Canon 80D

[a1ex]

Yay!

Code Select Expand


1.398333   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000002
1.398336   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x00020077
1.398338   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018 ; overlay
1.398351   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000009
1.398353   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x0002003B
1.398355   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E ; opacity, 0 = fully transparent, FF = fully opaque
1.615703   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000006
1.615706   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x00020077
1.615709   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018 ; BMP
1.615725   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x0000000C
1.615727   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x0002003B
1.615729   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E ; opacity
2.696875     CtrlSrv:fe5cf0af:83:03: IDLEHandler PRESS_PLAY_BUTTON
2.725693   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000002
2.725696   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x00020077
2.725698   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001785B ; overlay #2, black
2.725712   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000009
2.725714   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x0002003B
2.725716   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00017071 ; opacity #2, FF
3.037422   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x0000009F
3.037424   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x0002005B
3.037427   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x003F8170 ; image
3.058830   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x00000006
3.058833   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x00020077
3.058836   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018 ; overlay
3.058850   DispVCtrl:fe2085e7:fe2085e3:MMIO : [0xD2030100] <- 0x0000000C
3.058852   DispVCtrl:fe2085ef:fe2085e3:MMIO : [0xD2030104] <- 0x0002003B
3.058854   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E ; opacity


Bottom line: to print on the screen, all you need is to modify the contents of the image buffer. At least while in Canon menu, Canon code is not going to overwrite what you will draw there. The only significant difference from DIGIC 4/5 is the image format (UYVY rather than palette-based).

Yes, Canon's animations will overwrite our stuff, but that also happens on previous models, so it's not a big deal.

Code Select Expand

    while(1)
    {
        MEM(CARD_LED_ADDRESS) = LEDON;
        msleep(500);
        MEM(CARD_LED_ADDRESS) = LEDOFF;
        msleep(500);

        uint32_t * vram1 = (uint32_t *) 0x1901800;
        uint32_t * vram2 = (uint32_t *) 0x1785B00;
        for (int i = 0; i < 540; i++)
        {
            vram1[i + i * 960/2] = 0x46ff465e;
            vram2[i + i * 960/2] = 0x6d216d4b;
        }
    }
gives this - link to the image

You (80D owners) should have tested this one year ago, without waiting for me, after Ant123 published the image buffers. I think I've suggested this before:

If that works, the next steps would be:
[...]
- identifying the display buffer, printing hello world, opening ML menu...

found in RAM dump provided by sombree:
two uyvy buffers at 0x41785B00, 0x41901800
one RGBA buffer at 0x043ED100

please don't wait for me - start experimenting on your own.

One of the "harder" tasks is figuring out how to print things on the display. On EOS, the only half-successful experiment I'm aware of is this one, for 5DS. This part is best done with the camera in one's hands, although I'm (still) trying to bring the emulation far enough to initialize the display, so I could figure it out from there. On earlier models, writing into the display buffer is enough to make things appear on the screen; DIGIC 6 and newer models apparently use some sort of Takumi GPU (look it up on CHDK forum; they already figured it out for compacts).

You now have all the low-level info you need for turning this into a Hello World, and then into a working ML port (not necessarily with all features, but I don't expect any trouble for things like intervalometer, Lua scripting or raw video). Difficulty level: just one notch above DIGIC 4/5. Previously, the difficulty level was believed to be much higher, simply because nobody tried to see what happens if you change the contents of the display buffer.

For now, my research on DIGIC 6 ends here. There are many other areas of ML waiting for my attention. In no particular order: DIGIC 2/3/4+/7/8 (new ports), DIGIC 4/5 (maintenance, firmware updates), crop_rec with arbitrary resolutions, Lua, manual lens info, ISO improvements, integrating stuff into mainline, in-camera help, user guide, bugfixes, test suite and so on.

I'll keep looking into the emulation side of things, but please don't forget - porting ML on this camera is your job. You are the beneficiaries, not me. I'll be here here to help, but I'll repeat - please do not wait for me. Start experimenting on your own.

Good luck!

[OlRivrRat]

             @Alex

       "You (80D owners) should have tested this one year ago, without waiting for me, after Ant123 published the image buffers. I think I've suggested this before:"

       Thanks Ever So Much again for the work You have done on attempts to port ML to the 80D. Now I sincerely hope that Your apparent assumption, that there are those among Us 80D Owners that Share Your Knowledge & Abilities, is Correct. I wish I did but I definitely Do Not possess even the slightest clue of what to look for or where to look.

                                                                                  ORR ~ DeanB

[Chellyandruu]

And sombree , he did a great job too.

[OlRivrRat]

   Absolutely, Sombree & Ant are doing Great Work & will hopefully be able to Get The Ball To The Goal ~

                           ORR ~ DeanB

[sombree]

Proof of concept using code from font_direct.c and disp_direct.c:

[wadehome]

Nice work sombree! If you happen to get ML fully running on your 80D, I'd be interested in working with you remotely to get it running on my 5Div if you were interested?

[OlRivrRat]

             @Sombree

       Looks as if You on to something Good ~ Keep it Rolling > Please & Thank You ~

                                                                      ORR ~ DeanB

[JosiahD]

Thanks to those of you that put work into this project I have an 80D and can't what to get ML on it I would offer to help but would not know what I am doing.

[a1ex]

Just cross-checking some older notes:

BITMAP_VRAM              0x41707000 0x002F7C00   3111936

1.449657   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018 ; overlay, 960x540 UYVY, see reply #251
1.449674   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E ; opacity, FF everywhere, 960x540 bytes
4.219496   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001785B ; overlay #2
4.219517   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00017071 ; opacity #2

=>

Code Select Expand


opacity #2: 01707100 - 017859FF
overlay #2: 01785B00 - 01882CFF
opacity #1: 01882E00 - 019016FF
overlay #1: 01901800 - 019FE9FF


Looks OK; bitmap overlay buffers are, indeed, in the BITMAP_VRAM region hardcoded in RscMgr.

IMG_VRAM1                0x7F422800 0x003F4800   4147200
IMG_VRAM2                0x7F817000 0x003F4800   4147200
IMG_VRAM3                0x7FC0B800 0x003F4800   4147200

3.137019   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x003F8170 ; image, 736x480 UYVY, 16px bar on the right

=> image buffer (in playback mode) at 0x3F817000 - 0x3F8C37FF.

Matches IMG_VRAM2. In LiveView I expect all these 3 buffers to be used (4 on some models).

[ Side note: the addresses from RscMgr logs are uncacheable (bit 0x40000000). That means, 0x7F422800 and 0x3F422800 refer to the same physical memory address. Reading and writing - from the main CPU - at the first address will bypass the CPU caches and will access the physical memory directly. Reading and writing - from the main CPU - at the second address will use the CPU cache. ]

This is going to be useful for locating image buffers in other cameras, without analyzing the entire RAM dump.

[Ant123]

When will all these buffers be supported in QEMU?

[a1ex]

When you will give me these three clones, pre-trained and ready to work

Trying to find the answer to an older question, regarding DISP_SetUpdateOSDVram on DIGIC 7. From 80D logs:

Code Select Expand


cat STARTUP.LOG | grep -a 'DISP_SetUpdateOSDVram(\|0xD2030108'
1.045569  GuiMainTas:fe44fae1:04:03: DISP_SetUpdateOSDVram(0x41882d00)(0)
1.236507     CtrlSrv:fe44fae1:04:03: DISP_SetUpdateOSDVram(0x419fea00)(1)
1.398338   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018
1.398355   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E
1.615709   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018
1.615729   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E
2.725351     CtrlSrv:fe44fae1:04:03: DISP_SetUpdateOSDVram(0x41882d00)(2)
2.725698   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001785B
2.725716   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00017071
3.037427   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x003F8170
3.058502     CtrlSrv:fe44fae1:04:03: DISP_SetUpdateOSDVram(0x419fea00)(3)
3.058836   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x00019018
3.058854   DispVCtrl:fe2085f1:fe2085e3:MMIO : [0xD2030108] <- 0x0001882E


In all of the 80D logs I've got, I could only find two arguments for DISP_SetUpdateOSDVram: 0x41882d00 and 0x419fea00. These appear to match the BMP (overlay) buffers. Their placement is a bit unusual - first we've got the opacity data, then the bitmap data, and the argument to DISP_SetUpdateOSDVram points right after these. It appears to be a descriptor of these image buffers:

xxd -e -s 0x1882d00 -l 0x2c 80D/RAM4.BIN
01882d00: 5652414d 41785b00 41707100 01000102  MARV.[xA.qpA....
01882d10: 000003c0 0000021c 41882d1c 4d454d50  .........-.APMEM
01882d20: 00000010 00000000 41707000           .........ppA

xxd -e -s 0x19fea00 -l 0x2c 80D/RAM4.BIN
019fea00: 5652414d 41901800 41882e00 01000102  MARV...A...A....
019fea10: 000003c0 0000021c 419fea1c 4d454d50  ...........APMEM
019fea20: 00000010 00000000 41707000           .........ppA

- 0x00: MARV (VRAM reversed)
- 0x04: pointer to bitmap data
- 0x08: pointer to opacity data (optional)
- 0x0C: flags?
- 0x10: xres (960)
- 0x14: yres (540)
- 0x18: pointer to some "permanent memory" structure?
- 0x1c: PMEM (identifier of "permanent memory" structure?)
- 0x20: ?
- 0x24: ?
- 0x28: pointer to BITMAP_VRAM area from RscMgr

The above structure appears to be valid on at least 5D4 and 77D (likely on all other DIGIC 6 and 7 models).

[Midnight Son]

So just how far do you think from getting ML on the 80D is at this point?

[Walter Schulz]

Top of page -> User Guide -> FAQ -> Troll questions section

[Nhmln]

So what's left to figure out to get everything running on the 80D?

[a1ex]

From the download page: somebody who has the camera and sufficient time, motivation and skill to complete the port. In other words, somebody willing and able to sit down and debug it. Don't look at me - I have more cameras than I can handle.

Long answers earlier on this page, earlier on this topic, earlier on other topics about new ports.

[Alucard]

From the download page: somebody who has the camera and sufficient time, motivation and skill to complete the port. In other words, somebody willing and able to sit down and debug it. Don't look at me - I have more cameras than I can handle.

Long answers earlier on this page, earlier on this topic, earlier on other topics about new ports.

I am willing to help, I have the camera in hand as a spare. Currently using the A7iii as my main, so I can spare some concern for the 80D. However my coding knowledge is very basic. I can help with debugging and testing the camera if it makes things faster for you guys. Would be nice to have the ML port but I don't mind without it either as I don't see myself going back to the 80D as the main, maybe a B cam. I can help until I get rid of the 80D. So if there is anyone who want my help, hit me up.

TO EVERYONE ASKING WHEN,
Stop being a pain in the a** to who ever is working on it. If you have knowledge in this or spare time to learn C# then do it yourself. Obviously you guys have the camera with you. So if you have so much free time to ask WHEN everyday, please just go and learn how to port it. there is a lot of support material on this forum. IT WILL BE AVAILABLE WHEN IT IS READY!
I am just trying to collect the useful information for the port here and half of the thread is filled with WHEN? please stop asking this. Obviously when it is ready you will see here and as it progresses you will see that here as well.

[a1ex]

Committed the Hello World code contributed by @names_are_hard (200D) and @chris_overseas (5D4) - details.

Does it work on 80D?

[sombree]

Yes, it works
With default "Hello, World!" text position:

[a1ex]

Got it. The 200D also has a 960x540 bitmap buffer, but its active area (720x480) is located at the top left. There, the message is aligned properly.

On 80D, the active area (720x480) is centered in the 960x540 bitmap buffer.

TODO: can the active area position be found in VRAM structures or register configuration, without hardcoding model-specific offsets?

[reddeercity]

Great news !
I have a chance to get a 80D , good price ($675.00 CND)  60p 1080p  h264 , nice
and with the development going nicely here , it's getting to top my list of cam to get .
I'm reading on some site that 80D has 80MB's write speed on the SD Card , is this true ?
https://www.cameramemoryspeed.com/reviews/sd-cards/lexar-professional-2000x-uhs-ii-32gb-sdhc-memory-card/


Seeing EOS R @ 179MB/s does the 80D have the same interface but just limited by canon firmware ?
If the 80D has the potential of the EOS R write speed (over clocking maybe ) then I would get a 80D to help out .

Edit: seems 80d has SDR104 bus mode , so maybe it does write at that speed .
I'm getting more interested .

[Greg]

Seeing EOS R @ 179MB/s does the 80D have the same interface but just limited by canon firmware ?

I doubt that 80D has a UHS-II connector.

[ddelreal]

Dang, thought the 80D would be the one to get the April 1st announcement.

[a1ex]

Why? All DIGIC 6/7/8 models got the announcement, if you read closely.

The best part - the above progress applies to ALL other DIGIC 6/7/8 models! At least the GUI code is going to work with little or no changes!

I just happened to pick the smallest / cheapest / most difficult to port model for myself. The M50 also has bits from PowerShot firmware, which makes it slightly different from others (but still closer to 80D & co. than any other DIGIC 5 firmware).

On 80D and maybe other D6 models (only confirmed the 5DS R so far, but not the 5D4), the only change to the GUI side would be fixing the alignment, i.e. declaring an offset. Screen buffer size is 960x540, physical screen size is 720x480, so... you do the math.

[Danne]

M50. Already ported? Wow.

[KelvinK]

M50. Already ported? Wow.

magiclantern-fishy.2019Apr01.M50101.zip