0.027.660 Evf:ff2c6f58:MMIO : [0xC0F06800] <- 0x00010013
0.027.661 Evf:ff2c6f58:MMIO : [0xC0F06804] <- 0x02D801D7
These values are OK, both set from engio_write. I could not find other instances. What happened to the shadow memory, then?!
Generally, ENGIO registers cannot be read back directly (with very few exceptions), so Canon code also writes their value into RAM (possibly to read them back later, or for debugging). On M2, this shadow memory is at 0x9696C -> 0x412a0000, and a register is written there like this:
*reg = value;
*(reg & 0x3FFFF | shadow_addr) = value;
In other words, the value written into register 0xC0F06800 would be also written to memory at 0x412a6800.
We've got a problem: 0x412a0000 & 0x3FFFF is not 0. The value written to 0xC0F26800 (EDMAC channel 0x18) will be also written to the same memory address, at 0x412a6800. When reading this back, we'll get whatever was written last (of these two registers).
It's the first model I'm aware of with this problem. 5D3 has the shadow memory at 0x29C04 -> 0x41700000. 700D: 0x31708 -> 0x41400000. For other models, the value can be found in gdb+qemu; I didn't even think about it until now, since it just worked.
Can these registers be read directly from hardware? (answer: no - they won't crash, but they will return just 0 or 1)
BTW, this probably means the ENGIO register range is from 0xC0F00000 to 0xC0F3FFFF ("only" 65536 registers?) and the other ranges are not meant to be written with these routines (engio_write / EngDrvOut). I should enforce this in the code.
Stack trace to see where this shadow memory is allocated:
0x35F20(6109f0 &"StageClass", 35f20, 19980218, 19980218) at [ShootCapture:ca14:19dfc8] (pc:sp)
0xFF0D38C0(406108e8 &"ShootCapture", 0, ff0c5724, 40000) at [ShootCapture:35f7c:19dfa0] (pc:sp)
0x3637C(61096c &"StateObject", 406108e8 &"ShootCapture", 0, ff0c5724) at [ShootCapture:ff0d38ec:19df88] (pc:sp)
0x363B4(61096c &"StateObject", 406108e8 &"ShootCapture", 0, ff0c5724) at [ShootCapture:363ac:19df78] (pc:sp)
0xFF1567B4(406108e8 &"ShootCapture", ff0c5724, 40000, ff1567b4) at [ShootCapture:36434:19df58] (pc:sp)
0xFF23398C(412a0000, 44000, 1, ff1567b4) at [ShootCapture:ff156810:19df20] (pc:sp)
0xFF4ADB84(412a0000, 44000, 1, 0) at [ShootCapture:ff2339cc:19dee0] (pc:sp)
0xFF2C6BE8(412a0000, 44000, 1, 0) at [ShootCapture:ff4adb8c:19ded8] (pc:sp)
Size appears hardcoded to 0x44000 (so, 412a0000 - 0x412e4000). Doesn't help much. Can be found on the
RscMgr memory map as well:
ENGINE_MIRROR 0x412A0000 0x00044000 278528
We might be able to find
another buffer for this.