Author Topic: Battery grip pins / UART  (Read 35365 times)

kitor

  • Developer
  • Member
  • *****
  • Posts: 249
Re: Battery grip pins / UART
« Reply #50 on: January 07, 2021, 09:56:42 PM »


MPU... but do you know from what camera? K429 rings a bell?



Anybody?



Well, that's EOS R Battery grip!  :P



Interesting thing is that you won't get shell unless poked RST pin (not sure to what level, i just attached my UARTs TX temporary and pressed any key).
EDIT: this may be related to me having grip on/off switch in off position when the tests were done. YMMV.

You need to almost completely disassemble grip first. It will not work without camera attached.

More details on MPU itself in DIGIC 8 MPU investigation

If you come here from Twitter, please note that post thumbnail had wrong pins described for RX/RST (they were accidently shifted to the right)
EOS R, 200D, 50D...

deviousfusion

  • New to the forum
  • *
  • Posts: 4
Re: Battery grip pins / UART
« Reply #51 on: February 01, 2021, 11:54:42 AM »
X-Post from https://www.magiclantern.fm/forum/index.php?topic=17969.msg233932#msg233932

Some updates:
The 1300D has UART port accessible by removing the thumb grip above the DPAD. Some 1300D do not have the connector soldered on, but the pads on the PCB are visible. I was able to probe test the pins and got a pinout:

Pin No.|    1|    2|    3|   4|    5|    6|
STATE|   0V|  3V3|  3V3|   G|  3V3|  3V3|
Func.|MPU Rx|MPU Tx| (?) |GND|CPU Rx|CPU Tx|

Console outputs
Probing pin 2 gives:


Probing Pin 6 gives:
Code: [Select]
#
  2010: 14066.703 [FM] FM_Suspend : Normal
 Firm Jump RAM to ROM 0xFE0C0000
K404 READY
     0:    13.602 [STARTUP]
K404 ICU Firmware Version 1.1.0 ( 4.4.6 )
    57:   119.351 [RSC] hMemoryQueue (0x660012) hStorageQueue (0x680014)
   121:   137.499 [RTC] PROPAD_GetPropertyData : PROP_RTC 0xfd
   122:   138.857 [RTC] ChangePropertyCBR 0x0, 0x4000
   123:   139.113 [RTC] RTC_Permit 0x20
   134:   139.440 [SND] Seq LPC fin
   151:   142.332 [ENG] [ENGIO](Addr:0x4fb40000, Data:0x   30000)
   154:   150.577 [WB] AdjustWb Done.
   168:   152.797 [TERMINATE] SHUTDOWN init comp
   170:   152.884 [TERMINATE] Abort init comp
   192:   156.561 [MC] PROP_GUI_STATE 0
   197:   156.859 [MC] JobState 0
   200:   157.573 [MC] PROP_LCD_OFFON_BUTTON : 1
   202:   157.758 [MC] PROP_VARIANGLE_GUICTRL : Enable
   205:   158.770 [MC] regist master CardCover
   248:   174.656 [PRP] M:37 F:0 L:0 P:B T:1
   378:   254.481 [LV] [GMT] PROP_TEMP_STATUS : STATUS_NORMAL
   498:   264.995 [LV] InitializeLiveViewDefectDetection
   902:   299.478 [MD] Init RCh1=0, RCh2=0
   905:   300.002 [MD] Set RCh1=d, RCh2=18
  1292:   863.742 [INDEV] INDEV_Initialize
  1299:   865.931 [HDMI] [MID] HDMI_IP_Initialize
  1315:   885.667 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
  1316:   885.741 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
  1352:   906.774 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
  1422:   929.689 WARN [LVDS] First Get DTS_GetAllRandomData
  1524:   940.646 [GUI] MainEventHandler PROP_QR_DIDNOT_EXECUTE(0)(0)
  1570:   945.934 [STARTUP] startupInitializeComplete
  1572:   946.095 [MC] cam event guimode comp. 0
  1732:   996.044 [MC] cam event guimode comp. 0
  1829:  1171.131 [DISP] TurnOnDisplay action Type=0

Now here is where I'm stuck. I do not know what the connector is called.  This is what it looks like (its not JST):

coon

  • Developer
  • Member
  • *****
  • Posts: 103
Re: Battery grip pins / UART
« Reply #52 on: February 11, 2021, 11:27:40 PM »
The connector is a 6 pin vertical JST 0.8mm:
https://de.aliexpress.com/item/4001088873723.html

A matching cable is available here:
https://de.aliexpress.com/item/4001144163609.html
EOS RP

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12564
Re: Battery grip pins / UART
« Reply #53 on: April 10, 2021, 04:23:14 PM »
EOS M2 has the same UART connector as 1300D (photo from Walter's; TX pins matching the above description from deviousfusion):



Code: [Select]
MON>>>
E1OFF

Code: [Select]
SD Detect High
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1

[SF] Bufcon Base 0xc022c0d4
SerialFlash Initialize
     0:    55.279 [STARTUP]
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
     4:    57.627 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
     5:    58.313 [PROPAD] SerialFlash Packages!! 0x2d0000
...

760D appears to be similar (photo from igoro00 on Discord):


Matching cable also available on Digikey:
https://www.digikey.com/en/products/detail/jst-sales-america-inc/A06SUR06SUR32W51A/6009351

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7988
Re: Battery grip pins / UART
« Reply #54 on: April 10, 2021, 05:52:42 PM »
Spoiler alert: 250D / SL3 allows a somehow convinient access to UART, too. There is a rectangular hole under rubber cover (thumb rest). My 250D doesn't have a connector but solder pads are the same as shown for 200D here: https://www.magiclantern.fm/forum/index.php?topic=7531.msg224730#msg224730
Don't know if there are cameras in the wild where Canon soldered a connector (see 1300D). Pictures will follow.


kitor

  • Developer
  • Member
  • *****
  • Posts: 249
Re: Battery grip pins / UART
« Reply #55 on: May 07, 2021, 08:29:04 PM »
EOS M50

Good news: UART found


Code: [Select]
eEC412 READY                                                                 
        0:      3.281 [STARTUP]                                             
EC412 ICU Firmware Version 1.1.0 ( 7.3.0 )                                   
       31:     12.869 [SHTV] ShtPmaPath Init                                 
       49:     25.268 [STARTUP] St Reason 0                                 
      113:     66.185 [PROPAD] ERROR GetPropertyData ID = 0x01000013         
      114:     66.191 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000013 L:2992 
      188:     79.808 [PRP] ERROR TWICE PROPERTYMASTER 0x80020037 L:2454     
      189:     79.825 [PRP] ERROR EventDispatch : Current = 0, dwEventID = 0, dwParam = 0xd31154
      299:    117.433 [MR] MRIPC_Initilaize (28)                             
      309:    117.765 [MR] mvrChangeAckCBR : Video - Mode=0,Type=0,Rate=2500,GOP=12
      327:    118.142 [PROPAD] ERROR GetPropertyData ID (0) = 0x02010008
      328:    118.147 [PRP] ERROR NOT FOUND PROPERTY ID = 0x02010008 L:2992
      339:    118.461 [MR] [TCTEST]FreeRunBase RTC:0(h)0(m)0(s)->0
      340:    118.469 [MR] FreeRun/1 [0][0][0][0][0][0]
      404:    128.589 [PROPAD] ERROR GetPropertyData ID (0) = 0x00020005
      405:    128.605 [PROPAD] ERROR GetPropertyData ID (0) = 0x0001002B
      406:    128.614 [PROPAD] ERROR GetPropertyData ID (0) = 0x00010025
       43:    130.592 [EPPVRM] InitializeVramSubTest
      416:    132.067 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0


Bad news: Requires a complete disassembly to gain access  :(


EOS R, 200D, 50D...

Ant123

  • Contributor
  • Member
  • *****
  • Posts: 173
Re: Battery grip pins / UART
« Reply #56 on: May 07, 2021, 10:18:38 PM »

kitor

  • Developer
  • Member
  • *****
  • Posts: 249
Re: Battery grip pins / UART
« Reply #57 on: May 07, 2021, 10:50:15 PM »
No, I had M50 just for a few days to play, I already shipped it back. And I don't have JTAG interface anyway...
But yes, it reminded me pads I have seen in old PowerShots, which confirms that despite having EOS-alike firmware it was designed by "the other team"
EOS R, 200D, 50D...

kitor

  • Developer
  • Member
  • *****
  • Posts: 249
Re: Battery grip pins / UART
« Reply #58 on: May 21, 2021, 08:37:50 PM »
EOS 50D (and most likely 40D)

It was known already that UART is accessible externally from battery grip pins. It requires a modified grip / battery to access.

I thought for sure there has to be some connector inside for factory tests / programming, and I wasn't wrong.

There are two debug connectors, one on ICU (on the other side of HDMI port), and one for MPU - above CF slots. Test pads are exposed around this area.

For MPU - two topmost testpads are (top) MPU_RX, (bottom) MPU_TX
For ICU - two rightmost testpads are (top) ICU_TX, (bottom) ICU_RX

ICU debug connector is easily accessible after removing just ports cover part of the case.





Code: [Select]
CF is not a startup disk.                                                 
K261 READY                                                                   

     0:     8.308 [STARTUP]  K261 ICU Firmware Version 1.0.9 ( 3.4.5 )
Open Console K261[1]>...
K261[1]>
     7:    45.299 [HPD] add emergency isr.                           
    22:    88.777 [STARTUP] Ceres Disappeared                               
   102:   111.712 [ENG] [ENGIO](Addr:0x5c640000, Data:0x   30000)           
   133:   122.797 [MC] PROP_GUI_STATE 0                                     
   138:   123.116 [MC] JobState 0                                           
   139:   123.304 [MC] HDMIConnect ---> (0)                                 
   142:   124.325 [MC] regist master CardCover
   196:   361.327 [PRP] M:51 F:0 L:0 P:20
   197:   361.636 [STARTUP] internal version 03:04:05:00:51:00:00:20
   211:   369.843 [LVMD] Init RCh1=0, RCh2=0
   213:   370.125 [LVCFG] LV_Initialize Jun 17 2009
   219:   372.766 [LVMD] Set RCh1=a, RCh2=18
   226:   375.385 [LVCFG] PROP_TEMP_STATUS  Temp:0, FrameRate:1
   227:   375.609 [LVCFG] PROP_LV_ACTION STOP
   231:   375.893 [LVCFG] PROP_LV_LOCK PERIMIT
   235:   376.190 [LVCFG] PROP_SHOOTING_TYPE 0
   240:   377.805 [LV] PROP_LIVE_VIEW_FACE_AF
   247:   378.733 [LVCFG] PROP_LIVE_VIEW_VIEWTYPE_SELECT 0->0
   249:   378.959 [LVCFG] PROP_LIGHT_FALLOFF_COMP 0
   269:   389.022 [PTP] LensID:0,0,0
   321:   397.123 [PTP] PhotoStudioMode:0
   374:   403.430 [PTP] LV End Clear LVData
   377:   403.599 [PTPCOM] SetPtpTransportResources:0,319b
   492:   416.092 [DISP] InitializeDisplayDeviceController (PUB)
   493:   416.157 [DISP] Memory Area 0 0 0 0 0 0
   497:   418.039 [HDMI] HPD OFF
   546:   467.916 [LVCFG] PROP_OUTPUT_TYPE 0(0) / 0
   574:   476.772 [GUI] HDMI_VIDEO_CODE 0
   667:   526.338 [STARTUP] startupInitializeComplete
   669:   526.477 [MC] cam event guimode comp. 0
   687:   527.785 [MC] cam event guimode comp. 0
   690:   528.014 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   696:   528.999 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   767:   701.207 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=0
   794:   868.687 [DISP] BackLightOn
   796:   885.114 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=1

Code: [Select]
K261[1]>drysh
=== Dry-shell start ===
Dry> help
[Debug]
 task  sem  event  mq  mutex  cond  timer  mkobjsize  extask  kill  suspend
 resume  release  delete  prio  mkcfg  meminfo  xd  xm  memmap  objinfo
[Misc]
 vers  exit  dminfo

Dry> vers
DRYOS version 2.3, release #0023
  Dry-MK 2.39
  Dry-DM 1.14
  Dry-stdlib 1.33
  Dry-shell 1.11
  Dry-command alpha 029
Dry>

Code: [Select]
E1ON
MON>>about

  MPU Ver...0x51
  MPU code   area check sum...0x0506D389


MON>>
E1OFF
EOS R, 200D, 50D...

reddeercity

  • Contributor
  • Hero Member
  • *****
  • Posts: 2283
Re: Battery grip pins / UART
« Reply #59 on: May 22, 2021, 05:40:28 AM »
This is great, Thanks!   :)
I was thinking about this the other day on how to do this to D4's without having a battery grip .
This helps me greatly , I have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems
now i just need to get uart device and get my head around this .

kitor

  • Developer
  • Member
  • *****
  • Posts: 249
Re: Battery grip pins / UART
« Reply #60 on: May 22, 2021, 07:41:04 AM »
3v3 and as usual 115200,8,n,1. So any USB UART should do.

In fact it had problems with my 1v8 modified UART (with resistor voltage divider on transmit line), it was in "undetermined" range and camera would randomly get some input.

Bonus: 50D doesn't need magic spell to enter EvShell.

Quote
I have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems
Similar to this - I bought it to:
- verify if dev branch from git repo still works properly on old cameras
- have a reference point for how things work on older generations
EOS R, 200D, 50D...

reddeercity

  • Contributor
  • Hero Member
  • *****
  • Posts: 2283
Re: Battery grip pins / UART
« Reply #61 on: May 25, 2021, 05:13:26 AM »
Thanks for the info , I"ll do some shopping and see what i can find .