416d8c90
00028882: 400 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8640 ISO ADTG gain (per column, mod 4 or mod 8)
00028884: 400 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8644 ISO ADTG gain (per column, mod 4 or mod 8)
00028886: 400 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d8648 ISO ADTG gain (per column, mod 4 or mod 8)
00028888: 400 ISO=0 Tv=125 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46364 addr=416d864c ISO ADTG gain (per column, mod 4 or mod 8)
================================================================== Because the file is bigger, we just put some of it ... the rest is in the link below:Follow Bilal's instructions to find the addresses and I'll plug them into the code.Well, I hope I got it right. ADTG-GUI came up with same values both for video and for foto mode:
Evf:46284:416d93f0 v=2051(0x803) nrzi_dec=4093(0xffd)
At least I can find these values in Critix post too.
else if (is_camera("EOSM2", "1.0.3")) // WIP found movie mode but photo mode is taken from EOSM
{
is_eosm2 = 1;
FRAME_CMOS_ISO_START = 0x416d93f0; // CMOS register 0000 - for LiveView, ISO 100 (check in movie mode, not photo!)
FRAME_CMOS_ISO_COUNT = 6; // from ISO 100 to 3200
FRAME_CMOS_ISO_SIZE = 34; // distance between ISO 100 and ISO 200 addresses, in bytes
PHOTO_CMOS_ISO_START = 0x416d93f0
; // CMOS register 0000 - for photo mode, ISO 100
PHOTO_CMOS_ISO_COUNT = 6; // from ISO 100 to 3200
PHOTO_CMOS_ISO_SIZE = 16; // distance between ISO 100 and ISO 200 addresses, in bytes
CMOS_ISO_BITS = 3;
CMOS_FLAG_BITS = 2;
CMOS_EXPECTED_FLAG = 3;
}
Could you try this module?I put the module into Dforts build December 21 and started in photo mode but the module fails to load with the same error as posted here (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209583#msg209583). Dfort made a minor change in reply #355 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209584#msg209584) which fixed it.
https://bitbucket.org/Dannephoto/magic-lantern/downloads/dual_iso.mo
Black 1/5: mean too different (8152, ref 8013+-0.00)
Maybe worth to look into it too, this message does not show when going back to dfort's original DUAL_ISO.mo
ISOless PH err(8)Now with error code 8 instead of err(15) both in photo and video mode.
int err = isoless_enable(PHOTO_CMOS_ISO_START, PHOTO_CMOS_ISO_SIZE, PHOTO_CMOS_ISO_COUNT, backup_ph);
PHOTO_CMOS_ISO_START = 0x416d93f0
; // CMOS register 0000 - for photo mode, ISO 100
PHOTO_CMOS_ISO_START = 0x416d93f0; // CMOS register 0000 - for photo mode, ISO 100
Does that make sense?
shoot_malloc(1.0MB|TMP|DMA) FAILED AT adtg_gui.c:1004, log_iso_regs.
You don't need to load dual_iso to find the right values. Set the ISO to 100 and follow Bilal's instructions (https://www.magiclantern.fm/forum/index.php?topic=7139.msg197146#msg197146). Try using the iso-research for this. Do screenshots and post them if possible.I did all this already following Bilal's instructions using your the ISO research build from your repository. The result is posted in #362 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209617#msg209617). Same values for photo mode 2 as well as video mode made me suspicious whether I did right or not so I repeated a couple of times but in the end it was no difference.
In the meantime I posted a new build that has PHOTO_CMOS_ISO_START and FRAME_CMOS_ISO_START set to the same address. Let's see if that clears up the ISOless PH err(?).Unfortunately the result is the same as posted here (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209622#msg209622)
I have memory error when i try to use adtg_gui with iso-research.2018Dec22.EOSM2103.zip:
I updated the latest build with the latest adtg_gui module. See if that works. magiclantern-Nightly_with_adtg_gui.2018Dec23.EOSM2103Ok, now photo mode and video mode show different results. A strange thing was that in photo mode I got even 2 different values, one before taking a picture and another one after taking a picture (both having dual iso activated). But ever since then the second value got kind of persistent and I cannot reproduce the initial one (though I have a screenshot, but ... never mind). So here are the new values for COMS[0]:
Evf:46284:416d949a v=2231(0x8b7) nrzi_dec=3877(0xf25)Evf:46284:416d93f0 v=2051(0x803) nrzi_dec=4093(0xffd)
PHOTO_CMOS_ISO_SIZE = 16; // distance between ISO 100 and ISO 200 addresses, in bytes
@gukuangshi - Welcome to the forum!I am using MC Rokkor-PF 58 mm f/1.4, as the color is more beautiful than md-rokkor-50-mm-f1.4. I once own many visions of minolta lens, the mc 50 1.4 pg processes better sharpness. I will test the temperature again. In my camera, the temperature rises from 16-36 degrees after using 20 minutes. One more things, could you tell me how can I remain center focus using free moving one point. In the manual, it says that when you touch other place, you can press delete(down) to turn back to the center focus. Thank you for your efforts, I will keep using newest vision of ML on my camera and report my advice.
You're using a Minolta MD Rokkor 50 mm f/1.4 (http://vintagelensreviews.com/vlr/reviews/minolta-md-rokkor-50-mm-f1-4-md-i/) or is it a MC Rokkor-PF 58 mm f/1.4 (http://vintagelensreviews.com/vlr/reviews/minolta-mc-rokkor-pf-58-mm-f1-4-mc-ii/)?
(https://farm5.staticflickr.com/4842/45495404515_b850b6be21_m.jpg) (https://flic.kr/p/2cjgQJ8)(https://farm5.staticflickr.com/4861/44591380690_d3fc2d6b87_m.jpg) (https://flic.kr/p/2aWotWs)
In any case, the ability to adapt so many different lenses is one of the strong points of this camera.
Using LiveView on any camera will raise the temperature and being a mirrorless camera it is always in LiveView mode. Now is ML causing the temperature faster than normal? Hard to see because the Canon overlays don't show the sensor temp. I don't have the EOSM2 in my hands at this time but what I did was to run this test on an EOSM. Turn on the camera with ML and checked the starting temperature, in my case 18C. Then pulled the card and turned on the camera and let it sit on LiveView for 1 minute, the temp rose to 24C. Let the camera cool back down to 18C and turned it on again this time with ML running for 1 minute--same results. Try it on the EOSM2, you should see the same results.
I'll let you figure out how to test this out, chances are power consumption will be pretty much the same whether or not you're using ML. Of course if you start using some of the advanced features like Danne's 100fps 4k feature :P it will probably burn through batteries.
Don't expect too much right away, we're still trying to make a somewhat stable build for this camera. Check out the Feature comparison matrix (https://builds.magiclantern.fm/features.html) page. If a feature isn't working on the EOSM, it probably won't work on the EOSM2.
I also did a big cleanup of the test builds so please try out the latest EOSM2 test builds at the top of my downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/).Using your latest build Dec 23 from last night still comes up with the same error ISOless PH err 8 . I made some more tests and had en observation which makes me wonder if we are looking at the correct register.
Meaning the CMOS[0] register changes values in depencence of the shutter speed. So, are we looking at the right register?
Photo mode 2--> Value after taking a shot -> since then kind of persistentCode: [Select]Evf:46284:416d949a v=2231(0x8b7) nrzi_dec=3877(0xf25)
Video mode --> this is the same as in previous tests based on iso_research buildCode: [Select]Evf:46284:416d93f0 v=2051(0x803) nrzi_dec=4093(0xffd)
c0f1b080:80000000 (was 1) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d74
c0f1b020: 6 (was 1) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bb4
c0f1b1c0:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d7c
c0f1b034: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bdc
c0f1b100:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d84
c0f1b028: 5 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bc4
c0f1b0c0:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d8c
c0f1b024: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bbc
c0f1b0c4: 3 (was 0) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8c44
c0f1b0c8:10000700 (was 0) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8c4c
c0f1b044:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8db4
c0f1b03c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bec
c0f1b140:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d94
c0f1b02c: 4 (was 1) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bcc
c0f1b180:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d9c
c0f1b030: 1 (was 3) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8bd4
c0f1b010:80000000 (was 0) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8da4
c0f1b038: 3 (was 4) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8be4
c0f1b284: 4 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d5c
c0f1b280: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8d64
c0f1b288: 11 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8ce4
c0f1b2b0: d61c684 (was d2cc000) ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414cb0 addr=19e2c8
c0f1b2b8: f00140 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff414ca8 addr=a8cec
c0f1b040:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=1 res=0 crop=0 task=ShootCapture pc=ff4153ec addr=a8dac
c0f27000: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb50
c0f27004: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb58
c0f27008: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb60
c0f2700c: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb68
c0f27010: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb70
c0f27014: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb78
c0f27080: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb80
c0f27084: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb88
c0f27088: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb90
c0f2708c: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bb98
c0f27090: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bba0
c0f27094: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bba8
c0f07168: c80100 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff415f9c addr=9a7a8
c0f08100: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff416e3c addr=19e2c8 CCDSEL (0-1)
c0f08114: 5 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff416e48 addr=19e2c8 LV raw type (see lv_af_raw, lv_set_raw) - DIGIC IV (PACK32_ISEL)
c0f082d4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff416e54 addr=19e2c8 WDMAC32_ISEL (0-7)
c0f38324:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5ccb6c addr=19e2a0
c0f38318:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5ccb78 addr=19e2a0
c0f3831c: 114 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff79e9a4 addr=19e248
c0f38320:32100001 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5ccce0 addr=19e250
c0f42264:10000c00 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691880
c0f42268:3ec03fc0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691888
c0f4226c: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691890
c0f42280: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691898
c0f42284:10000c00 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918a0
c0f42288:3ec03fc0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918a8
c0f4228c: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918b0
c0f422a4:10000c00 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918c0
c0f422a8:3ec03fc0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918c8
c0f422ac: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918d0
c0f422c0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918d8
c0f422c4:10000c00 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918e0
c0f422c8:3ec03fc0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918e8
c0f422cc: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=406918f0
c0f42500: fa00a0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691aa8
c0f42504: 280048 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ab0
c0f42508: 10001b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ab8
c0f4250c: 3c0028 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ac0
c0f42510: 6d005b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ac8
c0f42514: 9c0081 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ad0
c0f42520: 63f0002 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ad8
c0f42530: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ae0
c0f42534: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ae8
c0f42538: 15e ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691af0
c0f4253c: 190 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691af8
c0f42540: 96 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b00
c0f42544: 258 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b08
c0f42548: 20020 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b10
c0f42550: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b18
c0f42560: 63f0010 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b20
c0f42570: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b28
c0f42574: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b30
c0f42578: 15e ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b38
c0f4257c: 190 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b40
c0f42580: 96 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b48
c0f42584: 258 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b50
c0f42588: 20020 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b58
c0f42600: fa00a0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b60
c0f42604: 280048 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b68
c0f42608: 10001b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b70
c0f4260c: 3c0028 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b78
c0f42610: 6d005b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b80
c0f42614: 9c0081 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b88
c0f42620: 63f0010 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b90
c0f42630: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691b98
c0f42634: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ba0
c0f42638: 12c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ba8
c0f4263c: c8 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bb0
c0f42640: 7d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bb8
c0f42644: 12c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bc0
c0f42648: 20020 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bc8
c0f42650: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bd0
c0f42654: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bd8
c0f42658: bc ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691be0
c0f4265c: 70 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691be8
c0f42660: b0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bf0
c0f42664: 2d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691bf8
c0f42668: 3f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c00
c0f4266c: 32 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c08
c0f42670: 5 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c10
c0f42674: 6 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c18
c0f42678: 6 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c20
c0f4267c: 280010 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c28
c0f42680: 6003f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c30
c0f42684: 3a8003e ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c38
c0f42688: 6003f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c40
c0f4268c: 1b4003e ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c48
c0f42690: 200040 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c50
c0f42694: 20 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c58
c0f426a0: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c60
c0f426b0: 63f0010 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c68
c0f426c0: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c70
c0f426c4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c78
c0f426c8: 12c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c80
c0f426cc: c8 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c88
c0f426d0: 7d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c90
c0f426d4: 12c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691c98
c0f426d8: 20020 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bca20 addr=40691ca0
c0f08c90:1010032d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff41480c addr=416da3c0
c0f081c0: 10001 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414838 addr=9b014
c0f0820c: a4f0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414838 addr=9b01c
c0f08208: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4148cc addr=9b03c
c0f081a0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4148d8 addr=9b094
c0f08200: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4170cc addr=9b064
c0f081b8: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4170cc addr=9b06c
c0f081bc: a8 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4170cc addr=9b074
00028011: d38c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6308
00028012: ffff ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d630c
00028013: 51e5 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6310
00028014: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6314
00028015: b68f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6318
00028016: ffff ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d631c
00028017: 34d6 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6320
00028018: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6324
00028019: d276 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6328
0002801a: ffff ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d632c
0002801b: 77ed ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6330
0002801c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6334
0002801d: 5d0d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6338
0002801e: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d633c
0002801f: 64 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6340
00028020: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6344
00028021: b6b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6348
00028022: 100 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d634c
0002800d: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6350
0002800e: c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6354
00028024: 22 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6358
00028025: 7a ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d635c
00028048: 6e ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6368
00028049: 56 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d636c
00028065: 2c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6370
00028066: 7c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6374
0002802d: 25 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6378
0002802e: 66 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d637c
00028067: 7b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6380
00028068: 73 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6384
00028095: c4 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d638c
00028096: 2b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6390
0002818e: 2b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6394
0002818f: 2b ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=23c5c addr=416d6398
c0f37218:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff415438 addr=9b7cc
c0f37224: 120 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af0 addr=9b78c
c0f37228: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af0 addr=9b794
c0f3722c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af0 addr=9b79c
c0f37230: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af0 addr=9b7a4
c0f37234: 3210 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af0 addr=9b7ac
c0f085b0: 3fff ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414af4 addr=9b28c
c0f27400: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bbc0
c0f27040: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba40
c0f27044: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba48
c0f27048: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba50
c0f2704c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba58
c0f27050: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba60
c0f27054: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba68
c0f27058: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba70
c0f2705c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba78
c0f27060: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba80
c0f27064: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba88
c0f27068: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba90
c0f2706c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9ba98
c0f27070: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9baa0
c0f27074: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9baa8
c0f27078: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bbb0
c0f2707c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bab8
c0f270c0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bac0
c0f270c4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bac8
c0f270c8: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bad0
c0f270cc: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bad8
c0f270d0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bae0
c0f270d4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417758 addr=9bbb8
c0f270d8: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9baf0
c0f270dc: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9baf8
c0f270e0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb00
c0f270e4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb08
c0f270e8: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb10
c0f270ec: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb18
c0f270f0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb20
c0f270f4: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb28
c0f270f8: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb30
c0f270fc: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4176a0 addr=9bb38
c0f050f0: 5 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=30b70 addr=19e2a0
c0f05218: 23 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=30ab0 addr=19e2a8
c0f085d0:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4153d0 addr=9b8ac
c0f085d4: 2 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417580 addr=9b86c
c0f085d8: dc80527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417580 addr=9b874
c0f085dc: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414be8 addr=9b884
c0f08d3c: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414be8 addr=9b88c
c0f09078: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc14c addr=a895c
c0f0b0c0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bbfe4 addr=a87b4
c0f0b0e8: 4 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bbfe4 addr=a87d4
c0f0b140: e30037 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a87f4
c0f0b144: e30037 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a87fc
c0f0b148: e30037 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8804
c0f0b14c: e0014 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a880c
c0f0b138: 10 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8814
c0f0b150: 800080 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a881c
c0f0b154: 800080 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8824
c0f0b158: 1000100 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a882c
c0f0b15c: 1000100 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8834
c0f0b160: 7ff0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a883c
c0f0b164: 7ff0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8844
c0f0b168: 7ff0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a884c
c0f0b16c: 7ff0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff5bc058 addr=a8854
c0f0a104: dc80527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c18 addr=19e2c8
c0f0a108: c90001 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4ae200 addr=19e2c0
c0f0a10c: d310011 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c40 addr=19e2c8
c0f0a014: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4ae104 addr=19e2c0
c0f2e000:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4153dc addr=9bd18
c0f2e004: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bcc8
c0f2e008: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bcd0
c0f2e00c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bcd8
c0f2e018: 4 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bce0
c0f2e01c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bce8
c0f2e020: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bcf0
c0f2e024: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff417960 addr=9bcf8
c0f2e028: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6a94
c0f2e02c: dc80527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6a9c
c0f2e030: c ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6aa4
c0f2e034: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6aac
c0f2e038: 3e0014 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6ab4
c0f2e03c: dbd0525 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6abc
c0f2e040: 800080 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6ac4
c0f2e044: 800080 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6acc
c0f2e048:20413520 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6ad4
c0f2e04c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6adc
c0f2e050:77772222 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6ae4
c0f2e054: f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6aec
c0f2e058: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6af4
c0f2e05c:333b343f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6afc
c0f2e060: c0a12 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b04
c0f2e064:e1ae733f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b0c
c0f2e068: fdf3 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b14
c0f2e06c:d8000505 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b1c
c0f2e070: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b24
c0f2e074:bf000111 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b2c
c0f2e078: 25 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b34
c0f2e07c: d0008 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b3c
c0f2e080: b0001 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b44
c0f2e084: 25 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b4c
c0f2e088: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b54
c0f2e08c: 71 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b5c
c0f2e090: 527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b64
c0f2e094: 707 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414c94 addr=e6b6c
c0f1b260:80000000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff4153ec addr=a8d6c
c0f1b084: 1000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8bf4
c0f1b088: dc80527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8bfc
c0f1b1c4: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c04
c0f1b1c8: dc80527 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c0c
c0f1b1cc: 3e0015 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c14
c0f1b1d0: dbd0524 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c1c
c0f1b1d4: 3e0015 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c24
c0f1b1d8: dbd0524 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c2c
c0f1b1dc: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c34
c0f1b1e0: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c3c
c0f1b104: 10010 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c54
c0f1b108: 35051 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c5c
c0f1b10c: 4ff ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c64
c0f1b110: d7f0510 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c6c
c0f1b184: d ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c74
c0f1b188: 35f013f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c7c
c0f1b18c: 21 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c84
c0f1b144: 10 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c8c
c0f1b148: 330512 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c94
c0f1b14c: ef0000 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8c9c
c0f1b150: 35f013f ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8ca4
c0f1b204: 1 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8cac
c0f1b264: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8cb4
c0f1b268: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8cbc
c0f1b26c: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8cc4
c0f1b270: 0 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=ff414ca8 addr=a8ccc
c0f05010: 35 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=30ab0 addr=19e2b0
What am I missing here?
00f00000: 803 ISO=100 Tv=160 Av=35 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=16d14 addr=4048124c Analog ISO (most cameras)
In my camera, the temperature rises from 16-36 degrees after using 20 minutes.
One more things, could you tell me how can I remain center focus using free moving one point. In the manual, it says that when you touch other place, you can press delete(down) to turn back to the center focus.
Look on your SD card under ML/LOGS/ADTG.LOGThank you very much. Merry Christmas to you. The Cannon Custom Functions of the down arrow (trash button) won't work by a quick press. And to start the camera when press the center button (SET button), the camera still possesses ML. And weather long press or short press, it's the same. I'm using magiclantern-Nightly.2018Dec23.EOSM2103.zip. I hope one day, a quick press of the trash button will realize Cannon Custom Functions with ML.
Here is the line I'm looking for (this one is from the EOSM):
Canon EOS M 2.0.2Code: [Select]00f00000: 803 ISO=100 Tv=160 Av=35 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=16d14 addr=4048124c Analog ISO (most cameras)
That seems about normal.
ML uses the down arrow (trash button) to open the ML menu. If you start without ML (press the SET button when starting) it should work. Note that you can change the behavior of the trash button using the Canon Custom Functions -- C.FnIV:Operation/Others [6]
[EDIT] On the EOSM using the unified branch a quick press of the trash button centers the focus box and a longer press opens the ML menu. On the iso-research branch a quick press of the trash button doesn't center the focus box.
00f00000: 827 ISO=100 Tv=50 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9412 Analog ISO (most cameras)
Look on your SD card under ML/LOGS/ADTG.LOGSure, that's what I did. My point is that there is not a single row with "task=ShootCapture", task=Evf only, what ever I changed in the procedure.
Here is the line I'm looking for (this one is from the EOSM):
Canon EOS M 2.0.2Code: [Select]00f00000: 803 ISO=100 Tv=160 Av=35 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=16d14 addr=4048124c Analog ISO (most cameras)
00f00000: 86f (was 893) ISO=100 Tv=30 Av=20 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d9456 Analog ISO (most cameras)
Also, I set the advanced options before enabling the recording (so the counter on the right remains to 0 uniq / 0 until I take a shoot.Just to make it clear for me, are you in photo mode or do you take a picture in movie mode (talking about recording)?
Just to make it clear for me, are you in photo mode or do you take a picture in movie mode (talking about recording)?
I made many changes to the settings, and now i don't seem to be able to save any log to the SD... Still experimenting!
00f00000: 803 ISO=100 Tv=200 Av=20 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f0 Analog ISO (most cameras)
As you can see Tv is higher than in post #388 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209718#msg209718) which leads to anoher value for CMOS[0]. As you can see Tv...
PROP_HANDLER( PROP_APERTURE_AUTO )
{
/* this gets updated in Tv mode (where PROP_APERTURE is not updated); same for P, Auto and so on */
/* it becomes 0 when camera is no longer metering */
dual_iso ISOless ( 8 ) & (15) err finally solved for Canon 700D that have this problem!
The problem was in CMOS (0) Registers at ISO 100, It was different in my camera.
... depending on what's stored in their settings area (properties) and where that stuff happens to be allocated at startup. It can happen on any camera model, but some of them were just lucky.
I believe that Tv and Av are the property values and will vary depending on how the camera is metering at that point in time.That's is totally correct and it was provoked in my test scneario just to show that the value we are looking for is changing when exposure (Tv) is changing. a1ex commented here (https://www.magiclantern.fm/forum/index.php?topic=15895.msg209685#msg209685)
In photo mode LiveView, Canon firmware uses exposure simulation (i.e. the actual exposure values are not necessarily the ones dialed in their menus, but something with equivalent brightness). That's why CMOS[0] appears to depend on shutter speed - because Canon firmware is actually changing ISO....I ran all the tests with this advanced feature "disabled logging in LiveView", still the result in ADTG.LOG shows task=EvF (=LV) only, instead of task=ShootCapture - which makes me conclude:
Look at the task name - "Evf" is Canon's task for LiveView on recent models. For still photos, it's "ShootCapture"....
If the camera cannot operate without returning to LiveView, you have an option to disable logging in LiveView, in the Advanced menu. That option was written specifically for the EOS M, which had the same issue.
By the way, I inactivated Exp.Sim in ML exposure menu for all testing, w/o any effect, Canon firmware seems to use it anyway.
/** We can't change ExpSim from ML (at least not yet) **/
#define CONFIG_EXPSIM
#ifdef CONFIG_EXPSIM
#define FEATURE_EXPSIM
#endif
...
#ifdef CONFIG_EXPSIM
#define FEATURE_LV_ZOOM_AUTO_EXPOSURE
#endif
/**
* State object hooks are pieces of code that run in Canon tasks (state objects). See state-object.c .
* They might slow down Canon code, so here you can disable all of them (useful for debugging or early ports)
*/
#define CONFIG_STATE_OBJECT_HOOKS
#ifndef __platform_state_object_h
#define __platform_state_object_h
#define DISPLAY_STATE DISPLAY_STATEOBJ
#define INPUT_SET_IMAGE_VRAM_PARAMETER_MUTE_FLIP_CBR 26 // need to verify
#define INPUT_ENABLE_IMAGE_PHYSICAL_SCREEN_PARAMETER 27 // need to verify
#define EVF_STATE (*(struct state_object **)0x91CF0)
#define MOVREC_STATE (*(struct state_object **)0x93AF8)
#define SSS_STATE (*(struct state_object **)0x9169C)
#endif // __platform_state_object_h
#ifndef __platform_state_object_h
#define __platform_state_object_h
#define DISPLAY_STATE DISPLAY_STATEOBJ
//#define INPUT_SET_IMAGE_VRAM_PARAMETER_MUTE_FLIP_CBR 24 /* unused */
#define INPUT_ENABLE_IMAGE_PHYSICAL_SCREEN_PARAMETER 25
#define EVF_STATE (*(struct state_object **)0x6733C)
// #define MOVREC_STATE (*(struct state_object **)0x691AC)
// #define SSS_STATE (*(struct state_object **)0x91BD8)
#endif // __platform_state_object_h
// http://magiclantern.wikia.com/wiki/VRAM_ADDR_from_code
// stateobj_disp[1]
#define YUV422_LV_BUFFER_DISPLAY_ADDR (*(uint32_t*)(0x90494+0x12C))
#define YUV422_LV_BUFFER_DISPLAY_ADDR (*(uint32_t*)(0x90494+0x12C))
From my point of view, the value is correct. I checked it again today (and yesterday I looked at that value).
#define INPUT_ENABLE_IMAGE_PHYSICAL_SCREEN_PARAMETER 27 // need to verify
#define INPUT_SET_IMAGE_VRAM_PARAMETER_MUTE_FLIP_CBR 26 // need to verify
I ran the following test a couple of times but the file adtg.log did not show a single line with the task = "ShootCapture", only lots of Evf entries. My procedure was:
- work in photo mode 2, M expo, Exp.Sim off.
- load adtg_gui.mo
- Debug: ADTG Registers on
- Enter ADTG registers submenu Advanced
- Set Disable logging in Live view
- Set Auto Log registers after taking a pic
- leave ML menu
- take a picture
- message on the display that 35 registers have been logged in a .ca. 4k file
Did the same test w/ "Disable logging Off" but the result was approx. the same. What am I missing here?
#elif defined(CONFIG_EOSM2) // using EOSM values for now
#define TG_FREQ_BASE 32000000
#define FPS_TIMER_A_MIN (ZOOM ? 716 : MV1080CROP ? 532 : 520)
#undef FPS_TIMER_B_MIN
#define FPS_TIMER_B_MIN ( \
RECORDING_H264 ? (MV1080CROP ? 1750 : MV720 ? 990 : 1970) \
: (ZOOM || MV1080CROP ? 1336 : 1970))
Did the same test with 5D3, with current CMOS/ADTG build from the Experiments page. Result: 36 registers logged, all of them from the ShootCapture task. Not sure what's wrong - maybe M2 doesn't get out of LiveView when taking a picture. To check this, make sure PROP_LV_ACTION actually gets executed (add a printf there, for example). If it does, write down the value of buf[0] before taking the picture (expected 1) and after returning to LiveView (expected 0).
#ifdef CONFIG_LIVEVIEW
PROP_HANDLER( PROP_LV_ACTION )
{
lv = !buf[0];
NotifyBox(5000, "lv 0x%x", lv);
}
#endifGives 0x1 on the eosm2 when camera is on telling me liveview is on. Taking a picture briefly shows 0x0 then back to 0x1. This goes for both photo and movie mode.0002805f: c1 ISO=0 Tv=60 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b7c Shutter blanking for x5/x10 zoom
00028061: c1 ISO=0 Tv=60 Av=56 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46270 addr=416d7b80 Shutter blanking for LiveView 1x
#define FRAME_SHUTTER_BLANKING_ZOOM (*(uint16_t*)0x416D7B7C) // ADTG register 805f
#define FRAME_SHUTTER_BLANKING_NOZOOM (*(uint16_t*)0x416D7B80) // ADTG register 8061
/* when reading, use the other mode, as it contains the original value (not overriden) */
#define FRAME_SHUTTER_BLANKING_READ (lv_dispsize > 1 ? FRAME_SHUTTER_BLANKING_NOZOOM : FRAME_SHUTTER_BLANKING_ZOOM)
#define FRAME_SHUTTER_BLANKING_WRITE (lv_dispsize > 1 ? &FRAME_SHUTTER_BLANKING_ZOOM : &FRAME_SHUTTER_BLANKING_NOZOOM) // commented out on EOSM
00f00000: 803 ISO=100 Tv=60 Av=35 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f0 Analog ISO (most cameras)
...
00f00003: f08 ISO=100 Tv=60 Av=35 lv=0 zoom=1 mv=0 res=-1 crop=-1 task=Evf pc=46284 addr=416d93f6 Analog ISO on 6D
Canon EOS M 2.0.2
00f00000: 803 ISO=100 Tv=50 Av=45 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=16d14 addr=4048124c Analog ISO (most cameras) PHOTO_CMOS_ISO_START = 0x4048124C;
On a regular EOSM it looks like this. Assume this is what we´re after but on the eosm2?Code: [Select]Canon EOS M 2.0.2
00f00000: 803 ISO=100 Tv=50 Av=45 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=16d14 addr=4048124c Analog ISO (most cameras)
diff --git a/modules/adtg_gui/adtg_gui.c b/modules/adtg_gui/adtg_gui.c
--- a/modules/adtg_gui/adtg_gui.c
+++ b/modules/adtg_gui/adtg_gui.c
@@ -20,6 +20,8 @@
#include "io_trace.c"
#endif
+#include <shoot.h>
+
#define DST_DFE 0xF000
#define DST_CMOS16 0x0F00
#define DST_CMOS 0x00F0
@@ -1006,6 +1008,8 @@
msg[0] = 0;
int len = 0;
int saved_regs = 0;
+
+ take_a_pic(0);
len += snprintf(msg+len, size-len, "%s %s\n", camera_model, firmware_version);
for (int i = 0; i < reg_num; i++)
Canon EOS M2 1.0.3
...
0002c517: 500 (was 0) ISO=100 Tv=100 Av=80 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=240ec addr=416d736c
0002c518: 0 ISO=100 Tv=100 Av=80 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=240ec addr=416d7370
0002c519: 0 ISO=100 Tv=100 Av=80 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=240ec addr=416d7374
0002c026: 0 ISO=100 Tv=100 Av=80 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=240ec addr=416d7368
...
There is another way to log photo capture alongside with LiveView - in adtg_gui, in the Advanced menu, set "Unique Key" to "Register + caller task". That way, still photo and LiveView registers will be logged as separate entities, rather than grouped together (even if both tasks will override the same register).
Caveat: you have to enable that option *before* enabling ADTG registers (i.e. it's not something you can change during a logging session). Go to the submenu first, while the stuff is still grayed out, change the unique key, then go back to enable the main menu entry.
Did you restart camera and went into the unique setting without turning adtg_gui on? After selection turn on adtg_gui.Ah, my bad. Was not aware of that I can enter ADTG menu w/o activation. Now it works
{
.name = "Histogram type",
.priv = &hist_type,
+ #ifdef FEATURE_RAW_HISTOGRAM
.update = raw_histo_update,
- #ifdef FEATURE_RAW_HISTOGRAM
.max = 3,
#else
.max = 1,
Canon EOS M2 1.0.3
0002c001: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6b90
0002c021: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6b94
0002c009: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6b98
0002c0a5: 1e4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6b9c
0002c0dc: f281 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6ba0
0002c0de: 7a09 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6ba4
0002c0d9: 4009 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6ba8
0002c0f0: 4904 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bac
0002c0dd: 571 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bb0
0002c0df: ca0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bb4
0002c0fb: 7 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bb8
0002c0d8: 4805 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bbc
0002c070: e22 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bc0
0002c0e1: 419 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bc4
0002c0e2: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bc8
0002c002: 19f ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e08 addr=416d6bcc
0002c000: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22e7c addr=416d6bec
0002c020: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c4c
0002c00d: 5249 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c50
0002c058: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c54
0002c075: 2202 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c58
0002c01c: 22fe ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c5c
0002c01b: ff1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c60
0002c0b0: e000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c64
0002c0b1: 1e3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c68
0002c0b3: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c6c
0002c0b4: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c70
0002c0b5: 1fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c74
0002c0b7: 201 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c78
0002c014: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c7c
0002c012: 18 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c80
0002c00e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c84
0002c00f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c88
0002c010: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c8c
0002c011: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c90
0002c015: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c94
0002c016: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c98
0002c017: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6c9c
0002c018: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ca0
0002c019: fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ca4
0002c01a: fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ca8
0002c079: 2000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cac
0002c07a: 2000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cb0
0002c06e: 1808 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cb4
0002c06f: 3828 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cb8
0002c077: 410 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cbc
0002c078: 832 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cc0
0002c06d: 1000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cc4
0002c07d: 2202 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cc8
0002c030: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ccc
0002c031: 7 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cd0
0002c032: 9 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cd4
0002c037: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cd8
0002c038: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cdc
0002c039: 72 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ce0
0002c03a: 472 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ce4
0002c03b: 72 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ce8
0002c03c: 472 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cec
0002c03d: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cf0
0002c03e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cf4
0002c03f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cf8
0002c040: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6cfc
0002c041: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d00
0002c042: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d04
0002c043: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d08
0002c044: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d0c
0002c047: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d10
0002c048: 100 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d14
0002c049: 5 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d18
0002c04a: 401 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d1c
0002c04b: 8 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d20
0002c056: ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d24
0002c083: 3003 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d28
0002c082: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d2c
0002c093: 40 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d30
0002c094: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d34
0002c086: 4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d38
0002c087: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d3c
0002c088: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d40
0002c089: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d44
0002c08a: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d48
0002c0a0: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d4c
0002c09c: 400 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d50
0002c09b: 177 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d54
0002c080: ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d58
0002c0c0: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d5c
0002c0c1: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f30 addr=416d73b4
0002c0c2: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d64
0002c00a: 70 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d68
0002c004: 18 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d6c
0002a000: fff1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d70
0002a001: 4001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d74
0002a002: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d78
0002a003: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d7c
0002a004: fff2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d80
0002a005: 4001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d84
0002a006: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d88
0002a007: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d8c
0002a008: fff4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d90
0002a009: 4001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d94
0002a00a: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d98
0002a00b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6d9c
0002a00c: fff8 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6da0
0002a00d: 4001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6da4
0002a00e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6da8
0002a00f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dac
0002a010: fff9 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6db0
0002a011: 4001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6db4
0002a012: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6db8
0002a013: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dbc
0002a014: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dc0
0002a015: 14a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dc4
0002a016: 8000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dc8
0002a017: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dcc
0002a018: f005 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dd0
0002a019: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dd4
0002a01a: ffff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dd8
0002a01b: fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6ddc
0002a01c: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6de0
0002a01d: dc9 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6de4
0002a01e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6de8
0002a01f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dec
0002a020: 5c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6df0
0002a021: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6df4
0002a022: 70 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6df8
0002a023: fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6dfc
0002c500: 8 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22efc addr=416d6e00
00028900: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65d0
00028802: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65d4
00028804: 79 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65d8
00028806: 8 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65dc Causes interlacing artifacts
0002880e: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65e0
00028812: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65e4
00028813: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65e8
000288fc: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65ec
00028820: 300 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65f0
00028821: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65f4
00028822: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65f8
00028826: 9 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d65fc
00028827: 65 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6600
00028828: 3222 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6604
00028829: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6608
0002882a: 7ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d660c
0002882c: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6610
0002882e: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6614
00028830: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6618 Only slightly changes the color of the image (g3gg0)
00028832: 22 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d661c
00028836: 1022 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6620
00028837: 11 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6624
00028838: cd ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6628
00028839: 4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d662c
0002883a: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6630
0002883c: 69 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6634
00028840: 35 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6638
00028842: 6a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d663c
00028846: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6640
00028848: 1ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6644
0002884a: 600 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6648
0002884b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d664c
00028862: 31 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6650
00028866: d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6654
00028868: 4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6658
0002886a: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d665c
00028880: 800 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6660 Black level (reference value for the feedback loop?)
00028889: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6664
0002888a: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6668
000288b2: 742 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d666c
000288b4: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6670
000288b6: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6674
000288b8: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6678
000288ba: fe ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d667c
000288bc: ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6680
000288c2: 13 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6684
000288d4: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6688
000288e9: 10 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d668c
000288ea: 61 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6690
000288ec: ff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6694
000288ee: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f08 addr=416d6698
00028300: 3001 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f6c
00028005: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f70
00028006: 7c2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f74
00028007: 7c2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f78
0002800a: 41 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f7c
00028026: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f80
00028027: 8 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f84
0002802c: 110 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f88
0002802f: 864 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f8c
00028030: 822 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f90
00028031: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f94
00028032: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f98
00028035: 1f ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5f9c
00028036: 13 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fa0
00028037: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fa4
0002803b: 864 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fa8
0002803c: 822 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fac
0002803d: 1f ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fb0
0002803e: 13 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fb4
0002803f: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fb8
00028043: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fbc
00028044: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fc0
00028047: 110 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fc4
0002804a: 82f ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fc8
0002804b: 812 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fcc
0002804c: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fd0
0002804d: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fd4
00028050: 36 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fd8
00028051: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fdc
00028052: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fe0
00028056: 82f ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fe4
00028057: 812 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fe8
00028058: 36 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5fec
00028059: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5ff0
0002805a: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5ff4
0002805e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5ff8 Shutter blanking for x5/x10 zoom
0002805f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d5ffc Shutter blanking for x5/x10 zoom
00028060: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6000 Shutter blanking for LiveView 1x
00028061: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6004 Shutter blanking for LiveView 1x
00028069: 839 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6008
0002806a: 832 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d600c
0002806b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6010
0002806c: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6014
0002806f: 39 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6018
00028070: 2d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d601c
00028071: 839 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6020
00028072: 832 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6024
00028073: 39 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6028
00028074: 2d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d602c
00028079: 101 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6030
00028080: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6034
00028081: 2d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6038
00028082: 3c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d603c
00028083: 2d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6040
00028084: 3c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6044
00028088: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6048
00028089: 164 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d604c
0002808c: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6050
0002808d: 164 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6054
00028097: 19 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6058
00028098: 869 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d605c
0002809d: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6060
0002809e: 13 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6064
0002809f: 90 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6068
000280a0: 199 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d606c
000280a1: 19 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6070
000280a2: 869 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6074
000280a3: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6078
000280a4: 13 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d607c
000280a5: 90 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6080
000280a6: 199 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6084
000280ae: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6088
000280af: 78 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d608c
000280b0: b1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6090
000280b1: 16d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6094
000280ba: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6098
000280bb: 78 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d609c
000280bc: b1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60a0
000280bd: 16d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60a4
000280c9: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60a8
000280ca: 78 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60ac
000280cb: ca ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60b0
000280cc: be ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60b4
000280d5: 21 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60b8
000280d6: 78 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60bc
000280d7: ca ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60c0
000280d8: be ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60c4
000280e4: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60c8
000280e5: 164 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60cc
000280e6: cc ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60d0
000280f1: 164 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60d4
000280f2: cc ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60d8
00028101: b4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60dc
00028102: 1b7 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60e0
00028103: b4 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60e4
00028104: 1b7 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60e8
00028134: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60ec
00028135: 61 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60f0
00028136: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60f4
00028137: 61 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60f8
0002813a: 110 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d60fc
0002814d: 26 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6100
0002814e: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6104
0002814f: 60 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6108
00028150: 26 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d610c
00028151: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6110
00028152: 60 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6114
00028155: 10 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6118
00028170: 11 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d611c
00028176: 11 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6120
0002817a: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6124
0002817b: 101 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6128
0002817c: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d612c
0002817d: 101 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6130
000281a2: 11 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6134
000281a4: 2901 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6138
000282a9: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d613c
000282aa: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6140
000282af: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6144
000282b0: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6148
000282b5: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d614c
000282b6: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6150 PowerSaveTiming 'on'? set to Line count - 1
000282bb: 1a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6154
000282bc: 27 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6158
000282c7: 1a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d615c
000282c8: 27 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6160
000282d7: 1a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6164
000282d8: 27 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6168
000282e3: 1a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d616c
000282e4: 27 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6170
000282f0: 500 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6174
000282f3: 318 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6178 Line count that gets darker (top optical black related)
000282f6: 400 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d617c
000282fa: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6180
000282fb: 61 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6184
000282fc: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6188
000282fd: 61 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d618c
0002811a: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f14 addr=416d6190
0002c51b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f2c addr=416d7284
0002c51c: 1100 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f2c addr=416d7288
0002c501: 5454 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b7c addr=416d72a8
0002c502: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b7c addr=416d72ac
0002c503: 707 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b7c addr=416d72b0
0002c504: 707 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b7c addr=416d72b4
0002c505: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b7c addr=416d72b8
0002c506: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72d8
0002c51a: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72dc
0002c507: 3fff ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72e0
0002c508: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72e4
0002c509: 4e ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72e8
0002c50a: 1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72ec
0002c50b: 5a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72f0
0002c50c: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72f4
0002c50d: 55 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72f8
0002c50e: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d72fc
0002c50f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7300
0002c510: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7304
0002c511: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7308
0002c512: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d730c
0002c513: e6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7310
0002c514: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7314
0002c515: 5a ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d7318
0002c516: 2000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22b8c addr=416d731c
00024002: 1886 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75ac
00024003: 28 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75b0
00024004: 1906 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75b4
00024005: 1c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75b8
00024006: 1a86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75bc
00024007: 12 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75c0
00024008: 186 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75c4
00024009: c0e1 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75c8
0002400a: 106 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75cc
0002400b: c0a7 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75d0
0002400c: 1006 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75d4
0002400d: ffd9 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75d8
0002400e: 15 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75dc
0002400f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75e0
00024010: 25 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75e4
00024011: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75e8
00024012: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75ec
00024013: 411 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75f0
00024014: 218c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75f4
00024015: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75f8
00024016: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d75fc
00024017: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7600
00024018: 210c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7604
00024019: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7608
0002401a: 35 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d760c
0002401b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7610
0002401c: 2d ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7614
0002401d: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7618
0002401e: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d761c
0002401f: 413 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7620
00024020: 218c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7624
00024021: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7628
00024022: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d762c
00024023: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7630
00024024: 210c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7634
00024025: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7638
00024026: 35 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d763c
00024027: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7640
00024028: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7644
00024029: 411 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7648
0002402a: 218c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d764c
0002402b: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7650
0002402c: 86 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7654
0002402d: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7658
0002402e: 210c ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d765c
0002402f: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7660
00024030: 7106 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7664
00024031: 40 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7668
00024032: 35 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d766c
00024033: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f4c addr=416d7670
00027c0b: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74a4
00027c0f: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74a8
00027c25: 7e ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74ac
00027ce0: 80 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74b0
00027ce5: c0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74b4
00027cf1: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74b8
00027d02: c0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74bc
00027d0d: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74c0
00027cd0: 173 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74c4
00027cd1: 23 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74c8
00027cd8: 173 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74cc
00027cd9: 6 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74d0
00027cda: 173 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74d4
00027cdb: 26 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74d8
00027d03: 3 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74dc
00027ce3: d000 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f5c addr=416d74e0
00027c34: 2 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f6c addr=416d7500
00027c22: 10 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f6c addr=416d7510
00027c21: 0 ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f6c addr=416d7508
00027c20: ffef ISO=100 Tv=8 Av=99 lv=1 zoom=1 mv=0 res=-1 crop=-1 task=ShootCapture pc=22f6c addr=416d750c
==================================================================
[ShootCapture:000232e8 ] cmos_write(0x416D70E0)
CMOS[0] <- 0x803
CMOS[1] <- 0x4CE
CMOS[2] <- 0xC6
CMOS[3] <- 0x900
CMOS[4] <- 0x2
CMOS[5] <- 0x0
CMOS[6] <- 0x42B
CMOS[7] <- 0x800
CMOS[8] <- 0x0
CMOS[9] <- 0x81
Regarding finding adress for dual iso wonder if it's a timing issue. When I check registers set in crop_rec I can see registers flash by in raw.c. first they will be set but quickly goes back to original registers. This is not the case when registers are set manually from adtg_gui. One theory is that shootCapture might be shown briefly but it won't be logged because of some interrupting issue causing registers back into original state.
Call for testers - as lately I've been hunting various bugs on this branch, and noticed some of the changes introduced model-specific issues (for example, api_test.lua was failing on 60D on one of the earliest tests).
For every single camera model available on the Experiments page (lua_fix build), please run:
- api_test.lua (upload the log)
- selftest.mo -> stubs tests (upload the log)
- bench.mo -> memory benchmarks (upload the screenshot)
- overall sanity check (for example, if you decide to take this build out and use it for a couple of hours, please report back)
===============================================================================
ML/SCRIPTS/API_TEST.LUA - 2019-1-1 23:20:32
===============================================================================
Strict mode tests...
Strict mode tests passed.
Generic tests...
arg = table:
[0] = "API_TEST.LUA"
camera = table:
shutter = table:
raw = 104
apex = 6.
ms = 16
value = 0.015625
aperture = table:
raw = 48
apex = 5.
value = 5.6
min = table:
raw = 40
apex = 4.
value = 4.
max = table:
raw = 80
apex = 9.
value = 22.6
iso = table:
raw = 72
apex = 5.
value = 100
ec = table:
raw = 0
value = 0
flash = true
flash_ec = table:
raw = 0
value = 0
kelvin = 6500
mode = 3
metering_mode = 3
drive_mode = 0
model = "Canon EOS M2"
model_short = "EOSM2"
firmware = "1.0.3"
temperature = 211
gui = table:
menu = false
play = false
play_photo = false
play_movie = false
qr = false
idle = false
shoot = function: 0xb0c564
wait = function: 0xb0b490
bulb = function: 0xb0c798
reboot = function: 0xb0c538
burst = function: 0xb0c818
event = table:
pre_shoot = nil
post_shoot = nil
shoot_task = nil
seconds_clock = nil
keypress = nil
custom_picture_taking = nil
intervalometer = nil
config_save = nil
console = table:
hide = function: 0xb09e14
show = function: 0xb09e24
write = function: 0xb09eb8
clear = function: 0xb09e04
lv = table:
enabled = true
paused = false
running = true
zoom = 1
overlays = false
pause = function: 0xb0d048
stop = function: 0xb0c9b0
wait = function: 0xb0d408
info = function: 0xb0cd44
resume = function: 0xb0d038
start = function: 0xb0c9a0
lens = table:
name = "EF-S55-250mm f/4-5.6 IS STM"
focal_length = 55
focus_distance = 655350
hyperfocal = 28540
dof_near = 27357
dof_far = 1000000
af = true
af_mode = 0
focus = function: 0xb0e0b4
autofocus = function: 0xb0deec
display = table:
idle = nil
height = 480
width = 720
load = function: 0xb0ec24
off = function: 0xb0e930
print = function: 0xb0fd60
clear = function: 0xb0e84c
notify_box = function: 0xb0e9f4
pixel = function: 0xb0fb94
screenshot = function: 0xb0e85c
on = function: 0xb0e940
rect = function: 0xb0f568
draw = function: 0xb0eadc
line = function: 0xb0f8cc
circle = function: 0xb0f298
key = table:
last = 10
press = function: 0xb10538
wait = function: 0xb10270
menu = table:
visible = false
set = function: 0xb11b24
close = function: 0xb10898
new = function: 0xb12960
get = function: 0xb11d04
block = function: 0xb10aa0
select = function: 0xb11a50
open = function: 0xb108b0
movie = table:
recording = false
stop = function: 0xb0e4b4
start = function: 0xb0e548
dryos = table:
clock = 23
ms_clock = 23408
image_prefix = "IMG_"
config_dir = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = nil
path = "B:/"
path = "ML/"
path = "ML/SETTINGS/"
ml_card = table:
drive_letter = "B"
dcim_dir = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
file_number = 1393
folder_number = 100
free_space = 13128
image_path = function: 0xb13e60
type = "SD"
path = "B:/"
_card_ptr = userdata
shooting_card = table:
drive_letter = "B"
dcim_dir = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
file_number = 1393
folder_number = 100
free_space = 13128
image_path = function: 0xb13e60
type = "SD"
path = "B:/"
_card_ptr = userdata
cf_card = nil
sd_card = table:
drive_letter = "B"
dcim_dir = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = table:
exists = true
create = function: 0xb13c84
children = function: 0xb13b0c
files = function: 0xb139f0
parent = nil
path = "B:/"
path = "B:/DCIM/"
path = "B:/DCIM/100CANON/"
file_number = 1393
folder_number = 100
free_space = 13128
image_path = function: 0xb13e60
type = "SD"
path = "B:/"
_card_ptr = userdata
date = table:
hour = 23
sec = 33
year = 2019
month = 1
isdst = false
wday = 3
yday = 1
day = 1
min = 20
directory = function: 0xb13550
rename = function: 0xb13410
call = function: 0xb1320c
remove = function: 0xb134e4
interval = table:
time = 10
count = 0
running = false
stop = function: 0xb148a0
battery = table:
function not available on this camera
stack traceback:
[C]: in ?
[C]: in for iterator 'for iterator'
ML/SCRIPTS/LIB/logger.lua:125: in function 'logger.serialize'
ML/SCRIPTS/API_TEST.LUA:45: in function <ML/SCRIPTS/API_TEST.LUA:44>
[C]: in function 'globals.xpcall'
ML/SCRIPTS/API_TEST.LUA:44: in function 'globals.print_table'
ML/SCRIPTS/API_TEST.LUA:90: in function 'globals.generic_tests'
ML/SCRIPTS/API_TEST.LUA:1494: in function <ML/SCRIPTS/API_TEST.LUA:1490>
[C]: in function 'globals.xpcall'
ML/SCRIPTS/API_TEST.LUA:1490: in function 'globals.api_tests'
ML/SCRIPTS/API_TEST.LUA:1529: in main chunktask = table:
create = function: 0xb15088
yield = function: 0xb14f08
property = table:
Generic tests completed.
Module tests...
Testing file I/O...
Copy test: autoexec.bin -> tmp.bin
Copy test OK
Append test: tmp.txt
Append test OK
Rename test: apple.txt -> banana.txt
Rename test OK
Rename test: apple.txt -> ML/banana.txt
Rename test OK
SD card (B:/) present
- free space: 13128 MiB
- next image: B:/DCIM/100CANON/IMG_1394.CR2
- DCIM dir. : B:/DCIM/100CANON/
- B:/DCIM/100CANON/IMG_1352.CR2
- B:/DCIM/100CANON/IMG_1353.CR2
- B:/DCIM/100CANON/MVI_1354.MOV
- B:/DCIM/100CANON/MVI_1355.MOV
- B:/DCIM/100CANON/MVI_1356.MOV
- B:/DCIM/100CANON/MVI_1357.MOV
- B:/DCIM/100CANON/MVI_1358.MOV
- B:/DCIM/100CANON/MVI_1359.MOV
- B:/DCIM/100CANON/MVI_1360.MOV
- B:/DCIM/100CANON/IMG_1361.CR2
- B:/DCIM/100CANON/IMG_1362.CR2
- B:/DCIM/100CANON/IMG_1363.CR2
- B:/DCIM/100CANON/IMG_1364.CR2
- B:/DCIM/100CANON/IMG_1365.CR2
- B:/DCIM/100CANON/MVI_1366.MOV
- B:/DCIM/100CANON/MVI_1367.MOV
- B:/DCIM/100CANON/MVI_1368.MOV
- B:/DCIM/100CANON/MVI_1369.MOV
- B:/DCIM/100CANON/IMG_1370.CR2
- B:/DCIM/100CANON/IMG_1371.CR2
- B:/DCIM/100CANON/IMG_1372.CR2
- B:/DCIM/100CANON/IMG_1373.CR2
- B:/DCIM/100CANON/IMG_1374.CR2
- B:/DCIM/100CANON/IMG_1375.CR2
- B:/DCIM/100CANON/IMG_1376.CR2
- B:/DCIM/100CANON/IMG_1377.CR2
- B:/DCIM/100CANON/IMG_1378.CR2
- B:/DCIM/100CANON/IMG_1379.CR2
- B:/DCIM/100CANON/IMG_1380.CR2
- B:/DCIM/100CANON/IMG_1381.CR2
- B:/DCIM/100CANON/IMG_1382.CR2
- B:/DCIM/100CANON/IMG_1383.CR2
- B:/DCIM/100CANON/IMG_1384.CR2
- B:/DCIM/100CANON/MVI_1385.MOV
- B:/DCIM/100CANON/MVI_1386.MOV
- B:/DCIM/100CANON/IMG_1387.CR2
- B:/DCIM/100CANON/MVI_1388.MOV
- B:/DCIM/100CANON/MVI_1389.MOV
- B:/DCIM/100CANON/IMG_1390.CR2
- B:/DCIM/100CANON/MVI_1391.MOV
- B:/DCIM/100CANON/IMG_1392.CR2
- B:/DCIM/100CANON/MVI_1393.MOV
- B:/SPOTLI~1/
- B:/SPOTLI~1/STORE-V2/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.REP/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.COR/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.LIV/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~2.LIV/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~2.LIV/RETIRE.26
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~3.LIV/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~3.LIV/JOURNA~1.163
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~3.LIV/RETIR~1.163
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~4.LIV/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.ASS/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~2.ASS/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.HEA/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.MIG/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~2.MIG/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.SCA/
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1.SCA/RETIRE.582
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/PSID.DB
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/TM~1.SNO
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/TM~1.LIO
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIO~1.CRE
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/TMP.CAB
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/CA~1.CRE
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/INDEXS~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~1.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~2.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~3.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~4.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~1.SHA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~5.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~~37.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~~40.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~1.DIR
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/STOR~1.UPD
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/0DIREC~1.SHA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~2.SHA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~~54.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~~57.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/~~~~~~60.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~1.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/PERMST~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/CA~1.MOD
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~2.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~~3.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~~4.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~1.SHA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~~5.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~90.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~~93.IND
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/STORE.DB
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/STOR~1.DB
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/REVERS~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/TMPSPO~1.STA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/STORE_~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/JOURNA~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/SHUTDO~1
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/REVERS~1.SHA
- B:/SPOTLI~1/STORE-V2/DEEEAF~1/LIVE~152.SH