Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: SpenceM on September 05, 2018, 03:09:27 PM

Title: Canon EOS R
Post by: SpenceM on September 05, 2018, 03:09:27 PM
Today Canon showed us the new EOS R. Unfortunately, they’re crippling it. 4k video is heavily cropped, and can’t even get 120fps @ 1080p. Also only 1 SD card slot.

So it’s up to the awesome people of MagicLantern to unlock this camera’s true potential!  ;)
Title: Re: Canon EOS R
Post by: a1ex on September 07, 2018, 01:31:20 PM
If you've got one and don't mind running a couple of tests, just ask.

Expecting to get blank screen with M50 code, i.e. hopefully able to run a while(1). Maybe also LED blinks if lucky.
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 01:53:57 PM
Also only 1 SD card slot.
UHS-II interface, though. First time in consumer/prosumer line-up.
Lens interface protocol redesigned. Means work for devs.
No third party lenses for RF mount, only EF/EF-S with adapter. Seriously, Canon?
Menu control redesign.
New HDMI modes.

Sounds like lot of fun and navigation towards HC SVNT DRACONES.
Full code ahead, argh!



Seriously, a1ex: Your twitter account sounds like you'r not absolutely against sending you a specimen. It's nonetheless twitter. So: Where are we heading, cap'n?
Title: Re: Canon EOS R
Post by: kitor on September 07, 2018, 02:09:25 PM
I'm looking forward to see it in person, at the moment I really think about going back to Canon from A7s1. Body seems to win in terms of ergonomic with both Nikon Z and A7/A9. ISO performance (at least on photos I saw, unfortunately jpegs only) is not too bad, and I think up to 40k after Lightroom it will be comparable with a7s in 1080/2.5k resolution that I usually export my photos.

I will miss rear dial. However with new ring on lenses (set this to aperture control) and using camera dials for ISO/exposure seems to be a good idea.

As for 4K, IIRC Kai tried with 10-18mm EF-S on adapter and it worked perfectly. So there are some workarounds to this crop factor other than on 5d4.

Quote
No third party lenses for R mount,
I missed that info, where they stated it? Remember there are not too many third party lenses for Sony FE too. AFAIR Sigma announced first E-mounts this year...

In terms of lenses with my a7s I use 16-35/4 and 24-240 which is perfect (but heavy) all-around lens. Here will probably go back for 70-200 on adapter and native 24-105, sadly there was no wide zoom like 16-35 or 17-40 announced...
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 02:42:22 PM
[RF mount and third party]
I missed that info, where they stated it?

No quote from Canon itself. Problem seems to exist because of a (at least one) Canon patent covering RF mount and no word given about licensing to third parties.
Nothing heard from Sigma, Tamron, Tokina (to name the most usual suspects) about it.

I think/hope there will be some interviews at Photokina trying to get a solid statement about this.
Title: Re: Canon EOS R
Post by: a1ex on September 07, 2018, 04:19:39 PM
Seriously, a1ex: Your twitter account sounds like you'r not absolutely against sending you a specimen. It's nonetheless twitter. So: Where are we heading, cap'n?

Well, since the other DIGIC 6/7 ports appear to be a little different from what we are used to (DIGIC 4/5), and simply waiting for others to jump in apparently wasn't exactly the best idea for these models, I've considered getting a recent camera and making a reference port, that others could easily adapt to other "new" cameras. Was thinking at M50, as it seems close enough to all other DIGIC 7 models, yet different enough to be challenging (its firmware is a strange mix between EOS and PowerShot codebases, and the sensor looks a bit faster than on older Canons).

Then noticed the giveaway and got tempted by the full-frame dual pixel RAW (some unfinished notes I've started to write a while ago here (https://a1ex.magiclantern.fm/bleeding-edge/5D4/5d4-dual-pixel.html)). Didn't expect anything to come up from that, but looks like some folks took it (maybe a bit too) seriously.

EOS R is also DIGIC 8. No idea what's inside, but expecting its firmware to be similar to M50. Whether we'll be able to run code on it, remains to be seen.
Title: Re: Canon EOS R
Post by: dfort on September 07, 2018, 04:28:47 PM
Your twitter account...

You mean we should be following someone other than just @autoexec_bin for the latest ML news?
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 05:34:31 PM
Didn't expect anything to come up from that, but looks like some folks took it (maybe a bit too) seriously.

Friendly forces may be among the hardest to endure. (Source: Fortune cookie of the day)

With that thought in mind:
I think there are some people happy to hear about your change of heart and willing to express their happiness through donations. If you drop a word I'm convinced there will be no troubles getting you a EOS R (+ RF lens + EF/EF-S-Adapter) or a M50.

Title: Re: Canon EOS R
Post by: kitor on September 15, 2018, 07:14:43 PM
I just pre-ordered R + 24-105. So @a1ex if you have any ideas for rom dumping feel free to contact me.

Hope to get it on time as I'm going for a week to Chernobyl Exclusion Zone just day after release. So either new toy (and opportunity to compare it against A7s) for this trip, or will have to wait until I'm back.
Title: Re: Canon EOS R
Post by: KelvinK on September 18, 2018, 11:34:13 AM
Price tag for RF lenses is non adequate (you get body and 28-70 5.5k$) making whole system kinda strange. And for this price you have 50mm in 4k.
Title: Re: Canon EOS R
Post by: kitor on September 18, 2018, 09:38:39 PM
Depends on what you want. I'll probably add 70-200 2.8L IS II + something wide like mentioned 16-35 on EF and leave 24-105 for trips where I don't have time/want to play with lenses.
Yup, I'm not shooting much video, and just before my 5d2 hit the floor (in accident) I worked mostly as photojournalist. After two years break (done only ~3000 shoots on a7s during those 2 years, half of them on two visits in the Zone) i'm getting back into it, and lastly most shots are either on 16-35 or on 100+mm.

With all the 'paradoxes' that R presents, I still decided to buy it. For Canon skintones, EF lenses and body ergonomics (waited for a7sIII but I consider even a9 too small for my hands).
Many people talk about single SD card and IBIS - I don't consider them a problem, but to be fair - none of my previous cameras had those. And would probably buy again 5dc as backup body.
After you go mirrorless, seems there's no going back. I still borrow 5D2 and Nikon D7000 from mum, but after I got used to EVF I always missed exposure on first few shots as on EVF WYSIWYG ;)
Title: Re: Canon EOS R
Post by: lovelybead on October 01, 2018, 03:26:08 AM
I ordered one too. I work in tech and am happy to help with however I can once it arrives!

Theoretically speaking: Would it possible with ML to shoot 120fps in 1080p or would the limit still be 720p? That's the main gripe I have with this camera. The 4k crop I don't mind so much.
Title: Re: Canon EOS R
Post by: kitor on October 01, 2018, 12:27:21 PM
Quote
Theoretically speaking:
We don't have any ideas about internals, and you're asking questions.

Nobody from dev team have it, and what's worse it's not just an iteration of DSLR, some things for sure had changed.
The best expectation is no expectations.
Title: Re: Canon EOS R
Post by: a1ex on October 01, 2018, 07:10:18 PM
If it's like 5D4, it's very unlikely, as 1080p60 appears to be pushed to the limit (https://www.magiclantern.fm/forum/index.php?topic=17695.msg206730#msg206730). That's an unexpected limitation, since on both models, the sensor appears to be fast enough (https://twitter.com/autoexec_bin/status/1037487068870520833) for 1080p120, assuming no readout overhead for lower resolutions.

5D3:

5936x3950x7.65 = 179 Mp/s (full size, including black bars, in photo mode)
5796x3870x7.65 = 171 Mp/s (active area size)

3744x1382x31.5 = 163 Mp/s (full size, including black bars, 1:1 crop x5)
3596x1320x31.5 = 149 Mp/s (active area size)

2080x1320x40 = 109 Mp/s (full size, including black bars, 3x3 binning 1080p FPS override)
1936x1280x40 = 99 Mp/s (active area size)

2080x1040x48 = 104 Mp/s (active size, 3x3 binning crop_rec)
1936x1040x48 = 97 Mp/s (active size)

700D (LiveView figures from the bleeding-edge crop_rec (https://www.magiclantern.fm/forum/index.php?topic=19300.msg205546#msg205546)):

5280x3529x6.45 = 120 Mp/s (full size)
5208x3476x6.45 = 117 Mp/s (active size)

2592x1107x33.3 = 95 Mp/s (full size, 1:1 crop x5)
2520x1080x33.3 = 91 Mp/s (active size)

1808x1189x43.3 = 109 Mp/s (full size, including black bars)
1736x1160x43.3 = 98 Mp/s (active size)

In other words:
- 5D3 1080p (1936x1280) was pushed to 40 FPS, i.e. about 100 Mp/s out of 170 in photo mode (what limits it? no idea)
- 700D 1080p (1736x1160) was pushed to 43 FPS with a slower sensor, i.e. about 100 Mp/s out of 120

Take it with a grain of salt, i.e. as pure speculation or CR0 if you prefer; I did not see the EOS R firmware.
Title: Re: Canon EOS R
Post by: a1ex on October 16, 2018, 08:48:32 PM
Tried to run some initial tests on the EOS R; unfortunately, this is all we've got:

(https://a1ex.magiclantern.fm/bleeding-edge/R/r.jpg)

The error screen looks just like on previous models, which is encouraging. The camera recognized there was a FIR file on the card, for the correct model, otherwise it would have printed "Update file cannot be found". The error message means it could not verify the checksum; Canon might have changed the file format, or maybe also the encryption.



Edit: progress - apparently it doesn't like tiny FIR files, but otherwise it accepts them:

(https://a1ex.magiclantern.fm/bleeding-edge/R/progres.jpg)
Title: Re: Canon EOS R
Post by: kitor on October 21, 2018, 09:06:00 AM
Nice to see that something is going on!
This green screen is a problem with graphics runtime, or it hanged in this state? Just wonder, as graphics is not really needed to have a rom dump...
Title: Re: Canon EOS R
Post by: a1ex on October 21, 2018, 03:56:45 PM
Every single accepted FIR file (that did not print an error) hanged in the green screen state.

Otherwise, the error message was always the one from the screenshot.

My hypothesis:
- Canon does some more checks to decide whether the file format is valid or not (possibly some data structure where the old FIR files had executable code)
- that green screen might be the result of some incomplete display shutdown from the bootloader:
   - test video: https://vimeo.com/295449758
   - while loading a FIR, Canon bootloader prints "Loading..."
   - after that, on previous models it turns off the display and the SD card, then it runs the firmware update program
   - that firmware update will turn on the display again; that means, you would see a short flicker (https://youtu.be/WzMTZr_Zef0?t=280) (display turning off and on for a split second)
   - in the test video, I do not see the display turning off, which is why I believe the bootloader maybe "forgot" to turn it off before running the FIR code
   - maybe just the image stream was turned off, and the display controller (which is likely "smarter" than in previous models) timed out and displayed some green screen.

The above is just speculation.

Easiest way to figure it out: wait for a firmware update.
Harder way: perform some more blind tests, hoping to get some different outcome (other than green screen or error message).

I'm not 100% sure we actually executed code on the camera, but the lack of error message hopefully means the FIR file was accepted (i.e. encryption was not changed).
Title: Re: Canon EOS R
Post by: kitor on October 31, 2018, 01:05:49 PM
As I finally got my hands on R (arrived just yesterday), some photos comparing to 5D2 and A7s1: https://imgur.com/a/8rHgjoI

First impressions:
- grip ergonomy is wonderful. It's smaller than 5D2, but due to a bit different shape it's similar in comfort of holding it.
- where's back dial ?!
- touch bar is a joke. Was disabled factory default and I kept it disabled.
- control ring is interesting feature. Not sure why was also factory default disabled.
- mode dial is not that bad (how often do you switch modes?). However there's so much wasted space in power switch location.
- AF is fast AF ( ;) ). I was amazed after using A7s for last two years.
- 24-105 is quite heavy lens.
- LP-E6N! Took two spare LP-E6 from mum's 5D2 (btw, 10 years anniversary!) and now I have three. Eat this, Sony!
- I'm amazed so far with EVF quality. Much better than A7s1, which was the first EVF that convinced me that mirrorless may substitute DSLR.
- A few more programmable buttons wouldn't hurt.
Title: Re: Canon EOS R
Post by: a1ex on November 17, 2018, 10:53:12 PM
EOS R users might be interested in the following numbers (thanks @kitor for test images):

Silent still: 17.47 μs/line, 78.25 ms full readout at 6720x4480 => 385 MPix/second readout speed?
4K24/23.98/25/30: 14.45 +/- 0.019 μs/line, 31.2 ms at 3840x2160
1080p24/25/30/50/60: 14.12 +/- 0.067 μs/line, 15.3 ms at 1920x1080
720p25/30/50/60: 21.20 +/- 0.087 μs/line, 15.3 ms at 1280x720
720p100/120: 9.47 +/- 0.204 μs/line, 6.8 ms at 1280x720
Title: Re: Canon EOS R
Post by: Walter Schulz on December 13, 2018, 10:15:44 AM
Most readers may be aware of Lensrental's tear-down/disssembly of an RF 50/1.2:
https://www.lensrentals.com/blog/2018/12/disassembly-of-the-canon-rf-50mm-f1-2l/

Well, R system really seems to be a hard nut to crack ...
Title: Re: Canon EOS R
Post by: kitor on December 17, 2018, 08:41:44 AM
After some time spent with R I have some more conclusions:

- AF works great with EF lenses (I use 100-400 atm)
- Grip is expensive as hell, but worth it - since it will charge both batteries inside
- quirks: grip has separate USB-C for charging, will charge only with LP-E6N, won't charge any with both E6 and E6N inserted.
- where's back dial ?! ( ;) )

Yesterday I (finally!) bought 5DIII as spare body... with respectable 258k shutter count :P Yep, it was so cheap I can replace shutter twice before hit "usual" price, and it has so signs of failing.
Anyway, to the point. When I was shooting with 5D2 and 100-400 (had a7 16-35, r 24-105 and 5d2 100-400 on last trip to cover all scenarios) I noticed i somehow like R grip better. Now I confirmed this - due to it's grip depth, R with 100-400 on adapter seems more comfortable to me. Feels more secure in my hands, and that's an interesting observation as I was looking to jump to 1 series for bigger body while I had my first 5D2...
Title: Re: Canon EOS R
Post by: Dmytro_ua on December 17, 2018, 10:34:47 AM
This question is directed more to ML developers then to R owners.
Is R have any potential advantages for ML video possibilities over 5d4, except eye tracking?
Title: Re: Canon EOS R
Post by: KelvinK on December 17, 2018, 01:23:06 PM
This question is directed more to ML developers then to R owners.
Is R have any potential advantages for ML video possibilities over 5d4, except eye tracking?

No. But image quality can differ. For some reason, 4K on 5D4 is sharper then on R.
Title: Re: Canon EOS R
Post by: Dmytro_ua on December 17, 2018, 03:49:55 PM
No.

What about DIGIC 6+ vs DIGIC 8,  CF bus vs SDXC UHS-II bus?
Title: Re: Canon EOS R
Post by: kitor on January 10, 2019, 08:13:25 AM
Interesting quirks:
- Battery grip has ability to upgrade it's firmware (additional option in firmware update menu).
- Toshiba M4EBF10XBG inside (may be wrong about F). Google gives no results, but A1ex found another uC with very similar name.
- Shutter and AF pins are directly available on grip connector. Ground them for action.
- There's a single (unused in grip) pin that shows some digital communication on camera start, photo shots and sometimes random "messages" on idle. Signal is active-low 3.3v, around 50kHz, but no luck trying to treat is as 57600 serial communication. Will borrow logical analyzer and try to dump this.

(https://i.ibb.co/FgnmgJ1/49759127-1882742475181896-2832192286425612288-n.jpg) (https://ibb.co/FgnmgJ1)

USB-C in grip seems to be used only for charging grip batteries. USB-C in body is used for communication and charge of internal battery when no grip is attached.
Both work only with LP-E6N (won't charge E6) and with USB-PD adapters only. No luck with standard 5V chargers and QC/PE ones.
Title: Re: Canon EOS R
Post by: a1ex on January 10, 2019, 08:57:57 AM
- There's a single (unused in grip) pin that shows some digital communication on camera start, photo shots and sometimes random "messages" on idle. Signal is active-low 3.3v, around 50kHz, but no luck trying to treat is as 57600 serial communication.

Here's my attempt at manually identifying the message format and timings. It appears to be UART (https://tutorial.cytron.io/2012/02/16/uart-universal-asynchronous-receiver-and-transmitter/), bit time about 18.5-19 microseconds, so about 52000-54000 baud. Couldn't identify any plain text in these short fragments, though.

(https://a1ex.magiclantern.fm/bleeding-edge/R/r-uart2.jpg) (https://a1ex.magiclantern.fm/bleeding-edge/R/r-uart4.jpg)
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 28, 2019, 06:55:29 PM
Hello, Where can i download the Magic lantern firmware update for EOS R?
Title: Re: Canon EOS R
Post by: Walter Schulz on January 28, 2019, 07:58:57 PM
You have to find the tree ... (https://www.magiclantern.fm/forum/index.php?topic=17695.msg207023#msg207023)
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 29, 2019, 10:19:51 AM
It´s under development?
Title: Re: Canon EOS R
Post by: Walter Schulz on January 29, 2019, 10:26:40 AM
What difference does it make? ML development follows no schedule.
2 years ago a generous offer was made: A 750D (free of charge) for anyone willing and able to port it. Nobody claimed it ...

My advice:
If there is no ML for your cam act like there will be no ML for your cam ever.
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 29, 2019, 02:32:44 PM
Where can i download RLEDID14.FIR  ?
Title: Canon EOS R Firmware
Post by: jga on February 12, 2019, 07:23:45 AM
Firmware 1.1 has been released: https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware
Title: Re: Canon EOS R
Post by: civita on February 12, 2019, 08:43:03 AM
A new firmware regarding EOS R was released!

https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware
 (https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware)
Canon EOS R Firmware v.1.1.0 changes:
Title: Re: Canon EOS R
Post by: Sapporo on February 12, 2019, 11:32:06 AM
Firmware 1.1.0 is release from Canon now https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware&firmwaredetailid=tcm:13-1776855
Title: Re: Canon EOS R
Post by: kitor on February 12, 2019, 05:47:18 PM
Grip communication was my mistake, this pin is used by grip itself unfortunately.
Anyway,
Code: [Select]
Battery close!
RSTFLG : 0010
E1ON
openBattery
/USB_DET undetected
setCCSnkRst

MON>>>All task Initialize
================SD send recode 0 0
WakeupReason from ICU: 0x67,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,
Hello from MPU  8)
Title: Re: Canon EOS R
Post by: a1ex on February 12, 2019, 10:17:56 PM
... the "behind the scenes" picture:

(https://a1ex.magiclantern.fm/bleeding-edge/R/rr.jpg)

The firmware update... unfortunately wasn't helpful. None of my previous tricks worked with it. I'm still wondering why some of my previous test FIRs resulted in green screen, but I'm now 100% sure we did not execute any code on the camera. The green screen was likely a bug in Canon's FIR loading routine, or something like that.

The good news - kitor identified two UART ports: one at 3.3V, used by the MPU (outputs the log from above) and another at 1.8V, likely used by the main CPU (same voltage level on DIGIC 6 (https://www.magiclantern.fm/forum/index.php?topic=7531.msg200763#msg200763)). The latter needs some level shifting (https://electronics.stackexchange.com/questions/333229/1-8v-uart-with-3-3v-uart), but - at least on previous models - it has everything we need to enable the boot flag and explore around.

Worst case - ML on EOS R may require some hardware hacking in order to install it (like in the above picture). No big deal, right? I mean, you need a lot more knowledge to be able to use it (https://www.eoshd.com/comments/topic/28683-how-do-i-get-ml-crop-recording-going-on-my-5d3/?tab=comments#comment-273299) ;)

Also forgot to mention - I've got high-res PCB pictures from the Lensrentals teardown (https://www.lensrentals.com/blog/2018/10/teardown-of-the-canon-eos-r-mirrorless-camera/). If any of you can identify anything from here, please write it down.

(https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7943-small.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7943.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7944-small.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7944.JPG)
Title: Re: Canon EOS R
Post by: kitor on February 13, 2019, 05:24:04 PM
Oh hello!

Code: [Select]
Dry[WarpPUX]> sysvers
SystemIF 1.01
DRYOS version 2.3, release #0060+p4
 MACH 0.51
Title: Re: Canon EOS R
Post by: kitor on February 14, 2019, 08:03:51 AM
If you missed the news:
https://twitter.com/_kitor/status/1095807058358796290

However executed via bootloader CLI, and took a lot of pain to debug this for Alex and me. Would be much easier if I had proper FPC for this debug connector; had to hold needle to TX pad all the time by hand.
Title: Re: Canon EOS R
Post by: Danne on February 14, 2019, 08:12:18 AM
Geniuses.
Title: Re: Canon EOS R
Post by: a1ex on February 14, 2019, 06:21:17 PM
Initial notes:

- Encryption changed. Wasn't able to look inside the firmware update. Unable to create FIR files for this camera.
- Other than that, bootloader and overall code structure look familiar.
- Portable ROM dumper worked (https://bitbucket.org/hudson/magic-lantern/commits/b6ec71d104dcb66f48802707467fd7e8036816ac?at=recovery) after (https://bitbucket.org/hudson/magic-lantern/commits/230b4fdd1ad3f31c3e4c93155e4504d83cc1c657?at=recovery) some (https://bitbucket.org/hudson/magic-lantern/commits/5b87791d9c225bb6c7a2feefed570f8b955317db?at=recovery) minor (https://bitbucket.org/hudson/magic-lantern/commits/1ff7677fcababfbbebd44d386aa5f312656e404a?at=recovery) tweaking (https://bitbucket.org/hudson/magic-lantern/commits/19f18f0492eaa4ea86c4550e33f24733aeb54fe5?at=recovery).
- Display buffer in bootloader context: 1024x682, otherwise like M50 (UYVY).
- LED address: 0xD01300D4 (0xD01300D8/DC maybe also valid).
- CPU info: identical to M50/SX70.
- Early startup: identical to M50 (yes, this entire block (https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/platform/M50.101/consts.h?fileviewer=file-view-default#consts.h-9) is identical, same stub addresses).
- Can jump to main firmware (with this trick (https://bitbucket.org/hudson/magic-lantern/commits/7d4d8bbd3b0257eb7cc893777f6e47d7684b3970?at=digic6-dumper)). Autoexec.bin is loaded on both CPU cores (https://bitbucket.org/hudson/magic-lantern/commits/0f8fc984f719c52d3be1749be20133e643f0bdd6?at=digic6-dumper) (maybe there are more?)
- Can save log files and dump ROM from main firmware.
- Overall, very similar to M50, but closer to "classic" EOS firmware (i.e. less of a PowerShot). Also has a MPU.
- Most of the code runs from ROM, very much like M50.
- Source code committed to digic6-dumper (https://bitbucket.org/hudson/magic-lantern/branch/digic6-dumper) branch (initial platform directory) and recovery (https://bitbucket.org/hudson/magic-lantern/branch/recovery) branch (portable ROM dumper, CPU info).

... and took a lot of pain to debug this for Alex and me.

It's true, it took us many hours of debugging, but compared to other models, this was quite easy. It definitely wasn't a matter of staring at the code for hours or days with no idea what to do next (cough 7D, EOSM shutter bug, 80D io_trace and many others). Yes, the camera was stubborn, but there was visible progress every few dozens of minutes (except during our breaks).

That was partly because most of the hard work was already done for M50 and all other earlier models, so it was mostly a matter of identifying what to tweak. And because Canon didn't change *that* much (except for the FIR encryption). And I didn't have to hold any needle on the UART connector :D
Title: Re: Canon EOS R
Post by: Walter Schulz on February 14, 2019, 06:39:23 PM
- Encryption changed.

Boy, really hate to read that!
Title: Re: Canon EOS R
Post by: Indy on February 14, 2019, 11:34:15 PM
Boy, really hate to read that!
Working on it with Alex :-)
Title: Re: Canon EOS R
Post by: kitor on February 15, 2019, 07:31:14 AM
Initial notes:

I'll add here
- LV is taking so many resources, that it's loosing input on UART. Going into menu makes it reliable + camera output is a few times faster.

For adventurous (as it need's 1v8 UART or 3v3 with voltage divider on TX), simple bootloader dumper:
Code: [Select]
import serial
import sys

start = int('0xE0000000',16)
end = int('0xE0040000',16)
step = int('0x1000',16)
current = start

with serial.Serial('/dev/ttyS6', 115200, timeout=1) as ser, open("dump2.log", 'w', encoding='utf-8') as logfile:
  while True:
    line = ser.readline()
    if line is not b'':     #skip timeouts
      decoded = line.replace(b'\r\n',b'').decode("UTF-8") #bytes to string
      print(decoded)
      logfile.write(decoded + '\n')

    if b"Mode ON" in line:       #enter interactive shell
      ser.write(b'akashimorino\r\n')
    elif b"K424[1]>" in line:    #prompt, start data dump
      if current > end:
        sys.exit(0)
      ser.write(str.encode("d " + hex(current) + " " + hex(step) + "\r\n"))
      current += step

Of course you need to reassemble this data into binary form yourself.

UART location/pinout is here (https://www.magiclantern.fm/forum/index.php?topic=7531.msg212071#msg212071).


Quote
And I didn't have to hold any needle on the UART connector
Yup. Fortunately with bootflag enabled, now RX is sufficient.
Title: Re: Canon EOS R
Post by: a1ex on February 15, 2019, 05:05:15 PM
This camera has 2 GiB (https://www.magiclantern.fm/forum/index.php?topic=5071.msg212085#msg212085) of RAM 8)

Canon already struggled to pack this amount of RAM into the 32-bit address space: only the first GiB is visible as regular ("cacheable") memory. The second GiB is only visible as "uncacheable", and - just a guess - probably used exclusively by DMAs (image processing etc). Then, there are 512 MiB reserved from peripherals (addresses starting with C and D), 256 for the main ROM (starting with E), 256 for the slow (serial?) flash (starting with F, but apparently unused on R), and a couple of small regions overlapped here and there (DF - probably some sort of TCM; BFE - something with special meaning, etc).

MMU configuration is very similar to DIGIC 7:
Code: [Select]
00001000-00001FFF -> 00000000-00000FFF (   +0) O:NCACH I:WB,WA  P:RW       [ CPU0 only ]
00001000-00001FFF -> 00001000-00001FFF (-1000) O:NCACH I:WB,WA  P:RW       [ CPU1 only ]
00002000-3FFFFFFF -> 00002000-3FFFFFFF (   +0) O:NCACH I:WB,WA  P:RW       [ cacheable RAM - only the first GiB ]
40000000-BFFFFFFF -> 40000000-BFFFFFFF (   +0) O:NCACH I:NCACH  P:RW       [ uncacheable RAM - 2 GiB ]
C0000000-C2FFFFFF -> C0000000-C2FFFFFF (   +0) Device           P:RW XN    [ MMIO area ]
C4000000-C4FFFFFF -> C4000000-C4FFFFFF (   +0) Device           P:RW XN
C8000000-CAFFFFFF -> C8000000-CAFFFFFF (   +0) Device           P:RW XN
CC000000-CDFFFFFF -> CC000000-CDFFFFFF (   +0) Device           P:RW XN
D0000000-D0FFFFFF -> D0000000-D0FFFFFF (   +0) Device           P:RW XN
D2000000-D2FFFFFF -> D2000000-D2FFFFFF (   +0) Device           P:RW XN
D4000000-D5FFFFFF -> D4000000-D5FFFFFF (   +0) Device           P:RW XN
D7000000-D9FFFFFF -> D7000000-D9FFFFFF (   +0) Device           P:RW XN
DE000000-DEFFFFFF -> DE000000-DEFFFFFF (   +0) Device           P:RW XN
DF000000-DFFFFFFF -> DF000000-DFFFFFFF (   +0) O:NCACH I:WB,WA  P:RW       [ TCM? ]
E0000000-E7FFFFFF -> E0000000-E7FFFFFF (   +0) O:WB,WA I:WB,WA  P:R        [ main ROM ]
E8000000-EFFFFFFF -> E8000000-EFFFFFFF (   +0) Strongly-ordered P:R  XN    [ ? ]
F0000000-F7FFFFFF -> F0000000-F7FFFFFF (   +0) O:WB,WA I:WB,WA  P:R        [ only used on M50; at least on DIGIC 7, it's much slower than main ROM ]
F8000000-FFFFFFFF -> F8000000-FFFFFFFF (   +0) Strongly-ordered P:R  XN    [ ? ]

i.e.
- 00000000-00000FFF virtual: unavailable (likely used to catch null pointer errors)
- 00001000-00001FFF virtual: private page for each of the two cores (mapped to either 00000000-00000FFF or 00001000-00001FFF physical)
- other than that, flat mapping everywhere (with different permissions)
- some regions in the MMIO (Device) areas are unavailable; minor differences from DIGIC 7 in this area.
Title: Re: Canon EOS R
Post by: Mike Tornado on February 15, 2019, 07:00:54 PM
I'll add here
- LV is taking so many resources, that it's loosing input on UART. Going into menu makes it reliable + camera output is a few times faster.

For adventurous (as it need's 1v8 UART or 3v3 with voltage divider on TX), simple bootloader dumper:
Code: [Select]
import serial
import sys

start = int('0xE0000000',16)
end = int('0xE0040000',16)
step = int('0x1000',16)
current = start

with serial.Serial('/dev/ttyS6', 115200, timeout=1) as ser, open("dump2.log", 'w', encoding='utf-8') as logfile:
  while True:
    line = ser.readline()
    if line is not b'':     #skip timeouts
      decoded = line.replace(b'\r\n',b'').decode("UTF-8") #bytes to string
      print(decoded)
      logfile.write(decoded + '\n')

    if b"Mode ON" in line:       #enter interactive shell
      ser.write(b'akashimorino\r\n')
    elif b"K424[1]>" in line:    #prompt, start data dump
      if current > end:
        sys.exit(0)
      ser.write(str.encode("d " + hex(current) + " " + hex(step) + "\r\n"))
      current += step

Of course you need to reassemble this data into binary form yourself.

UART location/pinout is here (https://www.magiclantern.fm/forum/index.php?topic=7531.msg212071#msg212071).

Yup. Fortunately with bootflag enabled, now RX is sufficient.

Did you try sht_memoryread2 B:/K424_00.bin 0xE0000000 0x00040000 ?
Title: Re: Canon EOS R
Post by: kitor on February 15, 2019, 07:11:48 PM
No, was working with what Alex provided to me. While I have *some* background in hw hacking (was working on jlime linux port to bsquare power handheld... 10 years ago), that's my first entry into Canon's world (only messed with ML 5d2 audio code before).
Printing things over serial seems to be safer too (considering still have 4/5 of loan to pay and disassembled camera already  ;) )

[e]
sht_memoryread2 is missing :(