Messages

[6D.116]

Hello everybody,

without knowing that JLL is already working on a 6D.116 port, I did a little work myself.

The resulting source code can be found here: https://bitbucket.org/Maqs/magic-lantern/branch/6D.116



Seems to be running so far, but as I am rather a hacker than a user, I could be missing something.  Read this as: please test!

For those of you how want to try the 6D.116 work-in-progress:

• download the 6D.113 nightly as a base
• replace the autoexec.bin file with autoexec.bin
• put the symbol file 6D_116.sym in ML/modules/

Some modules may not work, as they check explicitly for 6D.113.

There may also be bugs. The usual disclaimers apply.

Thanks to Maqs, I've been able to fill in the values I was missing.
ML seems to run fine on 6D with firmware 116. I haven't done any extensive tests yet though.
Anyone who wants to try it can test the binary provided by Maqs.

Update on 1.1.6 support

Back LCD is displaying now (Canon menu only)
ML seems to run but doesn't show up on the back LCD yet (trash button brings up an unresponsive Canon menu, only to disappear after a few seconds)
bmp_printf seems to be displayed correctly.

Full 116 support is not too far away now
Latest commit here

Update on 1.1.6 port

EDIT: bit of progress, the problem I'm having is actually elsewhere. I disabled CONFIG_CRASH_LOG and it doesn't crash anymore so I guess I'm missing some more stubs.
However, the while loop still doesn't go through. Will keep digging.

I kind of tracked down the source of my black screen.

Basically, my port runs fine until the line below in boot-hack.c
The way I "confirmed" the code to be running fine until here is by adding calls to info_led_blink() at several points during boot.
The led blinks fine and I can even take pictures (top lcd working, viewfinder info working, no back lcd).
However, once I reach this line, the camera either simply doesn't turn on, or if I turn it on quickly enough and try to take a picture, it will freeze (err 80 on top lcd)

Code Select Expand

    // wait for firmware to initialize
    while (!bmp_vram_raw()) msleep(100);

I have found bmp_vram_info to be 0x9bc98 on 1.1.6, according to the references I found for 1.1.3 and matched the code with the dump on 1.1.6

On 1.1.3, there are two references to the bmp_vram_info address (0x9bc78) when searching for SetBitmapVramAddress

Code Select Expand

ff13a134: e28f2e2d add r2, pc, #720 ; ff13a40c: (42746553)  *"SetBitmapVramAddress BitmapAddr:%#08x"
[snip]
ff13a148: e59f42e4 ldr r4, [pc, #740] ; ff13a434: (0009bc78)



Code Select Expand

"SetBitmapVramAddress BitmapAddr:%#08x":
ff13a40c: 42746553 rsbsmi r6, r4, #348127232 ; 0x14c00000
ff13a410: 616d7469 cmnvs sp, r9, ror #8
[snip]
ff13a430: 00000078 andeq r0, r0, r8, ror r0
ff13a434: 0009bc78 andeq fp, r9, r8, ror ip


On 1.1.6:

Code Select Expand

ff13a12c: e28f2e2d add r2, pc, #720 ; ff13a404: (42746553)  *"SetBitmapVramAddress BitmapAddr:%#08x"
[snip]
ff13a140: e59f42e4 ldr r4, [pc, #740] ; ff13a42c: (0009bc98)


Code Select Expand

"SetBitmapVramAddress BitmapAddr:%#08x":
ff13a404: 42746553 rsbsmi r6, r4, #348127232 ; 0x14c00000
ff13a408: 616d7469 cmnvs sp, r9, ror #8
[snip]
ff13a428: 00000078 andeq r0, r0, r8, ror r0
ff13a42c: 0009bc98 muleq r9, r8, ip


So I am not sure why the while() loop is making the camera crash.

Any ideas ?

Update on 116 support

I managed to make good progress. I can now boot into ML and take pictures, however back LCD screen is still not operational (I think the GUI task address hack is correct though).
More info here

Will continue debugging later this week.

@JLL:
Be sure to verify the correct stub necessary to hijack the gui task. Otherwise you may experience the symptomps you described. You can find it in boot-hack.c:

Code Select Expand


#ifdef CONFIG_6D
    //Hijack GUI Task Here - Now we're booting with cache hacks and have menu.
    cache_fake(0xFF0DF6DC, BL_INSTR(0xFF0DF6DC, (uint32_t)hijack_6d_guitask), TYPE_ICACHE);
#endif


Don't forget to check the hijack addresses in consts.h and #undefine property request changes in internals.h before you continue.

Thanks for the tip ! Will look into it tonight.

Quick update on firmware 116 support

I have found most of the required stubs and addresses.
I have also managed to compile and start ML but I get a black screen (top display works, no LED activity).
I'm now trying to debug where it went wrong. So far, I have confirmed (through various trial and error) that the entry point is reached (copy_and_restart()) but along the way, it stumbles somewhere.

Will report more later.

If you will do it with success, can we expect you will go further and try to fix bugs we have on 6D build?

That's the intent yes (will be highly dependent on my free time though)

I started on the 6D.116 stubs and consts. I have marked the addresses I checked and confirmed as comments (JL:CHECKED) so I can keep track of what I went over but will remove them later on.

Progress here

I managed to dump the 116 ROM and started on hunting down the stubs.

For obvious reasons, I can't share the rom here however, if any of you would like to try it, here's what I did:

• download the file from a1ex's post
• since we're working on 1.1.6 firmware, make sure your camera is up to date
• copy the FIR file at the root of your SD card and start the camera
• take a picture with your camera, make sure the image is viewable with the camera viewer
• enter the camera menu -> firmware ver : 1.1.6 ->update firmware
• the camera will reboot, display the firmware update screen briefly and reboot again
• once the sensor cleaning is done, enter the camera image viewer, the screen will remain black for a few seconds while the SD card led indicator will start blinking, this means that the ROM is being dumped on the SD Card
• there now should be a file called (NULL) at the root of your SD card, size is 32MB
• in order to split the file in two so you can start working according to this thread, you can use the following term command (unix environment)

Code Select Expand

split -b16m <input_file> <output_file_pattern>

• this should split the 32MB file in two 16MB files "<output_file_pattern>aa" and "<output_file_pattern>ab", you can rename them ROM0.BIN and ROM1.BIN respectively

Thanks a1ex !
I can't believe I missed that thread/post after all the search I've done :/
This should speed things up.

I'm currently learning about ML with my 6D.
I can compile and do my modifications just fine and now, moving on to trying to dump the 1.1.6 firmware.

From what I've gathered so far, making a FIR file is not possible since source is not provided for the tools (according to this thread - unless this info is outdated)
Another thread mentions this same process for the 5D and firmware 1.2.3 here. Someone managed to do it with help from a1ex but no one is reporting how they did it.

And then there's the installer.c source file that can be used to generate an autoexec.bin (and thus, allow us to dump the firmware - but looks like we still need to have a FIR file made for 1.1.6, otherwise the 6D won't boot the autoexec.bin we just made)
I also tried using the special updater that coutts is mentioning at the top post but it didn't seem to work (and likely won't, since it was made for 1.1.2 ?)

Anyway, in order to compile installer.c and have it running, it looks like there are a few function stubs (the ones for firmware 1.1.6) we need to find first. Those are (according to stubs.S):
- cstart
- bzero32
- create_init_task
- init_task
and likely, most file IO functions so ML can dump the firmware on the SD card.

There are also a few defines (in config-defines.h) that seem relevant (CONFIG_DUMPER_BOOTFLAG and CONFIG_EARLY_PORT) but they are only used inside boot-hack.c (and not installer.c)

I will continue digging and report what I find later.

EDIT: Also a relevant link on the wiki about packing FIR files (might not be up-to-date)
http://magiclantern.wikia.com/wiki/Packing_FIR_Files

Hello !

I'm a software developer living in Japan and owner of a 6D.

Since it went out of warranty last month, I just figured I'd take the plunge and try to do some stuff with it.

I just took a quick look at the development environment so I'm not entirely up to speed yet. I just hope there are ways to actually recover from anything bad I might be doing during development...

Anyway, see you guys around.