Canon 80D

[a1ex]

The first logs (last changeset) look good. I can imagine why 22476f9 would give error (too many messages coming from interrupts -> important interrupts might get delayed). However, I'm unable to explain why 4a8d74a would fail, while b35a216 would work - the only difference is what gets printed in the task name field.

Can you double-check 4a8d74a? Does it save a log, even if the error message appears? ERR70 is an assertion somewhere in DryOS (thousands of different conditions could cause this), but DryOS continues to runs after that and ML can save files (at least on earlier models).

If 4a8d74a is really causing ERR70 (which I doubt, but who knows), can you try to get a log from 22476f9 with 4a8d74a reverted? That is:

Code: [Select]

hg up --clean 22476f9
hg backout --no-commit 4a8d74a

Here's the annotated MPU conversation from DEBUGMSG4.LOG:

Code: [Select]

mpu_send(06 04 02 00 00 00)                                        ; Init group
mpu_recv(06 05 01 00 03 00)                                        ; PROP_SHOOTING_MODE
mpu_recv(06 05 01 4f 00 00)                                        ; PROP_FIXED_MOVIE
mpu_recv(06 05 01 99 00 00)                                        ; PROP 80040057
mpu_recv(06 05 01 9a 00 00)                                        ; PROP 80040058
mpu_recv(06 05 01 06 18 00)                                        ; PROP_APERTURE
mpu_recv(06 05 01 3f 00 00)                                        ; PROP_FLASH_ENABLE
mpu_send(08 06 01 a7 00 01 00 00)                                  ; ???
mpu_send(08 06 01 a7 00 01 00 00)                                  ; ???
mpu_recv(30 2f 02 0d 03 03 00 00 01 00 00 00 00 01 00 01 00 01 02 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 01 00 01 00 0f 00 07 01 00 00 00 00) ; Card group
mpu_recv(5a 59 02 0f 01 02 00 08 01 01 00 00 00 00 00 00 00 00 00 00 17 6a 00 00 00 0f 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 03 01 2c 00 00 0b b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; Movie group
mpu_recv(48 46 02 10 00 00 00 00 00 00 00 00 00 00 ff 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 02 01 01 00 03 00 01 00 04 00 00 01 05 00 01 01 00 00 00 00 47 47 00 02 00 00 00 00 00 00 00 00 00) ; AF group
mpu_send(06 04 0e 4c 00 00)                                        ; ???
mpu_send(24 22 0e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(2a 28 0e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(0c 0a 0e 2c 00 00 00 00 00 00 00 00)                      ; ???
mpu_send(06 05 0e 30 00 00)                                        ; ???
mpu_send(06 04 0e 31 00 00)                                        ; ???
mpu_send(06 04 0e 35 00 00)                                        ; ???
mpu_send(0c 0a 0e 38 00 00 00 00 00 00 00 00)                      ; ???
mpu_send(46 44 0e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(70 6f 0e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(12 10 0e 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00)    ; ???
mpu_recv(42 40 02 11 00 17 00 00 00 00 17 00 ff ff ff ff ff f8 00 00 00 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00) ; AF2 group
mpu_recv(06 05 01 af 02 00)                                        ; ???
mpu_recv(10 0e 02 05 07 00 00 00 01 00 00 03 05 03 00 00)          ; PROP_CFN_1
mpu_recv(2e 2c 02 07 11 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 03 08 47 03 0f 00 11 10 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_3
mpu_send(12 10 0e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00)    ; ???
mpu_send(26 24 0e 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_recv(1e 1d 02 08 05 c3 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_4
mpu_recv(06 05 01 95 02 00)                                        ; PROP 8004005C
mpu_recv(2e 2c 02 07 11 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 03 08 47 03 0f 00 11 10 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_3
mpu_send(0a 08 0e 3f fe ff ff ea 00 00)                            ; ???
mpu_send(08 06 0e 40 fe ff 00 00)                                  ; ???
mpu_send(06 05 0e 49 fe 00)                                        ; ???
mpu_send(06 05 0e 4b fe 00)                                        ; ???
mpu_recv(8e 8d 02 0e 03 03 03 04 00 00 00 5d 00 00 00 00 0e 10 00 00 00 00 21 00 00 01 03 00 00 06 04 00 00 01 00 01 00 00 03 84 00 65 18 00 00 00 00 00 00 00 00 01 03 00 00 83 48 00 00 70 48 80 48 80 48 83 48 58 48 90 01 00 03 03 01 00 01 00 00 03 00 00 00 00 01) ; Mode group
mpu_recv(06 05 03 37 00 00)                                        ; PROP_MIRROR_DOWN_IN_MOVIE_MODE
mpu_recv(0a 08 03 2f 00 40 00 00 00 00)                            ; PROP_SPECIAL_OPTION
mpu_recv(06 05 03 20 01 00)                                        ; PROP_STARTUP_CONDITION
mpu_recv(06 05 03 76 00 00)                                        ; ???
mpu_recv(08 06 01 a7 00 01 00 00)                                  ; ???
mpu_recv(64 62 02 12 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 43 43 7e 7e 7e 43 43 01 70 01 70 01 70 00 96 00 96 00 96) ; Lens group
mpu_recv(06 05 03 35 01 00)                                        ; PROP_BATTERY_REPORT_COUNTER
mpu_recv(1c 1b 03 1d 35 02 00 00 00 e7 00 4c 50 2d 45 36 4e 00 00 00 00 01 00 00 65 16 15 00) ; PROP_BATTERY_REPORT
mpu_recv(06 04 03 36 00 00)                                        ; PROP_BATTERY_REPORT_FINISHED
mpu_recv(08 07 03 7e 91 99 ff 00)                                  ; ???
mpu_recv(08 06 01 a7 00 00 00 00)                                  ; ???
mpu_recv(06 05 04 06 05 00)                                        ; PROP_DEFAULT_LV_MANIP
mpu_recv(0e 0d 04 30 00 00 00 00 00 00 00 00 00 00)                ; ???
mpu_recv(06 05 01 48 01 00)                                        ; PROP_LIVE_VIEW_MOVIE_SELECT
mpu_recv(06 05 01 4b 01 00)                                        ; PROP_LIVE_VIEW_VIEWTYPE_SELECT
mpu_recv(06 05 01 49 01 00)                                        ; PROP_LIVE_VIEW_AF_SYSTEM
mpu_recv(06 05 01 12 00 00)                                        ; PROP_WBB_GM
mpu_recv(06 05 01 13 00 00)                                        ; PROP_WBB_BA
mpu_recv(10 0e 01 8f 00 00 00 00 00 00 00 00 00 00 00 00)          ; PROP_LV_CFILTER
mpu_recv(0e 0c 01 b1 00 00 00 00 00 00 00 00 00 00)                ; ???
mpu_recv(06 05 01 03 04 00)                                        ; PROP_DRIVE_MODE
mpu_recv(08 06 01 a7 00 01 00 00)                                  ; ???
mpu_recv(08 06 01 a7 00 00 00 00)                                  ; ???
mpu_recv(06 05 04 29 01 00)                                        ; ???
mpu_recv(06 05 01 01 03 01)                                        ; PROP_SHOOTING_MODE_CUSTOM
mpu_recv(06 05 01 2e 01 00)                                        ; PROP_SAVE_MODE
mpu_recv(46 44 09 00 00 c6 00 32 00 32 81 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 10 50 49 02 59 88 88 00 88 88 00 32 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LV_LENS
mpu_recv(06 05 01 2c 02 00)                                        ; PROP_CURRENT_MEDIA
mpu_recv(12 10 03 00 9d 00 00 84 0b 00 00 00 00 00 00 00 00 00)    ; PROP 80030000
mpu_recv(06 05 03 23 11 00)                                        ; ???
mpu_recv(16 15 03 24 45 46 35 30 6d 6d 20 66 2f 31 2e 34 20 55 53 4d 00 00) ; PROP_LENS_NAME
mpu_recv(06 05 03 04 00 00)                                        ; PROP_POWER_KIND
mpu_recv(06 05 03 05 04 00)                                        ; PROP_POWER_LEVEL
mpu_recv(06 04 03 25 00 00)                                        ; ???
mpu_recv(06 05 01 3d 00 00)                                        ; PROP_TEMP_STATUS
mpu_recv(06 05 03 0d 00 00)                                        ; PROP_CARD2_RECORD
mpu_recv(06 05 03 0c 00 00)                                        ; PROP_CARD1_RECORD
mpu_recv(30 2e 03 15 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LENS
mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
mpu_recv(06 05 03 17 9c 00)                                        ; PROP_EFIC_TEMP
mpu_recv(06 05 03 6c 9b 00)                                        ; PROP 80030073
mpu_recv(30 2e 03 15 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LENS
mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
mpu_recv(0a 09 01 55 00 00 03 00 00 01)                            ; PROP_MULTIPLE_EXPOSURE_SETTING
mpu_recv(0a 09 01 70 00 00 01 00 00 01)                            ; PROP_HDR_SETTING
mpu_recv(0a 08 01 85 00 00 00 01 01 00)                            ; PROP_GIS_SETTING
mpu_recv(0c 0a 0e 2d 65 00 00 04 50 01 00 00)                      ; ???
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 03 5c 00 00)                                        ; PROP 80030061
mpu_recv(06 05 01 59 01 00)                                        ; PROP_MOVIE_SERVO_AF
mpu_recv(06 05 01 59 01 00)                                        ; PROP_MOVIE_SERVO_AF
mpu_send(0a 08 09 24 00 00 00 00 00 00)                            ; ???
mpu_send(08 07 03 6a 00 02 00 00)                                  ; ???
mpu_send(0a 08 03 06 00 00 00 00 00 00)                            ; PROP_AVAIL_SHOT
mpu_send(06 04 03 10 00 00)                                        ; PROP 80030008
mpu_send(06 05 03 07 ff 00)                                        ; PROP_BURST_COUNT
mpu_send(06 05 01 2e 01 00)                                        ; PROP_SAVE_MODE
mpu_send(0a 08 03 0b 00 00 00 00 00 00)                            ; PROP 80030007
mpu_send(06 05 03 19 01 00)                                        ; PROP_TFT_STATUS
mpu_send(06 05 01 56 00 00)                                        ; ???
mpu_send(06 05 04 0e 01 00)                                        ; PROP 8002000D
mpu_send(06 05 03 40 00 00)                                        ; PROP 80030040
mpu_send(0c 0b 03 53 03 00 48 81 81 00 00 00)                      ; PROP 80030058
mpu_send(0c 0b 03 53 03 00 48 81 81 00 00 00)                      ; PROP 80030058
mpu_send(08 06 01 2a 05 68 00 00)                                  ; PROP_CARD2_FILE_NUMBER
mpu_send(06 05 03 07 14 00)                                        ; PROP_BURST_COUNT
mpu_send(0a 08 03 06 00 00 00 ea 00 00)                            ; PROP_AVAIL_SHOT
mpu_send(06 05 03 11 01 00)                                        ; PROP_ICU_AUTO_POWEROFF
mpu_send(06 05 02 0a 00 00)                                        ; PROP_PERMIT_ICU_EVENT
mpu_send(06 05 03 0d 00 00)                                        ; PROP_CARD2_RECORD
mpu_send(06 05 03 0c 00 00)                                        ; PROP_CARD1_RECORD
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00)                                        ; PROP_VIDEOSNAP_MODE


[sombree]

I double-checked 4a8d74a and still no-go - camera gives Err70. Same thing happens with 22476f9 (as latest) and 4a8d74a reverted. Again, camera doesn't lock up - it reacts to pushing trigger button or on/off switch.
Btw. I tried extract_init_spells.py, rebuild qemu and got this log from qemu. It seems that emulation goes little further.

[OlRivrRat]

                     @Alex

       "Nothing printed on the screen? Repeatable?"

Just 1 Flash of LED then Dead Cam, Batt' Removal Necessary. Tried 6 Times, all same.

   The Portable Rescue & Your 29May Rom + SFData Dumper autoexe still work just fine.

[a1ex]

It seems that emulation goes little further.

Only seems to - with the new MPU messages, it no longer initializes the SD card (no more messages from CSMgrTask). I have a feeling some of the MPU messages were missed this time, too.

Can you try the latest changeset? (same sequence as before).

Just 1 Flash of LED then Dead Cam, Batt' Removal Necessary. Tried 6 Times, all same.

Best guess: bootable card without autoexec.bin (in this case, the FIR is not auto-loaded; the camera enters factory menu, but you need a hardware interface to see the messages). Updated the instructions to address this. The FIR file is meant for first-time contributors, who don't have the boot flag enabled yet. You can start it from a fresh card (format, copy the FIR and run Firmware Update from the menu).

[sombree]

e833d47:
- camera boots up
- DEBUGMSG.LOG is created
- logs: 1 and 2 were taken without lens; 3 and 4 - with lens attached

[a1ex]

Graphical view of the first log:

DEBUGMSG1.svg

It's not 100% clear which mpu_recv is a reply to which mpu_send, so we may need to find a way to delay the mpu_send calls (this was the trick I've used on previous models to figure out the dependencies between MPU messages).

[sombree]

You mean something like this?

[a1ex]

Yeah, same effect, except this time we are not able to patch ROM code. Figuring out how to do that would be a very useful contribution.

The technique used by io_trace might be useful (idea: set up a memory protection region over the ROM that would redirect all reads and executions to RAM). Porting io_trace is also going to be extremely useful, but debugging is tedious (expect lots of crashes and trial and error).

[sombree]

Sadly, it's way beyond my coding skills 

[a1ex]

Don't worry, there are knowledgeable ARM folks around (some possibly following this thread). I'm going to try it as well.

Meanwhile, notice the log files are much smaller than buffer size, but there's some more going on during startup. Can you try to log the entire process?

Start by increasing the delay in init_task (5 seconds should be enough). If the log gets full, increase the buffer size as well (currently 256K, you can try 512K or maybe more).

[sombree]

Logs with 5 seconds delay (1 is without lens, 2 is with lens attached). Changing buf[256 * 1024] to buf[512 * 1024] causes camera to lock up right after closing sdcard slot.
Edit: logs were taken with both wireless communication (wifi/nfc) and touch screen turned off.

[a1ex]

If log size is near 100K, there's no point in increasing the log size (256K > 100K). I thought they are going to be larger.

Another issue: the DIGIC clock (0xD400000C) appears to have more than 20 valid bits. Questions:
- does the old timer register (0xC0242014) still work? (try it in log.c instead of 0xD400000C)
- try "%08X>" for printing the timestamps (that way, we'll see how many bits are actually used); try this one with both registers

[sombree]

Link
1 - 0xD400000C and %08X>
2 - 0xC0242014 and %08X>
Does it mean that old timer register work?

Edit: Link updated (now from latest changeset).

[a1ex]

Right; the old register still works as a 20-bit timer; the new one has at least 21 bits. For some reason, last value is 1498313 microseconds (nearly 1.5 seconds), while on previous logs captured with msleep(1000), last value is 999385 microseconds. That's unusual - older models keep printing messages while the main info screen (with shutter, aperture and other controls) is displayed.

Maybe you can get some more messages by starting in LiveView?

[sombree]

Sorry, I forgot to mention - thats because I've changed init delay to 1.5 seconds.
Logs:
1 - 0xD400000C and 5 sec delay
2 - 0xC0242014 and 5 sec delay

[a1ex]

OK, that makes sense. Can you redo a regular startup with 5 seconds delay? Reason: timestamps printed with %05X are unreadable after the overflow.

[sombree]

Sure - link.
1 - no lens,
2 - with lens,
both with 0xD400000C.

[a1ex]

Looks good: DEBUGMSG1-5s.svg

You could also try to find out the number of bits used by 0xD400000C, but that may take a while. The procedure is simple - increase the delay and write down the maximum value. A 16-second delay would cover 16 bits. A 5-minute delay would cover 29 bits. If the timer has 32 bits, it will wrap around after 1 hour and 12 minutes.

[sombree]

I guess timer has 32 bits - it wrapped shortly after 71 minutes - log. Buffer size was set to 320K, init delay to 4380000 (73 minutes).

[a1ex]

Nice, finally a 32-bit microsecond timer

Found something interesting in this thesis, page 59: they use the same CPU core (Cortex R4). They mention some debug registers (DBGDRAR and others); see Cortex R4 TRM section 12.3.3 (Debug register interface - Coprocessor registers summary). I remember some folks already tried it without much success, but I don't remember seeing the test code.

Added these registers to the "cpuinfo" section on the recovery branch. Compile with CONFIG_BOOT_CPUINFO=y CONFIG_BOOT_DUMPER=y . Will it work or will it lock up?

If it works, uncomment the DBGDSCR register as well. I've commented it out just in case (QEMU printed some different name).

[sombree]

Link
1 - without DBGDSCR
2 - with DBGDSCR
In all cases I removed disable_caches_region1_ram_d6() from reboot.c to speed up dumping process.

Edit:
3 - with latest changeset (237777f)
4 - with latest changeset and caches disabled

[ariznaf]

Wowww

Great to see active developement in this model, with several of you working hard.
Thank you all for your efforts.
I will wait for the first working version to see if i can help with alpha testing.
You are great guys.

[whoreable]

Keep going at it boys! were rooting for you   

[a1ex]

Why don't you help us?

All you need is some courage to start following the notes. Browse the docs. Start poking around and write down what you discover. That's pretty much it; we don't really know what we are doing either.

I've just got a Raspberry Pi Zero (ARMv6) to try the above debug registers, but didn't power it on yet. You've got the real hardware; maybe you can read the thesis linked earlier and try to reproduce some of the results. Or maybe you can try something easier, like playing around with the logging code. Or try to figure out how to print some stuff on the screen. Watch this video for a nice intro. Just some ideas.

[k!r+]

Hi all.

Been watching and playing for a while with some others who are studying software development at uni and we would like to get ML on the 80D as a fun but challenging project. We've taken the 80D apart and posted some photos of the main board. If we missed something let me know as there are a few more we took, or we could take it apart again if we really need to (may have to if we need to find anything out about the NFC chip).

Hopefully these photo's will help with something.