Canon 80D

Started by ariznaf, June 02, 2016, 09:27:03 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

a1ex

Quote from: k!r+ on July 05, 2018, 03:29:57 AM
Hopefully these photo's will help with something.

Very nice pictures, thanks!

If anyone identifies some circuits, you are welcome to edit the Datasheets page. I'll start with the most obvious ones:

- AD80334 BBCZ (ADTG, likely custom chip designed for Canon by Analog Devices)
- Elpida B8164B4PR (8Gb SDRAM; this camera has 1GB RAM)
- F74965A: MPU, same as 5D3

Ant123

According to this page
QuoteAD80334BBCZ
4 CHANNEL, 14 bit , 50MSPS AFETG+PPP

80D sensor has no ADC onboard?

eduperez

Quote from: k!r+ on July 05, 2018, 03:29:57 AM
Hopefully these photo's will help with something.

Congrats on these photos, they are very clear.

I'm surprised to see that there is a button cell there, but it cannot be changed by the user...

Faucheur

Quote from: eduperez on July 06, 2018, 09:49:32 AM
...

I'm surprised to see that there is a button cell there, but it cannot be changed by the user...

The MS614 is a rechargeable button cell, probably there only for timekeeping when there is no battery in the camera.
Since it's rechargeable, no need for user replacement...

eduperez

Quote from: Faucheur on July 16, 2018, 10:43:18 AM
The MS614 is a rechargeable button cell, probably there only for timekeeping when there is no battery in the camera.
Since it's rechargeable, no need for user replacement...

Oh, I did not know that, thanks!

taudris

Quote from: Ant123 on July 05, 2018, 08:46:26 PM
According to this page
Quote
AD80334BBCZ
4 CHANNEL, 14 bit , 50MSPS AFETG+PPP
80D sensor has no ADC onboard?

50 MSPS is too slow for the 80D's sensor and capabilities, so it must be used for something else. 7 FPS at 25.8 MP (this is including the unexposed sensor area) is at least 181 MSPS, plus the fact that readout happens between exposures (the fastest this can be is the sync speed of 1/250sec, which at 7 FPS consumes 28ms per second).

Just a guess, but that chip could be used for the metering sensor or AF tracking.

JosiahD

I know you guys are working hard thanks very much.
Is their a way can try what you have done already?
Will it support FTP to a server?
let me know if I can help.
Thank you 8)

a1ex

QuoteIs their a way can try what you have done already?

Of course, just read previous posts (in particular, the April 1st "blind edition"). You will need to enable the boot flag.

Quote
Will it support FTP to a server?

Doable. None of my cameras have Wi-Fi, but Maqs documented the network interface on 6D:
http://magiclantern.wikia.com/wiki/6D/Networking

Feel free to put it to good use.

iAndrewT

Quote from: a1ex on September 07, 2017, 10:00:08 PM
Disabling the boot flag is easy - I can prepare a FIR for that, if needed.

Hi,

Could we get the boot flag disable FIR please? I need to send my 80D in for service (broken autofocus) and would like my camera to be as factory as possible when I send it in (it's under warranty).

Also, what kind of reading material should I be looking for to learn ARM development and get an idea of what's going on with the development here? I've got an unused RPi 3 and all my computers currently run macOS.

a1ex

Compile the recovery branch with CONFIG_BOOT_BOOTFLAG = y, from platform/portable.000, after applying the following diff:

--- a/src/reboot.c
+++ b/src/reboot.c

@@ -1233,8 +1233,8 @@
     if (set_bootflag && set_flag_i)
     {
         /* enable the boot flag */
-        printf(" - Enabling boot flag...\n");
-        set_bootflag(1, -1);
+        printf(" - Disabling boot flag...\n");
+        set_bootflag(1, 0);
     }
}


If you prefer a ready-to-run version: BDIS_80D.FIR (tested only in QEMU).

Caveat: if things go wrong, I may not be able to run further diagnostics; disabling the boot flag removes the ability to run user code on the camera.

There are links to reading material in this very topic.

iAndrewT

It worked! I'll do some research on the ARM development process over the next few weeks while my camera's in for service. I've also got a 750D so hopefully I can make myself useful for that camera too :D

a1ex

Great; they are both very similar, so a low-hanging fruit would be porting the current 80D code to 750D. Expecting it to work out of the box after adjusting the stubs (pretty much pattern matching between the two ROMs). This stage (startup code + simple experiments) can be debugged in the emulator.

Dj4n90

Hey everyone!

We've managed to get the emulation a bit further, to the point which some keys are being handled. The only ones which have visible actions are those which trigger shutdown (B and C). The other keys do appear to send MPU spells and some receive spells, however we're not able to see the effect they're having due to the lack of the GUI.

We've also run into a number of errors, which we have questions about:

ERROR [RTC] RTC_REGISTER_TIME_CORRECT ERROR 0x0 -> 0x9e
ERROR [RTC] !! RTC CHECK ERROR !!


Relevant Debug
[MPU] Received: 06 05 0e 4b fe 00  (unknown - unnamed)
[     Startup:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 1/2)
[     Startup:fe19b2ec ] CreateStateObject => 83bab0 at fe19b2ec
[     Startup:fe552ae3 ] (00:01) [RTC] RTC_InitializeRTCDriver Fin
[      RTCMgr:fe552975 ] RTCMgrState: (0) --0--> (0)      fe19b62b (x=59a0a0 z=83badc t=2c)
[      RTCMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 0/1)
[      RTCMgr:fe534253 ] register_interrupt(null, 0x117, 0xfe5340b5, 0x0)
[MPU] Sending : 28 26 02 07 0e 00 00 00 00 00 00 00 00 00 00 03 00 00 03 07 07 11 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (PROP_CFN_3)
[      RTCMgr:fe533629 ] (00:01) [PM] Disable (ID = 3, cnt = 1/2)
[      RTCMgr:fe1f79dd ] (00:06) [RTC] RTC_REGISTER_TIME_CORRECT ERROR 0x0 -> 0x9e
[      RTCMgr:fe534253 ] register_interrupt(null, 0x117, 0xfe5340b5, 0x0)
[      RTCMgr:fe1f7afd ] (00:06) [RTC] !! RTC CHECK ERROR !!

[      RTCMgr:fe1f7afd ] (00:06) [RTC] !! RTC CHECK ERROR !!

[      RTCMgr:fe534253 ] register_interrupt(null, 0x117, 0xfe5340b5, 0x0)
[      RTCMgr:fe19b939 ] register_func('RTC_Prohibit', fe19ccc3, 0)
[      RTCMgr:fe19b941 ] register_func('RTC_Permit', fe19ccbf, 0)
[      RTCMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 0/1)
[MPU] Sending : 06 05 03 37 00 00  (PROP_MIRROR_DOWN_IN_MOVIE_MODE)
[      RTCMgr:fe533629 ] (00:01) [PM] Disable (ID = 3, cnt = 1/2)
[      RTCMgr:fe19b949 ] register_func('RTC_CheckCharge', fe19b351, 0)
[      RTCMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 0/1)
[      RTCMgr:fe19b951 ] register_func('RTC_WriteCorrectValue', fe19b337, 0)
[MPU] Sending : 0a 08 03 2f 00 40 00 00 00 00  (PROP_SPECIAL_OPTION)
[      RTCMgr:fe533629 ] (00:01) [PM] Disable (ID = 3, cnt = 1/2)
[      RTCMgr:fe19b959 ] register_func('RTC_ReadCorrectValue', fe19b321, 0)
[      RTCMgr:fe19b961 ] register_func('RTC_SaveCorrectValue', fe19b2ff, 0)
[      RTCMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 0/1)


I've noticed that this error also appears in the 'Help I've bricked my camera!' error 70 posts on the forum which is making me question its actual involvement with the RTC chip. Is this an error with emulating the RTC chip or is it caused by something else breaking?
We've tried setting 'rtc_time_correct' to different values (including 0x9E) in model_list.c and through the RTC_WriteCorrectValue function in the shell, however we haven't seen anything change.

ASSERT : ./System/MariusAPI/OmarSysInfo.c, Task = RTCMgr, Line 73

Relevant Debug
[     Startup:fe14c196 ] CreateStateObject => 84a928 at fe14c196
[     Startup:fe465c77 ] task_create(ShootPreDevelop, prio=16, stack=8000, entry=fe465bdb, arg=84a954)
[ShootPreDevelop:fe14382f ] SPSState: (0) --0--> (1)      fe14c1b1 (x=84a8f8 z=0 t=0)
[ShootPreDevelop:fe14c1d1 ] (95:03) Init
[     Startup:fe0dc079 ] (00:05) [SEQ] seqEventDispatch (Startup, 3)
[      NFCMgr:fe63d8bb ] NFCMgrState: (0) --0--> (0)      fe718c5f (x=4749f0 z=0 t=0)
[     PropMgr:fe484ac9 ] PropState: (0) --3--> (0)      fe3d8305 (x=46f8f4 z=84ab38 t=14)
[      NFCMgr:fe63d8bb ] NFCMgrState: (0) --3--> (0)      fe717869 (x=4749f0 z=84ab7c t=8)
[      NFCMgr:fe71791b ] (4d:03)  PropChange:PROP_SPECIAL_OPTION ->init (0x4000)
[     PropMgr:fe484ac9 ] PropState: (0) --4--> (0)      fe3d855b (x=46f8f4 z=84ab58 t=0)
[      NFCMgr:fe63d8bb ] NFCMgrState: (0) --1--> (1)      fe71aa49 (x=4749f0 z=0 t=0)
[      NFCMgr:fe71aa53 ] register_func('nfcir', fe71a9df, 0)
[      NFCMgr:fe71aa5b ] register_func('nfciw', fe71a963, 0)
[      NFCMgr:fe71aa63 ] register_func('nfci2cchk', fe71a84f, 0)
[      NFCMgr:fe71aa6b ] register_func('nfcsread', fe71a7d9, 0)
[      NFCMgr:fe71aa73 ] register_func('nfcswrite', fe71a779, 0)
[      NFCMgr:fe71aa7b ] register_func('nfcsstatus', fe71a745, 0)
[      NFCMgr:fe71aa83 ] register_func('nfcswreg', fe71a285, 0)
[      NFCMgr:fe71aa8b ] register_func('nfcswriteb', fe71a225, 0)
[      NFCMgr:fe71aa93 ] register_func('nfcswrites', fe71a1bb, 0)
[      NFCMgr:fe71aa9b ] register_func('nfcswuriaar', fe71a115, 0)
[      NFCMgr:fe71aaa3 ] register_func('nfcswinitset', fe71a067, 0)
[      NFCMgr:fe71aaab ] register_func('nfcswempty', fe719fff, 0)
[      NFCMgr:fe71aab3 ] register_func('nfcchkWtime', fe719fbb, 0)
[      NFCMgr:fe71aabb ] register_func('nfcsetnirq', fe719a1d, 0)
[      NFCMgr:fe71aac3 ] register_func('nfcterminate', fe719a05, 0)
[      NFCMgr:fe71aacb ] register_func('nfcsetcamstate', fe7199db, 0)
[      NFCMgr:fe71aad3 ] register_func('nfccdread', fe719991, 0)
[      NFCMgr:fe71aadb ] register_func('nfccdwrite', fe7198ab, 0)
[      NFCMgr:fe71aae3 ] register_func('nfcresetcard', fe71988d, 0)
[      NFCMgr:fe71aaeb ] register_func('nfcsetwtime', fe719481, 0)
[      NFCMgr:fe71aaf3 ] register_func('nfcfreemsg', fe719465, 0)
[      NFCMgr:fe71aafb ] register_func('nfcswreg', fe71936d, 0)
[      NFCMgr:fe71ab03 ] register_func('nfcsrreg', fe719285, 0)
[      NFCMgr:fe71ab0b ] register_func('nfcchkmod', fe718e73, 0)
[      NFCMgr:fe71dadd ] register_func('nfctestferam', fe71da99, 0)
[      NFCMgr:fe533629 ] (00:01) [PM] Disable (ID = 77, cnt = 1/3)
[      NFCMgr:fe71ab37 ] (4d:03)  nfcmgrstate_Initialize:NewsDet_R Lo
[      NFCMgr:fe71aefd ] register_interrupt(NFCDET, 0x9a, 0xfe717fbd, 0x4749f0)
[      NFCMgr:fe168615 ] (00:01) [I2C] I2CD_Initialize
[      NFCMgr:fe16862f ] register_interrupt(I2C0_TIRQ, 0xdd, 0xfe167f29, 0x0)
[      NFCMgr:fe16863b ] register_interrupt(I2C0_SIRQ, 0xfd, 0xfe167fc7, 0x0)
[      NFCMgr:fe168653 ] register_interrupt(I2C1_TIRQ, 0x10d, 0xfe167f29, 0x1)
[      NFCMgr:fe168661 ] register_interrupt(I2C1_SIRQ, 0x12d, 0xfe167fc7, 0x1)
[      NFCMgr:fe168683 ] (00:01) [I2C] I2CD_Com mode[3], devAddr[0xA8]
[      NFCMgr:fe167ec7 ] (00:01) [I2C] CH1 bus ready
[      NFCMgr:fe167ec7 ] (00:01) [I2C] CH1 bus ready
[      NFCMgr:fe168465 ] (00:01) [I2C] read start condition
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=3c)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    65:   486.400 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80040033 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=3d)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    66:   486.400 [PRP] PropertyList:12 Current:4
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=44)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    83:   627.456 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80030075 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=45)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    84:   627.456 [PRP] PropertyList:23 Current:19
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=4a)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    89:   636.160 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80010006 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=4b)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
    90:   636.160 [PRP] PropertyList:40 Current:34
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=57)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   102:   652.288 ERROR [RTC] RTC_REGISTER_TIME_CORRECT ERROR 0x0 -> 0x9e
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=58)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   103:   592.128 ERROR [RTC] !! RTC CHECK ERROR !!

[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=59)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   104:   612.096 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80010007 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=5a)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   105:   612.096 [PRP] PropertyList:25 Current:28
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=5d)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   108:   636.160 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80010006 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=5e)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   109:   638.464 [PRP] PropertyList:40 Current:34
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=7a)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   137:   717.056 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80040033 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=7b)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   138:   717.056 [PRP] PropertyList:12 Current:4
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=c1)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   208:   829.184 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80030075 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=c2)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   209:   829.184 [PRP] PropertyList:23 Current:19
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=c3)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   210:   829.952 [PRP] ERROR ILLEGAL PARAM SIZE ID = 0x80010006 L:2483
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=c4)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   211:   829.952 [PRP] PropertyList:40 Current:34
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=130)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   320:  1006.592 [DISP] ERROR BackLightCtrl:0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=134)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   324:  1009.152 [MC] PROP_LCD_OFFON_BUTTON : 2
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=17f)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   399:  1205.760 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 0 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=180)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   400:  1210.880 [RSC] ERROR GetMargineSizeOfMovie NOT Exist Size or FrameRate K347 0 0 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=181)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   401:  1213.696 [RSC] ERROR GetEstimatedSizeOfMovieThumb NOT Exist Size or FrameRate K347 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=182)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/4)
   402:  1214.208 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 0 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/3)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=183)
[      NFCMgr:fe1684bd ] (00:03) CH1 read TCMP wait fail [0x09]
[      NFCMgr:fe168601 ] (00:03) [I2C] read data err
[      NFCMgr:fe168709 ] (00:01) [I2C] CH1 Init
[      NFCMgr:fe553eb5 ] (00:06) [I2C] I2C_Read[CH1] : 0xa8,0x00,0x01,0x00 (Task : NFCMgr)
[      NFCMgr:fe716a6f ] (4d:03)  nfcmgrstate_CeInitialize:ce_init 4194307
[      NFCMgr:fe71af13 ] (4d:03)  nfcmgrstate_Initialize ce_init
[      NFCMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 77, cnt = 0/2)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   403:  1214.976 [RSC] ERROR GetMargineSizeOfMovie NOT Exist Size or FrameRate K347 0 0 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=184)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   404:  1215.744 [RSC] ERROR GetEstimatedSizeOfMovieThumb NOT Exist Size or FrameRate K347 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=185)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   405:  1216.768 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 0 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=1b8)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   456:  1599.232 ERROR [I2C] I2C_Read[CH1] : 0xa8,0x00,0x01,0x00 (Task : NFCMgr)
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      RTCMgr:fe1f542b ] [ASSERT] 0 at ./System/MariusAPI/OmarSysInfo.c:73, fe1f542f
ASSERT : ./System/MariusAPI/OmarSysInfo.c, Task = RTCMgr, Line 73
[      RTCMgr:fe0d3f51 ] (8b:06) ASSERT : ./System/MariusAPI/OmarSysInfo.c, Task = RTCMgr
[      RTCMgr:fe0d3f5d ] (8b:06) ASSERT : Line 73
[      RTCMgr:fe0d3f69 ] (8b:06) ASSERT : 0
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=1bb)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   459: 11311.616 [STARTUP] ERROR ASSERT : ./System/MariusAPI/OmarSysInfo.c, Task = RTCMgr
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=1bc)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   460: 11312.128 [STARTUP] ERROR ASSERT : Line 73
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --2--> (0)      1a01 (x=79e4d0 z=0 t=1bd)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)
   461: 11312.128 [STARTUP] ERROR ASSERT : 0
[      DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 1/2)
[      DbgMgr:800033c7 ] DMState: (0) --14--> (0)      1c63 (x=79e4d0 z=84b0c4 t=0)
[     PropMgr:fe484ac9 ] PropState: (0) --6--> (0)      fe3d8647 (x=46f8f4 z=84b08c t=10)
[     PropMgr:fe0d44cb ] (8b:16) startupErrorRequestChangeCBR (0x1d)
[     PropMgr:fe0d4501 ] (8b:16) startupErrorRequestChangeCBR : ErrorSend (101, ABORT)
[     PropMgr:fe484ac9 ] PropState: (0) --6--> (0)      fe3d8647 (x=46f8f4 z=84b0dc t=e)
[     PropMgr:fe533629 ] (00:01) [PM] Disable (ID = 3, cnt = 1/3)
[MPU] Received: 08 06 03 03 65 01 00 00  (unknown - unnamed)
[    PowerMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 3, cnt = 0/2)
[      DbgMgr:fe533629 ] (00:01) [PM] Disable (ID = 18, cnt = 2/3)


This error is where the emulator is stopping. We are currently unsure about what is causing it and how to fix it. We are investigating the NFCMgr as it appears a few times just before the assert, however we aren't certain about its involvement.
We've tried 'patching' it like the EstimatedSize example in the HACKING.rst guide, however all the stack values we tried led to no change.

Any help you can provide would be greatly appreciated!

diogosilvalmeida

Hello there!

I am a 80D owner, how can I help with the magic lantern development? I'm not really into programming nowadays, but if you tell me what to do... I hope I can help in the development...

So...What can I do to help?






a1ex

Did some major refactoring on the digic6-dumper branch to make it easier to port ML on newer models. The code seems to be working in QEMU, but I'd still want a 80D owner to compile the latest code and make sure it's still working on the hardware.

There are no new features, but the codebase was confirmed to work on DIGIC 7 as well.

edit: confirmed by Chellyandruu, thanks.

OlRivrRat

                     @ Alex

"but I'd still want a 80D owner to compile the latest code and make sure it's still working on the hardware."

           As always, Thanks Much for All Your Efforts. It might be helpful to supply some info as to where

that "latest code" might be found .
ORR~DeanB  ~~  80D-ML  &  SL1+ML  &  5D2+ML  &  5DC+ML  &  70D+ML(AliveAgain)

maiadaharfendul

hi  everyone, i'm a new user of this forum  :)
I had own an old 550d with magic lantern, and It worked like a charm :)
now I have a eos 80d and I follow magic lantern development  with so many interest.
I have no skills of programming, but i can offer me (and my camera) as beta tester if requested :D

ricflair4life

Dear God, please provide these men the time and interest to develop this magic lantern to work on my 80d. Quickly.... in Jesus's name, amen.


critix

Hi.
Can you give me dump for this cam?
Thanks a lot...
Canon 1300D, 500D, EOS M, EOS M2

OlRivrRat

                       @Critix

           Yes > Provide EMail Address ~

                                 ORR ~ DeanB
ORR~DeanB  ~~  80D-ML  &  SL1+ML  &  5D2+ML  &  5DC+ML  &  70D+ML(AliveAgain)

burnersk

It happened somehow that I now own an 80D. First I want to use the camera as it was intended to be (without ML). However to support the porting of ML to 80D, I would like to offer some help: supply patches and do some testing.

This would be my first ML "project", and I would like to address some question that may (most possible) have popped up somewhere but I want to double check if the previous made answers would also apply to the 80D system (e.g. new bootloader, signature check algo, etc.).

First some "facts" I have discovered using ML for my old EOS 550D.


  • You have to have the matching ML ".fir" ("boot-flag" [developer mode] firmware update/patch) for the installed original Canon firmware
  • Once the developer mode is activated on the camera, the ML flavoured SD card can be inserted (Canon original with ML loads) or a non-ML flavoured SD card can be inserted (Canon original without ML loads)
  • When a Canon original firmware update is available, the update will disable the developer mode and another (matiching) ML ".fir" firmware patch have to be applied.
  • Having register access can also mean to be able to destroy (not only brick) the camera.
  • There are "soft" bricks, which can be "solved" by turning off the camera and ejecting the SD card.
  • But there are also "hard" bricks, which - in some rare cases - may can be fixed but requires expert knowledge with the board and bootloader proces. Mostly it will turn out as the camera is expensive paperweight

That being said (and maybe corrected by you)...


  • What is the current ML firmware version level - if there is any - to unlock the development mode and load code/ML from SD card?
  • "Recently", Canon released the 80D original firmware version 1.0.2, which I am planning to upgrade to if it isn't already installed on the camera. Is 1.0.2 supported by the current "implementation" (I heard the "debug screen" and "dump screen" works)?
  • Is the "main work" to find the memory addresses and put them into constants or do every/this camera requires "actual code" (mostly) to become a alpha version?

a1ex

Quote from: burnersk on September 19, 2018, 11:21:47 AM
When a Canon original firmware update is available, the update will disable the developer mode and another (matiching) ML ".fir" firmware patch have to be applied.
That didn't happen on 550D and other cameras I've tested (newest one being 700D).

Quote
But there are also "hard" bricks, which - in some rare cases - may can be fixed but requires expert knowledge with the board and bootloader proces. Mostly it will turn out as the camera is expensive paperweight

The biggest risk is reflashing the ROM by mistake. Unfortunately, Canon code does that at every shutdown, and ML is able to write anywhere in the memory, so it's way too easy to insert garbage there (this is by design - DryOS does not offer any kind of memory isolation between tasks). Fortunately, that shouldn't touch the code or the bootloader, so it should be recoverable (i.e. you should still be able to dump the altered ROM, and we should be able to run it in QEMU, compare it with a good ROM and reflash it with correct contents). This issue happened at some point on 5D3, but didn't have to reflash or resolder anything; just patched the affected bytes in RAM, and at the next shutdown, the correct values were written back into ROM.

Some settings are sent over to the MPU (secondary CPU) and stored in its own non-volatile memory. These situations should also be recoverable, although I've encountered one case where I was afraid to go further, as the MPU is the one that powers off the camera: I was messing up with the auto power off setting on 5D3. After setting it to 10 seconds, the camera seemed to work, it turned off by itself after 10 seconds, as expected, but then it did not turn back on. Not sure what exactly it was; it came on by itself after swapping a few batteries.

Quote
What is the current ML firmware version level - if there is any - to unlock the development mode and load code/ML from SD card?

The development happens on the digic6-dumper branch, so... just look at the file names.

Quote
Is the "main work" to find the memory addresses and put them into constants or do every/this camera requires "actual code" (mostly) to become a alpha version?

That's the easy part, doable by anyone who's not afraid of CTRL and F.

One of the "harder" tasks is figuring out how to print things on the display. On EOS, the only half-successful experiment I'm aware of is this one, for 5DS. This part is best done with the camera in one's hands, although I'm (still) trying to bring the emulation far enough to initialize the display, so I could figure it out from there. On earlier models, writing into the display buffer is enough to make things appear on the screen; DIGIC 6 and newer models apparently use some sort of Takumi GPU (look it up on CHDK forum; they already figured it out for compacts).

Another "harder" task is logging all MMIO reads and writes performed by the firmware. This one can be debugged in QEMU, but it's not exactly trivial.

And yet another "harder" task is figuring out how to patch code bits in the ROM. On earlier models, we use the so-called "cache hacks", but these are no longer available on D6. There are some debug registers that might be usable for the same purpose, although Ant123 already tried them without much success.

Then, there comes the easy but time-consuming part: enabling ML features, testing what works and what not, and fixing stuff in a way that doesn't break earlier models.

Right now you can experiment with simple things in C, for example an intervalometer. To take a picture:

call("Release");


Some fun stuff: found dual pixel raw streams in LiveView on both 70D and 5D4.

burnersk

Thanks for the information  :)

Quote from: a1ex on September 19, 2018, 04:21:05 PM
That didn't happen on 550D and other cameras I've tested (newest one being 700D).
Oh, I heard but never checked it myself. So I will delete that now from my own personal heap  ;)

Quote from: a1ex on September 19, 2018, 04:21:05 PMRight now you can experiment with simple things in C, for example an intervalometer. To take a picture:

call("Release");

I guess, I will start with the most generic thing: Have a blank screen drawn and change the background color. Next up is your example and I will start figuring out, how the system actually works. After that, I hopefully be more helpful with supplying patches for the 80D port.

a1ex

Quote from: burnersk on September 19, 2018, 08:19:24 PM
I guess, I will start with the most generic thing: Have a blank screen drawn and change the background color. Next up is your example [...]

I suggest starting with something that is known to work. Drawing on the screen from code running alongside main firmware (i.e. after the bootloader stage) is not working yet. For debugging, you've only got LED blinking and file I/O.

Be sure to check the blind edition, in particular its source code.