Messages

For version 203 of firmware:
https://bitbucket.org/ccritix/magic-lantern/downloads/crop_rec_4k_mlv_snd_isogain_1x3_presets_2018Dec01.EOSM203.zip

Yes, but @Muwex tried to use the EOSM2 version, instead of the EOSM version ...

Format card in cam...then copy from zip and make card bootable with eoscard...
Then try...

crop_rec_4k_mlv_snd.2018Aug06.EOSM2103.zip

is for EOSM2, not EOSM

Hi.
Can you give me dump for this cam?
Thanks a lot...

Hi.
Please send to me dump from 6D2 for finding stubs.
Thanks.

I've tried to see what the api_test.lua script does not work, but without a result. One of the "problems" was that the device had to be set to expanded ISO because it has ISO 3200 and expanded to 6400. The api_test.lua script is used maximum 6400.
Another change we tested. Script perform 100 random value tests. I just set maximum 10 values, and it was ok, but is crash to

Code Select Expand

printf (" Starting LiveView ... \ n ")
I can not tell, unfortunately, what is not ok ...

Minimal it's work. I tested like dfort and i's work.

Superb ... That means we are a big step forward.
Congratulations...
I can hardly wait to start the 1300D magic-lantern.

Hi.
I need ROM dump file for 200D and M50.
Thanks.

Code Select Expand


NSTUB(0xFF0234B4,  gui_init_end) -> is not OK.
NSTUB(    0x1E8C,  mvr_config)               // please re-check  -> is not OK
NSTUB(0xFF33030C,  fsuDecodePartitionTable)  -> is OK


I ran Stubs API test and the result was a positive, error-free result.
I'm now trying to see why there are errors in running the api_test.lua script.

Please read this:
https://wiki.magiclantern.fm/install

I have modified the compute_signature type from uint32_t to int.
In file reboot.c from:

Code Select Expand


    uint32_t s = compute_signature((void*)SIG_START, SIG_LEN);
    uint32_t expected_signature = CURRENT_CAMERA_SIGNATURE;
    if (s != expected_signature)
    {
        qprint("[boot] firmware signature: "); qprintn(s); qprint("\n");
        qprint("                 expected: "); qprintn(expected_signature); qprint("\n");

to:

Code Select Expand


    int s = compute_signature((int*)SIG_START, SIG_LEN);
    int _signature = (int)CURRENT_CAMERA_SIGNATURE;
    if (s != _signature)
    {
        qprint("[boot] firmware signature: "); qprintn(s); qprint("\n");
        qprint("                 expected: "); qprintn(_signature); qprint("\n");


And in the file fw-signature.h from:

Code Select Expand

static uint32_t compute_signature(uint32_t * start, uint32_t num)
{
    uint32_t c = 0;
    for (uint32_t * p = start; p < start + num; p++)

to:

Code Select Expand

static int compute_signature(int* start, int num)
{
    int c = 0;
    int* p;
    for (p = start; p < start + num; p++)

I compile minimally

Code Select Expand

make -C ../magic-lantern-1300D/minimal/1300D/ install_qemu
then run

Code Select Expand

./run_canon_fw.sh 1300D, firmware="boot=1"
but I get the following error:

Code Select Expand

SD LOAD OK.
Open file for read : AUTOEXEC.BIN
File size : 0x7EA0
Now jump to AUTOEXEC.BIN!!
008073EC: MCR p15, ...          : CACHEMAINT x770 (omitted)
008073EC: MCR p15,0,Rd,cr7,cr5,0: FlushICache <- 0x0
000BF634: MCR p15, ...          : CACHEMAINT x257 (omitted)
000BF634: MCR p15,0,Rd,cr7,cr5,0: FlushICache <- 0x0
DRYOS PANIC: Module Code = 1, Panic Code = 2
[MPU] WARNING: forced shutdown.
Without making the above changes, I could not compile minimally, I received the error:

Code Select Expand

[ CC       ]   reboot.o
../../src/reboot.c:207:12: error: conflicting types for 'compute_signature'
extern int compute_signature(int* start, int num);
            ^
In file included from ../../src/reboot.c:29:0:
../../src/fw-signature.h:37:17: note: previous definition of 'compute_signature' was here
static uint32_t compute_signature(uint32_t * start, uint32_t num)
                 ^
../../Makefile.filerules:25: recipe for target 'reboot.o' failed
make: *** [reboot.o] Error 1
How to fix the error:

Code Select Expand

DRYOS PANIC: Module Code = 1, Panic Code = 2

I run:

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=1" -d calls
I get:

Code Select Expand

    0x000052b4:  eafff28f      b      0x1cf8
      call 0x1E4C(0, 0, 0, 305c0 "\nCopyright (C) 1997-2014 by CANON Inc.\n")    at [1cfc:c373c]
       call 0xFE0C0F48(1, 2, 0, 31170 current_task)                              at [1e88:1d00]
        call 0xFE0C0A50(1, 2, 0, 31170 current_task)                             at [fe0c0f54:1e8c]
        return 1 to 0xFE0C0F58                                                   at [fe0c0a5c:1e8c]
        call 0x262C(fe0c1070 "DRYOS PANIC: Module Code = %d, Panic Code = %d\n", 1, 2, 31170 current_task)
                                                                                 at [fe0c0f80:1e8c]
         call 0x66B8(fe0c0a04, 0, fe0c1070 "DRYOS PANIC: Module Code = %d, Panic Code = %d\n", fcc)
                                                                                 at [2650:fe0c0f84]
          call 0xFE0C0A04(0, fe0c1070 "DRYOS PANIC: Module Code = %d, Panic Code = %d\n", 1b, fe0c0a04)
                                                                                 at [6718:2654]
           jump to 0xFE0C3B6C lr=671c                                            at [fe0c0a24:671c]
           0xfe0c0a24:  ea000c50      b 0xfe0c3b6c
           call 0xFE1292E0(0, fe0c1070 "DRYOS PANIC: Module Code = %d, Panic Code = %d\n", 1b, f38)
                                                                                 at [fe0c3b80:671c]
DRYOS PANIC: Module Code =            return 0 to 0xFE0C3B84                                                at [fe129364:671c]
         return 1b to 0x671C                                                    at [fe0c3b90:2654]
          call 0x6BAC(fe0c108c "d, Panic Code = %d\n", f8c, ffffffff, 1b)        at [6730:2654]
          return fe0c108c to 0x6734                                              at [6c30:2654]
          call 0x5AE0(fe0c108c "d, Panic Code = %d\n", f88, 0, 1b)               at [6748:2654]
          return fe0c108c to 0x674C                                              at [5b30:2654]
          call 0x6C3C(f6c, 0, 1, 0)                                              at [69d8:2654]


 Yes, i uncomment this line but i get error :

Code Select Expand

[ CP       ]   gcc-libgcc.a
[ LD       ]   magiclantern
boot-hack.o: In function `init_task_patched':
/home/cristi/magic-lantern-1300D/platform/1300D.110/../../src/boot-hack.c:606: undefined reference to `reloc'
/home/cristi/magic-lantern-1300D/platform/1300D.110/../../src/boot-hack.c:614: undefined reference to `reloc'
../../src/Makefile.src:197: recipe for target 'magiclantern' failed
make: *** [magiclantern] Error 1


I have found some values in the const.h file, which are found at 1200D and 550D, but which at 1300D did not appear.

Code Select Expand


// Used in boot-hack.c with CONFIG_ALLOCATE_MEMORY_POOL
#define ROM_ITASK_START 0xFE1296C8
#define ROM_ITASK_END  0xFE129768
#define ROM_CREATETASK_MAIN_START 0xFE0C1B60
#define ROM_CREATETASK_MAIN_END 0xFE0C1EB0
#define ROM_ALLOCMEM_END 0xFE0C1B74
#define ROM_ALLOCMEM_INIT 0xFE0C1B7C
#define ROM_B_CREATETASK_MAIN 0xFE129760

#define ARMLIB_OVERFLOWING_BUFFER 0x310a8 // in AJ_armlib_setup_related3

These values have also been checked by dfort.
But... when make install_qemu I have error:

Code Select Expand

make[1]: Leaving directory '/home/cristi/magic-lantern-1300D/tcc'
[ CC       ]   module.o
[ AR       ]   strrchr.o
[ AR       ]   dietlibc.a
[ AR       ]   lib_a-setjmp.o
[ AR       ]   newlib-libc.a
[ CP       ]   newlib-libm.a
[ CP       ]   gcc-libgcc.a
[ LD       ]   magiclantern
boot-hack.o: In function `init_task_patched':
/home/cristi/magic-lantern-1300D/platform/1300D.110/../../src/boot-hack.c:606: undefined reference to `reloc'
/home/cristi/magic-lantern-1300D/platform/1300D.110/../../src/boot-hack.c:614: undefined reference to `reloc'
../../src/Makefile.src:197: recipe for target 'magiclantern' failed
make: *** [magiclantern] Error 1

Are not the values found good?

On  Rebel T6 is not working yet...

I think that the timer values need to be found on the actual hardware.

How can i found the timer values? Must magiclantern run on real camera?

How long does the script for a camera run? I ran for 1300D, but after 2 hours, I had to stop the script.

- debugging your code like a PC program, by running it step by step (not just with printf's)

How can debugging step by step?
Thanks

I run

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=1" for dm-spy-experiments and I get crash in Debug -> Free Memory:

Code Select Expand

ASSERT: 0
at SystemIF::KerTask.c:191, guess_mem:39b0
lv:0 mode:3

guess_mem stack: 1a98a8 [1a9978-1a5978]
0xUNKNOWN  @ 41fc:1a9968
0x00C8F0A8 @ c81ca8:1a9920
0xUNKNOWN  @ c8f0f0:1a9908
0x000038FC @ c82158:1a98f8
0x00003CBC @ 39ac:1a98e0
0x00C8036C @ c808d8:1a98a8

Magic Lantern version : Nightly.2018Jul17.1300D110
Mercurial changeset   : c289baed76d1+9dff88575e96+ (1300D)
Built on 2018-07-17 16:33:24 UTC by root@DESKTOP-7QS9FV7.
Free Memory  : 247K + 586K
In CLI I have:

Code Select Expand

[DM] FROM Write Complete!!!
ASSERT : SystemIF::KerTask.c, Task = guess_mem, Line 191
ASSERT : SystemIF::KerTask.c, Task = guess_mem, Line 191
ASSERT : SystemIF::KerTask.c, Task = guess_mem, Line 191
Maybe that it helps...

Thank you. Then I will not continue with dm-spy-experiments branch.
Until you can create the FIR file, what could I do?

I have tried dm-spy-experiments branch merged in my 1300D branch. OK., but when I run

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=1" I got this error when enable DebugMsg Log:

Code Select Expand

[MPU] Received: 06 05 03 19 00 00  (PROP_TFT_STATUS - spell #41)
Save configs...
ICache: 8192b, idx=7e0 tag=fffff800 word=1c seg=c0000000
Jump range error: cf2e60 -> fe2993b8 != 22993b8
Patch error at fe2993b4 (jump out of range) = cf2e60
Jump range error: cf2e60 -> fe10fa74 != 210fa74
Patch error at fe10fa70 (jump out of range) = cf2e60
What are wrong?

Why I get this error:

Code Select Expand

  1348:   510.976 [GUI] ERROR ***** ConvertPropertyMovieDataToMovieSizeKind UnKnown Mo[MPU] Received: 06 05 03 19 01 00  (PROP_TFT_STATUS - spell #75)
vieInfo
  1349:   510.976 [GUI] ERROR MovieSize(1), FrameRate(81), ZoomMode(88), MovieMode(0)
  1367:   511.232 [GUI] ERROR ***** ConvertPropertyMovieDataToMovieSizeKind UnKnown MovieInfo
  1368:   511.232 [GUI] ERROR MovieSize(1), FrameRate(81), ZoomMode(88), MovieMode(0)
  1373:   511.232 [MC] cam event guimode comp. 0
  1411:   551.680 [DISP] TurnOnDisplay action Type=0
even I run

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=0".
After the qemu starts, the video menu never appears. Not even if I run

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=1"

When I run:

Code Select Expand

./run_canon_fw.sh 1300D,firmware="boot=1" -s -S & arm-none-eabi-gdb -x 1300D/debugmsg.gdb
I got this error:

Code Select Expand


[MPU] Received: 06 05 03 19 01 00  (PROP_TFT_STATUS - spell #75)
  1328:   825.344 [GUI] ERROR ***** ConvertPropertyMovieDataToMovieSizeKind UnKnown MovieInfo
  1329:   825.344 [GUI] ERROR MovieSize(1), FrameRate(81), ZoomMode(88), MovieMode(0)
  1347:   760.320 [GUI] ERROR ***** ConvertPropertyMovieDataToMovieSizeKind UnKnown MovieInfo
  1348:   760.320 [GUI] ERROR MovieSize(1), FrameRate(81), ZoomMode(88), MovieMode(0)
  1353:   760.576 [MC] cam event guimode comp. 0
[  DisplayMgr:fe123f78 ] register_interrupt(null, 0x34, 0xfe123e10, 0x1)
  1408:   802.560 [DISP] TurnOnDisplay action Type=0
[  DisplayMgr:fe123f78 ] register_interrupt(null, 0x34, 0xfe123e10, 0x1)
[  DisplayMgr:fe123f78 ] register_interrupt(null, 0x34, 0xfe123e10, 0x1)
Why? How can i fixed?

In file fps-engio.c is OK this value?

Code Select Expand


#elif defined(CONFIG_1300D)   
    #define NEW_FPS_METHOD 1
    #define SENSOR_TIMING_TABLE MEM(0x4015C)
    #define VIDEO_PARAMETERS_SRC_3 0x6A95C
    #define TG_FREQ_BASE 28800000
    #undef FPS_TIMER_A_MIN
    #define FPS_TIMER_A_MIN (ZOOM ? 734 : MV1080 ? 546 :576)
    #undef FPS_TIMER_B_MIN
    #define FPS_TIMER_B_MIN (ZOOM ? 1312 : MV480 ? 2000 : MV720 ? 1000 : 2200)
   

Hi.
After searches, I found the following values:
File consts.h:

Code Select Expand


#define HIJACK_INSTR_BSS_END 0xFE0C3B14
#define MVR_992_STRUCT (*(void**)(0x315dc+0x4)) // look in MVR_Initialize for AllocateMemory call
#define IMGPLAY_ZOOM_POS_X MEM(0x6FCC4) // Look up *"CentrePos x:%ld y:%ld"
#define IMGPLAY_ZOOM_POS_Y MEM(0x6FCC8) // (0x6FCC4+0x4) Look up *"CentrePos x:%ld y:%ld"
#define VIDEO_PARAMETERS_SRC_3 0x6A95C
#define DISPLAY_SENSOR_POWERED (*(int*)(0x359a0 + 0x18))  // =0x359B8; Look up *"ForceDisableDisplay (%d)"
#define INFO_BTN_NAME "DISP" // like 1200D
#define HALFSHUTTER_PRESSED (*(int*)0x359BC) // look for string "[MC] permit LV instant"
#define FOCUS_CONFIRMATION (*(int*)0x36EC4) // (0x36EC0 + 0x4) see "focusinfo" and Wiki:Struct_Guessing