Show Posts

101

Reverse Engineering / Re: Interrupt IDs

« on: January 23, 2018, 08:27:41 PM »

0x145: MZRM

102

Camera-specific Development / Re: Canon 80D

« on: January 17, 2018, 09:42:27 PM »

I'm not sure that this is useful until emulation reaches the mzrm initialization.

103

Camera-specific Development / Re: Canon 80D

« on: January 17, 2018, 05:45:48 PM »

found in RAM dump provided by sombree:
two uyvy buffers at 0x41785B00, 0x41901800
one RGBA buffer at 0x043ED100

bitmap buffers are 960*540 pixels with black bars:

104

General Development / Re: How to run Magic Lantern into QEMU?!...

« on: December 21, 2017, 08:19:47 AM »

Quote from: a1ex on December 20, 2017, 09:50:43 PM

The emulation doesn't seem to initialize Zico on 80D yet - does reach this stage on M3?

Code: [Select]

Set default DRAM parameter
#
DRYOS version 2.3, release #0055+p6
Copyright (C) 1997-2013 by CANON Inc.
[SDIO] Error
[SDIO] Error
[SDIO] Error
[SDIO] Error

StartDiskboot
Diskboot file not found
2.1.1
3.1.1
4.1.1
3.1.2:11,0,0,4,0
3.1.3:1
3.1.3:0
3.1.2:11,0,0,4,0
3.1.3:1
3.2.1:2
3.2.3:2
3.2.7:2
3.2.9:2
3.2.11:2
3.2.13:2
3.2.15:2
3.2.17:2
3.2.19:2
3.4.4.1:0,128,128,1
== PnlSync =========
  vwidth  : 494
  hwidth  : 909
  h_pre   : 723
  h_blank : 719
  vb_lt   : 490
  vb_st   : 11
  vp_lt   : 490
  vp_st   : 11
  vb_l    : 490
  vb_s    : 11
  vp_l    : 490
  vp_s    : 11
====================
3.4.1.1:720,480,1,10,1
3.3.2:fc5f95cc(32,32,32),1
3.3.3:fc5f95d0(0),1
3.3.4:fc5f95ec,(0,1),1
3.3.5:fc5f962c,1
3.3.7:fc5f965c,1
3.3.9:fc5f9664,1
3.3.10:fc5f9668,1
3.3.1:fc5f95cc,1
3.1.6:1,2,9,0
3.10.1:124,128,134,0,0,0,1
3.3.12:1,1
3.2.19:0
3.2.17:0
3.2.15:0
3.2.13:0
3.2.11:0
3.2.9:0
3.2.7:0
3.3.14:0,0,1
InitializeGraphicLog Addr:0x4112b000 Size:0x5000
DlphLog:Addr:0x4112b000, Size:0x1400
_FreeMsg   : ------ req:0 stt:32
_CreateMsg : 0xbff00500 size:12
_FreeMsg   : ------ req:0 stt:32
SendMsg   : 1
ZicoLog:Addr:0, Size:0x2800
InitializeGraphicLog SUCCESS
_FreeMsg   : ------ req:1 stt:33
_FreeMsg   : 0xbff00500 free:1
_CreateMsg : 0xbff00500 size:4
_FreeMsg   : ------ req:1 stt:33
SendMsg   : 2
_FreeMsg   : ------ req:2 stt:33
_CreateMsg : 0xbff00528 size:76
_FreeMsg   : ------ req:2 stt:33
SendMsg   : 3
_FreeMsg   : ------ req:3 stt:33
_CreateMsg : 0xbff00598 size:4
_FreeMsg   : ------ req:3 stt:33
SendMsg   : 4
_FreeMsg   : ------ req:4 stt:33
_CreateMsg : 0xbff005c0 size:0
_FreeMsg   : ------ req:4 stt:33
SendMsg   : 5
[GRYP]T: --- Initialize start ----------------
_FreeMsg   : ------ req:5 stt:37
_FreeMsg   : 0xbff00500 free:2
_FreeMsg   : 0xbff00528 free:3
_FreeMsg   : 0xbff00598 free:4
_FreeMsg   : 0xbff005c0 free:5
_CreateMsg : 0xbff00500 size:0
_FreeMsg   : ------ req:5 stt:37
SendMsg   : 6
[GRYP]T: InitializeGryp(Pri)    : Completed.
         Privilege Event handle : 0x02500050
_FreeMsg   : ------ req:6 stt:38
_FreeMsg   : 0xbff00500 free:6
_CreateMsg : 0xbff00500 size:0
_FreeMsg   : ------ req:6 stt:38
SendMsg   : 7
         GRYPHON revision       : 0x00000000
[GRYP]T: Initialize(Pri): Completed.
[GRYP]T: --- Initialize(Pri/Nml) Completed ---

_FreeMsg   : ------ req:7 stt:39
_FreeMsg   : 0xbff00500 free:7
_CreateMsg : 0xbff00500 size:12
_FreeMsg   : ------ req:7 stt:39
SendMsg   : 8
_FreeMsg   : ------ req:8 stt:40
_FreeMsg   : 0xbff00500 free:8
_CreateMsg : 0xbff00500 size:12
_FreeMsg   : ------ req:8 stt:40
SendMsg   : 9
_FreeMsg   : ------ req:9 stt:40
_CreateMsg : 0xbff00530 size:16

...



SendMsg   : 27
_FreeMsg   : ------ req:27 stt:59
_FreeMsg   : 0xbff00500 free:27
_CreateMsg : 0xbff00500 size:772
_FreeMsg   : ------ req:27 stt:59
SendMsg   : 28
3.4.1.4:5,00690f70,1,0,1e0
3.4.1.5:5,0,0,720,480,0,0,1
3.4.1.6:5,0,3,0,1
3.4.1.2:5,1,1
3.2.21:1,fc152451,00000000
3.2.22:1,1
3.2.3:0
3.3.15:1,1

At least it tries to draw something by sending JediDraw message (0xFC4BB8BA)
I've used this patch to display debug messages:

Code: [Select]

PatchDbgByte(0x00028698,0xFF);
PatchDbgByte(0x00028699,0xFF);
PatchDbgByte(0x0002869A,0xFF);
PatchDbgByte(0x0002869B,0xFF);

PatchDbgByte(0x000286A0,0x9D);
PatchDbgByte(0x000286A1,0xFD);
PatchDbgByte(0x000286A2,0x37);
PatchDbgByte(0x000286A3,0xFC);

PatchDbgByte(0x000286A8,0x9D);
PatchDbgByte(0x000286A9,0xFD);
PatchDbgByte(0x000286AA,0x37);
PatchDbgByte(0x000286AB,0xFC);

Quote

BTW, do you happen to have any notes on UTimer or Omar?

no

105

General Development / Re: How to run Magic Lantern into QEMU?!...

« on: December 20, 2017, 03:52:38 PM »

Quote from: a1ex on December 20, 2017, 12:49:51 AM

Some progress on emulating DIGIC 6:

I think it's possible to emulate simple drawing of text strings in case main CPU will send certain messages to MZRM core...
But on EOS M3 the camera controller still does not allow to start it normally and goes to shutdown.
What is the situation with DSLRs?

106

Camera-specific Development / Re: Porting ML to XSi (450D)

« on: December 07, 2017, 06:31:11 PM »

Quote from: a1ex on December 05, 2017, 01:55:49 AM

BTW - address 0xFFD65490 doesn't seem valid for 450D - did you mean 0xFFD237F0 ?

Yes. There was wrong address 0xFFD65490.
But it doesn't help to create working binaries using modern GCC.
Only gcc-arm-none-eabi-4_7-2012q4 generates binary which doesn't stuck.

Quote

Does that mean not all these patches from disable_cache_clearing are actually required for booting?

I don't know. I just found the same opcodes based on 40D port.

107

Camera-specific Development / Re: Porting ML to XSi (450D)

« on: September 24, 2017, 01:39:54 PM »

Quote from: a1ex on September 22, 2017, 09:31:17 PM

Does the "ETTR ETTR ETTR ETTR" message show up on actual hardware as in the above screenshot?

Yes, if you are talking about ML Prefs menu.

Quote

Compiling from latest changeset from Ant (c700f92) gives the same result (stuck on initial screen, with LED turned on).

Try this patch:

Code: [Select]

diff -r 18ac6b0f9929 platform/450D.110/init.c
--- a/platform/450D.110/init.c	Sun Oct 30 14:43:33 2016 +0200
+++ b/platform/450D.110/init.c	Sun Sep 24 14:27:14 2017 +0300
@@ -89,7 +89,9 @@
 	// _mem_init();
 	bmp_vram_idle_ptr = malloc(360*240);
 	// _find_ml_card();
-	 msleep(550);
+	 // msleep(550);
+	uint32_t size;
+    while((FIO_GetFileSize("AUTOEXEC.BIN", &size ) != 0) || (size == 0))  msleep(10);	 
 	_load_fonts();
        // msleep(300);
 	call("DisablePowerSave");

Note: I'm using gcc-arm-none-eabi-4_7-2012q4. With GCC 4.8 it stuks.

108

Camera-specific Development / Re: Canon 750D

« on: July 12, 2017, 06:33:45 PM »

Walter Schulz

Are not you tired of answering stupid questions from new members?
Maybe it's need to oblige them to read the FAQ before they can leave comments?

109

Camera-specific Development / Re: Porting ML to XSi (450D)

« on: June 24, 2017, 10:12:29 PM »

Quote from: armedchanger on June 24, 2017, 08:31:51 PM

I'm I missing something?

Read the FAQ first...

110

Reverse Engineering / Re: UHS-I / SD cards investigation

« on: June 19, 2017, 11:31:21 AM »

Quote from: a1ex on June 18, 2017, 11:54:16 PM

My hypothesis was that 5D3's SD controller is UHS-capable, but for some unknown reason (could be even problems during the initial tests), Canon decided not to include it in the firmware. As a result, some of the UHS initialization code (hopefully a small part) was optimized out.

If you can not enter UHS mode with ML but it works without, read this topic.
Conclusion:
Most SD cards need to be reinitialized by switching off SD power if they already were in UHS mode.

111