Magic Lantern Forum

Developing Magic Lantern => Reverse Engineering => Topic started by: frantony on August 06, 2013, 11:13:30 PM

Title: Battery grip pins / UART
Post by: frantony on August 06, 2013, 11:13:30 PM
Here is the image of Canon EOS 600D battery slot and the image of top part of Canon BG-E8:

(https://a1ex.magiclantern.fm/lost_found/canon_d600_bg_e8_pins.jpg)

You can see that camera body has 16 connection points for grip pins, but battery grip has  only 12 pins. The 4 central connection points are unused by grip.

Does anybody know how this 4 central connection points on the camera body can be used?

I have examinied Canon EOS 1100D camera, the situation is the same --- the camera body has the connection points unused by the grip.
Title: Re: battery grip pins
Post by: 1% on August 06, 2013, 11:35:12 PM
hehe, 4 pins only? USB I hope?

50D has extra pins the grip doesn't go to.
Title: Re: battery grip pins
Post by: frantony on August 06, 2013, 11:48:25 PM
Quote from: 1% on August 06, 2013, 11:35:12 PM
hehe, 4 pins only? USB I hope?

50D has extra pins the grip doesn't go to.

Hmm, camera body already has one USB connector.
More over USB uses point-to-point channels, so you can't easely duplicate the USB connector pins in the battery slot.

Moreover in this situation there is no need of 4 pins for USB as there is no need to use USB interface for power supply.
Title: Re: battery grip pins
Post by: 1% on August 06, 2013, 11:51:04 PM
Well I found 40D service manual. I'm going to see what it says about grip pins there.

WFT connects through the grip. Either the camera or it is the USB host for externals. That HDD thing has to work somehow.
Title: Re: battery grip pins
Post by: SDX on August 06, 2013, 11:52:26 PM
Aren't some of them plain serial for debugging purposes? I mean to have heard something like that a long time ago.
Title: Re: battery grip pins
Post by: 1% on August 07, 2013, 12:26:30 AM
Yea, maybe serial.. service manual doesn't mention it. 50D has another port for WFT that looks like an HDMI connector. So maybe that is serial console.. or does the battery grip already send the buttons this way?
Title: Re: battery grip pins
Post by: SDX on August 07, 2013, 01:20:35 AM
The inner electronics of a no-name battery grip:

(http://www.doc-diy.net/photo/battery_grip/images/pcb_bottom.jpg)
(http://www.doc-diy.net/photo/battery_grip/images/pcb_top.jpg)

It doesn't look very much like serial right there. A few multiplexers and MOSFETs.

I'm still curious. Any ideas on how to connect to these connectors without disassembling the camera?
Title: Re: battery grip pins
Post by: 1% on August 07, 2013, 01:40:02 AM
Its the ribbon cable to those pins?

3 mosfets on the back but what are #2? Power controlers? PMICs?
Title: Re: battery grip pins
Post by: SDX on August 07, 2013, 01:51:32 AM
It's a MC14066BCP in it's TSSOP–14 casing. It's a quad analog switch / quad multiplexer. All ribbon cables go to the button panels.
Title: Re: battery grip pins
Post by: g3gg0 on August 07, 2013, 01:51:42 AM
the 5D repair manual says its pins are those:

(middle two rows, maybe meant for grip)
BATDOOR
AFSEL
LGSEL
SW1
SW2
DIAL1
DIAL2
VCHKON
AELOCK
BATSEL1
BATSEL0

(outer rows, maybe debug)
TXDMPU RXDICU
TXDICU RXDMPU
MON1 MON3
MON0 MON2
Title: Re: battery grip pins
Post by: SDX on August 07, 2013, 02:01:55 AM
Wow, this sounds really interesting. Especially the fact that there is a RX line.
Title: Re: battery grip pins
Post by: 1% on August 07, 2013, 04:26:11 AM
So you'd have to solder to those pins, they are there in my grip making contact.

Wonder what the MON are for, the tx/rx look like serial (probably low voltage not PC voltage) to ICU + MPU.

ICU - Arm?
MPU - TX19A?

Title: Re: battery grip pins
Post by: frantony on August 07, 2013, 11:45:47 AM
Quote from: g3gg0 on August 07, 2013, 01:51:42 AM
the 5D repair manual says its pins are those:

(middle two rows, maybe meant for grip)
BATDOOR
AFSEL
LGSEL
SW1
SW2
DIAL1
DIAL2
VCHKON
AELOCK
BATSEL1
BATSEL0

(outer rows, maybe debug)
TXDMPU RXDICU
TXDICU RXDMPU
MON1 MON3
MON0 MON2

Thanks a lot! Now I see that 5D middle row pins are used by the grip, and outer rows (with smaller contact point) are unused by the grip.
Title: Re: battery grip pins
Post by: frantony on August 07, 2013, 11:56:24 AM
Quote from: 1% on August 07, 2013, 04:26:11 AM
So you'd have to solder to those pins, they are there in my grip making contact.

Hmm. Moreover this RX-TX signals go to the battery slot from main board, so may be soldering to the mainboard (e.g. near the appropriate connector) would be easier. But I don't want to solder to the cameras pcb.

Please correct me if I'm wrong, you write that you have the grip that has the middle contacts missed in the original Canon grip?
Title: Re: battery grip pins
Post by: SDX on August 07, 2013, 01:47:27 PM
I do have the LCD version of the BG-E8.

It has 12 (of 18 possible) pins and they are all somehow connected to something on the board. The board has nothing advanced on it, so no serial there.

I assume the remaining 4 are serial to MPU and ICU. Alternatively it's MON (whatever that is).

I checked how to add these 4 pins. It's not possible to do so from the inside, since the board for the others is mounted to the plastic there.
If I could find some very small springs they could be glued next to the others.
Title: Re: battery grip pins
Post by: bunker2 on June 24, 2016, 12:20:21 PM
Very interested in the Pinout. Help who can know everything about the subject. I also have this for the 600D, but what contacts for what answer? There are even pens with the monitor which shows the number of shots and battery life, but it is fine the power supply circuit and information on the Pinout. I would be very grateful for any information.
Can anyone have information on the Pinout of the contacts of the USB, sound, Etc. ON the SIDE PANEL to the LEFT ;)
Title: Re: battery grip pins
Post by: a1ex on August 19, 2017, 11:04:40 AM
Got 2 pictures from a 600D:

(http://a1ex.magiclantern.fm/bleeding-edge/mpu/600D-pins-1.jpg) (http://a1ex.magiclantern.fm/bleeding-edge/mpu/600D-pins-2.jpg)

Quote from: g3gg0 on August 07, 2013, 01:51:42 AM
TXDMPU RXDICU
TXDICU RXDMPU

These are likely the UART ports for the main CPU (ICU) and the MPU.

The first one should reveal the DryOS shell (aka DrySh or Dry-shell) (http://www.magiclantern.fm/forum/index.php?topic=2864.msg188188#msg188188). There should be also some activity from the bootloader (e.g. "Now jump to AUTOEXEC.BIN").

No idea about the second one.

If anyone could hook up an Arduino/RPi/whatever to these pins and log the UART activity, it will be very appreciated.
Title: Re: battery grip pins
Post by: g3gg0 on August 19, 2017, 03:02:27 PM
one with e.g. a battery grip (https://de.aliexpress.com/item/Vertical-MK-550D-Battery-Grip-for-Canon-550D-600D-650D-700D-T5i-T4i-T3i-T2i-As/32502865700.html) could use a logic analyzer like this one here (https://de.aliexpress.com/item/New-USB-Logic-SCM-24MHz-8-Channel-Logic-Analyzer-Debugger-for-ARM-FPGA-High-Quality/32793675349.html) with sigrok (https://sigrok.org/)
and check whats going on on the "standard" pins.
and maybe modify it to connect to other pins too.
Title: Re: battery grip pins
Post by: t3r4n on April 29, 2018, 05:11:07 PM
Hi all,
has anyone ever got this to work? Here are my findings on the 750D.
I tried to use a cheap battery grip on my 750D and soldered a wire to all twelve pins and the two battery pins to get an outside connection.
Then I tried to hook up a buspirate http://dangerousprototypes.com/docs/Bus_Pirate (http://dangerousprototypes.com/docs/Bus_Pirate) and get a serial connection. To get a potential reaction I used a bootable card without the autoexec.bin file. But after probing all pins I get no connection. So if no-one has a good idea that I should try I will get rid of the wires and start using the grip again.
Title: Re: battery grip pins
Post by: Ant123 on April 29, 2018, 05:49:09 PM
Make sure you are using proper speed and signal levels.
FYI, diagnostic uart has 1.8v levels on Digic 6 Powershots.
Title: Re: battery grip pins
Post by: t3r4n on April 30, 2018, 12:18:45 PM
thanks ant123
I measured some pins to be 3.3 V so assumed that to be the right level... Two resistors later I'm back in the game.
So I think I have to pins which have some communication going on.
- the first is on the battery itself (BAT1), which seems to be logic as Canon can identify fake and third party batteries
- the second is the one I call Pin4 in the picture. Here I find something that could be like the output in qemu but at incorrect baud rate and bits have to investigate further...


(https://thumb.ibb.co/ju0bgx/IMG_3083.png) (https://ibb.co/ju0bgx)
Title: Re: battery grip pins
Post by: aprofiti on September 08, 2018, 08:20:42 PM
Here are some photos of the 50D battery grip:

(https://thumb.ibb.co/eAFm0U/IMAGE_2018_09_08_20_16_26.jpg) (https://ibb.co/eAFm0U) (https://thumb.ibb.co/dA4eLU/IMAGE_2018_09_08_20_16_53.jpg) (https://ibb.co/dA4eLU) (https://thumb.ibb.co/nGfm0U/IMAGE_2018_09_08_20_17_10.jpg) (https://ibb.co/nGfm0U) (https://thumb.ibb.co/fFDvup/IMAGE_2018_09_08_20_17_25.jpg) (https://ibb.co/fFDvup) (https://thumb.ibb.co/nGjPn9/IMAGE_2018_09_08_20_17_33.jpg) (https://ibb.co/nGjPn9) (https://thumb.ibb.co/c00x79/IMAGE_2018_09_08_20_17_41.jpg) (https://ibb.co/c00x79) (https://thumb.ibb.co/c2OTEp/IMAGE_2018_09_08_20_18_10.jpg) (https://ibb.co/c2OTEp) (https://thumb.ibb.co/dHEDfU/IMAGE_2018_09_08_20_19_03.jpg) (https://ibb.co/dHEDfU) (https://thumb.ibb.co/eiYvup/IMAGE_2018_09_08_20_19_09.jpg) (https://ibb.co/eiYvup)

Didn't go further with disassembly as there was something I cannot find out that was blocking.
Tried with multimeter to find some of the connection on the test pad of the pcb, but only a couple was beeping...

On rear of the small pcb (camera side) there are only GND (most off) and VCC (2 or 3 near red cable) test pads

I appears to have all the connection and maybe also UART.
Does anyone know the pinout?
Title: Re: battery grip pins
Post by: a1ex on September 08, 2018, 10:08:05 PM
No idea what the pinout is, but I'd expect the camera to print a lot of things on the TXDICU pin (what you see on the serial console in QEMU), and maybe fewer things (no idea what) on TXDMPU.

I'd start by probing these pins with an oscilloscope / logic analyzer / Arduino board / anything else with an ADC, to figure out the voltage levels and baud rate.

Ant123 successfully identified both the TX and RX pins on EOS M3: https://chdk.setepontos.com/index.php?topic=12542.msg129346#msg129346
Title: Re: battery grip pins
Post by: a1ex on November 27, 2018, 10:32:40 PM
600D - one of these extra pins (i.e. not present in a regular grip) is indeed UART showing Canon's debug messages from main CPU. Details from Daniel Rozsnyo:

(https://a1ex.magiclantern.fm/bleeding-edge/uart/canon-600d-grip-fpc-connector.jpeg) (https://a1ex.magiclantern.fm/bleeding-edge/uart/canon-600d-uart-txd-inside-grip.jpeg) (https://a1ex.magiclantern.fm/bleeding-edge/uart/canon-600d-uart-txd-wiring.jpeg)

Sample log: 600d-okay-sensor.txt (https://a1ex.magiclantern.fm/bleeding-edge/uart/600d-okay-sensor.txt) (camera running vanilla firmware, without ML)

3.3V, baud 115200. A USB to TTL serial cable (e.g. like this (https://www.sparkfun.com/products/12977)) should be enough for getting this log.

You can get a much more complete log with the startup-log (https://builds.magiclantern.fm/jenkins/view/Experiments/job/startup-log/) and startup-log-mpu (https://builds.magiclantern.fm/jenkins/view/Experiments/job/startup-log-mpu/) builds (saved to card), but this log (from the UART pin) also covers messages from Canon's bootloader, and can be very useful for troubleshooting cameras that do not boot.
Title: Re: battery grip pins
Post by: a1ex on February 13, 2019, 12:09:50 AM
Daniel just found the UART pins on the EOS M:

(https://a1ex.magiclantern.fm/bleeding-edge/EOS-M/canon-eos-m_serial-ports.jpeg)


The 1.8V TXDICU pin worked out of the box with the 3.3V FTDI dongle. For RXDICU, Daniel used 2 resistors (470 ohm) as voltage divider.




Also, @kitor found the TXDMPU pin on the EOS R here (https://www.magiclantern.fm/forum/index.php?topic=22770.msg211964#msg211964) (TXDICU not yet confirmed). Same voltage levels as on the M.
Title: Re: Battery grip pins / UART
Post by: kitor on February 15, 2019, 07:41:30 AM
In case of R, UART is hidden under thumb rubber, next to Trash button (there's a hole to access connector). Pinout:

MPU RX IS WRONG. Scroll to post 38-43 on this thread for proper R/RP/... pinout.

1. 0V (not GND)
2. RXDICU (1v8)
3. TXDICU (1v8)
4. GND
5. RXDMPU (3v3)  #EDIT: WRONG! Unknown, (3v3)
6. TXDMPU (3v3)
7. ? (3v3)       #EDIT: WRONG! RXDMPU, (3v3)!
8. ? (3v3)


(https://i.imgur.com/Dt8kHcjl.png)

For upcoming RP I expect the same. (https://twitter.com/_kitor/status/1095956664287555584)
Note that R (and RP on mentioned photo) has 2nd similar connector next to this one. No communication was visible, something tells me this may be JTAG. However not accessible without disassembling camera.
Title: Re: Battery grip pins / UART
Post by: a1ex on March 01, 2019, 11:34:11 AM
5D Mark III: it's available right under the rubber cover, see these (https://d3nevzfk7ii3be.cloudfront.net/igi/VntcuHmdpVribNgj.large) pictures (https://d3nevzfk7ii3be.cloudfront.net/igi/rhuajO25WBKsbOpd.large) from iFixit, or this (https://www.fixyourcamera.org/files/Canon-5D-mkiii-Review-Teardown-197-SD-PCB-FixYourCamera-Org.jpg) from fixyourcamera.org. It's the white connector on the bottom right, with 12 pins. You don't need to disassemble the camera to access it.

Probed the pins with a FTDI RS232 dongle, at 3.3V 115200 baud with the serial terminal from Arduino, and got the following:
- TXDICU: pin 4 from top (starting with 1); didn't check the voltage, but I'd expect it to run at 1.8V
- TXDFPU: pin 6 from top (prints <FPU terminal>)
- TXDMPU: pin 10 from top, or 3 from bottom (prints MON>>> and E1OFF)
- GND: didn't check; used the metal plate at the bottom; it might be pin 8 from top, from looking at the PCB.

Offtopic: my 5D3 was defective, so I was more or less forced to take it apart. It's now working again, but I have no idea what I did to fix it (other than disassembling and reassembling it a few times, and trying to run some diagnostic routines).

edit: discussion about this defect moved over here (https://www.magiclantern.fm/forum/index.php?topic=23622).
Title: Re: Battery grip pins / UART
Post by: kitor on May 01, 2019, 01:00:42 PM
Quote from: kitor on February 15, 2019, 07:41:30 AM
For upcoming RP I expect the same. (https://twitter.com/_kitor/status/1095956664287555584)
Note that R (and RP on mentioned photo) has 2nd similar connector next to this one. No communication was visible, something tells me this may be JTAG. However not accessible without disassembling camera.

https://www.mirrorlessrumors.com/the-canon-eos-rp-disassembly-and-teardown/

After
QuoteA few more hide behind the button pad rubber which needs to peeled away, also like the EOS R.
Hole to UART connector is clearly visible. From board photos seems that only one of two connectors was left (lower one), unfortunately testpads positions suggests they may be hardly/not accessible through that hole, so proper FPC cable will be needed.
Title: Re: Battery grip pins / UART
Post by: turtius on June 22, 2019, 06:49:43 PM
This UART connector is also available on the 200D(@kitor suggested (https://www.magiclantern.fm/forum/index.php?topic=19737.msg217815#msg217815))under the 'thumb resting rubber' which is very similar to the EOS R.


(https://i.postimg.cc/j2KcZN0M/IMG-20190622-202111.jpg)
Title: Re: Battery grip pins / UART
Post by: turtius on January 31, 2020, 07:02:06 AM
Okay so i took apart the 200D and the connector was visible. Using a arduino due and a needle i was able to get some logs from the UART.
(115200,8N1)
(https://cdn.discordapp.com/attachments/671074798004338710/672682504267759616/Untitled.png)
Title: Re: Battery grip pins / UART
Post by: coon on September 26, 2020, 12:51:01 AM
I have taken a macro shot of EOS RPs connector, which looks very similar to R and 200D:

(https://i.ibb.co/v1BzCzQ/connector.jpg) (https://i.ibb.co/v1BzCzQ/connector.jpg)

Pinout is unknown yet. However, I am working on a Flex PCB cable to break out the pins of the connector to 2.54mm pin headers. As soon as I have succeeded with that I will hook up a scope / logic analyzer and will post the pinout here. I expect it to be the same as on R.

Since we cannot find any information about this connector, jack001214 and me have done some assumptions about his 200Ds connector inner width. I have designed a potential cable with various pin pitches in KiCad and jack printed them out on paper in a 1:1 scale until one of them seemed to fit.

Currently we are assuming the following dimensions:
Inner width: 3.5mm
Pin pitch 0.4mm

I did a print of the final version as well. Connector of RP seems to be compatible mechanically:

(https://i.ibb.co/9YGQkqk/connector-with-cable.jpg) (https://i.ibb.co/9YGQkqk/connector-with-cable.jpg)

The Flex PCB version of that cable is already in production at OSH Park and I assume it to arrive until 15th of October. I will then do a another macro shot to check if the cable does fit and if the pin pitch is correct. Meanwhile I am also working on a little ML dev kit circuit board where the other end of that cable can be connected to. It will provide 3 UARTs (ICU, MPU, FPU) and 1 JTAG port which can be accessed via USB then. ICU communication pins will have a proper level shift to 1.8V.

Cable in production does look like this:

(https://cdn.discordapp.com/attachments/671074798004338710/757208097206042624/unknown.png) (https://cdn.discordapp.com/attachments/671074798004338710/757208097206042624/unknown.png)

The work in progress dev kit I am currently working on does look like this so far:

(https://i.ibb.co/4Tdwzzt/dev-board-kicad.png) (https://i.ibb.co/4Tdwzzt/dev-board-kicad.png)

To be continued...
Title: Re: Battery grip pins / UART
Post by: t3r4n on October 03, 2020, 03:57:21 PM
Hi,
as winter comes and the "stay home and safe thing" continues I might be interested in testing that hardware thingy.

Title: Re: Battery grip pins / UART
Post by: coon on October 21, 2020, 12:06:03 PM
The cable has finally arrived this weekend:

(https://cdn.discordapp.com/attachments/671072748985909264/767859690360930304/IMG_20201019_231859094_HDR2.jpg) (https://cdn.discordapp.com/attachments/671072748985909264/767859690360930304/IMG_20201019_231859094_HDR2.jpg)

Production quality is better than I have expected. The cable fits into the connector. Pitch of 0.4mm matches perfectly:

(https://i.ibb.co/ftT6NGr/pitch-macro.png) (https://i.ibb.co/ftT6NGr/pitch-macro.png)

However, we were wrong about the width of 3.5mm. The cable needs to be a bit wider because it moves a bit and already lead to a tiny bend of the pins of my connector. Therefore I will produce another, little wider cable which should have a better fit.

After I've visually confirmed that the pin pitch is correct and I couldn't find any shorted pins with my multimeter I have powered the camera on and did some measurements by using a multimeter and a logic analyzer:

(https://cdn.discordapp.com/attachments/754146111987646464/768199862713843777/IMG_20201020_215135533_HDR.jpg) (https://cdn.discordapp.com/attachments/754146111987646464/768199862713843777/IMG_20201020_215135533_HDR.jpg)


Pinout on RP is about the same as on R and 200D:


1: (Unknown traffic on boot) (1v8)
2: RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7: Unknown (3v3)
8: Unknown (3v3)


There is some traffic on pin 1 when switching the camera on but I can't make any sense of it yet by just using a logic analyzer. I'll check that again as soon as I have a better flex pcb cable and access to an analog scope.
Update: I've checked pin 1 again with a 1Ghz scope and didn't observe any traffic here. Maybe it was just some glitching on the logic analyzer during boot. Logic just goes up to 3.3v and stays there as long as the camera is turned on.

Pins 3 and 6 have typical ICU and MPU traffic.

I have not checked pin 5 yet, but I assume it is the same as on R and 200D and therefore RXMPU.
Update: When sending something on Pin 5 there is not echo back of the input as on ICU. Even when just hitting enter or entering ? I get no response. Therefore I guarantee that this is TXMPU.

Pins 7 and 8 are unknown.

Ground is also available on hot shoe mount, tripod mount and strap mounts (when black color is scraped).
Title: Re: Battery grip pins / UART
Post by: Mike Tornado on October 21, 2020, 03:14:24 PM
I think, the connector on board is JST 08FZC-SM1-GAN-TB

http://www.jst-mfg.com/product/detail_e.php?series=638

Pinout is same on all cameras with this connector, 5D4, 200D, R, RP, 250D, etc... now im working on 250D with 3.3 Levels, it's ok, no plain to die :)

Quality of your fpcs is pretty good, where you print it? and what about costs?
Title: Re: Battery grip pins / UART
Post by: coon on October 21, 2020, 05:47:07 PM
I have printed it on Oshpark for $6.30. You get 3 pieces per order.
Title: Re: Battery grip pins / UART
Post by: coon on October 21, 2020, 06:01:09 PM
Quote from: Mike Tornado on October 21, 2020, 03:14:24 PM
I think, the connector on board is JST 08FZC-SM1-GAN-TB

http://www.jst-mfg.com/product/detail_e.php?series=638

Nice! Measurements in that paper look reasonable also the connectors footprint. Paper says that inner width is 3.6mm. That's the same value I get when comparing connector width with pin pitch on the images. I think I will try 3.6mm in the next revision then.
Title: Re: Battery grip pins / UART
Post by: coon on November 20, 2020, 09:17:20 PM
I have made another cable with a width of 3.65mm. This fits perfectly now and won't cause any mechanical damage to the connector anymore. Meanwhile I have designed a PCB as counter part for the cable:

(https://i.ibb.co/XLsLxpp/Emur-Z-JXIAAwe-Ka.jpg)

It will have a quad FTDI which I will configure for 3xUART and 1xJTAG. I don't know where JTAG is yet or if it is available at all. But if we should find it we can use it that way.
I'll try to solder it this weekend.
Title: Re: Battery grip pins / UART
Post by: coon on December 09, 2020, 08:42:56 PM
I have finally soldered it and it works pretty well so far:

(https://i.ibb.co/b7BDXxD/IMG-1681.jpg)

Once connected via USB to a PC it announces four UART ports:
  - Port 1 is for JTAG (I don't know if and where JTAG pins on EOS RP are and if they work on 3.3V level. But if they do, I can use this with tools like OpenOCD for example.)
  - Port 2 is reserved for FPU and is not connected in this first revision
  - Port 3 is connected to cameras ICU RX/TX pins via 1.8V voltage level shifter ICs
  - Port 4 is directly connected to cameras 3.3V MPU RX/TX pins

dmesg output:

(https://i.ibb.co/Q8bThNM/dmesg.png)

In practice connected to an EOS RP it looks like this...:

(https://i.ibb.co/0sFHpr6/practice.jpg)

... and this (ICU on the top, MPU on the bottom):

(https://i.ibb.co/dcC67YG/terminator.png)

However, it requires some advanced SMD soldering skills to get this assembled. Some PCB manufacturers like JLCPCB do offer a SMT assembly service, where all SMD parts can be ordered presoldered together with the board. That way one can just order the board plus the cable and can start right ahead without soldering at all. Therefore I am working on an upgraded version where this is possible.

I have also made a few mistakes in my DigiKey order so I have to fix the BOM in my github repo. Once this is done I will publish all schematics and gerber files of this.

Signal quality is good. I cannot observe any noticable noise, ringing or glitches:

(https://i.ibb.co/LQYGyjF/drysh.jpg)

Voltage for 1.8V ICU line is perfectly on 1.8V:

(https://i.ibb.co/zsHXPJP/voltage.jpg)

All in all I am very happy with the result.

May the UART adventures begin.  8)

Title: Re: Battery grip pins / UART
Post by: Mike Tornado on December 10, 2020, 03:38:40 PM
Working on Tornado EOS and Tornado SCF big update, that add all new cameras. Sometimes shit happens, it's normal process, yesterday I broke EOS R6.
Uart, service firmware, not helped for me, so finaly i restore it with memory programmer. Found uart pinout, maybe, helped for somebody.

(https://imageup.ru/img5/thumb/eos_r6_uartconnector3684765.jpg) (https://imageup.ru/img5/3684765/eos_r6_uartconnector.jpg)
Title: Re: Battery grip pins / UART
Post by: coon on December 10, 2020, 08:08:14 PM
Thanks for the findings. The connector meight be the same as on RP but as an angled version, so dev kit plus flex pcb meight also work on R6.
Are you sure with the pinout?

It should be:


1:
2: RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7:
8:


But yours is:


1:
2: RXICU (?)
3: TXICU (?)
4: GND
5:
6: TXMPU (?)
7: RXMPU (?)
8:


Did you also note the voltage levels on each pin?
Title: Re: Battery grip pins / UART
Post by: Mike Tornado on December 12, 2020, 09:06:09 AM
Quote from: coon on December 10, 2020, 08:08:14 PM
Thanks for the findings. The connector meight be the same as on RP but as an angled version, so dev kit plus flex pcb meight also work on R6.
Are you sure with the pinout?

It should be:


1:
2: RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7:
8:


But yours is:


1:
2: RXICU (?)
3: TXICU (?)
4: GND
5:
6: TXMPU (?)
7: RXMPU (?)
8:


Did you also note the voltage levels on each pin?

No error here, i always check many times.

ICU - Tx -> PC - Rx
ICU - Rx <- PC - Tx

Same for MPU

ICU levels is 1.8V, but i use 3.3V levels bridge, so no problems.
MPU levels is 3.3V
Title: Re: Battery grip pins / UART
Post by: coon on December 13, 2020, 04:22:47 PM
deleted
Title: Re: Battery grip pins / UART
Post by: coon on December 13, 2020, 04:28:00 PM
So only our RXMPU pins differ. Mine meight be wrong.

how do you know that RXMPU is on pin 7? Do you get any response from MPU when sending something there?
Title: Re: Battery grip pins / UART
Post by: coon on December 14, 2020, 04:22:26 AM
Turns out we were wrong about the pinout all the time. The pinout of Mike Tornado is the correct one.

I have already expected something like that so I have added the option to the dev kit for beeing able to remap all pins between cable and dev board side.
The dev kit was designed for RP in the first place so you can simply do a 1:1 connection by using jumpers usually. Due to the wrong assumption that pin 5 is RXMPU instead of pin 7, this doesn't work of course.
Therefore pin 7 of the cable needs to be mapped to pin 5 of the dev board like this:

(https://i.ibb.co/6001CWc/dev-board-remap.jpg) (https://i.ibb.co/6001CWc/dev-board-remap.jpg)

And voila, I get an echo on UART. Typing HELP lists some commands on MPU:


MON>>>HELP

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
INDIINFO INDICLK INDIAVE ACCCAMPOS CYCLE
ADPTEST BATTCLOSE BATTCHECK BCINFO BATTLEVEL
BATTUSEERR BATTREPREQ BATTEXCLU BATTCHECKSPEC
GETRCP GETRC GETSC FGCOMM FGCOMME4 BATTINFO
VLDET CHGBATTLEVEL ABOUT VER FAABOUT FAVER HELP
UPBNY TRMOSC DEBUGLOG ICUREQ DISPPORTKEEP REGR
REGW MEMR MEMW EEPR EEPW EEPCLK ADCHECK
ADCHECK2 ADTIME ADMODE SCOUT UARTMODE UARTBRD
UARTSEND DNFCLK DNFON DNFOFF RTCON RTCOFF
RTCADJON RTCADJOFF TIMEOUT KWUPCNT I2C ICUTEST
MODE MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG
BATSEL GRIPLED LENSPOWER E1ON E1OFF FACMD
TIMERCMD INFOCMD STACKINFO SW MDIALMODE
TEMPINFO TEMPCLK DRYCTEST SYSRESET DLOG DTASK
DUMP LED


We have shell access to MPU now. :)

I may fix the pinout in the next revision of the board. Now I need to get some sleep. More MPU related info on the R/RP thread soon.
Title: Re: Battery grip pins / UART
Post by: kitor on December 15, 2020, 08:39:31 AM
I just updated my original post with pinout that it was wrong, pointing to proper one :)
Title: Re: Battery grip pins / UART
Post by: kitor on December 17, 2020, 09:45:58 PM
Looks like I just got a complete pinout for 5D Mark III

(https://kitor.pl/eos/img/5d3_uart_th.jpg?2) (https://kitor.pl/eos/img/5d3_uart.jpg)

News: By poking connectors on SD card board I noticed pattern between UART pins and one of ribbons going to main PCB.
I extrapolated that there's probably one more RX/TX line than Alex found. After a short discussion we checked - and it's EEKO core (https://www.magiclantern.fm/forum/index.php?topic=13408.0).

I got interactive shells on ICU, MPU, EEKO, no reaction for any inputs on FPU. Only prints <FPU terminal>, no echo.
Title: Re: Battery grip pins / UART
Post by: Mike Tornado on December 19, 2020, 02:00:43 PM
Quote from: coon on December 13, 2020, 04:28:00 PM
So only our RXMPU pins differ. Mine meight be wrong.

how do you know that RXMPU is on pin 7? Do you get any response from MPU when sending something there?

Its easy, first i search the Tx pin using needle and looking for some readable output, when i fount it, i solder the Tx and seach for Rx with same scheme, but i send data and waiting answer.
Title: Re: Battery grip pins / UART
Post by: g3gg0 on January 04, 2021, 02:24:19 PM
@coon:

PCB looks like JLCPCB - graphics like altium designer. (or kicad?)
Or do you have it on EasyEDA also?

regards,
g3gg0
Title: Re: Battery grip pins / UART
Post by: coon on January 04, 2021, 03:26:56 PM
I've used Kicad for cable and dev board. You can find the project and gerber files here:
https://github.com/coon42/magic-lantern-dev-kit

The latest commit does already contain a fix for the MPU TX pin, so a manual fix via jumper wire is not needed anymore.
Title: Re: Battery grip pins / UART
Post by: kitor on January 07, 2021, 12:11:03 PM
Just to confirm, as I yesterday used MPU UART on R - it indeed has RXMPU on pin 7 (as expected).

Pin 5 is the mystery, as it originally got extrapolated by me based on testpads around the debug connector - those go to 2,3 and 5,6 - and there's no testpad for pin 7.
Title: Re: Battery grip pins / UART
Post by: kitor on January 07, 2021, 09:56:42 PM
(https://kitor.pl/eos_r/img/dryos.png)

MPU... but do you know from what camera? K429 rings a bell?



Anybody?



Well, that's EOS R Battery grip!  :P

(https://kitor.pl/eos_r/img/grip_uart_th.jpg) (https://kitor.pl/eos_r/img/grip_uart.jpg)

Interesting thing is that you won't get shell unless poked RST pin (not sure to what level, i just attached my UARTs TX temporary and pressed any key).
EDIT: this may be related to me having grip on/off switch in off position when the tests were done. YMMV.

You need to almost completely disassemble grip first. It will not work without camera attached.

More details on MPU itself in DIGIC 8 MPU investigation (https://www.magiclantern.fm/forum/index.php?topic=25661.msg233520#msg233520)

If you come here from Twitter, please note that post thumbnail had wrong pins described for RX/RST (they were accidently shifted to the right)
(https://kitor.pl/eos_r/img/grip_th2.jpg) (https://kitor.pl/eos_r/img/grip.jpg)
Title: Re: Battery grip pins / UART
Post by: deviousfusion on February 01, 2021, 11:54:42 AM
X-Post from https://www.magiclantern.fm/forum/index.php?topic=17969.msg233932#msg233932

Some updates:
The 1300D has UART port accessible by removing the thumb grip above the DPAD. Some 1300D do not have the connector soldered on, but the pads on the PCB are visible. I was able to probe test the pins and got a pinout:





Pin No.|    1|    2|    3|   4|    5|    6|
STATE|   0V|  3V3|  3V3|   G|  3V3|  3V3|
Func.|MPU Rx|MPU Tx| (?) |GND|CPU Rx|CPU Tx|

Console outputs
Probing pin 2 gives:
(https://cdn.discordapp.com/attachments/789206911886950411/805669600250691614/unknown.png)

Probing Pin 6 gives:
#
  2010: 14066.703 [FM] FM_Suspend : Normal
Firm Jump RAM to ROM 0xFE0C0000
K404 READY
     0:    13.602 [STARTUP]
K404 ICU Firmware Version 1.1.0 ( 4.4.6 )
    57:   119.351 [RSC] hMemoryQueue (0x660012) hStorageQueue (0x680014)
   121:   137.499 [RTC] PROPAD_GetPropertyData : PROP_RTC 0xfd
   122:   138.857 [RTC] ChangePropertyCBR 0x0, 0x4000
   123:   139.113 [RTC] RTC_Permit 0x20
   134:   139.440 [SND] Seq LPC fin
   151:   142.332 [ENG] [ENGIO](Addr:0x4fb40000, Data:0x   30000)
   154:   150.577 [WB] AdjustWb Done.
   168:   152.797 [TERMINATE] SHUTDOWN init comp
   170:   152.884 [TERMINATE] Abort init comp
   192:   156.561 [MC] PROP_GUI_STATE 0
   197:   156.859 [MC] JobState 0
   200:   157.573 [MC] PROP_LCD_OFFON_BUTTON : 1
   202:   157.758 [MC] PROP_VARIANGLE_GUICTRL : Enable
   205:   158.770 [MC] regist master CardCover
   248:   174.656 [PRP] M:37 F:0 L:0 P:B T:1
   378:   254.481 [LV] [GMT] PROP_TEMP_STATUS : STATUS_NORMAL
   498:   264.995 [LV] InitializeLiveViewDefectDetection
   902:   299.478 [MD] Init RCh1=0, RCh2=0
   905:   300.002 [MD] Set RCh1=d, RCh2=18
  1292:   863.742 [INDEV] INDEV_Initialize
  1299:   865.931 [HDMI] [MID] HDMI_IP_Initialize
  1315:   885.667 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
  1316:   885.741 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
  1352:   906.774 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
  1422:   929.689 WARN [LVDS] First Get DTS_GetAllRandomData
  1524:   940.646 [GUI] MainEventHandler PROP_QR_DIDNOT_EXECUTE(0)(0)
  1570:   945.934 [STARTUP] startupInitializeComplete
  1572:   946.095 [MC] cam event guimode comp. 0
  1732:   996.044 [MC] cam event guimode comp. 0
  1829:  1171.131 [DISP] TurnOnDisplay action Type=0


Now here is where I'm stuck. I do not know what the connector is called.  This is what it looks like (its not JST):
(https://i.imgur.com/Fqjk4AC.png)
Title: Re: Battery grip pins / UART
Post by: coon on February 11, 2021, 11:27:40 PM
The connector is a 6 pin vertical JST 0.8mm:
https://de.aliexpress.com/item/4001088873723.html

A matching cable is available here:
https://de.aliexpress.com/item/4001144163609.html
Title: Re: Battery grip pins / UART
Post by: a1ex on April 10, 2021, 04:23:14 PM
EOS M2 has the same UART connector as 1300D (photo from Walter's (https://www.magiclantern.fm/forum/index.php?topic=26032.msg235148;topicseen#msg235148); TX pins matching the above description from deviousfusion):

(https://a1ex.magiclantern.fm/bleeding-edge/M2/comp_IMG_9963.jpg) (https://a1ex.magiclantern.fm/bleeding-edge/M2/M2-UART-V.JPG)


MON>>>
E1OFF



SD Detect High
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1

[SF] Bufcon Base 0xc022c0d4
SerialFlash Initialize
     0:    55.279 [STARTUP]
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
     4:    57.627 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
     5:    58.313 [PROPAD] SerialFlash Packages!! 0x2d0000
...


760D appears to be similar (photo from igoro00 on Discord):
(https://a1ex.magiclantern.fm/bleeding-edge/760D/IMG_20210201_115658.jpg)

Matching cable also available on Digikey:
https://www.digikey.com/en/products/detail/jst-sales-america-inc/A06SUR06SUR32W51A/6009351
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on April 10, 2021, 05:52:42 PM
Spoiler alert: 250D / SL3 allows a somehow convinient access to UART, too. There is a rectangular hole under rubber cover (thumb rest). My 250D doesn't have a connector but solder pads are the same as shown for 200D here: https://www.magiclantern.fm/forum/index.php?topic=7531.msg224730#msg224730
Don't know if there are cameras in the wild where Canon soldered a connector (see 1300D). Pictures will follow.
(https://media.discordapp.net/attachments/789206911886950411/830796035608674344/UART_250D.png)
Title: Re: Battery grip pins / UART
Post by: kitor on May 07, 2021, 08:29:04 PM
EOS M50

Good news: UART found

(https://kitor.pl/eos_r/img/eos_m50_uart_th.jpg) (https://kitor.pl/eos_r/img/eos_m50_uart.jpg)
eEC412 READY                                                                 
        0:      3.281 [STARTUP]                                             
EC412 ICU Firmware Version 1.1.0 ( 7.3.0 )                                   
       31:     12.869 [SHTV] ShtPmaPath Init                                 
       49:     25.268 [STARTUP] St Reason 0                                 
      113:     66.185 [PROPAD] ERROR GetPropertyData ID = 0x01000013         
      114:     66.191 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000013 L:2992 
      188:     79.808 [PRP] ERROR TWICE PROPERTYMASTER 0x80020037 L:2454     
      189:     79.825 [PRP] ERROR EventDispatch : Current = 0, dwEventID = 0, dwParam = 0xd31154
      299:    117.433 [MR] MRIPC_Initilaize (28)                             
      309:    117.765 [MR] mvrChangeAckCBR : Video - Mode=0,Type=0,Rate=2500,GOP=12
      327:    118.142 [PROPAD] ERROR GetPropertyData ID (0) = 0x02010008
      328:    118.147 [PRP] ERROR NOT FOUND PROPERTY ID = 0x02010008 L:2992
      339:    118.461 [MR] [TCTEST]FreeRunBase RTC:0(h)0(m)0(s)->0
      340:    118.469 [MR] FreeRun/1 [0][0][0][0][0][0]
      404:    128.589 [PROPAD] ERROR GetPropertyData ID (0) = 0x00020005
      405:    128.605 [PROPAD] ERROR GetPropertyData ID (0) = 0x0001002B
      406:    128.614 [PROPAD] ERROR GetPropertyData ID (0) = 0x00010025
       43:    130.592 [EPPVRM] InitializeVramSubTest
      416:    132.067 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0



Bad news: Requires a complete disassembly to gain access  :(


(https://kitor.pl/eos_r/img/eos_m50_teardown_th.jpg) (https://kitor.pl/eos_r/img/eos_m50_teardown.jpg)
Title: Re: Battery grip pins / UART
Post by: Ant123 on May 07, 2021, 10:18:38 PM
Will you try to use JTAG on M50?
https://chdk.setepontos.com/index.php?topic=13408.msg140667#msg140667 (https://chdk.setepontos.com/index.php?topic=13408.msg140667#msg140667)
Title: Re: Battery grip pins / UART
Post by: kitor on May 07, 2021, 10:50:15 PM
No, I had M50 just for a few days to play, I already shipped it back. And I don't have JTAG interface anyway...
But yes, it reminded me pads I have seen in old PowerShots, which confirms that despite having EOS-alike firmware it was designed by "the other team"
Title: Re: Battery grip pins / UART
Post by: kitor on May 21, 2021, 08:37:50 PM
EOS 50D (and most likely 40D)

It was known already that UART is accessible externally from battery grip pins. It requires a modified grip / battery to access.

I thought for sure there has to be some connector inside for factory tests / programming, and I wasn't wrong.

There are two debug connectors, one on ICU (on the other side of HDMI port), and one for MPU - above CF slots. Test pads are exposed around this area.

For MPU - two topmost testpads are (top) MPU_RX, (bottom) MPU_TX
For ICU - two rightmost testpads are (top) ICU_TX, (bottom) ICU_RX

ICU debug connector is easily accessible after removing just ports cover part of the case.

(https://kitor.pl/eos_r/img/eos_50d_uart_1_th.jpg) (https://kitor.pl/eos_r/img/eos_50d_uart_1.jpg)

(https://kitor.pl/eos_r/img/eos_50d_uart_2_th.jpg) (https://kitor.pl/eos_r/img/eos_50d_uart_2.jpg)

CF is not a startup disk.                                                 
K261 READY                                                                   

     0:     8.308 [STARTUP]  K261 ICU Firmware Version 1.0.9 ( 3.4.5 )
Open Console K261[1]>...
K261[1]>
     7:    45.299 [HPD] add emergency isr.                           
    22:    88.777 [STARTUP] Ceres Disappeared                               
   102:   111.712 [ENG] [ENGIO](Addr:0x5c640000, Data:0x   30000)           
   133:   122.797 [MC] PROP_GUI_STATE 0                                     
   138:   123.116 [MC] JobState 0                                           
   139:   123.304 [MC] HDMIConnect ---> (0)                                 
   142:   124.325 [MC] regist master CardCover
   196:   361.327 [PRP] M:51 F:0 L:0 P:20
   197:   361.636 [STARTUP] internal version 03:04:05:00:51:00:00:20
   211:   369.843 [LVMD] Init RCh1=0, RCh2=0
   213:   370.125 [LVCFG] LV_Initialize Jun 17 2009
   219:   372.766 [LVMD] Set RCh1=a, RCh2=18
   226:   375.385 [LVCFG] PROP_TEMP_STATUS  Temp:0, FrameRate:1
   227:   375.609 [LVCFG] PROP_LV_ACTION STOP
   231:   375.893 [LVCFG] PROP_LV_LOCK PERIMIT
   235:   376.190 [LVCFG] PROP_SHOOTING_TYPE 0
   240:   377.805 [LV] PROP_LIVE_VIEW_FACE_AF
   247:   378.733 [LVCFG] PROP_LIVE_VIEW_VIEWTYPE_SELECT 0->0
   249:   378.959 [LVCFG] PROP_LIGHT_FALLOFF_COMP 0
   269:   389.022 [PTP] LensID:0,0,0
   321:   397.123 [PTP] PhotoStudioMode:0
   374:   403.430 [PTP] LV End Clear LVData
   377:   403.599 [PTPCOM] SetPtpTransportResources:0,319b
   492:   416.092 [DISP] InitializeDisplayDeviceController (PUB)
   493:   416.157 [DISP] Memory Area 0 0 0 0 0 0
   497:   418.039 [HDMI] HPD OFF
   546:   467.916 [LVCFG] PROP_OUTPUT_TYPE 0(0) / 0
   574:   476.772 [GUI] HDMI_VIDEO_CODE 0
   667:   526.338 [STARTUP] startupInitializeComplete
   669:   526.477 [MC] cam event guimode comp. 0
   687:   527.785 [MC] cam event guimode comp. 0
   690:   528.014 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   696:   528.999 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   767:   701.207 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=0
   794:   868.687 [DISP] BackLightOn
   796:   885.114 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=1


K261[1]>drysh
=== Dry-shell start ===
Dry> help
[Debug]
task  sem  event  mq  mutex  cond  timer  mkobjsize  extask  kill  suspend
resume  release  delete  prio  mkcfg  meminfo  xd  xm  memmap  objinfo
[Misc]
vers  exit  dminfo

Dry> vers
DRYOS version 2.3, release #0023
  Dry-MK 2.39
  Dry-DM 1.14
  Dry-stdlib 1.33
  Dry-shell 1.11
  Dry-command alpha 029
Dry>


E1ON
MON>>about

  MPU Ver...0x51
  MPU code   area check sum...0x0506D389


MON>>
E1OFF
Title: Re: Battery grip pins / UART
Post by: reddeercity on May 22, 2021, 05:40:28 AM
This is great, Thanks!   :)
I was thinking about this the other day on how to do this to D4's without having a battery grip .
This helps me greatly , I have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems
now i just need to get uart device and get my head around this .
Title: Re: Battery grip pins / UART
Post by: kitor on May 22, 2021, 07:41:04 AM
3v3 and as usual 115200,8,n,1. So any USB UART should do.

In fact it had problems with my 1v8 modified UART (with resistor voltage divider on transmit line), it was in "undetermined" range and camera would randomly get some input.

Bonus: 50D doesn't need magic spell to enter EvShell.

QuoteI have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems
Similar to this - I bought it to:
- verify if dev branch from git repo still works properly on old cameras
- have a reference point for how things work on older generations
Title: Re: Battery grip pins / UART
Post by: reddeercity on May 25, 2021, 05:13:26 AM
Thanks for the info , I"ll do some shopping and see what i can find .
Title: Re: Battery grip pins / UART
Post by: kitor on August 25, 2021, 08:43:43 AM
EOS 60D

Not confirmed on any real camera yet, however easy to spot after seeing multiple ones before.

There's a hole under thumb rubber, in bottom right corner - same spot as 5D3 or EOS R.
Motherboard has 6 pin FPC connector there, visually similar to EOS M/M2, however it is flat to motherboard so I have no idea how one would connect anything without disassembly.
There are test points next to connector, so it should be easy to check the pinout with multimeter and USB UART.
Title: Re: Battery grip pins / UART
Post by: theBilalFakhouri on August 25, 2021, 11:51:19 AM
5D3 Connector:
(https://i.ibb.co/wWTQgVB/5-D3-Connector.jpg)

Close-up view:
(https://i.ibb.co/fHWzx5L/5-D3-Connector-Close-Up.jpg)
Title: Re: Battery grip pins / UART
Post by: theBilalFakhouri on August 25, 2021, 01:39:56 PM
My 700D:

(https://i.ibb.co/N701B0B/700-D-UART-1.jpg)

If this place was for the UART, then the connector isn't soldered and probably those pins are for the connector.

(Sorry for low image quality, it was a bit challenging to show the pins)
Title: Re: Battery grip pins / UART
Post by: kitor on August 25, 2021, 02:28:45 PM
Quote from: theBilalFakhouri on August 25, 2021, 11:51:19 AM
5D3 Connector:

Pinout here (https://www.magiclantern.fm/forum/index.php?topic=7531.msg233101#msg233101)

Quote from: theBilalFakhouri on August 25, 2021, 01:39:56 PM
My 700D:

Looks like 1300D, 760D, etc. I guess they will be the same pinout.
Title: Re: Battery grip pins / UART
Post by: ainu on August 25, 2021, 09:49:52 PM
Canon 70d connector.
Sorry - can't insert image direct from google drive. Here is the link to image.
https://drive.google.com/file/d/1ALmXZdK861ftQMDRvyEEVFGyu-pmosQr/view?usp=sharing (https://drive.google.com/file/d/1ALmXZdK861ftQMDRvyEEVFGyu-pmosQr/view?usp=sharing)

Since the connector is angular, it is impossible to calculate the number of pins without disassembling the camera.
The size of the window for the cord is 6x4 mm, the width of the connector is 5mm.
Does anyone know which connector/cord I need to connect?
Is it possible to get into the shell of the DryOs?
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on August 25, 2021, 10:57:19 PM
It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption. This is EOS M2 connector: https://cdn.discordapp.com/attachments/789206911886950411/830444158539530270/M2-UART.JPG and I'm convinced it is https://www.jst-mfg.com/product/pdf/eng/eXSR.pdf?60cb966485eee

Their shipment costs are somehow reasonable. You may find samples with wires attached by various distributors (with hellish shipment penalty).
Title: Re: Battery grip pins / UART
Post by: ainu on August 25, 2021, 11:23:46 PM
Quote from: Walter Schulz on August 25, 2021, 10:57:19 PM
It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption.
Many thanks. I found this connector in my local radiodetail shop (~1$/1pcs). It came to me at next week and I will check it.
Title: Re: Battery grip pins / UART
Post by: ainu on September 01, 2021, 09:34:51 PM
Quote from: Walter Schulz on August 25, 2021, 10:57:19 PM
It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption. This is EOS M2 connector: https://cdn.discordapp.com/attachments/789206911886950411/830444158539530270/M2-UART.JPG and I'm convinced it is https://www.jst-mfg.com/product/pdf/eng/eXSR.pdf?60cb966485eee

Their shipment costs are somehow reasonable. You may find samples with wires attached by various distributors (with hellish shipment penalty).

I confirm than on 70D connector on mainboard is SM06B-XSRS-ETB (by mistake I buy this. Connector in the mainbord are identical) and we need cable with connector code 06XSR-36S (complete cable code: wire+connector is  A06XSR06XSR36R51B).
Complete cable will arrive to me at the middle of october  :(
Title: Re: Battery grip pins / UART
Post by: kitor on September 02, 2021, 08:41:34 AM
Another parallel to PCB, huh.

Quote from: ainu on August 25, 2021, 09:49:52 PM
Does anyone know which connector/cord I need to connect?
Is it possible to get into the shell of the DryOs?

For sure you will get into EvShell. Pinout is the question, but it can be easily probed - you expect two RX/TX pairs (one for ICU, one for MPU), power and ground.
GND can be taken from anywhere, transmit lines can be just guessed by plugging RX from UART adapter to each line and turning camera off/on, RX are usually next to corresponding TX.

Voltage levels needs to be confirmed but for Digic 5 we expect everything to run 3v3.
Title: Re: Battery grip pins / UART
Post by: ainu on September 23, 2021, 09:45:15 PM
Quote from: kitor on September 02, 2021, 08:41:34 AM

For sure you will get into EvShell. Pinout is the question.

The cable came to me. He's exactly fit. Within a week I will try to check the pinout and connect to the EvShell.
EvShell corresponding to MPU or ICU? Or may be my question is wrong?
Title: Re: Battery grip pins / UART
Post by: kitor on September 24, 2021, 10:44:31 AM
EvShell is the "main" shell on ICU on DSLRs. You can access DryOS Shell using 'drysh' command from EvShell.

See https://www.magiclantern.fm/forum/index.php?topic=25662.0 for the general idea, but please note that linked thread is for Digic 8 so not everything will be applicable.

On MPU there's a separate shell like that:
https://www.magiclantern.fm/forum/index.php?topic=25661.0

Easy to distinguish due to different prompts :)
Title: Re: Battery grip pins / UART
Post by: ainu on September 24, 2021, 10:02:44 PM
Try find pinout.
Numbers From screen side 1  to SD card side 6.

Canon 70D
Screen 1 | 2 | 3 | 4 | 5 | 6| SD card.
Pin 1 - ICU TX (must be connected to usb uart RX)
Pin 2 - ICU RX (must be connected to usb uart TX)
Pin 3 - GND. Connected directly (0 Om) to tripod mount and hot shoe base.
Pin 4 - Power (+). Camera off 3.1v, camera on 3.3v
Pin 5 - MPU TX (must be connected to usb uart RX)
Pin 6 - MPU RX (must be connected to usb uart TX)

Information about EvShell and MPU commands on 70D here:
https://www.magiclantern.fm/forum/index.php?topic=26251.msg236870#msg236870 (https://www.magiclantern.fm/forum/index.php?topic=26251.msg236870#msg236870)
Title: Re: Battery grip pins / UART
Post by: kitor on October 16, 2021, 09:36:26 PM
750D same style and pinout as 1300D, 700D, 760D, 70D, M2... Located under thumb rubber.

Dry[MARIUS]> sysvers
SystemIF 0.28
DRYOS version 2.3, release #0055+p4
MK 2.63
DM 1.20
EFAT 1.18
stdlib 1.54
drylib 1.22
shell 1.18
command alpha 063
MACH 0.27
Title: Re: Battery grip pins / UART
Post by: vth on October 28, 2021, 09:00:22 AM
Not found yet working UART pinout for Canon 5D mark II (I need it for repair purpose) and here is one:
(https://photo-parts.com.ua/parts/IMG_STORE/Canon%205D%20mark%20II%20PCB/Canon%205D2%20UART%20and%20JTAG.jpg)
Also I digged JTAG pinout, but haven't checked it yet.
Also here is JTAG and UART pinout for processors used in old cameras:Digic 4 CK4-1249 and Digic 4 CH4-6405 (they are same at this small part)
(https://photo-parts.com.ua/parts/Datasheets/Digic%204%20CK4-1249DigicCK41249UARTandJTAG.jpg)
Title: Re: Battery grip pins / UART
Post by: coon on February 07, 2022, 09:45:08 PM
Today I've made some further experiments on RP debug connector and I've found out when pulling pin 5 low, MPU gives the following output when battery power is applied:


RSTFLG : 0009
!!!MPU Forced Wakeup!!!
setCCSnkRst
disableBattUVLOInt
Reg0D: 00/00, Reg14: 7F/7F
setCCSnkRst
E0ON
E1ON
initBattery

MON>>>sw task Initialize Complete
/USB_DET undetected
batt task Initialize Complete
adapter task Initialize Complete
temp task Initialize Complete
disp task Initialize Complete
acc task Initialize Complete
setCCSnkRst


This will boot MPU and ICU, even when battery door is open, and also won't shut it down when opening battery door. Thus the last unknown pin is /MPU_FORCED_WAKEUP
We do now know the full pinout of the debug connector of modern cams (200D, R, RP, R6, R5 etc.):


1: VCC_ICU (1v8)
2: RX_ICU (1v8)
3: TX_ICU (1v8)
4: GND
5: /MPU_FORCED_WAKEUP (3v3)
6: TX_MPU (3v3)
7: RX_MPU (3v3)
8: VCC_MPU (3v3)


It's not possible to power camera through debug connector, as not all parts in camera will be supplied with power. MPU will refuse to boot with low battery warning. Therefore I think the pins are meant so be "sense' pins, so one does now if MPU and ICU are currently powered. Instead 7.2V have to be provided via battery connector, or alternatively via the test pads next to it:

(https://media.discordapp.net/attachments/754146111987646464/808977673464184872/unknown.png)

Title: Re: Battery grip pins / UART
Post by: coon on March 25, 2022, 03:33:49 PM
Meanwhile I have soldered the unpopulated connector, next to the UART one on RPs mainboard. I can confirm that a JST 08FZC-SM1-GAN-TB(HF) fits perfectly. It can directly be ordered from JST.

While analyzing the port I have found out it exposes JTAG pins:


1: SWCLK (3v3)
2: GND
3: SWDIO (3v3)
4:
5:
6:
7: VCC_MPU (3v3)
8: /RST (3v3)


(https://media.discordapp.net/attachments/789206911886950411/956921122832646184/rp_debug.jpg)

However:
- It's not full JTAG but SWD, a simplified one wire variant of JTAG.
- Only JTAG pins of MPU are available. It would be more interesting of having JTAG for ICU
- Readout protection seems to be activated as I wasn't able to read out anything from MPU. Thus I probably need to erase and reflash MPU firmware before I am able to use SWD features. As I don't want to brick it I won't do this right now.
- 3 pins are still unknown

Kinda interesting but seems not very useful to me yet.
Title: Re: Battery grip pins / UART
Post by: kitor on April 28, 2022, 08:56:46 AM
Quote from: vth on October 28, 2021, 09:00:22 AM
Not found yet working UART pinout for Canon 5D mark II (I need it for repair purpose) and here is one:

As the image URL is broken, here are the images:
https://photo-parts.com.ua/parts/imgbrowse.php?folder=IMG_STORE/Canon%205D%20mark%20II%20PCB/
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on September 21, 2022, 10:05:05 PM
(https://cdn.discordapp.com/attachments/789206911886950411/1022236080390537229/IMG_0146.png)
17-pin SUR for 5DS/5DS R!

Pinout (top to bottom)
1 VCC. 3v1 off, 3v3 on
2
3
4
5
6 Secondary ICU TX
7 Secondary ICU RX
8 GND
9 FPU TX
10 FPU RX (?)
11
12
13 Primary ICU TX
14 Primary ICU RX
15
16 MPU TX
17 MPU RX
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on September 25, 2022, 04:48:29 PM
Created a wiki page for UART connectors for each cam. For cams without SUR/XSR/FZC/FZA connector I tried to link info about UART pins on PCB.
Please check and correct errors.
https://wiki.magiclantern.fm/uart_connectors

(https://abload.de/img/2022-09-3009_25_44-uamhips.png)

Updated links to PCBs in g3gg0's post: https://www.magiclantern.fm/forum/index.php?topic=19378.msg240573#msg240573
(Should be moved to somewhere else ...)
Title: Re: Battery grip pins / UART
Post by: kitor on September 27, 2022, 08:09:14 AM
Oh, I forgot to post SX740.
Unfortunately on PCB, requires a complete disassembly. Hard to solder without damaging traces...

(https://kitor.pl/eos/img/sx740_uart_th.jpg) (https://kitor.pl/eos/img/sx740_uart.jpg)

EOS R5, under a plastic cover under the screen. FZC8, pinout same as EOS R.

(https://kitor.pl/eos/img/r5_uart_th.jpg) (https://kitor.pl/eos/img/r5_uart.jpg)
Title: Re: Battery grip pins / UART
Post by: kitor on October 11, 2022, 04:05:58 PM
EOS 7D Mark 1

This is actually a success story of unbricking 7D mk1 on our Discord channel.
Photos kudos to @roscombot, who is the owner of now fully functional 7D.

Back story - something had happened during a downgrade from 2.0.5 to 1.2.3 that made camera inoperable.
Story goes that this was many years ago when camera was still on warranty, and Canon service center was not able to fix it.

What we found is Master CPU was running 1.2.3 firmware and screaming about broken properties. Slave CPU was running 2.0.5 and waiting for communication from Master.
Long story short is that after some digging in QEMU and Ghidra we were able to successfully drop to FROMUTILITY menu and start upgrade from there. While downgrading everything to 1.2.3 did not solve the problem, upgrading to 2.0.5 fixed it.

Important notes are:
- one can start FROMUTILITY on both CPUs, but on Master it is broken (?) some options just hang, other appear to work but do nothing. Slave has more options.
- Thanks to Walter for poking around and finding Slave CPU UART. That was a key to unbricking this camera.

btw: Slave CPU runs GUI, etc... and MagicLantern also runs there.

(https://kitor.pl/eos/img/7d_uart_th.jpg?2) (https://kitor.pl/eos/img/7d_uart.jpg)
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on October 11, 2022, 11:04:59 PM
Canon EOS 7D
(https://abload.de/img/7d_uart_16eiu7.png)
Layout for 16-pin XSR (bottom left)
From left to right

1                            9
2                           10
3                           11 VCC (2.94 off/3.3 on)
4                           12
5                           13 MPU TX
6                           14 MPU RX
7                           15 GND
8 VCC (3V off, 3v4 on)      16
Title: Re: Battery grip pins / UART
Post by: Walter Schulz on January 10, 2023, 09:16:16 PM
7DII:

From top to bottom:
1 MPU Rx
2 MPU Tx
3
4
5 Master ICU Rx
6 Master ICU Tx
7
8 (Some kind of reset when connected to ground. Both ICUs restart but rear display goes black and remains until battery pull and insert)
9 FPU Rx (?)
10 FPU Tx
11Vcc
12 GND
13 Slave ICU Rx
14 Slave ICU Tx

In case you are wondering about order: SUR connector rotated 180° compared to 5D3, 5DS R.
Title: Re: Battery grip pins / UART
Post by: kitor on January 15, 2023, 07:53:48 PM
6D mk I:

(https://kitor.pl/eos/img/6d_uart_th.jpg) (https://kitor.pl/eos/img/6d_uart.jpg)

From top to bottom:
1 EEKO_TX
2 EEKO_RX
3 ?? (3v3), trying to transmit resets ICU
4 ICU_TX
5 ICU_RX
6 GND
7 ?? (3v3)
8 MPU_TX
9 MPU_RX
10 ?? (3v3)


Dry> vers
DRYOS version 2.3, release #0051
  Dry-MK 2.60
  Dry-DM 1.20
  Dry-stdlib 1.52
  Dry-NET6 0.33 111125+4796
  Dry-ECI6 0.20+110927
  Dry-DNS 1.23pre 120130-4845
  Dry-DHCPC 2.23
  Dry-PX 1.09
  Dry-drylib 1.21
  Dry-shell 1.17
  Dry-command alpha 058



Dry> help
[Debug]
xd  xm  task  PCMcheck  PCMclear
[EekoLog]
GetEekoLog  PutEekoLog


Fun story: This was a dead camera body, no signs of life. After power was applied it immediately printed "UndefinedInstruction" on ICU UART in loop.
The issue was a blown fuse on power PCB. One of ICU RAM power rails was missing due to that.
Title: Re: Battery grip pins / UART
Post by: kitor on March 04, 2023, 10:50:18 AM
BG-R10 aka EOS R5/R6 battery grip

Due to comm connector relocation it is much easier to plug camera in while disassembled :)

(https://kitor.pl/eos/img/r5_grip_th.jpg) (https://kitor.pl/eos/img/r5_grip.jpg)

(https://kitor.pl/eos/img/r5_grip_2_th.jpg) (https://kitor.pl/eos/img/r5_grip_2.jpg)

Investigation on Digic X MPU, including... firmware emulation in QEMU  :)
https://www.magiclantern.fm/forum/index.php?topic=25661.msg242569#msg242569