ML on EOS-M2

[dfort]

News update -- made some major changes.

I was merging in Danne's latest EOSM changes but because there were so many branches merged into my M2 experiments branch it turned out that this branch wasn't working properly with the EOSM. After lots of trial and error I finally got it working on the EOSM so now we should be in a better place to continue debugging the M2.

[dfort]

Got basic crop_rec working!

Ok--not nearly as exciting as what Danne is doing on the EOSM but using his bleeding edge branch with the EOSM2 merged in and trying out just the basic crop_rec which is 3x3 sampling with the 1280x720/60p setting I was able to record H.264. Better still, setting FPS override to 24fps and pushing the A timer to +30 recording raw video is possible. Here's the proof:

mlv_dump -v

Code: [Select]

...
    Res:  1736x696
    raw_info:
      api_version      0x00000001
      height           727
      width            1808
...
      sampling        3x3 (read 1 line, skip 2, bin 3 columns)
...
     Camera Name:   'Canon EOS M2'


[Danne]

 Already done here:
https://www.magiclantern.fm/forum/index.php?topic=15895.msg209291#msg209291

Since the correct adtg and engio adreeses was added all registers changes as expected. Still freezes though...

[dfort]

I'm always a few steps behind Danne. Ok--good to know that the basic crop_rec setting is still working and it is easy to switch between the "is_basic" settings and the new and improved settings.

The main issue to work on is the LiveView freeze. Looks like it is time to go back to creating startup logs and see if that reveals anything. First thing I tried was the dm-spy-experiments branch. It doesn't boot into LiveView on the EOSM/M2 with "CONFIG_DEBUG_INTERCEPT_STARTUP=y" but it is showing something that might be a hint:

grep "TouchMgr" EOSM2_1.LOG

Code: [Select]

756A8>   TouchMgr:ff34630c:c1:03: touchSetCommand
756EA>   TouchMgr:ff345ef8:c1:03: touchIgnore
757AD>   TouchMgr:ff345f60:c1:03: touchInit
7B06D>   TouchMgr:ff346008:c1:16: Touch IC Ver : 0x0009
8C331>   TouchMgr:ff3455dc:c1:01: ### CheckTouchEvent ###
9DFFC>   TouchMgr:ff345748:c1:01: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(15,15)
9E03E>   TouchMgr:ff345a9c:c1:03: touchHandle : Not Working
A33EB>   TouchMgr:ff3455dc:c1:01: ### CheckTouchEvent ###
A392A>   TouchMgr:ff345748:c1:01: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(15,15)
A396D>   TouchMgr:ff345a9c:c1:03: touchHandle : Not Working
A8D1E>   TouchMgr:ff3455dc:c1:01: ### CheckTouchEvent ###
A9269>   TouchMgr:ff345748:c1:01: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(15,15)
A92AB>   TouchMgr:ff345a9c:c1:03: touchHandle : Not Working
...
BLAH BLAH BLAH
[EDIT] Ran the same test on the EOSM and it isn't complaining:

Code: [Select]

73E90>   TouchMgr:ff335208:c1:16: Start Sensibility = 0
73ED9>   TouchMgr:ff335430:c1:03: NORMAL SENSIBILITY
73F9A>   TouchMgr:ff334c78:c1:01: skip Touch polling
7408F>   TouchMgr:ff335d80:c1:03: TOUCH_UILOCK OFF GUI = 1 UILock = 0
7C393>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
845F8>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
8A2AF>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
91C06>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
9B02E>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
A255A>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
A9A7D>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
B0F8B>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
B84A5>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
BFAC8>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #0 X0 Y0 0 0 ID(0,0)
C6F4C>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt1 #1 X0 Y479 0 0 ID(1,15)
CE461>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt2 #1 X0 Y479 0 0 ID(1,15)
D59E7>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #1 X0 Y479 0 0 ID(1,15)
DCF04>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt2 #1 X1 Y479 0 0 ID(1,15)
E4415>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #1 X1 Y479 0 0 ID(1,15)
EB904>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt1 #1 X2 Y479 0 0 ID(1,15)
F2E22>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt3 #1 X6 Y479 0 0 ID(1,15)
FA35B>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt1 #1 X9 Y479 0 0 ID(1,15)
01885>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt2 #1 X10 Y479 0 0 ID(1,15)
08DC3>   TouchMgr:ff3355e0:c1:02: F:0 O:0 B:0 Cnt0 #1 X14 Y479 0 0 ID(1,15)


[critix]

I took the EOSM2.103_dm-spy-experiments branch from you @dfort, I compiled with "CONFIG_DEBUG_INTERCEPT_STARTUP = y", but unfortunately, it does not save me a log. Do I miss something? Anything to be done?

[dfort]

LiveView never turns on and the orange LED flickers, right? Just let it cook for a while, pull the battery and there should be a log file in the card's root directory.

BTW--I turn on the "CONFIG_DEBUG_INTERCEPT_STARTUP=y" option by placing it in a Makefile.user file in the top magic-lantern directory.

[critix]

I did not run EOSM2.103_dm-spy-experiments branch in the EOSM2, but in qemu.
I do not have my device now.

[critix]

New stubs value found:

Code: [Select]

-NSTUB(0xFF3CF44C,  PlayMain_handler)
+NSTUB(0xFF787304,  PlayMain_handler)


[dfort]

That is in line with what I found a while back on the EOSM:

platform/EOSM.202/stubs.S

Code: [Select]

-NSTUB(0xFF3BC078,  PlayMain_handler)
+NSTUB(0xFF715BA4,  PlayMain_handler)
Feature request -- put the changeset information in the log file. I'm searching for that perfect selftest run on the EOSM but can't figure out which changeset I used. Specifically, I'm trying to find out which commit caused this to show up on the EOSM/EOSM2:

Code: [Select]

[FAIL] suite->num_chunks => 0x1

[dfort]

I'm trying to find out which commit caused this to show up on the EOSM/EOSM2:

Code: [Select]

[FAIL] suite->num_chunks => 0x1

Found it:

Code: [Select]

exmem: reworked shoot_malloc to handle large requests better
- moved autodetection to dedicated functions (for both fragmented and continuous allocations)
- autodetect the max available size for large requests (slower, but when it fails, it fails gracefully)
Revision:
17094
Changeset:
da3cfb7600fcd96d1020690372ebc23c5fd58f85 [da3cfb7600fc]
Parents:
17093
Author:
alex@thinkpad
Date:
February 23, 2018 at 3:26:53 PM PST
Branch:
lua_fix
Working on narrowing it down even further if possible.

[dfort]

Narrowed it down on the EOSM. Reverting the following code at line 435:

src/exmem.c

Code: [Select]

-/* called from RscMgr task */
-static REQUIRES(RscMgr) void srm_malloc_cbr(void** dst_ptr, void* raw_buffer, uint32_t raw_buffer_size)
+static void srm_malloc_cbr(void** dst_ptr, void* raw_buffer, uint32_t raw_buffer_size)

Resolves the suite->num_chunks fails when running the selftest module Stubs API test. However, it doesn't resolve it on the EOSM2. This probably isn't a "fix" but it does seem to point out a problem on the EOSM. Now to get back on track and see if it can be "fixed" on the M2.

[EDIT 1] Note that regressing exmem.c all the way back to revision 17093 - changeset 21264fc914dc does "fix" the issue on the M2.

[EDIT 2] Narrowed down the issue with the EOSM2 failing the selftest module exmem tests to 'struct memSuite * _shoot_malloc_suite_contig(size_t size)'. Replacing that block of code with the version in the "working" lua_fix changeset resolves the exmem fails on the selftest module. This hack also works with the EOSM. I'm thinking that what this is pointing to is a problem with one or more ExMem stubs on the EOSM/EOSM2. Checking the EOSM against the 700D and 100D I found some differences in the AddMemoryChunk stub. Another stub that doesn't look like a perfect pattern match between these platforms is GetFirstChunkFromSuite. Hard to tell but DeleteMemorySuite and GetMemoryAddressOfMemoryChunk might be different too.

[dfort]

Facepalm moment.

Using the latest exmem.c from the crop_rec_4k_mlv_snd branch and the latest selftest module from the lua_fix branch and the EOSM doesn't show the num_chunks fails but the EOSM2 does. Hacking exmem is obviously not the solution so took yet another look at the EOSM2 ExMem stubs but found nothing that looked out of place. Any hints? Seems I took one step forward and two steps back these last couple of days.

[dfort]

No big breakthrough to report but what I've been doing today might help other users wanting to dive into coding so...

I've mentioned the num_chunks fails before but there's another problem that the selftest Stubs API test is showing on the EOSM2. It is showing up on the GUI stub test so I narrowed down the tests like this:

modules/selftest/selftest.c

Code: [Select]

    /* save log after each sub-test */
    for (int i=0; i < n; i++)
    {
        stub_test_model_id();               stub_test_save_log();
        /* Skip down to the GUI test
        stub_test_edmac();                  stub_test_save_log();
        stub_test_cache();                  stub_test_save_log();
        stub_test_af();                     stub_test_save_log();
        stub_test_file_io();                stub_test_save_log();
        stub_test_gui_timers();             stub_test_save_log();
        stub_test_other_timers();           stub_test_save_log();
        stub_test_malloc_n_allocmem();      stub_test_save_log();
        stub_test_exmem();                  stub_test_save_log();
        stub_test_strings();                stub_test_save_log();
        stub_test_engio();                  stub_test_save_log();
        stub_test_display();                stub_test_save_log();
        stub_test_dryos();                  stub_test_save_log();
        */
        stub_test_gui();                    stub_test_save_log();

        beep();
    }

I recently discovered that the EOSM had a problem with the PlayMain_handler stub. Nobody probably noticed it because it only showed up as a problem on the test log.

Code: [Select]

...
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
...

Not much of a hint on what to fix is it? Now that the EOSM is fixed and the EOSM2 is nearly identical I thought why not try breaking some stubs on the EOSM and that might help find which stubs to fix on the EOSM2. I found a couple of them and put in some additional information in the log.

For example for the PlayMain_handler issue:

modules/selftest/selftest.c

Code: [Select]

    /* take a picture and go to play mode */
    lens_take_picture(64, AF_DISABLE);
    msleep(2000);
    enter_play_mode();
    TEST_FUNC_CHECK(is_play_mode(), != 0);
    TEST_MSG("[INFO] Checking stub = PlayMain_handler\n"); // <---- Added which stub is being tested to the log
    TEST_FUNC_CHECK(is_pure_play_photo_mode(), != 0);
    TEST_FUNC_CHECK(is_pure_play_movie_mode(), == 0);

I kept breaking the Dialog handlers stubs one at a time and came up with only two that show up in the tests. Ok--so let's get back to the EOSM2:

STUBTEST.LOG

Code: [Select]

[Pass] is_play_mode() => 0x1
[INFO] Camera model: Canon EOS M2 1.0.3 (0x80000355 EOSM2)
[Pass] is_camera("DIGIC", "*") => 0x1
[Pass] is_camera(__camera_model_short, firmware_version) => 0x1
       SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
       SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
       SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[INFO] Checking stub = LiveViewShutterApp_handler
[Pass] display_idle() => 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[FAIL] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[FAIL] PLAY_MODE => 0x1
       SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
       SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[INFO] Checking stub = PlayMain_handler
[Pass] is_pure_play_photo_mode() => 0x1
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 25 passed, 3 failed.
.
So at least we know that those two stubs are fine. It would be great if the selftest log included the names of the stubs being tested so we could be able to zero in on what needs fixing but I imagine that would be a lot of work. At least a lot of work the way I'm doing it.

One more tip. If you want to speed up the install by building just the modules you're testing:

Code: [Select]

make install ML_MODULES="selftest"

[dfort]

The latest test build on my downloads page includes some annotations in the selftest module Stubs API tests log.

I've been running these test way too much for my sanity these past few days. If you read my last several posts you'll notice that I have been obsessed with trying to get a perfect test run.

The most frustrating has been the num_chunks fails because it doesn't seem to be consistent. I recently found out how to always pass the ExMem test on both the EOSM and the EOSM2. Simply restore the Canon settings to their default. Now the default settings are something no Magic Lantern power user would ever use, in fact ML will flash a warning to get out of Auto mode. Still, when resetting to factory defaults there are no num_chunks failures.

Another issue that seems to disappear is the LiveView freeze. I said "seems to disappear" because the Canon defaults to JPEG instead of RAW in photo mode and it turns out that switching to RAW will freeze LiveView with the raw histogram enabled.

There are a few tests that fail on the EOSM2 that pass on the EOSM, I annotated those. Then there are some tests that fail on both of these cameras so it will require some more digging to figure out which stub is causing this. There are a few autofocus tests that pass in photo mode but not in movie mode depending on which lens is mounted on the camera and maybe if it is a full moon because I know that I was able to get a perfect score on the EOSM a while back but for the life of me I can't replicate it.

In any case, here's one of my EOSM2 test runs--enjoy!

Code: [Select]

[Pass] is_play_mode() => 0x1
[INFO] Camera model: Canon EOS M2 1.0.3 (0x80000355 EOSM2)
[Pass] is_camera("DIGIC", "*") => 0x1
[Pass] is_camera(__camera_model_short, firmware_version) => 0x1
[Pass] src = fio_malloc(size) => 0x4de1a084
[Pass] dst = fio_malloc(size) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0xffffffcf
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, 4097) => 0x0
[Pass] edmac_memcpy(dst, src, 4097) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0xffffffb1
[Pass] edmac_memcpy(dst, src, size) => 0x4e61e090
[Pass] memcmp(dst, src, size) => 0x0
[Pass] memcmp(dst, src, size) => 0xfffffff2
[Pass] edmac_memcpy_start(dst, src, size) => 0x4e61e090
       dt => 0x2978
[Pass] copied => 0x400b70
[Pass] copied => 0x400b70
[Pass] copied => 0x400b70
[Pass] memcmp(dst, src, copied) => 0x0
[Pass] memcmp(dst, src, copied + 16) => 0x4b
       edmac_memcpy_finish()
       free(src)
       free(dst)
Cache test A (EDMAC on BMP buffer)...
[Pass] bmp = bmp_load("ML/CROPMKS/CINESCO2.BMP", 1) => 0x809ce4
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x890
[Pass] old => 0x0
[Pass] irq => 0xc0
[Pass] differences => 0x0
Cache test B (FIO on 8K buffer)...
[Pass] tries[0] => 0xea
[Pass] tries[1] => 0xe8
[Pass] tries[2] => 0x104
[Pass] tries[3] => 0x112
[Pass] failr[0] => 0x3f
[Pass] failw[0] => 0x9c
[Pass] failr[1] => 0x40
[Pass] failw[1] => 0x0
[Pass] failr[2] => 0x0
[Pass] failw[2] => 0xb4
[Pass] failr[3] => 0x0
[Pass] failw[3] => 0x0
       times[0] / tries[0] => 0x1e
       times[1] / tries[1] => 0x1e
       times[2] / tries[2] => 0x1e
       times[3] / tries[3] => 0x1e
Cache tests finished.

[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x1
[INFO] ****** EOSM/M2 usually fails here but sometimes passes ******
[FAIL] wait_focus_status(1000, 3) => 0x0
[FAIL] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] lv_focus_status => 0x1
[Pass] HALFSHUTTER_PRESSED => 0x1
[Pass] wait_focus_status(1000, 3) => 0x0
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] lv_focus_status => 0x1
[Pass] f = FIO_CreateFile("test.dat") => 0x5
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
[Pass] FIO_WriteFile(f, (void*)0xFF000000, 0x10000) => 0x10000
       FIO_CloseFile(f)
[Pass] FIO_GetFileSize("test.dat", &size) => 0x0
[Pass] size => 0x20000
[Pass] p = (void*)_alloc_dma_memory(0x20000) => 0x40a97ae0
[Pass] f = FIO_OpenFile("test.dat", O_RDONLY | O_SYNC) => 0x5
[Pass] FIO_ReadFile(f, p, 0x20000) => 0x20000
       FIO_CloseFile(f)
       _free_dma_memory(p)
[Pass] count => 0x3a98
[Pass] buf = fio_malloc(0x1000000) => 0x4de1a084
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000000
[Pass] f = FIO_OpenFile("test.dat", O_RDWR | O_SYNC) => 0x5
[Pass] FIO_SeekSkipFile(f, 0, SEEK_END) => 0x82000000
[Pass] FIO_WriteFile(f, buf, 0x10) => 0x10
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_END) => 0x81fffff0
[Pass] FIO_WriteFile(f, buf, 0x30) => 0x30
[Pass] FIO_SeekSkipFile(f, 0x20, SEEK_SET) => 0x20
[Pass] FIO_SeekSkipFile(f, 0x30, SEEK_CUR) => 0x50
[Pass] FIO_SeekSkipFile(f, -0x20, SEEK_CUR) => 0x30
[Pass] FIO_GetFileSize_direct("test.dat") => 0x82000020
[Pass] is_file("test.dat") => 0x1
[Pass] FIO_RemoveFile("test.dat") => 0x0
[Pass] is_file("test.dat") => 0x0
[Pass] SetTimerAfter(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x89ae
       msleep(900)
[Pass] timer_func => 0x0
       msleep(200)
[Pass] timer_func => 0x1
[Pass] ABS((timer_time/1000 - t0) - 1000) => 0xa
[Pass] ABS((timer_arg - ta0) - 1000) => 0x14
[Pass] timer = SetTimerAfter(1000, timer_cbr, overrun_cbr, 0) => 0x89d2
       msleep(400)
       CancelTimer(timer)
[Pass] timer_func => 0x0
       msleep(1500)
[Pass] timer_func => 0x0
[Pass] SetHPTimerAfterNow(0, timer_cbr, overrun_cbr, 0) => 0x15
[Pass] timer_func => 0x2
[Pass] SetHPTimerAfterNow(100000, timer_cbr, overrun_cbr, 0) => 0x32ec6
       msleep(90)
[Pass] timer_func => 0x0
       msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 100000) => 0x117
[Pass] ABS(DeltaT(timer_arg, ta0) - 100000) => 0xfa
[Pass] ABS((get_us_clock() - t0) - 110000) => 0xdb
[Pass] SetHPTimerAfterNow(90000, next_tick_cbr, overrun_cbr, 0) => 0x32ec8
       msleep(80)
[Pass] timer_func => 0x0
       msleep(20)
[Pass] timer_func => 0x3
       msleep(80)
[Pass] timer_func => 0x3
       msleep(20)
[Pass] timer_func => 0x1
[Pass] ABS(DeltaT(timer_time, t0) - 300000) => 0x169
[Pass] ABS(DeltaT(timer_arg, ta0) - 300000) => 0x148
[Pass] ABS((get_us_clock() - t0) - 310000) => 0xf9
       t0 = GET_DIGIC_TIMER() => 0xa622a
       msleep(250)
       t1 = GET_DIGIC_TIMER() => 0xe2bb2
[Pass] ABS(MOD(t1-t0, 1048576)/1000 - 250) => 0x2
       LoadCalendarFromRTC( &now )
       s0 = now.tm_sec => 0x23
       Date/time: 2019/01/24 14:54:35
       msleep(1500)
       LoadCalendarFromRTC( &now )
       s1 = now.tm_sec => 0x25
[Pass] MOD(s1-s0, 60) => 0x2
[Pass] MOD(s1-s0, 60) => 0x2
       m0 = MALLOC_FREE_MEMORY => 0x603e8
[Pass] p = (void*)_malloc(50*1024) => 0x11e7c8
[Pass] CACHEABLE(p) => 0x11e7c8
       m1 = MALLOC_FREE_MEMORY => 0x53bd8
       _free(p)
       m2 = MALLOC_FREE_MEMORY => 0x603e8
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
       m0 = GetFreeMemForAllocateMemory() => 0x1efc38
[Pass] p = (void*)_AllocateMemory(128*1024) => 0xa97aa0
[Pass] CACHEABLE(p) => 0xa97aa0
       m1 = GetFreeMemForAllocateMemory() => 0x1cfc2c
       _FreeMemory(p)
       m2 = GetFreeMemForAllocateMemory() => 0x1efc38
[Pass] ABS((m0-m1) - 128*1024) => 0xc
[Pass] ABS(m0-m2) => 0x0
       m01 = MALLOC_FREE_MEMORY => 0x603e8
       m02 = GetFreeMemForAllocateMemory() => 0x1efc38
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40a97ae0
[Pass] UNCACHEABLE(p) => 0x40a97ae0
[Pass] CACHEABLE(p) => 0xa97ae0
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40a97ae0
       _free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4de1a074
[Pass] UNCACHEABLE(p) => 0x4de1a074
       _shoot_free(p)
       m11 = MALLOC_FREE_MEMORY => 0x603e8
       m12 = GetFreeMemForAllocateMemory() => 0x1efc38
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0x1023e0
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x102408
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0x1023e0
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1f24000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x102408
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1f24000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x44000064
[Pass] UNCACHEABLE(p) => 0x44000064
       largest_shoot_block = suite->size => 0x1f24000
[INFO] largest_shoot_block: 31MB
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0x1023e0
[Pass] suite->signature => 'MemSuite'
[INFO] ************ Reset Canon settings if suite->num_chunks => 0x1 fails ************
[Pass] suite->num_chunks => 0x4
[Pass] suite->size => 0x2024000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x102408
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x15b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
       chunk = GetNextMemoryChunk(suite, chunk) => 0x117510
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x169c000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4ae00064
[Pass] UNCACHEABLE(p) => 0x4ae00064
       chunk = GetNextMemoryChunk(suite, chunk) => 0x11e7c8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1774000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x45f240e4
[Pass] UNCACHEABLE(p) => 0x45f240e4
       chunk = GetNextMemoryChunk(suite, chunk) => 0x11e800
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x2024000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x44000064
[Pass] UNCACHEABLE(p) => 0x44000064
       chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x2024000
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0x1023e0
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x4
[Pass] suite->size => 0x3300000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x102408
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x15b4000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4de1a070
[Pass] UNCACHEABLE(p) => 0x4de1a070
       chunk = GetNextMemoryChunk(suite, chunk) => 0x117510
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x169c000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4ae00064
[Pass] UNCACHEABLE(p) => 0x4ae00064
       chunk = GetNextMemoryChunk(suite, chunk) => 0x11e7c8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1774000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x45f240e4
[Pass] UNCACHEABLE(p) => 0x45f240e4
       chunk = GetNextMemoryChunk(suite, chunk) => 0x11e800
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x3300000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x44000064
[Pass] UNCACHEABLE(p) => 0x44000064
       chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x3300000
[INFO] ************ Reset Canon settings if suite->num_chunks => 0x1 fails ************
       shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x233b0c
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x233ae0
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x233ac0
[Pass] bar => '*****hjkl;'
       bzero32(bar + 5, 5)
[Pass] bar => '****'
       EngDrvOut(LCD_Palette[0], 0x1234)
[Pass] shamem_read(LCD_Palette[0]) => 0x1234
       call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
       call("TurnOffDisplay")
[Pass] DISPLAY_IS_ON => 0x0
       call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
       task_create("test", 0x1c, 0x1000, test_task, 0) => 0xebd600ea
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[Pass] get_task_name_from_id(current_task->taskId) => 'run_test'
[Pass] task_max => 0x84
[Pass] task_max => 0x84
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0xebd800ba
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0xebda029c
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0xebdc0064
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0xf
       SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
       SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
       SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[INFO] ************ Checking stub = LiveViewShutterApp_handler ************
[Pass] display_idle() => 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[INFO] ************ EOSM2 fails here ************
[FAIL] MENU_MODE => 0x0
[INFO] ************ EOSM2 fails here ************
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[INFO] ************ EOSM2 fails here ************
[FAIL] PLAY_MODE => 0x1
       SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
       SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[INFO] ************ Checking stub = PlayMain_handler ************
[Pass] is_pure_play_photo_mode() => 0x1
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 11689 passed, 23 failed.
.

[dfort]

Looks like those fails on the focus tests are not valid on the EOSM/EOSM2.

So, we're down to just a few stubs to hunt down in the GUI tests.

modules/selftest/selftest.c

Code: [Select]

    // GUI_Control
    msleep(1000);
    TEST_VOID(GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000););
    TEST_FUNC_CHECK(PLAY_MODE, != 0);
    TEST_FUNC_CHECK(MENU_MODE, == 0);
    TEST_VOID(GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000););
    TEST_MSG("[INFO] ************ EOSM2 fails here ************\n");   
    TEST_FUNC_CHECK(MENU_MODE, != 0);
    TEST_MSG("[INFO] ************ EOSM2 fails here ************\n");   
    TEST_FUNC_CHECK(PLAY_MODE, == 0);

    // also check dialog signature here, because display is on for sure
    struct gui_task * current = gui_task_list.current;
    struct dialog * dialog = current->priv;
    TEST_FUNC_CHECK_STR(dialog->type, "DIALOG");

    TEST_VOID(GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500););
    TEST_FUNC_CHECK(MENU_MODE, == 0);
    TEST_MSG("[INFO] ************ EOSM2 fails here ************\n");   
    TEST_FUNC_CHECK(PLAY_MODE, == 0);

STUBTEST.LOG

Code: [Select]

...
[INFO] Camera model: Canon EOS M2 1.0.3 (0x80000355 EOSM2)
...
       SetGUIRequestMode(1); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x1
       SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
       SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[INFO] ************ Checking stub = LiveViewShutterApp_handler ************
[Pass] display_idle() => 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[INFO] ************ EOSM2 fails here ************
[FAIL] MENU_MODE => 0x0
[INFO] ************ EOSM2 fails here ************
[FAIL] PLAY_MODE => 0x1
[Pass] dialog->type => 'DIALOG'
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[INFO] ************ EOSM2 fails here ************
[FAIL] PLAY_MODE => 0x1
       SW1(1,100)
[Pass] HALFSHUTTER_PRESSED => 0x1
       SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[INFO] ************ Checking stub = PlayMain_handler ************
[Pass] is_pure_play_photo_mode() => 0x1
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x1
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 11689 passed, 23 failed.
.
I can't find anything wrong in stubs.S so the problem must be somewhere else? Maybe in consts.h or gui.h?

Staring at the following bit of code but where to go from here?

platform/EOSM2.103/consts.h

Code: [Select]

#define PLAY_MODE (gui_state == GUISTATE_PLAYMENU && CURRENT_GUI_MODE == GUIMODE_PLAY)
#define MENU_MODE (gui_state == GUISTATE_PLAYMENU && CURRENT_GUI_MODE == GUIMODE_MENU)

[EDIT] Think maybe this is where the problem is at:

platform/EOSM2.103/consts.h

Code: [Select]

#define CURRENT_GUI_MODE (*(int*)0x928BC) // in SetGUIRequestMode (0x92860+0x5C)


[dfort]

Taking a close look at these two tests in the selftest module:

Code: [Select]

    TEST_VOID(GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000););
    TEST_VOID(GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500););

After running each one how about printing out which mode the camera is in:

Code: [Select]

    TEST_MSG("[INFO] MENU_MODE: 0x%X\n", MENU_MODE);
    TEST_MSG("[INFO] PLAY_MODE: 0x%X\n", PLAY_MODE);

Testing on the EOSM to see how it is supposed to work:

EOSM

Code: [Select]

       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0

Changing from play to menu to play makes sense. I didn't expect it to toggle the mode on/off, learned something new.

Now how about the EOSM2:

EOSM2

Code: [Select]

       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x0

The toggling works but there's a problem when in play mode and you switch to menu mode.

Code: [Select]

       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1
       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1

This is not an issue going the other way:

Code: [Select]

       GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[INFO] MENU_MODE: 0x1
[INFO] PLAY_MODE: 0x0
       GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[INFO] MENU_MODE: 0x0
[INFO] PLAY_MODE: 0x1

Just for the record, I did these tests like this:

modules/selftest/selftest.c

Code: [Select]

static void stub_test_gui()
{
    msleep(1000);
    TEST_VOID(GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500););

    TEST_MSG("[INFO] MENU_MODE: 0x%X\n", MENU_MODE);
    TEST_MSG("[INFO] PLAY_MODE: 0x%X\n", PLAY_MODE);

    TEST_VOID(GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000););

    TEST_MSG("[INFO] MENU_MODE: 0x%X\n", MENU_MODE);
    TEST_MSG("[INFO] PLAY_MODE: 0x%X\n", PLAY_MODE);
}
Any hints on which stub is the culprit here?

[EDIT] Can't be this, can it?

platform/EOSM2.103/gui.h

Code: [Select]

#define BGMT_MENU 0x6

[dfort]

I thought that maybe logging activity while pressing the Menu and Play buttons would give some sort of clue whether or not the button codes are correct so I built dm-spy-experiments with CONFIG_DEBUG_INTERCEPT and CONFIG_MMIO_TRACE. Got plenty of information but nothing that I could see that would help with the button codes in the previous post.

However, there were some interesting bits in the EOSM2 log that looked promising.

Code: [Select]

DBECD> DisplayMgr:ff1395e0:82:01: SetImageVramParameter pAddress=0x4f7e7800 pFlipCBR=0
E4151> DisplayMgr:ff1395e0:82:01: SetImageVramParameter pAddress=0x4fbf7800 pFlipCBR=0
EC4A4> DisplayMgr:ff1395e0:82:01: SetImageVramParameter pAddress=0x4f3d7800 pFlipCBR=0

Checking against the EOSM log it confirmed that this bit of guesswork is valid:

platform/EOSM2.103/consts.h

Code: [Select]

// Started out by using the one found value (0x4f3d7800)for all three as a workaround
// then adding 0x410000 to determine the other two.
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_LV_BUFFER_1 0x4F3D7800
#define YUV422_LV_BUFFER_2 0x4F7E7800
#define YUV422_LV_BUFFER_3 0x4FBF7800

Another related issue was finding the YUV422 HD Buffers:

platform/EOSM2.103/consts.h

Code: [Select]

// http://magiclantern.wikia.com/wiki/ASM_Zedbra
// skipped for now, will come up with a way to autodetect these values
// http://www.magiclantern.fm/forum/index.php?topic=15895.msg186493#msg186493
#define YUV422_HD_BUFFER_1 0x44000080
#define YUV422_HD_BUFFER_2 0x46000080

Found this in the log:

Code: [Select]

FAF31>        Evf:00039cdc:a9:01: [BUFF] RELEASEWRITING[YuvArray] (State[3] Addr[0x48000100][0])
FAF5B>        Evf:00039fa8:a9:01: [BUFF] RELEASEREADING[YuvArray] (State[4] Addr[0x483cc100][1])

Turns out that this matches the 700D, ran a log on that camera too to verify this. Wait--it is wrong on the EOSM, but what is this? Where is it used? Seems like it is only used in an obscure feature that is disabled on the EOSM called PLAY_EXPOSURE_FUSION. Don't know what it does but I turned it on so testers can have something else to play with. Here's a description of what it does:

Exposure Fusion: combine two or more images, useful for previewing HDR images or multiple exposures.

Sounds interesting -- but:

422 options are gone, though.

Something learned, nothing fixed.

[dfort]

Maybe found something that is causing the LiveView freezes, though no solution yet.

The freezes only happens in photo mode when the raw histogram is active which means that the Canon setting also must be set for RAW and not JPEG. In movie mode it happens when in raw video mode, not in H.264. Ok--so that means that we're in this section of the code:

src/raw.c

Code: [Select]

#ifdef CONFIG_RAW_LIVEVIEW
...
#endif /* CONFIG_RAW_LIVEVIEW */
That's a pretty big section to look at but in there is some printf statements that are visible when you turn on the console (Debug -> Show console). One section in particular seemed interesting and I added a few more printf statements and compared it to the EOSM:

Code: [Select]

static void raw_lv_free_buffer()
{
    printf("Freeing LV raw buffer %x.\n", raw_lv_buffer);
    printf("raw_allocated_lv_buffer : %x.\n", raw_allocated_lv_buffer);
    printf("raw_lv_buffer_size : %x.\n", raw_lv_buffer_size);
    if(raw_allocated_lv_buffer) {
        free(raw_allocated_lv_buffer);
        raw_allocated_lv_buffer = 0;

So, this is what I get on the EOSM2:


For comparison, this is the EOSM:


My guess is that raw_lv_buffer is an address so we'd better not mess with that, raw_allocated_lv_buffer is a boolean which is set the same on both cameras and raw_lv_buffer_size is the actual size of the LiveView buffer. There's a huge difference in sizes between the two cameras. From what I can see, raw_lv_buffer_size is being assigned here:

Code: [Select]

#ifdef CONFIG_EOSM2
#define DEFAULT_RAW_BUFFER MEM(0x91CF0 + 0x78)
#define DEFAULT_RAW_BUFFER_SIZE (0x48CC0000 - 0x48798100) // exact value = 0x48CC40C4 https://www.magiclantern.fm/forum/index.php?topic=5601.msg197778#msg197778
#endif
...
        raw_lv_buffer = (void *) DEFAULT_RAW_BUFFER;
        raw_lv_buffer_size = DEFAULT_RAW_BUFFER_SIZE;

So yes, 0x48CC0000 - 0x48798100 = 0x527F00. That is tiny compared with the EOSM. But wait, the 100D also has 527F00 so that isn't the problem so let's look somewhere else.

src/raw.c

Code: [Select]

/* our default LiveView buffer (which can be DEFAULT_RAW_BUFFER or allocated) */
static void* raw_get_default_lv_buffer()
{
#if !defined(CONFIG_EDMAC_RAW_SLURP)
    return CACHEABLE(shamem_read(RAW_LV_EDMAC));
#else
    return CACHEABLE(raw_lv_buffer);
#endif
}

What if we add another printf statement:

Code: [Select]

    printf("CACHEABLE(raw_lv_buffer) : %x.\n", CACHEABLE(raw_lv_buffer));

EOSM2


EOSM


Is that a significant finding?

I could have saved some space on this post by writing down the results instead of posting screenshots but what's that going in the EOSM2 screenshots? Looks like some corruption. It doesn't look like that when looking at it, what it looks like is a frozen LiveView but maybe this is a clue to what is going on? IDK -- don't even have a clue where to look to next.

[dfort]

Noticed that there have been several downloads on the test builds I've been posting. The first thing that will happen if you start in photo mode and have your Canon capture settings on RAW is that the LiveView screen will freeze. Switching to a non-LiveView screen like Play or Menu will free it up temporarily. If you turn off Global Draw it wont' freeze. The minimum needed is to change from raw to yuv histogram:



Loading the silent or mlv_lite or mlv_rec modules and activating those modules will also freeze LiveView. Basically, anything that activates RAW_LIVEVIEW will freeze the screen.

[dfort]

Been working with the bleeding edge branch so much that it has now become the most stable for the EOSM2. Loaded up the dm-spy-experiments branch and it was a wild ride but was able to save a log that might show the LiveView freeze. For comparison, I went through the same steps and saved an EOSM log so we can have something that doesn't freeze for comparison:

EOSM2_lv_freeze_DM-0000.LOG
EOSM_no_lv_freeze_DM-0000.LOG

Maybe this is a clue?

EOSM2

Code: [Select]

5446A>        Evf:00038564:a9:01: [VRAM] FrameParam[0x714160][0x4fbf7800][0x0][0x0]
EOSM

Code: [Select]

E64C3>        Evf:00024120:a9:01: [VRAM] FrameParam[0x75b5c4][0x4f1d7800][0xdfffffd7][0x0]
Or maybe this?

EOSM2

Code: [Select]

54721>        Evf:ff53fdd0:ad:01: [PATH] LVx1_60fps_StartYuvPath[483cc100,48000100]
54760>        Evf:ff53fa30:ad:01: [PATH] LVx1_60fps_StartVramPath2[4fbf7800][0]
EOSM

Code: [Select]

E66C4>        Evf:ff50a394:ad:01: [PATH] RecStandby_x1_60fps_StartYuvPath[463cc080,46000080]
E6709>        Evf:ff509fe0:ad:01: [PATH] RecStandby_x1_60fps_StartVramPath[4f1d7800][0]
[EDIT] Also got a couple of crash logs that might point to something.

Code: [Select]

ASSERT: !IS_ERROR( TryPostEvent( this->hTaskClass, this, EV_VD_INTERRUPT_EVF, NULL, 0 ) )
at ./Evf/EvfState.c:545, **INT-6Ah**:11c40
lv:1 mode:3
...
ASSERT: !IS_ERROR( TryPostEvent( this->hTaskClass, this, EV_SETPARAM_INTERRUPT_EVF, NULL, 0 ) )
at ./Evf/EvfState.c:503, **INT-E0h**:11b9c
lv:1 mode:3

PowerMgr stack: 2abfb0 [18b340-18af40]
0x0044C478 @ 44c4f4:2abfb0

Magic Lantern version : Nightly.2019Jan30.EOSM2103
Mercurial changeset   : 447b1fb774c7 (EOSM2.103_dm-spy-experiments)
Built on 2019-01-30 15:08:00 UTC by rosiefort@Rosie-Forts-Computer.local.
Free Memory  : 332K + 2110K


[Danne]

Very cool. How can we test vram and evf parameters?

[dfort]

I'm not really sure how to check vram and evf parameters but I just ran dm-spy-experiments on the 700D--putting the camera in photo mode and LiveView like the EOSM/M2.

700D

Code: [Select]

0638D>        Evf:ff36d1ec:a9:01: [VRAM] FrameParam[0x750b8c][0x4bde7800][0x5459a600][0x0]
Looks to me like this might be a hint:

EOSM2

Code: [Select]

5446A>        Evf:00038564:a9:01: [VRAM] FrameParam[0x714160][0x4fbf7800][0x0][0x0]
                                                                          ^^^ MISSING
The other part that stood out to me when comparing the M to the M2 now look perfectly fine:

700D

Code: [Select]

F64B6>        Evf:ff500e28:ad:01: [PATH] LVx1_60fps_StartYuvPath[463cc080,46000080]
F64FF>        Evf:ff500a64:ad:01: [PATH] LVx1_60fps_StartVramPath[4bde7800][0]

EOSM2

Code: [Select]

54721>        Evf:ff53fdd0:ad:01: [PATH] LVx1_60fps_StartYuvPath[483cc100,48000100]
54760>        Evf:ff53fa30:ad:01: [PATH] LVx1_60fps_StartVramPath2[4fbf7800][0]
Some of those addresses look familiar?

platform/700D.115/consts.h

Code: [Select]

#define YUV422_LV_BUFFER_1 0x4bde7800 <---- this one
#define YUV422_LV_BUFFER_2 0x4b9d7800
#define YUV422_LV_BUFFER_3 0x4c1f7800
...
    #define YUV422_HD_BUFFER_1 0x463cc080 <---- and these two
    #define YUV422_HD_BUFFER_2 0x46000080

platform/EOSM2.103/consts.h

Code: [Select]

#define YUV422_LV_BUFFER_1 0x4F3D7800
#define YUV422_LV_BUFFER_2 0x4F7E7800
#define YUV422_LV_BUFFER_3 0x4FBF7800 <---- this one
...
#define YUV422_HD_BUFFER_1 0x483cc100 <---- and these two
#define YUV422_HD_BUFFER_2 0x48000100

Maybe the order of the YUV422_LV_BUFFER's is important?

EOSM

Code: [Select]

#define YUV422_LV_BUFFER_1 0x4F1D7800 <---- log is showing this one
#define YUV422_LV_BUFFER_2 0x4F5E7800
#define YUV422_LV_BUFFER_3 0x4F9F7800

Changed the order on the EOSM2 and the screen still freezes so nope, that's not it.

EOSM2

Code: [Select]

#define YUV422_LV_BUFFER_1 0x4FBF7800 <---- made this one the first buffer like on the 700D
#define YUV422_LV_BUFFER_2 0x4F3D7800
#define YUV422_LV_BUFFER_3 0x4F7E7800


[Danne]

700D

Code: [Select]

0638D>        Evf:ff36d1ec:a9:01: [VRAM] FrameParam[0x750b8c][0x4bde7800][0x5459a600][0x0]
Looks to me like this might be a hint:

EOSM2

Code: [Select]

5446A>        Evf:00038564:a9:01: [VRAM] FrameParam[0x714160][0x4fbf7800][0x0][0x0]
                                                                          ^^^ MISSING

This seems interesting don´t you think? Like needle in a haystack. Even worse i´d say. Probably would have found 10 needles by now. We need guidance 

Hm, double check stubs and constants for vram related regs?

[dfort]

Yes, that looks interesting but will it lead to resolving the freezing LiveView issue?

Another issue with this camera is finding the addresses needed for dual iso. That is also bringing up another issue that the addresses should not be hardcoded, but how to find them dynamically?

The solution is to avoid making assumptions about the addresses of these registers, i.e. to get rid of these hardcoded addresses. See reply #2968 and this topic. I find it hard to believe there are only 2 possible values on a given camera model. FRAME_SHUTTER_BLANKING constants should be probably handled in the same way (i.e. hardcoded addresses should be deleted).

The CMOS data is in the middle of Canon's property data structure, so playing around with prop_diag, or with Canon's property functions in QEMU, might reveal something. One possible step is identifying these properties (for example, by parsing a RAM dump around the known addresses with prop_diag).

I got prop_diag working as a stand alone app and was able to parse ROM1.BIN but am stuck trying to figure out how to parse the RAM4.BIN, especially, "...around the known address..." As Sergeant Schultz would say, "I know nothing!"

Code: [Select]

Loading ROM1.BIN...
Scanning from 0x102c4f000 to 0x103c4f000...
Trying offset 0x60000, status=0xffff, size=0xd2c...
Prop  c000004      4  01003110
Prop  c000002   3316  00641031 00000CF2 00000030 00010001 00000000*8 00011031    ...
Trying offset 0x80000, status=0x0, size=0x1084...
Skipping inactive block 0x80000, status=0x0, size=0x1084...
Trying offset 0x82000, status=0x0, size=0x1084...
Skipping inactive block 0x82000, status=0x0, size=0x1084...
Trying offset 0x84000, status=0x0, size=0x1084...
Skipping inactive block 0x84000, status=0x0, size=0x1084...
Trying offset 0x86000, status=0x0, size=0x1084...
Skipping inactive block 0x86000, status=0x0, size=0x1084...
Trying offset 0x88000, status=0x0, size=0x1084...
Skipping inactive block 0x88000, status=0x0, size=0x1084...
Trying offset 0x8a000, status=0x0, size=0x1084...
Skipping inactive block 0x8a000, status=0x0, size=0x1084...
Trying offset 0x8c000, status=0x0, size=0x1084...
Skipping inactive block 0x8c000, status=0x0, size=0x1084...
Trying offset 0x8e000, status=0x0, size=0x1084...
Skipping inactive block 0x8e000, status=0x0, size=0x1084...
Trying offset 0x90000, status=0x0, size=0x1084...
Skipping inactive block 0x90000, status=0x0, size=0x1084...
Trying offset 0x92000, status=0x0, size=0x1084...
Skipping inactive block 0x92000, status=0x0, size=0x1084...
Trying offset 0x94000, status=0x0, size=0x1084...
Skipping inactive block 0x94000, status=0x0, size=0x1084...
Trying offset 0x96000, status=0x0, size=0x1084...
Skipping inactive block 0x96000, status=0x0, size=0x1084...
Trying offset 0x98000, status=0x0, size=0x1084...
Skipping inactive block 0x98000, status=0x0, size=0x1084...
Trying offset 0x9a000, status=0x0, size=0x1084...
Skipping inactive block 0x9a000, status=0x0, size=0x1084...
Trying offset 0x9c000, status=0x0, size=0x1084...
Skipping inactive block 0x9c000, status=0x0, size=0x1084...
Trying offset 0x9e000, status=0x0, size=0x1084...
Skipping inactive block 0x9e000, status=0x0, size=0x1084...
Trying offset 0xa0000, status=0x0, size=0x1084...
Skipping inactive block 0xa0000, status=0x0, size=0x1084...
Trying offset 0xa2000, status=0x0, size=0x1084...
Skipping inactive block 0xa2000, status=0x0, size=0x1084...
Trying offset 0xa4000, status=0x0, size=0x1084...
Skipping inactive block 0xa4000, status=0x0, size=0x1084...
Trying offset 0xa6000, status=0x0, size=0x1084...
Skipping inactive block 0xa6000, status=0x0, size=0x1084...
Trying offset 0xa8000, status=0x0, size=0x1084...
Skipping inactive block 0xa8000, status=0x0, size=0x1084...
Trying offset 0xaa000, status=0x0, size=0x1084...
Skipping inactive block 0xaa000, status=0x0, size=0x1084...
Trying offset 0xac000, status=0x0, size=0x1084...
Skipping inactive block 0xac000, status=0x0, size=0x1084...
Trying offset 0xae000, status=0x0, size=0x1084...
Skipping inactive block 0xae000, status=0x0, size=0x1084...
Trying offset 0xb0000, status=0xffff, size=0x1084...
Prop  2000000      4  0000FFFF
Prop  2000001     36  "1.0.3" 00 "7A(2b)" 00629F00 0000000C 004DAB00 19980218    ...
Prop  2000005     36  "6.0.6 7A(2b)" 00629F00 0000000C 004DAB00 19980218         ...
Prop  2000002      4  00000013
Prop  2000003      4  FFFFFFFF
Prop  2000004     32
Prop  2000006     16  00060006 7A00002B 08000000 00303030
Prop  2000007     36  "0.0.0"
Prop  2000008      4
Prop  2010000      4  0000008E
Prop  2010001      4  00000064
Prop  2010002      4  00000064
Prop  2010003      4
Prop  2010004      4  00000602
Prop  2010005      4
Prop  2010009      4
Prop  201000a      4  000764D1
Prop  201000b      4
Prop  2010006      4
Prop  2010007      4  00008000
Prop  2010008      4
Prop  201000d      4
Prop  201000e      4
Prop  201000f      4
Prop  2010010      4  00000064
Prop  2010011      4  00000065
Prop  2010012      4  00000064
Prop  2010013      4  00010000
Prop  2010014      4
Prop  2020000     44  00000000*8 040001FD 028B0400
Prop  2020008     44  00000000*8 040001FD 028B0400
Prop  2020009     44  00000000*8 040001FD 028B0400
Prop  202000a     44  00000000*8 040001FD 028B0400
Prop  202000b     44  00000000*8 040001FD 028B0400
Prop  2020005      4  00000001
Prop  2020006      4  00000002
Prop  2020001      4  00000008
Prop  2020002      4  00000008
Prop  2020003      4  00000008
Prop  2020004      4  00000008
Prop  202000c      4
Prop  202000d     40  00000000*8 04000400*2
Prop  202000e     40  00000000*8 04000400*2
Prop  202000f     40  00000000*8 04000400*2
Prop  2020010     40  00000000*8 04000400*2
Prop  2020011     40  00000000*8 04000400*2
Prop  2030000     28  51010000 52000000 57010000 54010000 55010000 50000000      ...
Prop  2030001     12  00000001
Prop  2030002     36  00000302 01008100 01000100 00000002 000100FF 00010001      ...
Prop  2030004      4
Prop  2030005      4
Prop  2030003      4
Prop  2030006     12  00000001
Prop  2040000      4  00000004
Prop  2040001      4  00000001
Prop  2040002      4
Prop  2040003      4
Prop  2040004      4
Prop  2040005      4  00000001
Prop  2040007      4  00000001
Prop  2040008      4  00000602
Prop  2040009      4  00000001
Prop  204000a      4  00000001
Prop  204000b      4
Prop  204000c      4  00000001
Prop  204000d      4
Prop  204000f     76
Prop  2050000    184  0000000F 00000000*2 00000009 00000000*14 00000009          ...
Prop  2050001      4  00004185
Prop  2050002      4  00000003
Prop  2050004      8  "IMG_" 00033200
Prop  2050005      4
Prop  2050003      4
Prop  2050006      4
Prop  2050007      4
Prop  2050008      4
Prop  2050009      8  00474D49 00033200
Prop  205000a      4
Prop  205000b      8  00000A7C 00000701
Prop  205000d      4
Prop  205000e      4  00000002
Prop  205000f      4  00000005
Prop  2050013      4
Prop  2050014      4
Prop  2050016      4
Prop  2050017      4  002F002F
Prop  2050018     48  00000010
Prop  2050019      8
Prop  205001a      4
Prop  205001c      4
Prop  205001f      4  0000001E
Prop  2050020      4
Prop  2050011      4
Prop  2050021      4
Prop  2050023      4
Prop  2050024      4  00000001
Prop  2050025      4
Prop  2050022      4  00000004
Prop  205001b      4  00000001
Prop  205001d     48  00000000*3 0000001E 0000000F 00000000 00000001 00000000*2  ...
Prop  2050026      4  0000001F
Prop  2050027      4  00000001
Prop  2050028      4
Prop  2050029      4
Prop  205001e      4
Prop  205002a      4
Prop  205002b      4  00000002
Prop  205002d      4
Prop  205002e     16  00000A7C 00000701 00000A7C 00000701
Prop  205002f      4  00000002
Prop  2050034      8  00000000 0000000F
Prop  205003a      4
Prop  205003b      4
Prop  2050037      4  00000001
Prop  2050036      4
Prop  2060000      4  00000001
Prop  2060001     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  2060002     24  00000000 00000002 00000000*2 DEADBEEF*2
Prop  2060003     24  00000000 00000004 00000000*2 DEADBEEF*2
Prop  2060004     24  00000000*4 DEADBEEF*2
Prop  2060005     24  00000000*4 DEADBEEF*2
Prop  2060006     24  00000000 00000003 DEADBEEF*2
Prop  2060007     24  00000000 00000003
Prop  2060008     24  00000000 00000003
Prop  2060009     24  00000000 00000003
Prop  206000a      4  00000087
Prop  206000b      4  00000087
Prop  206000c      4  00000087
Prop  206000d     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  206000e     24  00000000 00000002 00000000*2 DEADBEEF*2
Prop  206000f     24  00000000 00000004 00000000*2 DEADBEEF*2
Prop  2060010     24  00000000*4 DEADBEEF*2
Prop  2060011     24  00000000*4 DEADBEEF*2
Prop  2060012     24  00000000 00000003 DEADBEEF*2
Prop  2060013     24  00000000 00000003
Prop  2060014     24  00000000 00000003
Prop  2060015     24  00000000 00000003
Prop  2060016      4  00000081
Prop  2060017      4  00000081
Prop  2060018      4  00000081
Prop  2060019     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  206001a     24  00000000 00000002 00000000*2 DEADBEEF*2
Prop  206001b     24  00000000 00000004 00000000*2 DEADBEEF*2
Prop  206001c     24  00000000 00000003 DEADBEEF*2
Prop  206001e     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  2060021    300  63422100 DFBFA182 3F1F00FF BF9F7F5F 2300FFDF A2856746      ...
Prop  2060020     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  206001f     24  00000000 00000003 00000000*2 DEADBEEF*2
Prop  2060022     52  00000000 00000087 00000000 00000003
Prop  2060023     52  00000000 00000087 00000000 00000003
Prop  2060024      4  0000000D
Prop  2060025     24  FFFFFFFD 00000004 FFFFFFFD*2
Prop  2070000      4
Prop  2070001      4  00000001
Prop  2070002      8  5C4E33F9 00000004
Prop  2070004     16  0000002F
Prop  2070005      4
Prop  2070006      4  00000007
Prop  2070003      4
Prop  2070007      4  FFFFFFFF
Prop  2070008      4  FFFFFFFF
Prop  2070009      4
Prop  207000a      4
Prop  2070012      4
Prop  2070013     44  00000000*4 00000001 00000000 000007D0 00000006
Prop  2070014      4
Prop  2070015      4
Prop  2070016     48  00000000*4 FFFFFFFF 00000000 00000006
Prop  2070017      4
Prop  2070018      4
Prop  2080000      4  10000000
Prop  2080001      4  20000000
Prop  2090000      4  00000001
Prop  2090001      4
Prop  2090002      4
Prop  2090003      4
Trying offset 0xf00000, status=0xffff, size=0x1aedc...
Prop  b000000 110256  001A0F3C 00800030 00000000*2 03400020 00E00010 00000640    ...
Trying offset 0xf60000, status=0x0, size=0x173b8...
Skipping inactive block 0xf60000, status=0x0, size=0x173b8...
Trying offset 0xf80000, status=0xffff, size=0x173b8...
Prop  5010000     28  0000001C 00000000*3 00000001*2 00000002
Prop  5010001    544  00000000 0000006C 00000001 0201A8C0 00FFFFFF 00000000*23   ...
Prop  5010002   2204  00000000 000001B8 1401A8C0 "192.168.1.20" 00000000*6       ...
Prop  5010003   1264  00000000 000000FC 00000002*2 "Wft-canon" 00 00 00          ...
Prop  5010004     64  00000000 0000000C 00000000*2 0000000C 00000000*2           ...
Prop  5010005     44  00000000 00000008 00000001 00000008 00000001 00000008      ...
Prop  5010006    784  00000000 0000009C 00000000*17 00000001 00000000*20         ...
Prop  5010007     28  0000001C 00000000*2 00000001 00000002*2
Prop  5010008     24
Prop  5010009     84
Prop  501000a    504  00000000 00000064 00000000*24 00000064 00000000*24         ...
Prop  501000b    224  000000E0 00000000*54 00000050
Prop  501000c      4  00000001
Prop  501000d    288  00000124 00000000*70 FFFFFFFF
Prop  501000e    448  00000000 FFFFFFFF 00000000 FFFFFFFF*2 00000000*10          ...
Prop  4000000     40  00000000*8 04000400*2
Prop  4000001     40  00000000*8 04000400*2
Prop  4000002     40  00000000*8 04000400*2
Prop  4000003     40  00000000*8 04000400*2
Prop  4000004     40  00000000*8 04000400*2
Prop  4010000      4
Prop  4010001  16704
Prop  4010002      4
Prop  4010003  16704
Prop  4010004      4
Prop  4010005  16704
Prop  4020000  12400
Prop  e000001   2048  FFFFF000*284 52BCA004 FFFFF000*227
Prop  e000002   3072  FFFFF000*32 D480F000 FFFFF000*243 0E84F000 FFFFF000*246    ...
Prop  e000003   1024  FFFFF000*255
Prop  e000004   6252  00000000 0000003C 00000078 000000B4 000000F0 0000012C      ...
Prop  e020001     56  00000010 00000001*2 00000000 00000002 00000004 00000003    ...
Prop  e020002    484  00000000 00000030 00000000*7 00000031 00000000*7           ...
Prop  e020004    244
Prop  e030000   1024  00000001
Prop  e040000      4
Prop  e060000      8  "0000"
Prop  e060001      4
Prop  e060002      8  "0000"
Prop  e060003      8  "0000"
Prop  2090000      4  00000001
Prop  e070000     64
Prop  e070001     64
Prop  e080001     20  "mog-M2"
Prop 80040055     20  00000000*4 FFFFFFFF
Prop  e080003   2544  00000001 0000001C 00000000*2 00000001 00000002*2           ...
Prop  e080004   1496  00000001 00000000*2 FFFFFFFF*2 00000000*10 FFFFFFFF*2      ...
Prop  e080005   1568  00000000*3 00000006 00000002 "mog-M2" 00 6F 0000006E       ...
Prop  e080006   1196  00000000*3 FFFFFFFF*2 00000000*10 FFFFFFFF*2 00000000      ...
Prop  e080007   1384  00000000*2 FFFFFFFF*2 00000000*10 FFFFFFFF*2 00000000      ...
Prop  e080008   1192  00000000*2 FFFFFFFF*2 00000000*10 FFFFFFFF*2 00000000      ...
Prop  e080009   1516  00000000*2 FFFFFFFF*2 00000000*10 FFFFFFFF*2 00000000      ...
 - Camera model: ???
 - Firmware version: 1.0.3 / 6.0.6 7A(2b)
 - IMG naming: 100?????/IMG_1538.JPG

I take it this isn't Canon proprietary code because it has a lot of DEADBEEF in it.

[DeafEyeJedi]

Indeed interesting needles... closer to 10, if not more. HA. DEADBEEF it is. Needless to say... thanks for the reminder (even tho I had missed it Happy Belated Bday @dfort) would you still need me to try and get on the ISO-research tasks for this cam similar to how I did with this to help push this forward?