Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: dfort on April 21, 2018, 04:20:27 PM

Title: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 21, 2018, 04:20:27 PM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)

+1
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: acarboni on May 22, 2018, 05:40:24 PM
Hi! I've got an M50, a second camera, and I went out and bought a couple low-capacity SD cards. I'd love to help out with the blinking led test. Do I just use the standard one from the diagnostic tools thread (http://a1ex.magiclantern.fm/blink/autoexec.bin)? Does anyone have a link to instructions/materials that I might've missed to help me through the process?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lovefilm on June 03, 2018, 10:46:06 PM
Portable ROM dumpers (https://www.magiclantern.fm/forum/index.php?topic=16534) ready 8)

M50_DUMP.FIR (need a second volunteer who has either another camera to film the display, or a phototransistor connected to soundcard/arduino/whatever)

Emulation coming soon.

Hello a1ex!

Also got a M50 and a 2nd camera, would be happy to help as well.

Since the M50 is running EOS firmware, would that mean its easier to port Magic Lantern to it? :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on June 04, 2018, 04:19:01 PM
I went out and bought a couple low-capacity SD cards.

Really? You only need a small filesystem; card size doesn't matter. You can run the test on 128GB cards just as easy as on a 2GB card (in other words, both of them will have to be formatted at a smaller capacity anyway).

LED blinking FIR sent via PM.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lovefilm on June 04, 2018, 11:04:07 PM
LED blinking FIR sent via PM.

Trying to get it working on my M50,

I used dd to write the QEMU image suggested in here https://www.magiclantern.fm/forum/index.php?topic=16534.0 to my SD-Card, this it how it looks now:
Code: [Select]
root@cubeX:/home/freezer/Canon# fdisk -l /dev/sdd
Disk /dev/sdd: 59,5 GiB, 63864569856 bytes, 124735488 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start    End Sectors   Size Id Type
/dev/sdd1          99 506879  506781 247,5M  6 FAT16

And the file-structure within the FAT16:

Code: [Select]
root@cubeX:/media/freezer/EOS_DIGITAL# find .
.
./autoexec.bin
./LEDIDM50.FIR
./DCIM
./DCIM/autoexec.bin
./DCIM/LEDIDM50.FIR
./DCIM/100CANON
./DCIM/EOSMISC
./MISC

filesizes:
-rw-r--r-- 1 freezer freezer   604 Jun  4 19:16 LEDIDM50.FIR
-rw-r--r-- 1 freezer freezer 25312 Jun  4 20:07 autoexec.bin

I used the autoexec.bin from the Portable ROM-Dumper thread above and the .FIR provided. Copied them to both / and /DCIM

However nothing really seems to happen when turning it on with the SD-Card inserted. As far as I understand the .FIR file is to enable the boot-flag in the Canon Firmware, is there anything special needed to do to apply it?


Thanks!

Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ArcziPL on June 04, 2018, 11:28:58 PM
Run "firmware update" from the original menu.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lovefilm on June 04, 2018, 11:48:06 PM
Run "firmware update" from the original menu.

Can't find any option to update firmware in the original menu.

EOS Utility seems to have an option for Firmware Update, not sure if that would work? Don't have a Windows installation right now.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ArcziPL on June 05, 2018, 08:06:09 AM
You have to be in one of the following modes: M/Av/Tv/P. The camera manual describes it for sure. And don't use EOS Utility for that.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on June 05, 2018, 08:58:52 AM
Page 299 of your manual contains a screenshot showing firmware information. Highlight/select this item and open sub-menu to access firmware update option.
@ArcziPL: Nope, Canon don't bother users with this kind of geeky stuff ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lovefilm on June 05, 2018, 09:15:16 AM
Thanks,
got it now.

However when i confirm "Update firmware" with OK, the LCD screen goes black immediately with no LED blinking or anything else happening.
Have to remove the battery to revive it. 
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ldevulder on June 10, 2018, 05:23:09 PM
Hi all,

I've got a M50 and another camera (6D). I'm ready to help any developper to port ML on this camera.

I didn't find the FIR file to perform the LED blinking test on the M50.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on June 11, 2018, 10:00:32 PM
I didn't find the FIR file to perform the LED blinking test on the M50.

You need to get it from a1ex via PM.

Also read over posts from lovefilm because he tried running the M50 LED blinking test.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Ant123 on August 07, 2018, 11:06:24 PM
Canon released firmware update (https://www.usa.canon.com/internet/portal/us/home/support/details/cameras/eos-m-series-digital-cameras/eos-m50-body?subtab=downloads-firmware) for EOS M50.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on August 08, 2018, 05:55:59 PM
Looks very much like DIGIC 7. Dual core.

Code: [Select]
EC412 READY
EC412 ICU Firmware Version 1.0.1 ( 6.8.0 )
ICU Release DateTime May 23 2018 15:50:06
...
[CPU0] [        init:e014499b ] task_create(PowerMgr, prio=20, stack=400, entry=e01448ed, arg=0)
[CPU0] [        init:e0558f51 ] task_create(DbgMgr, prio=1f, stack=0, entry=e0558ecf, arg=c81c78)
[CPU0] [        init:e0097255 ] CreateStateObject(DMState, 0xe09d49c0, inputs=22, states=2)
[CPU0] [        init:e004c24b ] task_create(EEPROM, prio=1f, stack=400, entry=e004bea5, arg=0)
[CPU0] [        init:e0044ea9 ] task_create(ROM0R, prio=11, stack=400, entry=e00448c1, arg=620004)
[CPU0] [        init:e0044ebb ] task_create(ROM1R, prio=11, stack=400, entry=e00448c1, arg=640006)
...
[CPU0] [        init:e0622337 ] register_func('EnableBootDisk', e062228b, 0)
[CPU0] [        init:e0622343 ] register_func('DisableBootDisk', e0622295, 0)
...
[CPU0] [        init:e0050521 ] task_create(Startup, prio=15, stack=2800, entry=e0050415, arg=c826a0)
[CPU0] [        init:e0040905 ] task_create(TaskMain, prio=1d, stack=0, entry=e0040525, arg=0)
[CPU0] [     Startup:e0558f51 ] task_create(PropMgr, prio=14, stack=0, entry=e0558ecf, arg=cc9264)

akashimorino
[CPU0] [    TaskMain:e00461e9 ] register_func('drysh', e07393e9, 0)
[CPU0] [    TaskMain:e00461ff ] register_func('NewTaskShell', e00461ad, 0)
[CPU0] [    TaskMain:e00461c9 ] task_create(EvShel, prio=18, stack=8000, entry=e0046105, arg=0)
[CPU0] [      EvShel:e05773eb ] task_create(LowConsole, prio=19, stack=800, entry=e005153d, arg=0)
[CPU0] [      EvShel:e05773eb ] task_create(ConsoleSvr, prio=18, stack=800, entry=e0051141, arg=0)

Open Console EC412[1]>...

EC412[1]>drysh

Dry[WarpPUX]> ?
[Kern]
 extask  memmap  meminfo  mkcfg  dminfo  exobjinfo  stdlibcfg  efatcfg
 sysvers  xd  xm  prio  resume  suspend  release  sem  mutex  event  mq  exit

Dry[WarpPUX]> memmap
e008f6c0 : Exception vector
000dc870 : Heap start
           0x00114920(1132832)
001f1190 : Heap end
001f1190 : DRYOS system object
           0x000094e0(38112)
001fa670 : DRYOS system memory
           0x000e2200(926208)
000dc070 : Error exception stack start (PU0)
           0x00000400(1024)
000dc470 : Error exception stack end (PU0)
000dc470 : Error exception stack start (PU1)
           0x00000400(1024)
000dc870 : Error exception stack end (PU1)
df000000 : IRQ exception stack start (PU0)
           0x00001000(4096)
df001000 : IRQ exception stack end (PU0)
df001000 : IRQ exception stack start (PU1)
           0x00001000(4096)
df002000 : IRQ exception stack end (PU1)

Dry[WarpPUX]> meminfo -m
Malloc Information (onetime type)
  Start Address       = 0x000dc878
  End Address         = 0x001f0ec0
  Total Size          = 0x00114648 (  1132104)
  Allocated Size      = 0x000018c8 (     6344)
  Allocated Peak      = 0x000018c8 (     6344)
  Allocated Count     = 0x00000008 (        8)
  Free Size           = 0x00112d80 (  1125760)
  Free Block Max Size = 0x00112d80 (  1125760)
  Free Block Count    = 0x00000001 (        1)

Dry[WarpPUX]> sysvers
SystemIF 0.97
DRYOS version 2.3, release #0060+p2
 MACH 0.50

TODO: figure out LED address(es), bootloader display registers and a way to dump the ROM. Currently running it from a modified 200D bootloader.

Edit: might have found the LEDs (drive values: on = 0xD0002, off = 0xC0003)
- 0: SD card LED 0xD01300E4
- 6: WLAN LED 0xD01300E4 (same LED?!)
- 7, 8, 10, 11: 0xD01300E4 (same LED?!)
- 1, 2, 3, 4, 9: unknown 0xD01301A4
- 5: ?! (no obvious MMIO activity)

Volunteers willing to run untested code are welcome.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: shadimar69 on October 18, 2018, 04:12:32 AM
Hi all,

Just received my shiny new M50 and then rapidly proceeded to wonder how I can make it do what it 'should' be able to do. ;)

I have read through this forum, and have not seen any definitive working versions of ML(Magic Lantern) for the M50. Can someone significantly more intelligent than myself in regards to firmware code injection, please advise current status of a functioning ML for the Canon M50 on the DIGIC 8?

Please let me know if there is anything I can do to help progress/assist with the project moving forward.

Thanks in advance! :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on October 18, 2018, 09:22:22 AM
Status:
- can run custom code (FIR files for now; I need to prepare those)
- can blink the LEDs
- can flip error screen from bootloader
- can jump to main firmware from FIR (no special tricks required)
- cannot boot main firmware with 200D code (likely easy to debug)
- can not display custom stuff on the screen, not even from bootloader (likely easy after seeing the bootloader)

I can prepare test files for #5, but not right now.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: shadimar69 on October 18, 2018, 10:14:58 AM
Thank you for the status update a1ex!

Please let me know if there is anything that I can do to help expedite any of the steps.

Thank you again! :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: c_joerg on October 23, 2018, 09:38:54 AM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)

Does anyone know if Canon Basic is available on the M50 or EOS R(as with the M3)?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on October 23, 2018, 10:02:27 AM
Maybe. The M50 ROM contains the following strings:

Code: [Select]
B:/script.req
uartr.req
FIO_GetFileInfo (%s) ver.req failed
(%s) ver.req Dir
for DC_scriptdisk
B:/Factory.m
B:/AutoTest.m
B:/Extend.m

I have not tested it, but it's worth trying (http://chdk.wikia.com/wiki/Canon_Basic).

There is some (different) scripting interface in DIGIC 5 DSLRs (https://www.magiclantern.fm/forum/index.php?topic=2864.msg190986#msg190986) as well, but I have not explored it (it's left as a nice exercise for the community). This scripting engine is not present on DIGIC 6 or newer "pure EOS" models, from what I could tell.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: SniperJunkie on December 06, 2018, 10:10:56 PM
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: kenthinson on December 07, 2018, 06:38:11 AM
For DIGIC 7 models, the next step is porting the 80D startup code (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200895;topicseen#msg200895) (i.e. running user code alongside Canon firmware). I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras. You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you can test it on the camera.

The previous post was for M50 ( DIGIC 8 ). On this camera, I don't know yet how the bootloader looks like, and the code written for DIGIC 7 didn't work, so I'll probably attempt to dump the ROM directly from main firmware. The tests you'll run are:
- jumping to Canon firmware (expecting to be identical to DIGIC 7, i.e. jumping to 0xE0040000)
- LED blinking (testing the above addresses)
- LED blinking from main firmware (if I'll get this working in QEMU)
- ROM dumping from main firmware (could not test this one in QEMU yet)
- other tests (CPU model, diagnostic logs etc)

After publishing the ROM dumper, I'll update the emulator, attempt to enable the boot flag and get some diagnostic logs. Further progress will require a developer with a camera in their hands and plenty of spare time for experiments. If that describes you, your contribution will be more than welcome. I'll be here to help if you get stuck, but please be aware I'm not interested in maintaining yet another camera port alone.

If the code damages the camera, I'll try to help, but cannot guarantee success.

Hi a1ex. I'm a software engineering student. I'll be graduating the end of the month. I'm interested in working on my m50 with my spare time. I see the documentation on the site about setting up qemu dev environment. Looks exciting. Any advice you have for me before I jump in? Thanks :)

I'll be jumping in after the semester is over. For now back to writing papers  :'(
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on December 07, 2018, 07:49:20 AM
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.

Do you have another cam with ML running on it?
If not:
Take a look into http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input

@kenthinson: Welcome abord! Best luck for the finals!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on December 08, 2018, 07:11:57 PM
After exploring the D8 disassembly I have (I was given a reconstructed M50 dump) I decided to publish my findings here.

- The camera does appear to have the scripting language we (@CHDK) refer to as Canon Basic.
- I have the impression that the card setup is the same as described here: http://chdk.wikia.com/wiki/Canon_Basic/Card_Setup
- Event procedures (short: eventproc) do exist, the eventproc handling firmware routines seem to be the same as on PowerShots.
- There seems to be support for extend.m and autotest.m scripts, but their invocation may differ from what's described here: http://chdk.wikia.com/wiki/Canon_Basic#Starting_the_script

- Now, the differences:
 - Most event procedures that appear in CHDK related scripts do not exist. That means, CHDK scripts will not work on D8 cams.
 - Many event procedures seem to be pre-registered, so registration functions such as System.Create() are not necessarily needed.
 - In file names, the card root is B:/
 - I have not yet found an eventproc to write binary files from script, or, to write text on screen.
 
Problem is, I can't say for sure whether using a prepared script card is enough to run scripts. So, everything below is speculation.

Script support seems to be enabled when the cam is in factory mode - the factory mode flag is at 0xE1FF802C.
I think it is also enabled when there's a script named "AutoTest.m" in the root of the card. The code I found loads "AutoTest.m" automatically at the end of the startup procedure.

The following minimal script should make a hex dump of the first 0x40000 bytes of ROM. I'm not certain that my WriteFileString interpretation is correct.
For a first try, name the script "AutoTest.m".

Code: [Select]
dim startadr=0xe0000000
dim romsize=0x40000
dim fname="B:/ROM.TXT"

private sub Initialize()
    p = startadr
    f = OpenFileCREAT(fname)
    do while p < (startadr+romsize)
        WriteFileString(f,"%08X: %08x %08x %08x %08x\n",p,*p,*(p+4),*(p+8),*(p+12))
        p = p + 16
    loop
    CloseFile(f)
end sub

This script is not camera specific, so it can be tried on any D8 cameras (assuming that all D8 cams share the same codebase):
EOS M50, R; PowerShot SX740, SX70

To make sure the card is correctly prepared for scripting, get any older PowerShot (2005...2017) and use the universal dumper script (http://chdk.wikia.com/wiki/Canon_Basic/Scripts/Dumper) to check.

I can't guarantee success, but I think it's worth to try this route.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: StefanKeller.AC on December 18, 2018, 05:40:54 PM
sorry, but I didnt have success on my M50, I prepared the Card with EOSCard after true formating in the M50
(but with my M50 I also did not have success with the dumper scripts)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on December 18, 2018, 06:09:09 PM
EOScard?
Is there a bootflag enabler for the real (not emulated) M50 body?
Wondering if I missed something ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on December 18, 2018, 06:13:04 PM
sorry, but I didnt have success on my M50, I prepared the Card with EOSCard after true formating in the M50
(but with my M50 I also did not have success with the dumper scripts)
Thanks for trying. I guess we'll know more when emulation of the M50 becomes possible.
EOScard?
Is there a bootflag enabler for the real (not emulated) M50 body?
Wondering if I missed something ...
EOSCard can also set PowerShot-related flags, in this case the SCRIPT signature.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on December 18, 2018, 06:28:18 PM
EOSCard can also set PowerShot-related flags, in this case the SCRIPT signature.

Thanks for the explanation! I should get accustomed to those "hybrid cams" (for lack of a better word) terms...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on December 24, 2018, 10:39:36 PM
Please find a ROM dumper for the EOS/PowerShot M50. It took an entire week of trial and error to figure it out - thanks @71m363nd3r for testing!

D_M50101.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/D_M50101.FIR) (only for M50 firmware 1.0.1)

Source code: commit 568e05a (https://bitbucket.org/hudson/magic-lantern/commits/568e05a).

This is not using the portable codebase, but runs directly from the main firmware, using the regular ML boot process. For this reason, it is only compatible with M50 firmware 1.0.1. On other firmwares, it will just lock up.

There were two mysterious bugs that were preventing ML from booting on the M50 on real hardware, although it was working fine in the emulator, and its early startup code was apparently identical to 200D's:

1) The FIR is running on both CPU cores (unlike DIGIC 7, but I need to double-check). The two cores do not start at the same time; the main one (CPU0) wakes up the secondary one (CPU1) somewhere in cstart. It was easy to fix (https://bitbucket.org/hudson/magic-lantern/commits/0f8fc984f719c52d3b), but figuring it out with LED blinks was very puzzling.

2) The startup code, although nearly identical to 200D's, expected one of the cache maintenance functions to preserve R3 across the call (something not compatible with the C ABI). In our relocated startup code (that makes room for loading ML), I had to use a veneer to make a long call to that function. From all of the available registers, GCC picked exactly R3 to make that long call...

... and the side effect was disabling a loop that was zeroing out some memory. The trick is that, at camera startup, the RAM is not zeroed; you still have some electrical noise or maybe even some data from previous run. In the emulator, the RAM is always zeroed at startup. The result was that my test code was booting just fine in the emulator, but was locking up on real hardware. Good luck figuring out with binary feedback from the camera (i.e. works or locks up). I've solved it comparing the execution traces between the files reported to work (i.e. jumping to unmodified Canon firmware), and the ones reported to lock up (jumping to relocated Canon firmware); if anyone is curious, . I highly doubt I could have figured it out without an emulator. This change (https://bitbucket.org/hudson/magic-lantern/commits/b85a1b13a2fe0b32b52b6f8fe8d16812dcf10698) fixed it.

Once the two quirks were fixed, the startup code previously written for 200D worked out of the box.

When dumping the ROM, there was yet another quirk: initial attempt (calling dump_file with a ROM address) saved a file with correct size, that contained garbage. Oddly enough, it had fragments from the diagnostic log. Best guess: the DMA channel used for file I/O might be simply unable to read from the ROM. Instead, it probably ignores the higher address bits and just saves something from the RAM (matching the lower address bits). I'm not sure whether this step was working on 200D - need to double-check. Anyway, fixing this was straightforward: copying the ROM contents to RAM (https://bitbucket.org/hudson/magic-lantern/commits/568e05a9639874f25eed96f1084182d6e1f2a390) before saving did the trick.

Emulation is not ready yet; still working on it. I am able to emulate the bootloader (including file I/O), but main firmware doesn't initialize the SD card, so I'm unable to test Canon Basic scripts yet.

The same dumper source code works on 200D (I've actually used it to test the M50 dumper in QEMU, as file I/O isn't fully working), and - after finding a few stubs - on all the other DIGIC 7 models. If anyone is looking for some low-hanging fruit to get started with development, the new stubs are relatively easy to find and they can be tested in QEMU. Once you do that, I'll enable the boot flag, so you'll be able to run custom code on real hardware.

Dear Santa, please (https://www.magiclantern.fm/forum/index.php?topic=23084.msg208831#msg208831) give us the time and energy to port ML on these new cameras!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on December 27, 2018, 08:52:31 PM
so, apologies for being that guy, but where exactly do I start here?

I'm a skilled developer, but new to photography.  I have an M50 with the 1.0.1 firmware, and a decent amount of experience reverse engineering software.  I don't need any excessive hand-holding, just links, docs, and maybe a little setup troubleshooting.

If anyone is looking for some low-hanging fruit to get started with development, the new stubs are relatively easy to find and they can be tested in QEMU

Given the above, I can definitely give this a shot.  Sounds fun.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on December 28, 2018, 09:02:48 AM
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst

However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.

I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).

Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on December 28, 2018, 04:23:36 PM
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst

However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.

I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).

Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).

I assume the risk of bricking my camera with these tools is low (but not zero)?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on December 28, 2018, 04:54:59 PM
That's right. All of the binaries available in this thread were already confirmed to work on at least one other camera, and they were also tested in QEMU (where I could confirm they are reserving memory properly so our binary won't be overwritten by Canon firmware). They do not (at the time of writing) attempt to make any permanent changes to the camera. Sure, that will no longer apply after enabling the boot flag.

However, Canon firmware is, by design, unsafe (https://bitbucket.org/hudson/magic-lantern/pull-requests/825/prevent-canon-settings-from-being-saved/). Any DryOS task is able to write anywhere in memory, so a programming mistake can - in theory - have devastating effects. Starting from DIGIC 7, we've got a MMU, which currently doesn't do much other than a flat mapping, but can - in theory - be used to implement some sort of protection between ML code and Canon data structures. TLDR: there is a small probability of getting invalid settings written into one of the nonvolatile memories; that's usually recoverable, but I'm unable to guarantee it.

So far, the worst case I've recovered successfully was a Canon firmware update interrupted in the middle (i.e. not caused by ML). Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Danne on December 28, 2018, 05:17:35 PM
Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).
Word! My prop value mistake analyzed, narrowed down and fixed to camera original state within the hour...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on December 28, 2018, 05:24:31 PM
So far, the worst case I've recovered successfully was a Canon firmware update interrupted in the middle (i.e. not caused by ML). Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).

that makes me feel a lot better

I'll report back here once I get a chance to read the docs and get set up.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 02, 2019, 05:15:51 PM
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst

However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.

I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).

Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).

I'm having a bit of trouble with `hg` and `brew` at the moment.  I still want to help, but I need to get back to LA first where I can clean up my Mac.  :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: kenthinson on January 03, 2019, 01:55:02 PM
Ok progress report and questions for you guys!

Progress.

I have been following:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
Step 1, and 2 under installation complete. Got dependencies installed through home-brew.

In addition I dumped my m50 rom files. I got two bin files
540b1d00a2631c6a29a0280d75679440 ROM0.BIN
1e7c58573aa62d016f3b355205d8fed5 ROM1.BIN

Should I continue with step 3? Is qemu ready? or do we need to do some more work first.

Lets get this thing rolling :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 03, 2019, 05:00:49 PM
I'm having a bit of trouble with `hg` and `brew` at the moment.  I still want to help, but I need to get back to LA first where I can clean up my Mac.  :)

A couple of forum topics that will help get your Mac up and running in a hurry:

Setting up a Magic Lantern development environment on a Macintosh (https://www.magiclantern.fm/forum/index.php?topic=16012.0)

Magic Lantern development compiler.app (Mac OS) (https://www.magiclantern.fm/forum/index.php?topic=21882.0)

PM me when you get back to LA if you want to get together. I live nearby in Redondo Beach.

I keep thinking about getting an M50 for my next ML project--once the M2 is up and running.

Should I continue with step 3? Is qemu ready? or do we need to do some more work first.

I just checked and it looks like there isn't an EOSM50 directory yet so it might still be a little early. Though if you want to get started you can create that directory and start figuring out what is needed for the debugmsg.gdb file. The EOSM2 port started from scratch so you can see what was done to get that camera working in QEMU starting around this post in the ML on EOS-M2 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg185103#msg185103) topic.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on January 03, 2019, 06:09:06 PM
Though if you want to get started you can create that directory and start figuring out what is needed for the debugmsg.gdb file.

Well, that would be quite a bit of duplicated work. Please find here (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch) the draft QEMU patches for M50 in their current state. Not double-checked yet, but emulation goes far enough to save a log file on the virtual SD card with these commands in the serial console:
Code: [Select]
akashimorino
mount 2
dumpf

Not sure if that's enough for testing the Canon Basic scripts, but that's all I've got for now.

The M50 also has a serial flash, so one of the next steps is dumping its contents (easy; one way is to adapt this code (https://bitbucket.org/hudson/magic-lantern/src/unified/modules/sf_dump/sf_dump.c) on the minimal codebase, which is not able to load modules yet, and the other is to work from the "recovery" branch, i.e. directly from bootloader). Probably not a very straightforward task for a newcomer, but it's not very hard either.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 04, 2019, 12:36:11 AM
A couple of forum topics that will help get your Mac up and running in a hurry:

Setting up a Magic Lantern development environment on a Macintosh (https://www.magiclantern.fm/forum/index.php?topic=16012.0)

Magic Lantern development compiler.app (Mac OS) (https://www.magiclantern.fm/forum/index.php?topic=21882.0)

PM me when you get back to LA if you want to get together. I live nearby in Redondo Beach.

I keep thinking about getting an M50 for my next ML project--once the M2 is up and running.

Thanks for the links.  I'll check it out.

Also, neat.  Maybe we can meet up and you can play with the M50 a bit.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 04, 2019, 04:46:27 PM
Please find here (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch) the draft QEMU patches for M50 in their current state.

I had no idea it was this far along. Feel like we were just given the password to get into a speakeasy and now it is time to get drunk.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 05, 2019, 02:51:04 AM
I had no idea it was this far along. Feel like we were just given the password to get into a speakeasy and now it is time to get drunk.

I'm buyin' if it means I can get my camera to do all the stuff it should be able to do...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 06, 2019, 06:35:08 PM
Applied the qemu patch and got the M50 running. No GUI emulation yet and this is what the default qemu autoexec.bin looks like but hey, it is a start.

(https://farm5.staticflickr.com/4851/39668670933_28ffcae26e.jpg) (https://flic.kr/p/23roiQi)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on January 08, 2019, 04:43:20 PM
No twitter account: M50?
https://twitter.com/autoexec_bin/status/1082649361484529667
(https://pbs.twimg.com/media/DwZX1SCXQAMtgGo.jpg:small)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on January 08, 2019, 05:30:03 PM
Nope, M50 looks like this:

(https://a1ex.magiclantern.fm/bleeding-edge/M50/M50-hello.jpg)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on January 08, 2019, 05:45:21 PM
I know what it is, but not spoiling the game.
@a1ex Can it save files yet?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on January 08, 2019, 06:14:04 PM
Aspect ratio 4:3! Boy, you got us! And we're totally offtopic. Totally!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on January 08, 2019, 06:15:41 PM
Fujifilm?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on January 08, 2019, 06:16:40 PM
Nope, it's a Canon. But no DiGiC 7/8 on board!
Those Twitter members will hunt you down, a1ex!

Disclaimer: If I'm right, of course ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: nikfreak on January 08, 2019, 06:25:53 PM
No twitter either over here:

7D Mark II
EOS M3

Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on January 08, 2019, 06:38:08 PM
SX50 HS
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Ant123 on January 08, 2019, 06:43:39 PM
SX70HS
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: nikfreak on January 08, 2019, 06:48:54 PM
Canon PowerShot G1 X Mark III

 :D
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: nikfreak on January 08, 2019, 06:53:50 PM
EOS M5?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 08, 2019, 08:41:13 PM
Somebody here got it right.

(https://farm5.staticflickr.com/4816/46667116051_124f326d51_n.jpg) (https://flic.kr/p/2e6PaKa)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on January 08, 2019, 10:39:27 PM
Yes, it's a Canon. Yes, it has DIGIC 8 on board. Yes, it has a 4:3 screen.

SX70HS

... running EOS firmware!

@a1ex Can it save files yet?

Yes, just got a ROM dump.

Dumper (really hackish): SX70DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/SX70/SX70DUMP.FIR). I'll upload a nicer one later. I've used g3gg0's FullFAT-based dumper from the "recovery" branch; other than that, it was code written for M50 running from bootloader context.

The SX740 probably belongs to the same group, according to CHDK folks; I didn't look into it yet.

Have fun!



P.S. QEMU patches for M50 (linked earlier (https://www.magiclantern.fm/forum/index.php?topic=23296.msg210122#msg210122)) worked out of the box for the SX70 bootloader:

(https://a1ex.magiclantern.fm/bleeding-edge/SX70/SX70-qemu.png)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on January 08, 2019, 11:05:45 PM
Where does EOS R fit in? DiGiC 8 but EOS or Powershot codebase or mixed-breed?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on January 08, 2019, 11:14:29 PM
I did not see the EOS R firmware yet, but previous experiments (https://www.magiclantern.fm/forum/index.php?topic=22770.msg207211#msg207211) suggest it might be significantly different from the smaller models.

Though I'm tempted to repeat the tests, now that we've got the display working.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 09, 2019, 03:53:26 AM
The M50 also has a serial flash, so one of the next steps is dumping its contents (easy; one way is to adapt this code (https://bitbucket.org/hudson/magic-lantern/src/unified/modules/sf_dump/sf_dump.c) on the minimal codebase, which is not able to load modules yet, and the other is to work from the "recovery" branch, i.e. directly from bootloader). Probably not a very straightforward task for a newcomer, but it's not very hard either.

Did this ever get done?  I have to say, it's certainly not very straightforward.  :)  I have the green screen running on QEMU for the M50, but I can't get the screen you posted.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: LebedevRI on January 09, 2019, 09:32:15 AM
SX70HS
... running EOS firmware!

While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library (https://github.com/darktable-org/rawspeed) for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 10, 2019, 02:07:00 AM
oooh now I have a blinking LED on my M50 qemu, pls advise
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: DeafEyeJedi on January 11, 2019, 04:45:57 AM
Great work, @leathc!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 11, 2019, 04:57:29 AM
Great work, @leathc!

Thanks!  and thanks dfort for helping me!  haha
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: oswa on January 11, 2019, 06:40:13 AM
... running EOS firmware!


While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library (https://github.com/darktable-org/rawspeed) for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.

Below you can dl all the raw samples.

https://we.tl/t-X8KcVPjtVX (https://we.tl/t-X8KcVPjtVX)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 14, 2019, 08:12:01 AM
This (https://www.magiclantern.fm/forum/index.php?topic=17714.msg210501#msg210501) might help the M50 port.

Code: [Select]
  Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS M50 / KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/IMG_2868.JPG
 - User PS: CineStyle 
 - Boot flags: FIR=0 BOOT=-1 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x48C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x1 1
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000001
  (raw value)          0x1 1
CPACR      0x00000000
  (raw value)          0x0 0
DBGDIDR    0x35141000
  Revision             0x0 0
  Variant              0x0 0
  - (RAZ)              0x10 16
  Version              0x4 4 [v7 basic]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSCR    0x00000000
  HALTED               0x0 0
  RESTARTED            0x0 0
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x0 0
  PipeAdv              0x0 0
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - DONE!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on January 15, 2019, 01:26:02 PM
It's worth noting the above log was not from a real M50, but from the emulator. In other words, it's what I thought it might be, i.e. what I knew from DIGIC 7 (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200715#msg200715) (alongside with a few emulator quirks).

CPU info log from a real M50 / real SX70:
Code: [Select]
CHDK CPU info for 0x412 M50 / 0x805 SX70
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

Difference from 200D: CPUINFO-200D-vs-M50.html (https://a1ex.magiclantern.fm/bleeding-edge/M50/CPUINFO-200D-vs-M50.html)



edit: updated ROM dumpers (SX740 untested):
DIGIC 8:  M50 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMP_M50.FIR)  SX70 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMPSX70.FIR)  SX740 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DMPSX740.FIR)

and uploaded FIRs for getting the CPU info:
DIGIC 8:  M50 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUI_M50.FIR)  SX70 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUISX70.FIR)  SX740 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUSX740.FIR)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 16, 2019, 10:52:27 PM
edit: updated ROM dumpers (SX740 untested):
and uploaded FIRs for getting the CPU info:

I'll try these out on the real hardware. EDIT: for the M50 that is
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 16, 2019, 11:03:23 PM
those both run great on the M50, but I'm not actually seeing the dumps

it could be because I didn't format the card correctly or something I suppose
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on January 17, 2019, 06:34:02 AM
Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: leathc on January 17, 2019, 07:14:45 PM
Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.

no I'm an idiot, I didn't do low level format

I have the dumps now, and RESCUE.log for the CPU info
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: cmku on January 21, 2019, 11:45:14 PM
I run this dump firmware on my M50

there is the log :)

Code: [Select]
Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/0127.JPG
 - User PS: ??? ??? ???
 - Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - boot_read_sector 103604
 - boot_write_sector 10361a
 - 10362a: BL 104dc4
 - 10180B Card init => 2
 - Saving RESCUE.LOG ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: digiboy on February 05, 2019, 11:16:44 AM
Hello,
I have M50. I am Android programmer and my knowledge in embedded systems is small (easy AVR programming)
Are there any simple tasks that I could do?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on February 05, 2019, 03:54:06 PM
Since you mentioned AVR, what about this?

- find some UART (https://www.magiclantern.fm/forum/index.php?topic=7531) or JTAG (https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/) port and attempt to communicate with it

Related: 600D (https://www.magiclantern.fm/forum/index.php?topic=7531.msg208794#msg208794) (successful) and R (https://www.magiclantern.fm/forum/index.php?topic=22770.msg210363#msg210363) (unsuccessful).

However, that would be of secondary importance for models in this thread, since we are already able to execute code alongside Canon's main firmware. It could be useful for interfacing with other peripherals, or - better not get there - for unbricking.

A better idea would be to start reading the thread, and also the threads for other recent models. Are there any tasks you could do? Are you able to run the firmware in QEMU? Are you able to push the emulation even further? Are you able to fix the logging code, which worked out of the box on 80D, 5D4 and 200D, but crashed on M50? (you will need QEMU for this one)

BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Karim on February 08, 2019, 04:56:36 AM
BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.
Is that digic6-dumper branch not safe to run on camera or what?
If my camera won't turn into a brick maybe I'll give it a shot
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on February 08, 2019, 05:16:07 AM
https://mobile.twitter.com/autoexec_bin/status/1086653394142617601?p=p#
See a1ex's answer dated 07:55 - 19. Jan. 2019
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on February 08, 2019, 09:54:24 PM
See a1ex's answer dated 07:55 - 19. Jan. 2019

That answer was about ROM dumpers - these carry very little risk on new models. On M50, the ROM dumper was already confirmed to work, so the answer no longer applies.

Is that digic6-dumper branch not safe to run on camera or what?

The digic6-dumper branch works out of the box, but once you attempt to run the 80D experiments, it will fail. The issue is that Canon's DebugMsg is in RAM on DIGIC 6/7 (where we can override it easily), while on DIGIC 8 is in ROM (where we can override it with a little more coding). I didn't attempt to solve it yet, but I've documented the MMU configuration (https://chdk.setepontos.com/index.php?topic=13014.msg131247#msg131247) about 2 years ago.

Safety-wise, it's probably OK (but it's worth noting that Canon firmware reflashes the main ROM at shutdown (https://bitbucket.org/hudson/magic-lantern/pull-requests/825/prevent-canon-settings-from-being-saved/diff), so...)

If my camera won't turn into a brick maybe I'll give it a shot

I cannot guarantee that. Risks were explained for e.g. DIGIC 7 (https://www.magiclantern.fm/forum/index.php?topic=19737.75), 5D4 (https://www.magiclantern.fm/forum/index.php?topic=17695.msg208999#msg208999) etc. Enabling the boot flag will modify your camera, so there is a tiny chance of things going wrong when running this procedure on a new camera model.

Enabling the boot flag will enable anyone with (basic) programming skills to run the proof of concept code on their camera and experiment with it. You will still need QEMU for debugging and for understanding how your code will run. The logging code does not work yet; debugging will have to be done in QEMU. On hardware, you've only got LED blinks, file I/O (as long as the camera doesn't crash) and... display from bootloader context (but do check the 80D thread).

Still with me? If you are OK with the risks, just drop me a PM.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on February 12, 2019, 05:45:49 PM
Not sure where to post this as it's both DIGIC 7 and 8 related.
I've noticed that D7 and D8 ports still have
Code: [Select]
-march=armv7-rin platform/(cam)/Makefile.platform.default
"armv7-r" means ARM Cortex R. The Cortex R supports integer divide instructions in Thumb mode, whereas the Cortex A9 does not. To avoid getting undefined instruction exceptions in the future, I'd suggest using
Code: [Select]
-march=armv7-ainstead.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on February 12, 2019, 09:29:51 PM
Thanks, I wasn't aware of this difference.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: tn322201 on March 05, 2019, 03:03:50 PM
I am a new comer to magic lantern community. I have successfully dumped the ROM and CPU info from my M50. May I ask what this the next step in the development?

I was trying to use QEMU but do not know how to "clone" it to my computer. Consulting someone with experience could provide me with further steps in development.

Here is the attached CPU info:

Code: [Select]
 
Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/1900.JPG
 - User PS: ??? ??? ???
 - Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - boot_read_sector 103604
 - boot_write_sector 10361a
 - 10362a: BL 104dc4
 - 10180B Card init => 2
 - Saving RESCUE.LOG ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on March 09, 2019, 03:33:45 PM
Just FYI, Canon has released firmware updates for
EOS M50 (1.0.2)
PowerShot SX740 (1.0.1)
PowerShot SX70 (1.1.0)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on March 09, 2019, 07:18:33 PM
In this case, it's probably best to upgrade the codebase now, while there are not too many stubs and other firmware-specific constants. That could be an easy coding task for newcomers, as it's just a matter of pattern matching between the two firmware versions (and it helps you get familiar, to some extent, with Canon's code structure).

For QEMU, if the main guide is hard to follow, refer to the sticky tweet and other videos on the forum (todo: link them in the guide), then apply the patch linked earlier. I'm cleaning up my local changes and putting them through the test suite for quite some time, but I keep bumping into test failures, so it's taking a bit longer, sorry about that...

As usual, once you are ready to run and debug the proof of concept code on the camera, I'm also ready to enable the boot flag. The procedure was already tested on EOS R, so I don't expect any surprises.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on March 09, 2019, 10:44:10 PM
EOS M50 (1.0.2)

Code: [Select]
Firmware Version 1.0.2 incorporates the following fix:
1. Improves reliability of communication with external flashes.

It now works with yongnuo flash triggers.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 01, 2019, 09:55:41 AM
Please find the FIR file for enabling the boot flag on the EOS/PowerShot M50:

BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)

This will modify your camera.

The FIR for enabling the boot flag is expected to work with any Canon firmware version (1.0.1 or 1.0.2 or any future version). However, the code from the digic6-dumper branch ("Hello World") expects firmware 1.0.1; otherwise, it simply won't boot. Support for firmware 1.0.2 is left as an easy coding "qualification" task for whoever is willing to help me on this long jurney.

After enabling the boot flag, you will need to make your card bootable (EosCard/MacBoot/make_bootable.sh) and compile the proof of concept code from the digic6-dumper branch.

Logging code:
Code: [Select]
hg up digic6-dumper -C
cd platform/M50.101
make clean; make

"Hello World" code:
Code: [Select]
hg up digic6-dumper -C
cd minimal/hello-world
make MODEL=M50 clean; make MODEL=M50

"Hello World" binary (for firmware 1.0.1 only): autoexec.bin (https://a1ex.magiclantern.fm/bleeding-edge/M50/hello/autoexec.bin)

(https://a1ex.magiclantern.fm/bleeding-edge/M50/m50-hellow.jpg)

Happy April 1st :D
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 01, 2019, 01:18:32 PM


"Hello World" binary (untested, for firmware 1.0.1 only): autoexec.bin (https://a1ex.magiclantern.fm/bleeding-edge/M50/hello/autoexec.bin)

Happy April 1st :D

Great! Thanks Alex )
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on April 01, 2019, 01:43:25 PM
(https://i.postimg.cc/43RhNsbH/m50-2.jpg)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 01, 2019, 02:03:25 PM
magiclantern-fishy.2019Apr01.M50101.zip (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip)

(https://a1ex.magiclantern.fm/bleeding-edge/M50/bench.png)

8)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 02, 2019, 09:12:48 AM
Awesome, Alex! Might be the most hardest camera to port?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 02, 2019, 09:34:19 AM
It has some bits from PowerShot firmware, which makes it a bit different from all other EOS models. I mean, porting ML is no longer going to be "just" pattern matching; there will be parts of the code requiring wrappers or other "creative" solutions, not required on other models. That's where the difficulty comes from.

Trivial example: I could not find one of the stubs (GUI_Control), so I wrote a function that did the same thing, from scratch. I believe it's present on all regular EOS models (80D, 5D4, 200D, 77D, 7D2 and so on).

Another example - Canon blocked the Delete button in plain LiveView (since it's unused in their firmware in that mode), but I wanted it for ML menu, for consistency with all other models. This camera doesn't have a MPU, but has the PhySw task (like any other PowerShot), i.e. physical button status is directly visible from the main CPU. So, I've used that to detect the Delete button. That trick is not applicable to 80D, 5D4, 200D, 77D and others - these are "classic" EOS firmwares, with MPU. However, I see this as an advantage of the PowerShot firmware - if Canon did the same with the Delete button on say 200D (I don't know if they did or not), I might not be able to find a workaround.

Another quirk: exposure is stored internally in 1/3 EV steps (1 raw unit = 1/3 EV). On DIGIC 5 and earlier models, they use 1/8 EV steps (so 1/3 is actually 3/8, and 2/3 is actually 5/8). Not sure if this applies to other new models, or it might be a M50 quirk; need to check.

Another one: the shooting settings screen (i.e. what looks like plain photo mode on all other EOS models), is now running in LiveView, unlike on M/M2; it just hides the live image. Figure out how to handle it :D

You'll see these bits once I'll clean up and publish the source code.

Unsure about the EOS R - that one seems closer to "classic" EOS firmware, at first sight. For example, there are signs of a MPU being present, but button handling code looks similar to M50 (or, rather, something in-between M50 and "classic" EOS firmware).

BTW, Greg already sent me the updated stubs for 1.0.2, so the next build will run on latest firmware.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Sapporo on April 03, 2019, 08:45:08 AM
I saw the bench.mo in the software. Anyone tried the fastest write speed in play mode?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on April 03, 2019, 08:50:56 AM
Scroll up ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 03, 2019, 09:08:57 AM
That screenshot was with SanDisk Extreme Pro 32GB UHS-I (this one (https://www.amazon.com/SanDisk-Extreme-32GB-UHS-I-SDSDXXG-032G-GN4IN/dp/B01J5RHBQ4)). Didn't try others yet.

I think Walter mentioned something about an overclockable (?) SanDisk somewhere... found:

170 MByte/s is for read only and the only devices known today to use Sandisk's proprietary overclocking mode are Sandisk's newest cardreaders. Running there write rate is indeed higher, too. But with other devices they are only a tad slower compared to 95 MB/s and we don't know if older controllers (used in your M) are able to get unlocked.
See www.cameramemoryspeed.com

Do they have any documentation on this overclocking mode?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Levas on April 03, 2019, 09:14:54 AM
Write speed...not bad.
At the moment all I want to know is how fast is this sensor (Mhz) and how many columns does it read simultaneously  ;D
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 03, 2019, 09:16:24 AM
I believe it's 27 MHz x 12 channels (from the silent picture mode, which runs at about 300 MPix/s).

Code: [Select]
timer A =  534, B = 4061 (6408x4061  12.451 fps?) @ e19ebbd0
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on April 03, 2019, 09:35:33 AM
Do they have any documentation on this overclocking mode?

Haven't found anything yet. SanDisk states it is proprietary. A compatible adapter is pretty cheap: SDDR-C531/SDDR-399-G46. Happy re-engineering! ;-)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Levas on April 03, 2019, 09:48:07 AM
Nice, faster then 5d3.

Makes the 6K April fools joke (sort of) doable, in 3:1 aspect ratio  :P
https://www.eoshd.com/2019/04/canon-m50-hacked-features-6k-raw-and-a-i-driven-menus/ (https://www.eoshd.com/2019/04/canon-m50-hacked-features-6k-raw-and-a-i-driven-menus/)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 03, 2019, 10:37:34 AM
Yeah. I'm rather interested in capturing unpredictable action (i.e. kids), and a 12-fps full-res burst could be exactly what I need. I'm not going to save all these frames - only 2 or 3 of the best ones, as selected by the AI.

The feature is already implemented in the regular silent picture module (Best shots), but is limited to 1080p resolution (and, unfortunately, focus evaluation is broken when using crop_rec).

There is another nice feature in DIGIC 7 and 8  - they both use dual-core Cortex A9, with MMU. That is, we can easily remap the entire ROM contents into RAM and patch it away! You've read that right - it is *trivial* to make *any* temporary changes to ROM contents!

No other camera generation has this ability! DIGIC <= 5 have this ability to a very limited extent ("cache hacks"). All our attempts to unlock this ability DIGIC 6 were... unsuccessful. This (ability to patch the ROM contents) is not required for porting the basic ML functionality, but it is certainly helpful with the advanced stuff (crop_rec, adtg_gui, sd_uhs and others are using it).

Other reasons I've picked this camera:
- EOS firmware (yes, most of its firmware *is* EOS codebase, with some bits from PowerShot - totally different from M3, M5 & others, where the firmware is... PowerShot with a few EOS bits)
- DIGIC 8, 1GB RAM (https://www.magiclantern.fm/forum/index.php?topic=5071.msg212085#msg212085) (!)
- form factor, lens compatibility (EF + EF-M + third party adapters), speed booster availability
- working autofocus (I hope; didn't test it yet, but on 5D3 I consider it unusable)
- dual pixel (remember (https://a1ex.magiclantern.fm/bleeding-edge/5D4/5d4-dual-pixel.html) my (https://a1ex.magiclantern.fm/bleeding-edge/70D/dual-pixel/70D-dual-pixel.html) notes (https://a1ex.magiclantern.fm/bleeding-edge/5D4/dual-pixel/5D4-lv-daf-raw.html)?)
- EOSHD review (https://www.eoshd.com/2018/05/canon-eos-m50-an-accidental-4k-digital-bolex/) :D
- price!

Yep, I've got it to replace the good old (https://www.magiclantern.fm/forum/index.php?topic=23622) 5D3.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 03, 2019, 11:03:48 AM

- price!

Yep, I've got it to replace the good old (https://www.magiclantern.fm/forum/index.php?topic=23622) 5D3.

Ok Alex, when we can go to the shop and buy it ... with ML on board? Honestly never thought my next camera could be "M"... in world of Fuji&Sony alternatives  8)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 03, 2019, 11:17:47 AM
I'm not selling preinstalled versions of ML, sorry. You can install it yourself - EOSHD already did, and I hope he's not the only one :D

The "when" question is well covered in the FAQ and previous topics, but I'm trying (https://www.magiclantern.fm/forum/index.php?topic=23738.0) to find a way to speed up the process.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 03, 2019, 11:33:52 AM
I know about "when", just kidding  ;) Just happy with fact there's some "visual" progress after 2 or even 3 years of researching.

What's difference that M50 has EOS firmware?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 03, 2019, 11:36:31 AM
... one doesn't have to rewrite ML from scratch.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: shadimar69 on April 03, 2019, 02:32:28 PM
You can install it yourself - EOSHD already did, and I hope he's not the only one :D

Not the only one to try it... I love living on the bleeding edge! ;)
We are all really looking forward to seeing where this beautiful work will end up... Thank you very much @a1ex for all your hard work so far!

(https://i.ibb.co/XyJ0zq1/1.jpg) (https://ibb.co/XyJ0zq1)

(https://i.ibb.co/ZhnsVwz/2.jpg) (https://ibb.co/ZhnsVwz)

(https://i.ibb.co/LNw2f6Y/3.jpg) (https://ibb.co/LNw2f6Y)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 03, 2019, 02:43:04 PM
@a1ex do you think it's possible in theory to add touchscreen navigation in ML?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Sapporo on April 03, 2019, 03:12:48 PM
Scroll up ...
I was blind...sorry :-\

But 80MB/s, isn't that slow? If M5 has 81MB/s as average speed the fastest write speed with M5 should be around 90MB/s. M50 should have the same write speed as the other new Canon cameras with the same SD interface.
https://www.cameramemoryspeed.com/canon-m5/fastest-sd-cards/
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: linux4eva on April 03, 2019, 11:00:56 PM
Hey!
I'm following the topic for a while since deciding to get (and got) M50 recently! Really excited to see thing moving forward. Please let me know if there's anything I can help with.
Regarding the write speed why 80 MB/s on SD card should be considered slow?
The other camera I have is 7D and I just did a YouTube review (https://youtu.be/tbEaR2PhlQc) of new Kingston 256Gb CF card which had 60 MB/s in Magic Lantern benchmark, 80 MB/s while recording RAW video and was closer to 130 MB/s using USB 3.0 card reader. I thought the usual SD cards supposed to be slower than CF.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: acarboni on April 04, 2019, 12:06:28 AM
Amazing work and wonderful news! Thanks to everyone who got things this far!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: linux4eva on April 04, 2019, 05:36:06 AM
I got to check the 1st April's thread and I find suggestion to monetarily boost the ML development by accepting donations from the community while keeping software free and open source.
You might think to raise funds for a specific goals - that might keep developers more motivated. I can imagine that it is difficult to work on such projects while having a number of 'real' jobs. I guess there are many M50 owners out there who would gladly contribute for an upgrade to their camera.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: joanllm on April 07, 2019, 08:04:29 PM
This is great news! hopefully the video on Raw is very soon in this camera, I have an M50 so I will be happy to help you sharing here the results of the previews

Keep it up, very good job
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 10, 2019, 02:56:29 AM
My M50 arrived today - Yay!

With 1.0.2 firmware - Uh oh!

and Pelican's firmware archive has the M50--KissM-v101-win.zip (https://pel.hu/eoscard/) file is listed - Yay!

But clicking on the link gives a 404 file not found error - oooooh

However, the file is there--I mean here -> https://pel.hu/down/M50-KissM-v101-win.zip

Almost ready--uh, where's the ML-SETUP.FIR file? Available only by special request? Not sure where to start. Maybe with a firmware update to 1.0.2 for starters? That's the one thing that seems almost doable at the moment. In the meantime I'm attempting to put an "M50 Canon Firmware for Testers" package on my downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/) so others won't have to go through that rollercoaster ride to find the "right" firmware version. Compared to other cameras these firmware updater files are humongous.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: shadimar69 on April 10, 2019, 03:50:15 AM
Congrats on the M50 dfort! Absolutely in love with mine.
Almost ready--uh, where's the ML-SETUP.FIR file? Available only by special request? Not sure where to start. Maybe with a firmware update to 1.0.2 for starters?

This is what I used for my testing: The 'Fishy' is only running on firmware 1.0.1 currently.
Please find the FIR file for enabling the boot flag on the EOS/PowerShot M50:
BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)
This will modify your camera.
magiclantern-fishy.2019Apr01.M50101.zip (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip)

Appears to be a proof of concept at the moment. When I tested it, pressing the trash can button to activate only opened into the ML menu once every 5-7 times. The menu itself does not have fully fledged out functionality just yet. I am sure it will get there, obviously there is a lot of hard work that needs to go into this still. Absolutely brilliant work so far IMO! =Þ
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: yokashin on April 10, 2019, 10:49:30 AM
Canon has introduced the EOS Rebel SL3 (EOS 250D / EOS Kiss X10)
https://www.dpreview.com/news/1541666691/ultra-compact-canon-eos-rebel-sl3-offers-eye-detect-af-and-disappointing-4k-capture
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 10, 2019, 10:57:51 AM
My M50 arrived today - Yay!

Welcome to the future :D

Canon has introduced the EOS Rebel SL3 (EOS 250D / EOS Kiss X10)

Oh no, another camera to take care of!

To prepare the portable ROM dumper, I "only" need a CR3 image (i.e. wait for reviews with sample images). If that won't work, hardware hack à la EOS R.

BTW, after playing a bit with M and M50, I started to wonder what's the purpose of all other Rebel cameras on the market. Do they have better battery life, or...?

When I tested it, pressing the trash can button to activate only opened into the ML menu once every 5-7 times.

Really? It just worked here... and I'm pretty sure I've opened it more than 100 times.

You were in plain LiveView when pressing the delete button, right?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: zerocool22 on April 10, 2019, 12:29:08 PM
BTW, after playing a bit with M and M50, I started to wonder what's the purpose of all other Rebel cameras on the market. Do they have better battery life, or...?
True the only camera's from canon that matter atm are the 5D IV and canon eos r. Hope ML will run on either soon :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: shadimar69 on April 10, 2019, 01:49:06 PM
Really? It just worked here... and I'm pretty sure I've opened it more than 100 times.
You were in plain LiveView when pressing the delete button, right?

Yes tested in plain LiveView. To be able to consistently get the ML menu to come up, I have to double press the trash button, about 500ms between presses. If I just press once, screen goes black for 1 second, then returns back to normal live view.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KenSoftTH on April 10, 2019, 08:04:07 PM
It's official, Canon 200D Mark II with DIGIC 8 Announced

https://www.techradar.com/news/canons-eos-200d-mark-ii-is-a-lightweight-4k-dslr-thats-heavy-on-features
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 10, 2019, 08:39:03 PM
The 200D Mark II probably belongs in the DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2) (https://www.magiclantern.fm/forum/index.php?topic=19737.0) topic.

Back to the M50. First of all, I dumped the 1.0.2 firmware. Just in case I get the urge to port the current firmware.

(https://live.staticflickr.com/7808/33703854388_cc84cc2ac2.jpg) (https://flic.kr/p/Tmi4FJ)

Then I downgraded to 1.0.1 and turned on the camera bootflag -- no turning back now?

(https://live.staticflickr.com/7816/32638247127_4fb5cd4f22.jpg) (https://flic.kr/p/RJ8xLK)

I had no problems opening the ML menu with the Trash button but the first thing I noticed was that the ML menu hiccups every few seconds. Ok--this is an early port.

Hey, the selftest module included with the "fishy" build so how well does that work on the camera?

Code: [Select]
[Pass] is_play_mode() => 0x1
[INFO] Camera model: Canon EOS M50 1.0.1 (0x412 M50)
[Pass] is_camera("DIGIC", "*") => 0x1
[Pass] is_camera(__camera_model_short, firmware_version) => 0x1
       m0 = MALLOC_FREE_MEMORY => 0x60fe0
[Pass] p = (void*)_malloc(50*1024) => 0x10ff70
[Pass] CACHEABLE(p) => 0x10ff70
       m1 = MALLOC_FREE_MEMORY => 0x547d0
       _free(p)
       m2 = MALLOC_FREE_MEMORY => 0x60fe0
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
       m0 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] p = (void*)_AllocateMemory(128*1024) => 0xe5288c
[Pass] CACHEABLE(p) => 0xe5288c
       m1 = GetFreeMemForAllocateMemory() => 0x22272c
       _FreeMemory(p)
       m2 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] ABS((m0-m1) - 128*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
       m01 = MALLOC_FREE_MEMORY => 0x60fe0
       m02 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40e528a0
[Pass] UNCACHEABLE(p) => 0x40e528a0
[Pass] CACHEABLE(p) => 0xe528a0
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40e528a0
       _free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4660c094
[Pass] UNCACHEABLE(p) => 0x4660c094
       _shoot_free(p)
       m11 = MALLOC_FREE_MEMORY => 0x60fe0
       m12 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x2000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x2000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
       largest_shoot_block = suite->size => 0x2000000
[INFO] largest_shoot_block: 32MB
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x3
[Pass] suite->size => 0x2100000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1388000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
       chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffa8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x46110070
[Pass] UNCACHEABLE(p) => 0x46110070
       chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffe0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x2100000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
       chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x2100000
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x4
[Pass] suite->size => 0x3f00000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1388000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
       chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffa8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x46110070
[Pass] UNCACHEABLE(p) => 0x46110070
       chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffe0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x3780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
       chunk = GetNextMemoryChunk(suite, chunk) => 0x110018
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x3f00000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7d93e480
[Pass] UNCACHEABLE(p) => 0x7d93e480
       chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x3f00000
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x2ca654
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x2ca700
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x2ca6e0
[Pass] bar => '*****hjkl;'
       call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
       call("TurnOffDisplay")
[FAIL] DISPLAY_IS_ON => 0x1
       call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
       task_create("test", 0x1c, 0x1000, test_task, 0) => 0x6c6013c
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[FAIL] get_task_name_from_id(current_task->taskId) => '?'
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0x6c8012a
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0x6ca0242
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0x6cc003c
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
       SetGUIRequestMode(1); msleep(1000);
[FAIL] CURRENT_GUI_MODE => 0x0
       SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
       SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[Pass] MENU_MODE => 0x1
[Pass] PLAY_MODE => 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
       SW1(1,100)
[FAIL] HALFSHUTTER_PRESSED => 0x0
       SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[FAIL] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 4423 passed, 6 failed.
.

I take it this is a short test and not the one from the lua_fix branch? Still, pretty good for an early port.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lorenzo353 on April 11, 2019, 06:26:28 PM
about Canon EOS Rebel SL3 (EOS 250D / EOS Kiss X10)

To prepare the portable ROM dumper, I "only" need a CR3 image (i.e. wait for reviews with sample images). If that won't work, hardware hack à la EOS R.

https://cweb.canon.jp/eos/lineup/kissx10/img/sample/downloads/sample01.jpg
https://cweb.canon.jp/eos/lineup/kissx10/img/sample/downloads/sample02.jpg

Canon Image Type                : Canon EOS Kiss X10
Canon Firmware Version          : Firmware Version 4.0.5
Canon Model ID                  : Unknown (0x80000436)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 11, 2019, 08:31:35 PM
About those EOS Rebel SL3 (EOS 250D / EOS Kiss X10) sample images --

...I "only" need a CR3 image...

Those links point to JPEG files.

Hum, it does have a Digic 8 processor so maybe it should be discussed on this topic.

Now about the M50 --

Looks like the firmware dumper isn't dumping ROM1.BIN. It goes through the motions and the MD5 checks out but the entire file is filled with zeros. I'm talking about this one: https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMP_M50.FIR

Maybe there's a newer one or perhaps an older one that works? I was able to get a 1.0.1 dump from @leathc a while back with a valid ROM1.BIN.

In any case, the "fishy" April 1 build did save a valid ROM1.BIN dump but if I compile an autoexec.bin file from the current digic6-dumper branch it doesn't create a valid ROM1.BIN dump.

Just for fun I thought I'd try to port the 1.0.2 firmware and as far as I can tell it is working. Here's what the check-stubs.py script shows:

Code: [Select]
python check-stubs.py /Users/rosiefort/magic-lantern-hudson/platform/M50.101/stubs.S /Users/rosiefort/magic-lantern/platform/M50.102/stubs.S
Module termcolor missing, no color support will be available
STUB                    OLD           NEW     DELTA
current_interrupt    0x00001010 -> 0x00001010 [0x000] [contents not checked]
current_task         0x00001028 -> 0x00001028 [0x000] [contents not checked]
bmp_vram_info        0x0000fc20 -> 0x0000fc20 [0x000] [contents not checked]
init_task            0xe0040225 -> 0xe0040225 [0x000] [contents not checked] [!!!]
dump_file            0xe0085f61 -> 0xe0085f71 [0x010] [contents not checked]
memmap_info          0xe009de99 -> 0xe009deb9 [0x020] [contents not checked]
malloc_info          0xe00f1bd9 -> 0xe00f1c1d [0x044] [contents not checked]
sysmem_info          0xe00f1c71 -> 0xe00f1cb5 [0x044] [contents not checked]
create_init_task     0xe0143cbd -> 0xe0143d01 [0x044] [contents not checked]
smemShowFix          0xe0146f97 -> 0xe0146fdb [0x044] [contents not checked]
_malloc              0xe03c2307 -> 0xe03c2387 [0x080] [contents not checked]
_free                0xe03c233f -> 0xe03c23bf [0x080] [contents not checked]
task_create          0xe0545dd7 -> 0xe0545e4f [0x078] [contents not checked] [!!!]
_FIO_OpenFile        0xe0546429 -> 0xe05464a1 [0x078] [contents not checked]
_FIO_CreateFile      0xe05464db -> 0xe0546553 [0x078] [contents not checked]
_FIO_RemoveFile      0xe0546811 -> 0xe0546889 [0x078] [contents not checked]
_FIO_ReadFile        0xe05468ab -> 0xe0546923 [0x078] [contents not checked]
FIO_SeekSkipFile     0xe0546977 -> 0xe05469ef [0x078] [contents not checked]
_FIO_WriteFile       0xe0546a37 -> 0xe0546aaf [0x078] [contents not checked]
FIO_CloseFile        0xe0546c4b -> 0xe0546cc3 [0x078] [contents not checked]
_FIO_GetFileSize     0xe0546de7 -> 0xe0546e5f [0x078] [contents not checked]
_FIO_RenameFile      0xe054781b -> 0xe0547893 [0x078] [contents not checked]
_FIO_CreateDirectory 0xe0547ca5 -> 0xe0547d1d [0x078] [contents not checked]
FIO_Flush            0xe0547e8f -> 0xe0547f07 [0x078] [contents not checked]
_FIO_FindFirstEx     0xe0548107 -> 0xe054817f [0x078] [contents not checked]
FIO_FindNextEx       0xe054820d -> 0xe0548285 [0x078] [contents not checked]
FIO_FindClose        0xe05482cf -> 0xe0548347 [0x078] [contents not checked]
SetTimerAfter        0xe054ce09 -> 0xe054ce81 [0x078] [contents not checked]
CancelTimer          0xe054cebf -> 0xe054cf37 [0x078] [contents not checked]
msleep               0xe05597ef -> 0xe0559867 [0x078] [contents not checked]
uart_printf          0xe055a7a9 -> 0xe055a821 [0x078] [contents not checked]
_alloc_dma_memory    0xe055a9e9 -> 0xe055aa61 [0x078] [contents not checked]
_free_dma_memory     0xe055aa1d -> 0xe055aa95 [0x078] [contents not checked]
GetSizeOfMaxRegion   0xe055ade7 -> 0xe055ae5f [0x078] [contents not checked]
GetMemoryInformation 0xe055ae13 -> 0xe055ae8b [0x078] [contents not checked]
_AllocateMemory      0xe055af89 -> 0xe055b001 [0x078] [contents not checked]
_FreeMemory          0xe055b141 -> 0xe055b1b9 [0x078] [contents not checked]
call                 0xe05721bb -> 0xe0572233 [0x078] [contents not checked]
dcache_clean         0xe05776c5 -> 0xe057773d [0x078] [contents not checked]
icache_invalidate    0xe0577799 -> 0xe0577811 [0x078] [contents not checked]
DryosDebugMsg        0xe0577ec5 -> 0xe0577f3d [0x078] [contents not checked]
bzero32              0xe0578c59 -> 0xe0578cd1 [0x078] [contents not checked]
SetHPTimerAfterNow   0xe0732957 -> 0xe0732abf [0x168] [contents not checked]
SetHPTimerNextTick   0xe07329b7 -> 0xe0732b1f [0x168] [contents not checked]

Copying the M50.102 autoexec.bin to a bootable card (and with the camera bootflag set of course) will create a valid ROM0.BIN and an invalid ROM1.BIN just like the M50.101 version. That's pretty much all it does but hey--that's something!

Another issue with the 1.0.2 port is getting the firmware signature. Following my own tutorial (https://www.magiclantern.fm/forum/index.php?topic=19417.0) I defined CONFIG_HELLO_WORLD but it required a value for SIG_M50_102 or it would not compile and it didn't print "Hello World" on the LCD, much less print out the firmware signature.

One last piece of the puzzle:

platform/M50.102/Makefile.platform.default
Code: [Select]
FIRMWARE_ID     = 0x00000412 # Not sure where to find this
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: aprofiti on April 11, 2019, 08:48:41 PM
Another issue with the 1.0.2 port is getting the firmware signature. Following my own tutorial (https://www.magiclantern.fm/forum/index.php?topic=19417.0) I defined CONFIG_HELLO_WORLD but it required a value for SIG_M50_102 or it would not compile and it didn't print "Hello World" on the LCD, much less print out the firmware signature.
Easy way is to use Qemu with a faked value in src/fw-signature.h and let it print what src/reboot.c expect to be :)

One last piece of the puzzle:

platform/M50.102/Makefile.platform.default
Code: [Select]
FIRMWARE_ID     = 0x00000412 # Not sure where to find this
You can find it under "Canon CanonModelID Values" at https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html (https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html) or https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt (https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt)

Are they discovered from image metadata?

Also usually last digits are printed on serial console by the camera at firmware startup (ex. K412) and is reported under Model ID of the rom dumper.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 12, 2019, 02:06:32 AM
Ah -- there it is, first line on the RESCUE.LOG:

Code: [Select]
  Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS KISS M
 - Firmware version: 1.0.2 / 7.0.0 34(00)
 - IMG naming: 100CANON/????0000.JPG
 - User PS: ??? ??? ???
 - Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000
 - boot_read_sector 103604
 - boot_write_sector 10361a
 - 10362a: BL 104dc4
 - 10180B Card init => 2
 - Dumping ROM0... 100%
 - MD5: 0f1e58aea6c1b77d2d8ac244050069c0
 - Dumping ROM1... 100%
 - MD5: 2c7ab85a893283e98c931e9511add182
 - No serial flash.
 - Saving RESCUE.LOG ...

Ok, so that's the Model ID. I suspected that but wanted to make sure. Of course it doesn't change on a firmware update.

Looked up those links and it appears that the M50 hasn't been integrated into exiftool or libcraw2 or dcraw for that matter. There is one little hint on the dcraw source code (https://www.cybercom.net/~dcoffin/dcraw/dcraw.c) about the M50:

Code: [Select]
    { "Canon EOS M5", 0, 0, /* also M50 */
{ 8532,-701,-1167,-4095,11879,2508,-797,2424,7010 } },

That might be useful for future reference though if you run the latest build of dcraw with the -T option on a .CR3 file from the M50 all you come up with is a black frame.

To run the M50 in QEMU it still needs to be patched (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch). I saved a patched version in my repository so I merged in the latest qemu branch changes and -- ugh, more to do. There is a bunch of stubs that need to be updated in debugmsg.gdb. Hope I got all of them right:

qemu-eos/M50/debugmsg.gdb
Code: [Select]
# ./run_canon_fw.sh M50 -d debugmsg
# ./run_canon_fw.sh M50 -d debugmsg -s -S & arm-none-eabi-gdb -x M50/debugmsg.gdb

source -v debug-logging.gdb

# To get debugging symbols from Magic Lantern, uncomment one of these:
symbol-file ../magic-lantern/platform/M50.102/magiclantern
#symbol-file ../magic-lantern/platform/M50.102/autoexec
#symbol-file ../magic-lantern/platform/M50.102/stubs.o

macro define CURRENT_TASK 0x1028
macro define CURRENT_ISR  (*(int*)0x100C ? (*(int*)0x1010) : 0)
macro define NUM_CORES 2
macro define NULL_STR 0xE0041041

# GDB hook is very slow; -d debugmsg is much faster
# ./run_canon_fw.sh will use this address, don't delete it
# b *0xE0577F3C
# DebugMsg_log

b *0xE0786538
assert_log

b *0xE0545E4E
task_create_log

# what's the difference?!
b *0xE0546072
task_create_log

b *0xE057783C
register_interrupt_log

b *0xE05721B8
register_func_log

if 0
  b *0xE05727D0
  create_semaphore8_log

  b *0xE0572896
  take_semaphore_log
end

b *0xE0559272
CreateStateObject_log

b *0xE02A89E4
mpu_send_log

b *0xE016F31A
generic_log

b *0xE074F0F0
generic_log


b *0xE00508B0
generic_log

b *0xE0577ADC
generic_log

b *0xE06704E4
commands
  silent
  print_current_location
  printf "I2C_Write(%x, %x, %x, %x)\n", $r0, $r1, $r2, $r3
  set $r0 = 0
  set $pc = $lr
  c
end

b *0xE0573522
commands
  silent
  print_current_location
  printf "!! NIGHTMARE !! S_PROPAD_INVALIDPARAMETER 20003\n"
  set $r0 = 0
  set $pc = $lr
  c
end

b *0xE004490E
commands
  silent
  print_current_location
  printf "DataLoad_wait hack\n"
  set $r1 = 1000
  c
end

b *0xE004A488
commands
  silent
  print_current_location
  printf "lens init?\n"
  set $r0 = 0
  set $pc = $lr
  c
end

b *0xE01E1318
commands
  silent
  print_current_location
  printf "RemCPUSwChk\n"
  set $r0 = 0
  set $pc = $lr
  c
end

b *0xE016F31A
commands
  silent
  print_current_location
  printf "conductor\n"
  set $r0 = 0
  set $pc = $lr
  c
end

if 0
b *0xE01E12B8
commands
  silent
  print_current_location
  printf "SwitchCheck\n"
  set $r0 = 5
  set $r1 = 0
  set $pc = 0xE07599BC
  c
end
end

b *0xE0759A98
commands
  silent
  print_current_location
  KRED
  printf "LED drive %x %x\n", $r0, $r1
  KRESET
  log_result
  c
end

if 0
b *0xE05E994E
commands
  silent
  print_current_location
  printf "rtc drv\n"
  set $r0 = 0
  set $pc = $lr
  c
end
end

#b *0x1b1d40
#b *0x1b1c40
#b my_cstart
#b my_dcache_clean

#b *0xE0004cea thread 2
#b *0xe00400fe
#commands
#    dump binary memory 40000000.bin 0x40000000 0x40100000
#    dump binary memory DF000000.bin 0xDF000000 0xDF100000
#end

# i2c_read
b *0xE0670444
generic_log

# i2c_write
b *0xE06704E4
generic_log

# hpcopy
if 0
b *0xE02E02EE
commands
    silent
    print_current_location
    KRED
    printf "HPCopy(%x, %x, %x)\n", $r0, $r1, $r2
    KRESET
    set $r2 = 0x4
    tbreak *($lr & ~1)
    commands
        silent
        print_current_location
        KRED
        printf "HPCopy ret %x\n", $r0
        KRESET
    end
end
#generic_log
end


# HPCopy
# Hardware protocol looks complex; emulating from GDB for now
b *0xE02E02EE
commands
  silent
  print_current_location
  KRED
  printf "HPCopy(%x, %x, %x)\n", $r0, $r1, $r2
  KRESET

  # execute plain memcpy instead (same arguments)
  set $pc = 0xe065e8dd

  # we need to return 0 on success, unlike memcpy
  tbreak *($lr & ~1)
  commands
    silent
    set $r0 = 0
    c
  end
  c
end

b *0xE01E1318

b *0xE06599A0
commands
  silent
  print_current_location
  KRED
  printf "Wakeup\n"
  KRESET
  c
end

b *0xE01E12B8
commands
  silent
  print_current_location
  KRED
  printf "SwitchCheck skipping\n"
  KRESET
  set $pc = $lr
  c
end

b *0xE01A4B92
commands
  silent
  print_current_location
  KRED
  printf "RTCMgrState_S00_I00 skipping\n"
  KRESET
  set $pc = $lr
  c
end

b *0xE01E3796
commands
  silent
  print_current_location
  KRED
  printf "PhySw stuff skipping\n"
  KRESET
  set $pc = $lr
  c
end

b *0xE0040C90
commands
  silent
  print_current_location
  KRED
  printf "take_sem WaitCCInit\n"
  KRESET
  set $r1 = 1000
  c
end

b *0xE00EE288
commands
  silent
  print_current_location
  KRED
  printf "SubCPU something skipping\n"
  KRESET
  set $pc = $lr
  c
end

#b *0xE00504B2


cont

As I recall the gui emulation isn't working yet. The invalid 1.0.2 ROM1.BIN is a problem, QEMU kept crashing so I "borrowed" the valid file from 1.0.1 and the Frankenstein monster awoke:

(https://live.staticflickr.com/7832/47589234861_f70ba8d9c7.jpg) (https://flic.kr/p/2fvigxk)

Reason I'm calling it Frankenstein is because even though it is clearly running 1.0.2, the CineStyle Picture Style came from the 1.0.1 firmware dump ROM1.BIN file from @leathc.

Ok--so how about running my firmware update on it to get the firmware signature? It did seem to run fine on the camera but no matter how high I flew the kites or number of lightning strikes, qemu refused to go past this:

Code: [Select]
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: aprofiti on April 12, 2019, 02:54:52 AM
Two reasons I have encountered which can make it hang there:
1. It reached firmware signature check and failed to pass
2. Some wrong address for patching cache or others in platform/m50/constants.h

Have you compiled with Qemu debugging messages enabled?

Firmware signature message are that kind of type (like this (https://www.magiclantern.fm/forum/index.php?topic=19737.msg213298#msg213298)).
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 12, 2019, 05:07:42 AM
I've got the debugging messages enabled.

Code: [Select]
./run_canon_fw.sh M50,firmware="boot=0" -d debugmsg -s -S & arm-none-eabi-gdb -x M50/debugmsg.gdb
Lot of this going on:

Code: [Select]
[CPU0] [  HeartBeat0:e0234c7f ] SubCPU something skipping

Went back and forth between M50.101 and M50.102 and as far as I can see they are both running the same in QEMU with the exception of not being able to get past that sticking point (with "boot-1" of course) because of the firmware signature. Just to see if your suggestion of a "faked" value will show a message like what you got on the 200D I changed the M50.101 firmware signature and it got stuck at exactly the same place.

So--looks like I got a firmware update that is 99% there. It is just missing the key to unlock it.  :-X

Yeah, I know--this firmware update is just a minor one but going through the process is a good way to get familiar with the camera.

Code: [Select]
Firmware Version 1.0.2 incorporates the following fix:

1. Improves reliability of communication with external flashes.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: aprofiti on April 12, 2019, 11:57:22 AM
I mean compile with CONFIG_QEMU=y to enable qprintf in console.
Can't retrieve the exact command line now, should be appended after make command (tried in makefile one time and didn't worked with digic6 branch  so not sure about that method)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 12, 2019, 02:11:10 PM
Code: [Select]
make CONFIG_QEMU=y
BINGO!

Code: [Select]
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[boot] firmware signature: 0x3b70901c (997232668)
                 expected: 0x80bd9b4b (-2135057589)
            computed from: 0xe0040000 (-536608768)

It woke up:

Code: [Select]
[BOOT] jumping to relocated startup code at 0x1b2349 (1778505)
[CPU0] 001B1890: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B2348: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE008F6E0
[CPU0] 001B2352: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
Wake up CPU1
Wake up CPU1
[CPU1] E00088B4: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E00088C4: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D

Now how to get a valid ROM1.BIN dump. It is working on the "fishy" build but that hasn't been pushed to the remote yet. (Probably because there's something fishy with that changeset?)

Code: [Select]
Magic Lantern fishy.2019Apr01.M50101
Camera   : M50
Firmware : 101
Changeset: dd284faf66c8 (fishy-april-fools) tip
Built on : 2019-04-01 12:00:19 by alex@thinkpad

Code: [Select]
hg up -C dd284faf66c8
abort: unknown revision 'dd284faf66c8'!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: 70MM13 on April 12, 2019, 03:47:28 PM
dfort, this is very cool to watch!

keep sharing...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ughhhml on April 12, 2019, 05:47:38 PM

will anyone send a link to the full m50 software? pleas!!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on April 12, 2019, 07:08:19 PM
There is no full ML for M50 yet.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 13, 2019, 02:09:33 AM
Here's the obligatory "Hello, World!" shot of the M50 running firmware version 1.0.2.

(https://live.staticflickr.com/7812/47595697921_62700336af.jpg) (https://flic.kr/p/2fvSoMp)

Pull request submitted:

https://bitbucket.org/hudson/magic-lantern/pull-requests/955/m50-update-to-canon-firmware-version-102/diff
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lorenzo353 on April 13, 2019, 10:46:00 AM
Easy way is to use Qemu with a faked value in src/fw-signature.h and let it print what src/reboot.c expect to be :)
You can find it under "Canon CanonModelID Values" at https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html (https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html) or https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt (https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt)

Are they discovered from image metadata?

Also usually last digits are printed on serial console by the camera at firmware startup (ex. K412) and is reported under Model ID of the rom dumper.

you can use Exiftool to extract modelId from raw (CR2, CR3) or jpeg.

C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\m50\canon_eos_m50_02.jpg
Canon Model ID                  : EOS M50 / Kiss M

C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\250d\sample01.jpg
Canon Model ID                  : Unknown (0x80000436)

C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\r\447A0582.CR3
Canon Model ID                  : EOR R

for CR3 you can study parse_cr3.py
https://github.com/lclevy/canon_cr3

for CR2 see this poster : https://github.com/lclevy/libcraw2/blob/master/docs/cr2_poster.pdf,
it is stored in Makernote

you can also use craw2tool : https://github.com/lclevy/libcraw2/blob/master/user_manual.md
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on April 13, 2019, 09:15:51 PM
Thanks for the tips.

...the M50 hasn't been integrated into exiftool...

Oops, needed to update my exiftool. Now it works properly:

Code: [Select]
exiftool -CanonModelID IMG_0003.CR3
Canon Model ID                  : EOS M50 / Kiss M

I had an old version and the best it could so was this on jpeg files:

Code: [Select]
exiftool -CanonModelID IMG_0003.JPG
Canon Model ID                  : Unknown (0x412)

By the way, you can get the latest version of exiftool through the ML build scripts:

magic-lantern/modules/dual_iso/Makefile.cr2hdr
Code: [Select]
# Find the latest version of exiftool
EXIFTOOL_VERS=$(shell echo $$(curl -s https://www.sno.phy.queensu.ca/~phil/exiftool/ | grep -Em 1 'Download|Version' | grep -Eo '[0-9]+([.][0-9]+)?') | cut -d ' ' -f 1)
...
exiftool.tar.gz:
# Mac and Linux
wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-$(EXIFTOOL_VERS).tar.gz -O exiftool.tar.gz

exiftool.zip:
# Windows
wget http://www.sno.phy.queensu.ca/~phil/exiftool/exiftool-$(EXIFTOOL_VERS).zip -O exiftool.zip

That Makefile can also compile the latest dcraw and cr2dhr. Check it out.  8)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: aprofiti on April 15, 2019, 08:13:42 PM
you can use Exiftool to extract modelId from raw (CR2, CR3) or jpeg.
Thanks, you just confirmed my initial thinking on how it was discovered for newer models

for CR2 see this poster : https://github.com/lclevy/libcraw2/blob/master/docs/cr2_poster.pdf,
it is stored in Makernote
Had a look at the poster and it helped me to understand better how offsets are handled inside the file format :)

you can also use craw2tool : https://github.com/lclevy/libcraw2/blob/master/user_manual.md
@lorenzo353 I also looked at your library when tried to manipulate exif tags (https://www.magiclantern.fm/forum/index.php?topic=23683.msg213729#msg213729) in cr2 image, but if I don't remember wrong it's not minded to overwrite metadata.
Do you have any suggestions?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ioman on April 17, 2019, 11:32:55 PM
Hello. I just wanted to ask - how is the current state of ML port for M50? I would need bracketing function as I believe its not possible with the original firmware. I would also help contributer as I am developer, but I am javascript specialist and I think there is no use of that. :)

Thx. :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: scrax on April 18, 2019, 04:28:05 AM
Hello. I just wanted to ask - how is the current state of ML port for M50? I would need bracketing function as I believe its not possible with the original firmware. I would also help contributer as I am developer, but I am javascript specialist and I think there is no use of that. :)

Thx. :)

Welcome, you can start by clone repo, setup the toolchain and try to compile ML, that way you can follow development and make your tests, give feedback, make small changes (at first) and who knows that maybe the next big discoveries will come from your findings...

I'm thinking to get a M50 too, even if I was more interested in the RP but the new firmware signature freezed my hopes (for now)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: KelvinK on April 18, 2019, 10:04:20 AM
@scrax Getting M50 now is a good choose! Ultra cheap, Viltrox SpeedBooster and with ML it will be a small beast.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: scrax on April 18, 2019, 10:18:57 AM
@scrax Getting M50 now is a good choose! Ultra cheap, Viltrox SpeedBooster and with ML it will be a small beast.
Exactly, those are the reason mainly.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ioman on April 18, 2019, 10:26:01 AM
Ok, I will try to compile. I can compile and run QEMU even when I have not M50 yet right?

As for the cheapness.. do you think it could get cheaper maybe in 6 months? (canon about to release 2 new M models).
The current price is still to much for me. Now I have M10 and I need to go to M50 (big improvement. :) )

Regards,
Jakub
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: scrax on April 18, 2019, 10:44:51 AM
Ok, I will try to compile. I can compile and run QEMU even when I have not M50 yet right?

As for the cheapness.. do you think it could get cheaper maybe in 6 months? (canon about to release 2 new M models).
The current price is still to much for me. Now I have M10 and I need to go to M50 (big improvement. :) )

Regards,
Jakub

I was thinking you already had it; to run qemu you need a dump of the firmware from the camera you want to emulate
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ioman on April 18, 2019, 01:55:32 PM
Ok, and there arent any dumps from someone who has the camera?

Regards,
Jakub
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on April 18, 2019, 02:25:18 PM
Not for sharing here. ML team considers public sharing/posting ROM dump contents violating Canon's IP rights. 2 options:
- Shout out and hope someone will reply by PN to a new member.
- Prepare a card with a ROM dumper and find a way to use it with an M50.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ioman on April 18, 2019, 04:09:05 PM
Ok, got it. In my local camera shop they allow me to test the M50 with my card anytime I come here so this might be ok.

Jakub
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: ughhhml on April 20, 2019, 06:10:08 PM
hello guys! I'm totally new here and I want to install ML on my M50. Can someone step by step explain this to me?

Thanks,
Jacob
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on April 20, 2019, 06:13:49 PM
hello guys! I'm totally new here
No, you are not. See reply #123.

and I want to install ML on my M50. Can someone step by step explain this to me?
See reply #124
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on April 25, 2019, 07:36:54 AM
Offtopic stuff about the 'when' question moved over here (https://www.magiclantern.fm/forum/index.php?topic=23927.0).

TLDR - I'll share the code as soon as I'll clean it up and make sure it's compatible with other models (DIGIC 6/7/8, without breaking 4 and 5). However, that will happen after taking a short break (could be a month or two, maybe more, maybe less). Sorry, I have to.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on April 27, 2019, 09:08:38 PM
Diaphora - IDA PRO plugin for comparing the firmware :
https://github.com/joxeankoret/diaphora

M50 1.0.1 vs 1.0.2
(https://i.postimg.cc/8zJBKYX1/101vs102.jpg)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on April 30, 2019, 02:02:54 PM
Related to EDMAC (M50 1.0.2):

Code: [Select]
ROM:E0DD7A90

0xD0404000
0xD0420000
0xD0420100
0xD0420200
0xD0420300
0xD0420400...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Matt222Yt on May 25, 2019, 03:54:37 PM
Not sure why but my canon m50 doesn't recognize it as a firmware. Is this an April fools joke?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: AaronG on May 25, 2019, 07:59:17 PM
Hello! I am new in the forum. Despite being new user, I follow the forum for some time. I would like to know if the version of ML that is passed is compatible with 1.02 and if anyone can help me install it. Thank you!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on May 25, 2019, 09:12:20 PM
What is "it"? And unsure what you mean by "doesn't recognize".

http://www.catb.org/~esr/faqs/smart-questions.html#beprecise
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Matt222Yt on May 26, 2019, 06:00:34 AM
I meant that my canon m50 does not recognize the magic lantern firmware and it won't do a firmware update. I already put in the autoexec.bin file but the camera says "memory card containing firmware is required to update"
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: andy kh on May 26, 2019, 06:08:17 AM
From where you get the magic lantern firmware for m50?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on May 26, 2019, 07:16:44 AM
What andy kh said and (again): http://www.catb.org/~esr/faqs/smart-questions.html#beprecise esp. the part about reproducing an error.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Pinni3 on May 28, 2019, 08:50:31 PM
I meant that my canon m50 does not recognize the magic lantern firmware and it won't do a firmware update. I already put in the autoexec.bin file but the camera says "memory card containing firmware is required to update"

the basic is out in JUST THE START not full magic lantern.
It is not only the basic ml april fools you need.
If you look in the forums you will see post with the files you need.

you will need fir files
just the find function on the forum : BOOT_M50.FIR

Personaly i get the awnsers you get from others.
But the forum is for helping others?
I send you in the right direction but do know that ML is not in it full form.

i was also in the dark for the how to, but i invested time and surfed and searched the forum and found my awnsers. TY DFORT for the pointers (Again a hint for searching Matt222Yt)

Also please do not ask ET for full version. just my to cents. alex needs the break

Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on June 04, 2019, 11:37:41 PM
M50 1/200s ISO 100 - White Level

Exif -  11892

Looking at the raw data:
R - 16383
G - 15500 safe limit for my camera
B - 16383

Green channel clipping 15750 :
(https://i.postimg.cc/Qt486yWQ/green-15750.png)

 ???
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on July 26, 2019, 10:31:08 PM
M50 bit depth

Single - 14-bit
Continuous Low - 12-bit?
Continuous High - 12-bit?

Histograms (single, continuous low, continuous high) :
(https://i.postimg.cc/kGDkP9YT/single.png) (https://i.postimg.cc/ZRsMc2Yp/continuous-low.png) (https://i.postimg.cc/gjwBBsr5/continuous-high.png)

If you want to use 14-bit exposure bracketing, you need to quickly press the shutter button, continuous modes are not 14-bit.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: 71m363nd3r on July 27, 2019, 02:11:51 AM
Intresting...
How did you test it?
Just curious.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on July 27, 2019, 06:36:16 PM
These histograms show dark frames (lens cap photography).
Look at the histogram and you'll see the missing bits. It looks like 12-bit converted to 14-bit.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: c_joerg on August 04, 2019, 04:37:39 PM
M50 bit depth

Single - 14-bit
Continuous Low - 12-bit?
Continuous High - 12-bit?

The manual says that the data for continuous recordings are converted into 12 bits...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on August 04, 2019, 07:27:26 PM
Do you have a link to said manual? It's embarrasing but all I can find online is a manual resembling a pre-school children book.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: c_joerg on August 04, 2019, 07:37:38 PM
Do you have a link to said manual?

Only the German version ‘EOS_M50_Help_Guide_DE.pdf’
https://www.canon.de/support/consumer_products/products/cameras/digital_slr/eos-m50.html?type=manuals&manualid=tcm:83-1667469
Page 88 or search about 12 bit.

The M5 also has 12 bit  in continuous mode...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on August 04, 2019, 07:49:48 PM
Thanks! Found english "help-guide" here: http://gdlp01.c-wss.com/gds/2/0300030642/02/EOS_M50_Help_Guide_EN.pdf and the information about continuous shooting bit-depth on page 88, too.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on August 05, 2019, 12:18:27 AM
M50 - rolling shutter measurements - https://www.magiclantern.fm/forum/index.php?topic=23040.msg208479#msg208479

It looks like we have 3 readout modes :
Code: [Select]
timer A = 534, timer B = 4061 @ E19EBAC8
timer A = 1064, timer B = 4061 @ E19EBB20
timer A = 772 timer B = 4061 @ E19EBB78

Code: [Select]
[SHTC] ShutterType(1) ReadOutMode(1) ReleaseType(1) // Manual mode, mechanical shutter
[SHTC] ShutterType(3) ReadOutMode(0) ReleaseType(1) // Silent mode, electronic shutter
[SHTC] ShutterType(1) ReadOutMode(0) ReleaseType(2) // Manual mode, mechanical shutter, AEB continuous

ShutterType(1 - mechanical, 2 - ???, 3 - electronic rolling shutter) // 2- electronic global reset?
ReadOutMode(0 - 12 bit, 1 - 14 bit, 2 - ???)
ReleaseType(1 - ???, 2 - ???)

The manual says that the data for continuous recordings are converted into 12 bits...
I didn't know about it.  :o
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on August 06, 2019, 12:00:56 AM
Banding correction 200D (M50 also has this problem) before/after :

(https://i.postimg.cc/QC95yZmm/200-D-before-after-IMG-0635.jpg)
dpreview (https://www.dpreview.com/reviews/image-comparison/fullscreen?attr144_0=canon_eos200d&attr144_1=nikon_d5600&attr144_2=canon_eos200d&attr144_3=nikon_d5600&attr146_0=100_4&attr146_1=100_4&attr146_2=100_5&attr146_3=100_5&normalization=full&widget=545&x=0.127613738&y=0.5084248)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: 71m363nd3r on August 07, 2019, 12:03:02 AM
Banding correction 200D (M50 also has this problem) before/after :


The EOS R too, just compared it.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Sapporo on August 07, 2019, 02:48:47 PM
Banding correction 200D (M50 also has this problem) before/after :

(https://i.postimg.cc/QC95yZmm/200-D-before-after-IMG-0635.jpg)
dpreview (https://www.dpreview.com/reviews/image-comparison/fullscreen?attr144_0=canon_eos200d&attr144_1=nikon_d5600&attr144_2=canon_eos200d&attr144_3=nikon_d5600&attr146_0=100_4&attr146_1=100_4&attr146_2=100_5&attr146_3=100_5&normalization=full&widget=545&x=0.127613738&y=0.5084248)
Any tutorial how to remove that kind of banding? Or just dark frame substraction?
The EOS R too, just compared it.
Didn't the latest firmware for EOS R solve that?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on August 07, 2019, 05:43:05 PM
The EOS R too, just compared it.

EOS R (before/after)
(https://i.postimg.cc/3RbLhd4y/EOSR-before-after-447-A3152.jpg)

Any tutorial how to remove that kind of banding? Or just dark frame substraction?Didn't the latest firmware for EOS R solve that?
I don't know if I should publish this script, maybe I should sell it to Canon?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Sapporo on August 07, 2019, 06:29:26 PM
EOS R (before/after)
(https://i.postimg.cc/3RbLhd4y/EOSR-before-after-447-A3152.jpg)
I don't know if I should publish this script, maybe I should sell it to Canon?
Is that EOS R with the latest firmware 1.2.0? I saw samples of before/after with big difference. But yes, your script is impressive.
https://youtube.com/watch?feature=youtu.be&v=dfenxw0OKbc
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: RandomSynr on August 12, 2019, 06:22:35 PM
My first post, I am the owner of an M50.  I eagerly await ML for it.  I am trying to read as many posts as possible.

Am I right to say ML for m50 is still experimental?  I will follow these posts for updates and advice.

Cheers
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: walter_schulz on August 12, 2019, 09:50:09 PM
There is no ML for M50 and don't hold your breath.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: RandomSynr on August 13, 2019, 05:23:17 AM
No hope in life, takes out knife and cuts cheese and pours wine...  ;D

well if there is anything that can be done, I'm sure some on may be doing something or maybe just drinking wine and eating cheese
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: 71m363nd3r on August 13, 2019, 06:36:42 PM
No hope in life, takes out knife and cuts cheese and pours wine...  ;D

well if there is anything that can be done, I'm sure some on may be doing something or maybe just drinking wine and eating cheese

Are you willing to donate few bucks ?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on August 16, 2019, 04:12:57 AM
There is no ML for M50 and don't hold your breath.

Well there is this fishy build (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip) -- which requires setting the camera boot flag:

BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)

This will modify your camera.

Right now I'd really like to unset the camera boot flag because when inserting a card that has ML for another camera on it the M50 just goes into a coma. I'd ask for a FIR file but last time I asked for something--well, I won't ask.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Greg on August 16, 2019, 05:10:03 PM
Right now I'd really like to unset the camera boot flag because when inserting a card that has ML for another camera on it the M50 just goes into a coma.

https://www.magiclantern.fm/forum/index.php?topic=17360.msg204747#msg204747
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: dfort on August 21, 2019, 03:54:33 PM
Thanks Greg, that was easy.

Anyone else who wants to do this make sure you also set CONFIG_BOOT_BOOTFLAG=y
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Sisphotos on August 26, 2019, 11:39:49 PM
hello guys! I'm totally new here and I want to install ML on my M50. Can someone step by step explain this to me?
  :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: OlRivrRat on August 29, 2019, 10:55:36 PM
                     @ DFort & WeEIMC

"when inserting a card that has ML for another camera on it the M50 just goes into a coma"

           Should work if You simply "Hide" ML in a "HidingPlace" Folder/Directoy ~

                                                                      ORR ~ DeanB
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: safwanck on September 01, 2019, 05:54:40 PM
I am new to all this ML thing, But really want to test out this ML. So today I tested the fishy build on my M50.
The procedure was simple for me, just placed the boot m50.fir into the memory card and updated my firmware from canon menu. After that, I placed the entire fish build into my sd card and by using EOScard made my sd card bootable. Then just booted my camera. And I saw the log getting captured over my display.
(https://flic.kr/p/2h8UiLR)

And to enter the magic lantern settings, I need to press the delete button, but it didn't take to the ML settings during those presses as much as I need. Then I found that I need to be in video mode to get into ML settings. On video mode, Every press of delete button took me to ML menu.
(https://flic.kr/p/2h8TAwR)
Also, there is no extra function available on this Fishy build. the modules available are benchmark and self-test modules. Also, the video module in ML menu causes to freeze the camera and the only available option is to remove the battery.

Note guys, I don't know any technical stuff that much right now cause it's my first experience of flashing a custom ROM on Camera. So if any of you guys are free, feel free to let me know about all the technical stuff or at least what I did by flashing that boot m50.fir and how it's going to affect the future of my m50.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on September 04, 2019, 09:41:46 AM
You set the "boot flag" on your cam. It will now check for a bootable card each time battery hatch is closed and each time the cam is powered up from powersave. If you insert an incompatible card (very, very old EyeFi cards) cam will get stuck. If a bootable card is found it will check for autoexec.bin. If no autoexec.bin is found cam will get stuck. Just don't use bootable cards without autoexec.bin.
You haven't flashed a custom ROM to your card. Your firmware wasn't replaced. ML runs from card, not from NVRAM.

And you may consider not going somewhere without checking the consequences of your actions. Maybe consider asking before doing something if you're unable to check the consequences.
Just saying ...
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: knank on September 05, 2019, 02:31:52 PM
You set the "boot flag" on your cam. It will now check for a bootable card each time battery hatch is closed and each time the cam is powered up from powersave. If you insert an incompatible card (very, very old EyeFi cards) cam will get stuck. If a bootable card is found it will check for autoexec.bin. If no autoexec.bin is found cam will get stuck. Just don't use bootable cards without autoexec.bin.
You haven't flashed a custom ROM to your card. Your firmware wasn't replaced. ML runs from card, not from NVRAM.

And you may consider not going somewhere without checking the consequences of your actions. Maybe consider asking before doing something if you're unable to check the consequences.
Just saying ...

So, which are the functions avaiable on the fishy build or it's just a visible GUI with no features for the april fool's day?

Thanks i want to test it too but i have no time right now, thanks @safwanck for your post.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: safwanck on September 07, 2019, 01:03:51 PM
Thanks for the info. I personally test everything myself, ie why tested the fishy build without looking for more details.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: michael9 on September 09, 2019, 01:19:58 PM
Are you willing to donate few bucks ?

Yes.  send me/reply with a link?

Do you happen to know if any of the devs have an M50 and if that's the major block to further development?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lorenzo353 on September 11, 2019, 08:51:45 PM
Hi,

Could you please provide me raw samples in continuous mode (both raw and c-raw) ?
So that I can check it is 12bits or not ?
It should be stored in CMP1, offset 32.

Kind regards

Laurent
https://github.com/lclevy/canon_cr3
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: OlRivrRat on September 12, 2019, 05:02:08 PM
   @lorenzo353

Might be helpful to state Who are You asking these ?s of ~
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on September 12, 2019, 05:17:23 PM
Search engine -> CHDK lorenzo353

I don't think devs share your problem. See nanomad's reply https://www.magiclantern.fm/forum/index.php?topic=3096.msg14579#msg14579
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lorenzo353 on September 12, 2019, 09:13:56 PM
Hi,

I'm documenting the CR3 format here : https://github.com/lclevy/canon_cr3
Any CR3 capable model with continuous model can help, please.

12bits in continuous mode has been discussed in this thread, that's why I'm asking here.

Kind regards

Laurent
https://github.com/lclevy/canon_cr3 and http://lclevy.free.fr/cr2/


Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: 71m363nd3r on September 14, 2019, 02:44:04 AM
Hi,

I'm documenting the CR3 format here : https://github.com/lclevy/canon_cr3
Any CR3 capable model with continuous model can help, please.

12bits in continuous mode has been discussed in this thread, that's why I'm asking here.

Kind regards

Laurent
https://github.com/lclevy/canon_cr3 and http://lclevy.free.fr/cr2/

No problem, send me your contacts over PM, I will create the files for you.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: lorenzo353 on September 14, 2019, 08:15:35 PM
Hi,
It seems continuous mode in M50 produces 14 bits, sorry.
But G5 X Mark II and G7 X Mark III do produce 'raw burst', with several pictures in one CR3.
https://www.dpreview.com/reviews/canon-powershot-g5-x-mark-ii-review/5

"Another thing to note - the camera saves all the image in a sort of 'wrapper,' with the 'CR3' suffix. To open them on a desktop machine, you'll need to use Canon's Digital Photo Professional software. You can also extract and process individual files from the camera and save them out as JPEGs that way if you prefer."

Kind regards
Laurent
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: c_joerg on September 16, 2019, 08:21:24 AM
It seems continuous mode in M50 produces 14 bits, sorry.

Sure?
I also looked at the RAW data of the M50 some time ago. The data in continuous mode looked like the histograms of the previous posts. There is definitely a lack of information. Maybe the result will only be shifted to 14bit.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on October 25, 2019, 01:05:54 AM
Canon has released a firmware update for the recent PowerShot G7X III. Can someone take a look at the FIR and tell whether the current decoder/decrypter can still cope with it?

http ://gdlp01.c-wss.com/gds/6/0400005076/01/psg7xm3-v110-win.zip
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on October 25, 2019, 02:33:45 PM
It appears to use the same file format as EOS R/RP and 250D. That means, I'm unable to look inside without physical access to the camera (such as the UART interface).
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: srsa on October 25, 2019, 06:30:51 PM
It appears to use the same file format as EOS R/RP and 250D.
Thanks. That means, reversing the new format will be mandatory before any serious development effort on these new (and future) models.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: c_joerg on October 26, 2019, 03:01:13 PM
It appears to use the same file format as EOS R/RP and 250D. That means, I'm unable to look inside without physical access to the camera (such as the UART interface).
Does that say that it is an EOS firmware?
Thanks. That means, reversing the new format will be mandatory before any serious development effort on these new (and future) models.
Would a firmware dump in the camera bring more?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: a1ex on October 26, 2019, 07:09:54 PM
The FIR file format is the one used by EOS firmware. Whatever is inside, I don't know, but I'd expect something similar to the other EOS/PowerShot "hybrids".

Not exactly a priority for me right now - but once (if ever?) I'll be able to handle the already-started DIGIC 6/7/8 ports, including M50, I'll also look into newer models. The only problem is time - if you solve that for me, I can handle the rest :)
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Matt222Yt on November 15, 2019, 02:37:04 PM
How can I post an image? I have something to show and ask.
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: Walter Schulz on November 15, 2019, 03:22:21 PM
Use a pic host service and link it here
Code: [Select]
[IMG]https://hoster of your choice/mypic1.png[/IMG]
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: sadani99 on November 27, 2019, 10:04:30 AM
Hey!

New firmware on duty for M50! (1.0.3)

I think it's not good for us!
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: anykill on December 03, 2019, 02:07:16 AM
No news about m50 develop?
Title: Re: DIGIC 8 'PowerShot' development (M50, SX70, SX740)
Post by: names_are_hard on December 03, 2019, 05:07:53 PM
If there was, it would be in this thread.  But there isn't, so it's not ;)