DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)

[a1ex]

Module error: right, needs to be fixed somehow in the Makefiles.

xor_chk: reproduced on the Mac VM, will fix. No warnings on my main system.

gui.h: just create an empty file for now.

QEMU error: when in doubt, copy the commands from the guide. You've got an extra space that's not present in the READMEs (at least I couldn't find it). I'm hijacking an option from vanilla QEMU, as their command line parser doesn't seem the easiest thing to figure out.

[aprofiti]

QEMU error: when in doubt, copy the commands from the guide. You've got an extra space that's not present in the READMEs (at least I couldn't find it). I'm hijacking an option from vanilla QEMU, as their command line parser doesn't seem the easiest thing to figure out.

Yes, put a space when was't needed. Thank You a1ex.

How is debugging process of stubs in qemu minded?
Do I need to call each stubs by modified test code in minimal-d78.c and check for their behaviour using return value or expected outcome?

Currently I can see in qemu only the blinking red icon on bottom right of the screen, I imagine is led_blink() test.

[a1ex]

Sounds good; it should also save a log though. Either printf-based debugging (qprintf, compile with CONFIG_QEMU=y), or step by step debugging in gdb, or something like that. Also run with -d debugmsg and possibly other debugging options. No short answer, I'm afraid (I'm currently debugging a quirk in the logging code for about a week and still can't manage to pass the tests).

[aprofiti]

I'm not sure it's good... no log is saved to virtual SD.

Led icon is blinking too much fast and by trying to modify the timings (ex. msleep related to off period) in led_blink() doesn't seems to matter.
Screen looks gray like when booted with bootflag disabled, but on top left there is a broken black line.

In console I get no debug messages when bootflag is enabled but this: (compiled with make install_qemu ML_MODULES= from platform/77D)

Code: [Select]

./run_canon_fw.sh 77D,firmware=boot=1 -d debugmsg

DebugMsg=0xDF006E6C (from GDB script)
00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F0FFFFFF: eos.rom1
F1000000 - F1FFFFFF: eos.rom1_mirror
F2000000 - F2FFFFFF: eos.rom1_mirror
F3000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F4FFFFFF: eos.rom1_mirror
F5000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F6FFFFFF: eos.rom1_mirror
F7000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F8FFFFFF: eos.rom1_mirror
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling code execution logging.
[EOS] loading './77D/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './77D/ROM1.BIN' to 0xF0000000-0xF0FFFFFF
[MPU] FIXME: using generic MPU spells for 77D.
[MPU] FIXME: no MPU button codes for 77D.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E00075E0: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0007606: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E0007632: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0007628: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0007632: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004AC6: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004AC6: MCR p15, ...          : CACHEMAINT x3 (omitted)
[CPU0] E0004AC6: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
<<<<< Musa(PU0) Boot Ver 0.21 >>>>>
[CPU0] E0007672: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU1] E00075E0: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E0004BB2: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0007606: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU1] E0007632: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU1] E0007628: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0007632: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004AC6: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004AC6: MCR p15, ...          : CACHEMAINT x3 (omitted)
[CPU1] E0004AC6: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU1] E0004AEA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU1] E0004BA0: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0004AEA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004AFA: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU1] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004880
[CPU1] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU1] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x1       
[CPU1] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU1] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU1] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU1] E00076D8: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU1] E00076D8: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E00076D8: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU1] E00076F0: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU1] E00076F0: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU1] E00076FC: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU1] E00076FC: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU1] E00076FC: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU1] E00076FC: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU1] E000771C: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU1] E000771C: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU1] E0004A1A: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C5187D
[CPU1] E0004A1A: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5107D
[CPU0] E0004AEA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004AEA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004AFA: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E00076D8: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E00076D8: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E00076D8: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E00076F0: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E00076F0: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E00076FC: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E00076FC: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E00076FC: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E00076FC: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000771C: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000771C: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004940: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
Boot[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC6000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC2000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
Load
SLOT_A LOAD OK.
Open file for read : AUTOEXEC.BIN
File size : 0xA0
Now jump to AUTOEXEC.BIN(0x00800000)!!

I should try to put some debug messages (probably qprintf because not sure how to set gdb) to understand what code is executed, but I'm short in time now so will try in next days.

[a1ex]

If nothing is happening after autoexec.bin... then it's not booting. There should be plenty of debug messages from Canon. Also, delays are emulated fairly well (not exactly real-time, but close). If changing the msleep arguments do not affect the delays you see on the screen, then... you may be running some other code. To make sure you are running the code you are editing, write some nonsense near the msleeps - you should get a compile error. Otherwise, look in the Makefiles.

By default, on 77D, the code on the main repository runs the LED blinking test from reboot-dumper.c. Make sure you have changed that in Makefiles to match 200D.

For early boot debugging, compile with CONFIG_QEMU=y (after make clean) and I'd expect it to print at least something.

[aprofiti]

If nothing is happening after autoexec.bin... then it's not booting. There should be plenty of debug messages from Canon.

By default, on 77D, the code on the main repository runs the LED blinking test from reboot-dumper.c. Make sure you have changed that in Makefiles to match 200D.

Forgot about adapt makefile to this commit...

So I started by changing Makefile to this:

Code: [Select]

# 77D 1.0.2

CANON_NAME_FIR  = 5D300133.FIR
FIRMWARE_ID     = 0x80000408
UPDATE_NAME_FIR = LOG_77D.FIR

# Shrink Canon's malloc heap by changing its end address
#          ("meminfo -m" in drysh)    ("memmap" in drysh)
# Default: 0x000e0fa8 - 0x001f5658, 0x000e0fa0 - 0x001f5928 (total size 0x001146b0 ?)
# Patched: 0x000e0fa8 - 0x001b5658, 0x000e0fa0 - 0x001b5928 ( reserved for ML)
# (TO BE CHECKED)
ROMBASEADDR     = 0xE0040000
RESTARTSTART    = 0x001B5700

# Cortex A9, binaries loaded as Thumb
CFLAG_USER = -mthumb -march=armv7-a -mlong-calls

# these should be removed when porting starts
ML_SRC_PROFILE  = minimal
ML_MINIMAL_OBJ  = minimal-d678.o
ML_SRC_EXTRA_OBJS += log-d678.o stdio.o

# FIXME: should be boot-d6.o
ML_BOOT_OBJ = boot-d78.o
Used qemu and drysh to retrieve values for memory configuration, not sure if reserved space is enough and if rombaseaddr is correct...

At this point to make it compile I had to first find these constants by pattern matching with 200D:

Code: [Select]

/*
 *  77D 1.0.2 consts
 */

#define CARD_LED_ADDRESS            0xD208016C
#define LEDON                       0x20D0002
#define LEDOFF                      0x20C0003

#define HIJACK_FIXBR_DCACHE_CLN_1   0xe0040058   /* first call to dcache_clean, before cstart */
#define HIJACK_FIXBR_ICACHE_INV_1   0xe0040062   /* first call to icache_invalidate, before cstart */
#define HIJACK_FIXBR_DCACHE_CLN_2   0xe0040090   /* second call to dcache_clean, before cstart */
#define HIJACK_FIXBR_ICACHE_INV_2   0xe004009a   /* second call to icache_invalidate, before cstart */
#define HIJACK_INSTR_BL_CSTART      0xe00400b0   /* easier to fix up here */
#define HIJACK_INSTR_HEAP_SIZE      0xe00401c0   /* easier to patch the size; start address is computed */
#define HIJACK_FIXBR_BZERO32        0xe004013a   /* called from cstart */
#define HIJACK_FIXBR_CREATE_ITASK   0xe004019c   /* called from cstart */
#define HIJACK_INSTR_MY_ITASK       0xe00401cc   /* address of init_task passed to create_init_task */

Add more stubs to this list:

Code: [Select]

NSTUB(0xe0152eb1,  cli_spin_lock)          /* used in AllocateMemory/FreeMemory and others */

// Taken from 200d to make it compile.
NSTUB(    0x4030,  pre_isr_hook)  //Not Good
NSTUB(    0x4034,  post_isr_hook)  //Not Good
NSTUB(   0x6CC14,  isr_table_param)  //Not Good
NSTUB(0xDF007B59, _AllocateMemory)  //Not Good - Maybe 0xDF007E58
Did't figured out yet how to find isr related stubs from interrupt Handler.... Any Hints for me?

Now last thing to figure out was signature of the firmware; started by copying the one from 200D and then changed to this:

Code: [Select]

#define SIG_200D_101 0xf72c729a // from E0040000
#define SIG_77D_100  0x6dd89c83 // from e0040000
Which come to my surprise from Qemu: (wasn't reaching this point without the faked value)

Code: [Select]

Boot[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC6000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC2000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
Load
SLOT_A LOAD OK.
Open file for read : AUTOEXEC.BIN
File size : 0x6D20
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[boot] firmware signature: 0x6dd89c83 (1842912387)
                 expected: 0xf72c729a (-148082022)
            computed from: 0xe0040000 (-536608768)

Which ended in what is like make emulation a step ahead:

Code: [Select]

./run_canon_fw.sh 77D,firmware=boot=1 -d debugmsg

DebugMsg=0xDF006E6C (from GDB script)
00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F0FFFFFF: eos.rom1
F1000000 - F1FFFFFF: eos.rom1_mirror
F2000000 - F2FFFFFF: eos.rom1_mirror
F3000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F4FFFFFF: eos.rom1_mirror
F5000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F6FFFFFF: eos.rom1_mirror
F7000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F8FFFFFF: eos.rom1_mirror
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling code execution logging.
[EOS] loading './77D/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './77D/ROM1.BIN' to 0xF0000000-0xF0FFFFFF
[MPU] FIXME: using generic MPU spells for 77D.
[MPU] FIXME: no MPU button codes for 77D.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E00075E0: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0007606: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E0007632: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0007628: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0007632: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004AC6: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004AC6: MCR p15, ...          : CACHEMAINT x3 (omitted)
[CPU0] E0004AC6: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
<<<<< Musa(PU0) Boot Ver 0.21 >>>>>
[CPU0] E0007672: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU1] E00075E0: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E0004BB2: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0007606: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU1] E0007632: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU1] E0007628: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0007632: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004AC6: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004AC6: MCR p15, ...          : CACHEMAINT x3 (omitted)
[CPU1] E0004AC6: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU1] E0004AEA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU1] E0004BA0: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0004AEA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004AFA: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU1] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004880
[CPU1] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU1] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x1       
[CPU1] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU1] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU1] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU1] E00076D8: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU1] E00076D8: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E00076D8: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU1] E00076F0: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU1] E00076F0: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU1] E00076FC: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU1] E00076FC: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU1] E00076FC: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU1] E00076FC: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU1] E000771C: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU1] E000771C: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU1] E0004A1A: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C5187D
[CPU1] E0004A1A: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5107D
[CPU0] E0004AEA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004AEA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004AFA: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E00076D8: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E00076D8: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E00076D8: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E00076F0: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E00076F0: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E00076FC: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E00076FC: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E00076FC: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E00076FC: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000771C: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000771C: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004940: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
Boot[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC6000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[CPU0] 00100752: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC2000000
[CPU0] 0010075A: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
Load
SLOT_A LOAD OK.
Open file for read : AUTOEXEC.BIN
File size : 0x7120
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 00806A46: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 001008BC: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] 00806A66: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 00806A6A: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[boot] copy_and_restart 0x1b5700 (1791744)
[BOOT] reserving memory: 0x40000 (262144)
before: user_mem_size = 0x114988 (1132936)
 after: user_mem_size = 0xd4988 (870792)
[BOOT] fixing up branch at 0x1b7ba0 (1801120)  (ROM: 0xe0040058 (-536608680) ) to 0x1b5769 (1791849)
[BOOT] fixing up branch at 0x1b7bd8 (1801176)  (ROM: 0xe0040090 (-536608624) ) to 0x1b5769 (1791849)
[BOOT] fixing up branch at 0x1b7baa (1801130)  (ROM: 0xe0040062 (-536608670) ) to 0x1b5759 (1791833)
[BOOT] fixing up branch at 0x1b7be2 (1801186)  (ROM: 0xe004009a (-536608614) ) to 0x1b5759 (1791833)
[BOOT] fixing up branch at 0x1b7bf8 (1801208)  (ROM: 0xe00400b0 (-536608592) ) to 0x1b7c34 (1801268)
[BOOT] fixing up branch at 0x1b7c82 (1801346)  (ROM: 0xe004013a (-536608454) ) to 0x1b5751 (1791825)
[BOOT] fixing up branch at 0x1b7ce4 (1801444)  (ROM: 0xe004019c (-536608356) ) to 0x1b5749 (1791817)
[BOOT] changing init_task from 0xe0040215 (-536608235) to 0x1b577d (1791869)
[CPU0] 001B5F96: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 00806A20: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B5FB6: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 001B5FBA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[BOOT] jumping to relocated startup code at 0x1b7b49 (1801033)
[CPU0] 001B5F70: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B7B48: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE02427A0
[CPU0] 001B7B52: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
Now it appears to execute in qemu compiling code from minimal-678.c. (put some garbage in led_blink() to see if compilation fail)
But none of the functions contained is executed (put some qprintf to see if they get called).

I still get that black bar on top and still no log saved to sd unfortunately.
Now the red icon is not blinking anymore, but is solid red instead of blinking half of a second... My hope is it get stuck because of the missing stubs

@a1ex can you check if this is good up to this stage by looking at changes and what is printed by Qemu by using qprintf?

Didn't tried to add +1 to the stubs in ARM address to make it THUMB. May this be valid in this case?


EDIT:
Comparing 200D in Qemu I get:

Code: [Select]

./run_canon_fw.sh 200D,firmware=boot=1 -d debugmsg

DebugMsg=0xDF006E6C (from GDB script)
00000000 - 1FFFFFFF: eos.ram
40000000 - 5FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F0FFFFFF: eos.rom1
F1000000 - F1FFFFFF: eos.rom1_mirror
F2000000 - F2FFFFFF: eos.rom1_mirror
F3000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F4FFFFFF: eos.rom1_mirror
F5000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F6FFFFFF: eos.rom1_mirror
F7000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F8FFFFFF: eos.rom1_mirror
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling code execution logging.
[EOS] loading './200D/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './200D/ROM1.BIN' to 0xF0000000-0xF0FFFFFF
[MPU] FIXME: using generic MPU spells for 200D.
[MPU] FIXME: no MPU button codes for 200D.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E0007618: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E000763E: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000766A: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0007660: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000766A: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004ADA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004ADA: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004ADA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
<<<<< Musa(PU0) Boot Ver 0.17 (DE) >>>>>
[CPU0] E00076AA: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004AFE: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004BC8: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004AFE: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B0E: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E00076EC: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E00076EC: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E00076EC: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E0007704: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E0007704: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E0007710: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E0007710: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E0007710: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E0007710: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E0007730: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E0007730: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004940: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
Boot[CPU0] 0010074E: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC6000000
[CPU0] 00100756: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[CPU0] 0010074E: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC2000000
[CPU0] 00100756: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
Load
SLOT_A LOAD OK.
Open file for read : AUTOEXEC.BIN
File size : 0x5400
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 00804D16: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 001008D4: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] 00804D36: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 00804D3A: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[boot] copy_and_restart 0x1b6300 (1794816)
[BOOT] reserving memory: 0x40000 (262144)
before: user_mem_size = 0x114988 (1132936)
 after: user_mem_size = 0xd4988 (870792)
[BOOT] fixing up branch at 0x1b87b0 (1804208)  (ROM: 0xe0040068 (-536608664) ) to 0x1b6369 (1794921)
[BOOT] fixing up branch at 0x1b87e8 (1804264)  (ROM: 0xe00400a0 (-536608608) ) to 0x1b6369 (1794921)
[BOOT] fixing up branch at 0x1b87ba (1804218)  (ROM: 0xe0040072 (-536608654) ) to 0x1b6359 (1794905)
[BOOT] fixing up branch at 0x1b87f2 (1804274)  (ROM: 0xe00400aa (-536608598) ) to 0x1b6359 (1794905)
[BOOT] fixing up branch at 0x1b8808 (1804296)  (ROM: 0xe00400c0 (-536608576) ) to 0x1b8845 (1804357)
[BOOT] fixing up branch at 0x1b8892 (1804434)  (ROM: 0xe004014a (-536608438) ) to 0x1b6351 (1794897)
[BOOT] fixing up branch at 0x1b88f4 (1804532)  (ROM: 0xe00401ac (-536608340) ) to 0x1b6349 (1794889)
[BOOT] changing init_task from 0xe0040225 (-536608219) to 0x1b637d (1794941)
[CPU0] 001B6B96: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 00804CF0: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B6BB6: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 001B6BBA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[BOOT] jumping to relocated startup code at 0x1b8749 (1804105)
[CPU0] 001B6B70: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B8748: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE021CB60
[CPU0] 001B8752: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU1] E0007618: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E000763E: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU1] E000766A: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU1] E0007660: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E000766A: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004ADA: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004ADA: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU1] E0004ADA: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU1] E0004AFE: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU1] E0004BB8: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0004AFE: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004B0E: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0004A5A: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU1] E0004A62: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004880
[CPU1] E0004A66: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU1] E0004A6A: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x1       
[CPU1] E0004A6E: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU1] E0004A76: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU1] E0004A7E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004A7E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU1] E00076EC: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU1] E00076EC: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E00076EC: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU1] E0007704: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU1] E0007704: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU1] E0007710: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU1] E0007710: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU1] E0007710: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU1] E0007710: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU1] E0007730: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU1] E0007730: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU1] E0004A1A: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C5187D
[CPU1] E0004A1A: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5107D
[CPU0] 001B8844: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E06BE23C: MCR p15, ...          : CACHEMAINT x8845 (omitted)
[CPU0] E04B43BE: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC6000000
[CPU0] E04B43C6: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[CPU0] E04B43BE: MCR p15,0,Rd,cr7,cr8,0:        ATS <- 0xC2000000
[CPU0] E04B43C6: MRC p15,0,Rd,cr7,cr4,0:        PAR -> 0xB
[BOOT] autoexec.bin loaded at 1B6300 - 1B9A80.
[BOOT] calling pre_init_task 1B6B19...
[DBG] boot_pre_init_task()
[BOOT] reserved 262144 bytes for ML (used 14208)
[BOOT] starting init_task 200BBC...
K417 READY
[CPU0] [        init:e04bdce7 ] (00:05) [MEM] InitializePermanentMemory 0 4636784
[CPU0] [        init:e01b3235 ] (00:01) [HPC] InitializeHPCopy( 0 )
[CPU0] [        init:e01b3235 ] (00:01) [HPC] InitializeHPCopy( 1 )
[CPU0] [        init:e0584607 ] (00:01) [PM] Disable (ID = 137, cnt = 1/1)
[CPU0] [        init:e0041327 ] (89:16)
                                        K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
[CPU0] [        init:e0041333 ] (89:05)
                                        ICU Release DateTime 2017.09.21 12:53:23
[CPU0] [        init:e04c0ec5 ] (02:01) PROPAD_Initialize CreateBinarySemaphore = 0x4e003a
[CPU0] [        init:e04c0f75 ] (02:01) PROPAD_RegisterOmarSysBlockCBR 0xe00406eb 0xe00406b1
[CPU0] [        init:e0139d3f ] (02:01) PROPTUNEAD_RegisterOmarSysBlockCBR 0xe00406eb 0xe00406b1
[CPU0] [        init:e0048fd7 ] (00:03) [SEQ] CreateSequencer (Startup, Num = 6)
[CPU0] [        init:e004909b ] (00:02) [SEQ] NotifyComplete (Startup, Flag = 0x10000)
[CPU0] [        init:e00490d1 ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x2018000, Flag = 0x10000)
[BOOT] calling post_init_task 1B6B21...
Free memory: 5B1B44
Logging buffer: 7BA4C4 - 9BA4C3
Free memory: 3B1B34
Replacing DF006E6C DebugMsg with 1B854D...
[CPU0] 001B6B96: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] E06BE168: MCR p15, ...          : CACHEMAINT x1680 (omitted)
[CPU0] 001B6B96: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 001B6BBA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[CPU0] 001B6B96: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 001B6B70: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B6B96: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 001B6BBA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[CPU0] [        init:001b6b23 ] (00:0f) Logging started.
[CPU0] 001B858C: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[DBG] boot_post_init_task()
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dc0000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dc0004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dc2000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dc2004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dc4000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dc4004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dc6000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dc6004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dc8000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dc8004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dca000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dca004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dcc000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dcc004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dce000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dce004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dd0000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dd0004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dd2000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dd2004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dd4000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dd4004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dd6000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dd6004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dd8000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dd8004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dda000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dda004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1ddc000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1ddc004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dde000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dde004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de0000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de0004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de2000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de2004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de4000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de4004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de6000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de6004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de8000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de8004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dea000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dea004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dec000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dec004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dee000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dee004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1df0000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1df0004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1df2000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1df2004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1df4000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1df4004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1df6000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1df6004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1df8000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1df8004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dfa000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dfa004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dfc000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dfc004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1dfe000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1dfe004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b90 0xe1de0004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e01b32b5 ] (00:01) [HPC] HPCopy() use ch0 !
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[XDMAC0] Copy [0xE1DE0000] -> [0x409BA540], length [0x00001604], flags [0x00000005]
[XDMAC0] OK
[CPU0] [     RomRead:001b6d9b ] (00:0f) >>> INT-11Eh  E013A8F5(11E)
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 001B6D9E: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:001b6e67 ] (00:0f) <<< INT-11Eh
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b30 0xe1de2000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b34 0xe1de2004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c14af ] (02:05) PROPAD_CreateFROMPropertyHandle DRAMAddr 0x421f8400
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b18 0xe1980000 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b1c 0xe1980004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e04c1fe1 ] (02:01) ReadUncacheFromData 0x205b78 0xe1980004 0x4
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [     RomRead:e01b32b5 ] (00:01) [HPC] HPCopy() use ch0 !
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[XDMAC0] Copy [0xE1980000] -> [0x421F8400], length [0x00155BB8], flags [0x00000005]
[XDMAC0] OK
[CPU0] [      SFRead:e0139f05 ] (02:05) PROPTUNEAD_CreateFROMPropertyHandleToDRAM Addr:0x416a2c00
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [      SFRead:e01c7b0b ] (02:03) PROPCOMBO_LoadProperty(395)
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [      SFRead:e01b32b5 ] (00:01) [HPC] HPCopy() use ch1 !
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[XDMAC1] Copy [0xF0890000] -> [0x416A2C00], length [0x000FCBD8], flags [0x00000005]
[XDMAC1] OK
[CPU0] [      DbgMgr:e0584607 ] (00:01) [PM] Disable (ID = 10, cnt = 1/2)
[CPU0] 001B8578: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
     0:4294964.223 [STARTUP]
K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
So, it should switch from cpu0 to cpu1 but it freezes. What can cause the boot process to hang up? Some wrong constants?

[calle2010]

I followed the work from aprofiti and fixed the thumb bits in stubs.S.

I basically see the same results, including the strange broken line in the emulator. But the red light is on after boot for about a second and then turns off.

Unfortunately I get no log file on sd.img, neither with reboot-dumper nor with the changed makefile for minimal-d678.

Running the minimal-d678 in Qemu with "-d debugmsg,int,io" I get a lot of messages like this:

[CPU0] [      RscMgr:001b61ff ] (00:0f) >>> INT-01Bh dryos_timer 54535F4D(5F545241)
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[HPTimer] Firing HPTimer #13
[EOS] trigger int 0x28
[CPU0] 001B6202: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [GICC]    at RscMgr:E029D558:001B6203 [0xC1000110] <- 0x20      :
E04D45A4: Taking exception 5 [IRQ]
[CPU0] [GICC]    at RscMgr:E029D4D4:E0242919 [0xC100010C] -> 0x20      : GICC_IAR
[CPU0] [INT]     at RscMgr:E029D4FA:E0242919 [0xD4011000] -> 0x28      : Requested int reason a0 (INT 28h)
[CPU0] [      RscMgr:001b61ff ] (00:0f) >>> INT-028h HPTimer 0(696C4370)
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 001B6202: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [GICC]    at RscMgr:E029D558:001B6203 [0xC1000110] <- 0x20      :
[CPU0] [HPTimer] at RscMgr:E02B80CA:E05AA835 [0xC0243300] -> 0x40000   : Which timer(s) triggered
[CPU0] [HPTimer] at RscMgr:E02B8070:E05AA901 [0xC02432D4] <- 0x0       : HPTimer #13: reset trigger?
[CPU0] [HPTimer] at RscMgr:E02B8074:E05AA901 [0xC02432D4] -> 0x0       : HPTimer #13:
[CPU0] [HPTimer] at RscMgr:E02B80CA:E05AA99B [0xC0243300] -> 0x0       : Which timer(s) triggered
[CPU0] [      RscMgr:001b62cb ] (00:0f) <<< INT-028h HPTimer
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [INT]     at RscMgr:E029D5A2:001B62CF [0xD4011010] <- 0x28      : Enabled interrupt 28h
[CPU0] [      RscMgr:001b62cb ] (00:0f) <<< INT-01Bh dryos_timer
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
000350FC: Taking exception 5 [IRQ]
[CPU0] [GICC]    at RscMgr:E029D4D4:E02428C9 [0xC100010C] -> 0x20      : GICC_IAR
[CPU0] [      RscMgr:001b61ff ] (00:0f) >>> INT-01Bh dryos_timer 54535F4D(5F545241)
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 001B6202: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [GICC]    at RscMgr:E029D558:001B6203 [0xC1000110] <- 0x20      :
[CPU0] [      RscMgr:001b62cb ] (00:0f) <<< INT-01Bh dryos_timer
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
000350F6: Taking exception 5 [IRQ]
[CPU0] [GICC]    at RscMgr:E029D4D4:E02428C9 [0xC100010C] -> 0x20      : GICC_IAR
[CPU0] [      RscMgr:001b61ff ] (00:0f) >>> INT-01Bh dryos_timer 54535F4D(5F545241)
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] 001B6202: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [GICC]    at RscMgr:E029D558:001B6203 [0xC1000110] <- 0x20      :
[CPU0] [      RscMgr:001b62cb ] (00:0f) <<< INT-01Bh dryos_timer
[CPU0] 001B7958: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000

This is what the serial console shows:



free image upload


Not sure if this is normal or what to do next. I can't compare with another camera since I don't have other ROM dumps available.

Between all the messages above there are some more interesting logs for MPU as well:

[MPU] FIXME: using generic MPU spells for 77D.
[MPU] FIXME: no MPU button codes for 77D.
[MPU] Received: 06 04 02 00 00 00  (Init - spell #1)
[MPU] Sending : 2c 2a 02 00 03 03 03 04 03 00 00 48 00 00 00 14 50 00 00 00 00 81 06 00 00 04 06 00 00 04 06 00 00 04 01 01 00 00 00 00 4d 4b 01 00  (Init group)
[MPU] Sending : 06 05 01 21 01 00  (PROP_CARD2_EXISTS)
[MPU] Received: 22 20 0e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (unknown - unnamed)
[MPU] Received: 08 06 01 a7 00 01 00 00  (unknown - unnamed)
[MPU] Received: 08 06 00 00 02 00 00 00  (unknown - Complete WaitID)
[MPU] Received: 0a 08 03 06 00 00 00 00 00 00  (unknown - PROP_AVAIL_SHOT)
[MPU] Received: 06 04 03 10 00 00  (unknown - PROP 80030008)
[MPU] Received: 06 05 03 07 ff 00  (unknown - PROP_BURST_COUNT)
[MPU] Received: 06 05 01 2e 01 00  (unknown - PROP_SAVE_MODE)
[MPU] Received: 0a 08 03 0b 00 00 00 00 00 00  (unknown - PROP 80030007)
[MPU] Received: 06 05 03 19 01 00  (PROP_TFT_STATUS - spell #11)
[MPU] Received: 06 05 01 56 00 00  (unknown - unnamed)
[MPU] Received: 06 05 04 0e 01 00  (unknown - PROP 8002000D)
[MPU] Received: 06 05 03 40 00 00  (unknown - PROP 80030040)
[MPU] Received: 0a 09 01 55 00 00 02 00 01 00  (unknown - PROP_MULTIPLE_EXPOSURE_SETTING)
[MPU] Received: 0c 0b 03 53 02 00 48 81 81 00 00 00  (unknown - PROP 80030058)
[MPU] Received: 0c 0b 03 53 02 00 48 81 81 00 00 00  (unknown - PROP 80030058)
[MPU] Received: 06 05 03 8a 00 00  (unknown - unnamed)
[MPU] Received: 06 04 02 14 00 00  (unknown - unnamed)
[MPU] Received: 08 06 01 24 00 01 00 00  (PROP_CARD2_STATUS - spell #7)
[MPU] Sending : 08 06 01 24 00 01 00 00  (PROP_CARD2_STATUS)
[MPU] Received: 08 06 01 27 00 64 00 00  (unknown - PROP_CARD2_FOLDER_NUMBER)
[MPU] Received: 08 06 01 2a 04 e6 00 00  (unknown - PROP_CARD2_FILE_NUMBER)
[MPU] Received: 08 06 03 03 65 01 00 00  (unknown - unnamed)
[MPU] Received: 08 07 03 6a 00 02 00 00  (unknown - unnamed)

[calle2010]

I made some progress. I changed the create_task stub to

NSTUB(0xDF008CD3,  task_create)            /* used to start TaskMain, GuiMainTask etc */

Now the assertion message in serial console "SystemIF:KerTask.c, Task = init, Line 684" is gone.

Also I got a DEBUGMSG.LOG on the sd.img: https://gist.github.com/calle2010/f6a90f9973cf7d5e191190b45ab3f430

I have not verified all the other stubs yet.

[aprofiti]

I made some progress.

Now the assertion message in serial console "SystemIF:KerTask.c, Task = init, Line 684" is gone.

Also I got a DEBUGMSG.LOG on the sd.img: https://gist.github.com/calle2010/f6a90f9973cf7d5e191190b45ab3f430

I have not verified all the other stubs yet.

Good work calle2010!

I can't get it to boot main firmware as you got previously... my console is like you up to AUTOEXEC.bin message.

I tried to see what was getting with "-d debugmsg,int,io" but nothing special appened apart a "taking exception 2 [SVC]" message.

Code: [Select]

./run_canon_fw.sh 77D,firmware=boot=1 -d debugmsg,int,io

DebugMsg=0xDF006E6C (from GDB script)
00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F0FFFFFF: eos.rom1
F1000000 - F1FFFFFF: eos.rom1_mirror
F2000000 - F2FFFFFF: eos.rom1_mirror
F3000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F4FFFFFF: eos.rom1_mirror
F5000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F6FFFFFF: eos.rom1_mirror
F7000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F8FFFFFF: eos.rom1_mirror
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling code execution logging.
[EOS] enabling singlestep.
[EOS] loading './77D/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './77D/ROM1.BIN' to 0xF0000000-0xF0FFFFFF
[MPU] FIXME: using generic MPU spells for 77D.
[MPU] FIXME: no MPU button codes for 77D.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E00075E0: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [DIGIC6]       at 0xE00075F8:00000000 [0xDE000008] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE00075FA:00000000 [0xDE000000] -> 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0007600:00000000 [0xDE000000] <- 0x40      : ???
[CPU0] E0007624: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E0007632: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0007628: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0007656: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004AC6: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004AD2: MCR p15, ...          : CACHEMAINT x3 (omitted)
[CPU0] E0004AD6: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU0] [DIGIC6]       at 0xE0004DCA:E0004E9B [0xD209F208] <- 0x5930    : ???
[CPU0] [DIGIC6]       at 0xE0004DDA:E0004E9B [0xD209F208] <- 0x5932    : ???
[CPU0] [DIGIC6]       at 0xE0004DE2:E0004E9B [0xD209F200] <- 0x6320    : ???
[CPU0] [DIGIC6]       at 0xE0004DF2:E0004E9B [0xD209F200] <- 0x6322    : ???
[CPU0] [DIGIC6]       at 0xE0004DF8:E0004E9B [0xD209F204] <- 0x73F10   : ???
[CPU0] [DIGIC6]       at 0xE0004DFE:E0004E9B [0xD209F204] <- 0x33F10   : ???
[CPU0] [DIGIC6]       at 0xE0004E0C:E0004E9B [0xD209F204] <- 0x13F10   : ???
[CPU0] [DIGIC6]       at 0xE0004E14:E0004E9B [0xD209F204] <- 0x3F10    : ???
[CPU0] [DIGIC6]       at 0xE0004E26:E0004E9B [0xD209F204] <- 0x3F12    : ???
[CPU0] [DIGIC6]       at 0xE0004E2E:E0004E9B [0xD2090040] <- 0x3       : ???
[CPU0] [DIGIC6]       at 0xE0004E36:E0004E9B [0xD209F218] <- 0x4010    : ???
[CPU0] [DIGIC6]       at 0xE0004E4E:E0004E9B [0xD209F218] <- 0x4012    : ???
[CPU0] [DIGIC6]       at 0xDF02000A:E0004EB5 [0xD208005C] <- 0x800040  : ???
[CPU0] [DIGIC6]       at 0xDF020012:E0004EB5 [0xDE000014] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0xDF020016:E0004EB5 [0xDE000010] <- 0x9F      : ???
[CPU0] [DIGIC6]       at 0xDF020018:E0004EB5 [0xDE000010] -> 0x0       : ???
[CPU0] [DIGIC6]       at 0xDF02001C:E0004EB5 [0xDE000010] -> 0x0       : ???
[CPU0] [DIGIC6]       at 0xDF02001E:E0004EB5 [0xDE000010] -> 0x0       : ???
[CPU0] [DIGIC6]       at 0xDF020024:E0004EB5 [0xDE000014] <- 0x1       : ???
[CPU0] [ROMID]        at 0xDF020028:E0004EB5 [0xBFE01FD0] <- 0x0       : SROM ID
[CPU0] [ROMID]        at 0xDF02002C:E0004EB5 [0xBFE01FD2] <- 0x0       : SROM ID
[CPU0] [ROMID]        at 0xDF020030:E0004EB5 [0xBFE01FD4] <- 0x0       : SROM ID
[CPU0] [DIGIC6]       at 0xE0005E14:E0004EBB [0xD2090008] <- 0x430C04  : CLOCK_ENABLE
[CPU0] [DIGIC6]       at 0xE0005E1C:E0004EBB [0xD209002C] <- 0x1000    : ???
[CPU0] [DIGIC6]       at 0xE0005E24:E0004EBB [0xD20900D0] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0xE0005E2A:E0004EBB [0xD209B050] <- 0x98000021: ???
[CPU0] [DIGIC6]       at 0xE0005E32:E0004EBB [0xD209B070] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E3A:E0004EBB [0xD209B080] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E42:E0004EBB [0xD209B100] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E4A:E0004EBB [0xD209B110] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E52:E0004EBB [0xD209B220] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E5A:E0004EBB [0xD209B2D0] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E62:E0004EBB [0xD209B520] <- 0x16000000: ???
[CPU0] [DIGIC6]       at 0xE0005E6A:E0004EBB [0xD209B550] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E72:E0004EBB [0xD209B560] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E7A:E0004EBB [0xD209B590] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E82:E0004EBB [0xD209B600] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E8A:E0004EBB [0xD209B610] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0005E92:E0004EBB [0xD209B620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0xE0004EC0:E0004EBB [0xD2040128] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004EC8:E0004EBB [0xD204012C] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004ED0:E0004EBB [0xD2040130] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004ED8:E0004EBB [0xD2040134] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004EE0:E0004EBB [0xD2040138] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004EE8:E0004EBB [0xD204013C] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0xE0004EF0:E0004EBB [0xD2040140] <- 0x80000000: ???

...

[CPU0] [SDIO]         at 0x00106D06:00106B71 [0xC805000C] <- 0x11      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:00106B71 [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00106D00:00106B81 [0xC8050024] <- 0x4000    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:00106B81 [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:00106B81 [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:00106B81 [0xC805000C] <- 0x11      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:00106B81 [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107852:00106B91 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x00107854:00106B91 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:00107873 [0xC8050024] <- 0x4800    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:00107873 [0xC8050020] <- 0x1AA01   : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:00107873 [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:00107873 [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:00107873 [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x0010754C:00106D59 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106D59 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x7700    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x12000   : Response[0]
[CPU0] [SDIO]         at 0x001076AA:00106D79 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x001076AC:00106D79 [0xC805002C] <- 0x80000000: response setup?
[CPU0] [SDIO]         at 0x00106D00:001076CB [0xC8050024] <- 0x6940    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:001076CB [0xC8050020] <- 0x10000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:001076CB [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:001076CB [0xC805000C] <- 0x2       : Command flags?
[CPU0] [SDIO]         at 0x00106D08:001076CB [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x001076D0:001076CB [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x001076D2:001076CB [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x001076D4:001076CB [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x001076D6:001076CB [0xC8050038] -> 0x80      : Response[1]
[CPU0] [SDIO]         at 0x001076D8:001076CB [0xC8050034] -> 0xFFFF0000: Response[0]
[CPU0] [SDIO]         at 0x001075DC:00106BB7 [0xC8050028] <- 0x88      : Response size (bits)
[CPU0] [SDIO]         at 0x001075DE:00106BB7 [0xC805002C] <- 0x7F08    : response setup?
[CPU0] [SDIO]         at 0x00106D00:001075FD [0xC8050024] <- 0x4200    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:001075FD [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:001075FD [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:001075FD [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:001075FD [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107602:001075FD [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107604:001075FD [0xC8050040] -> 0xAA585951: Response[3]
[CPU0] [SDIO]         at 0x00107606:001075FD [0xC805003C] -> 0x454D5521: Response[2]
[CPU0] [SDIO]         at 0x00107608:001075FD [0xC8050038] -> 0x1DEADBE : Response[1]
[CPU0] [SDIO]         at 0x0010760A:001075FD [0xC8050034] -> 0xEF006219: Response[0]
[CPU0] [SDIO]         at 0x001077C2:00106BCF [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x001077C4:00106BCF [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:001077E3 [0xC8050024] <- 0x4300    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:001077E3 [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:001077E3 [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:001077E3 [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:001077E3 [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x001077E8:001077E3 [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x001077EA:001077E3 [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x001077EC:001077E3 [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x001077EE:001077E3 [0xC8050038] -> 0x45      : Response[1]
[CPU0] [SDIO]         at 0x001077F0:001077E3 [0xC8050034] -> 0x67050000: Response[0]
[CPU0] [SDIO]         at 0x001075DC:00106E4B [0xC8050028] <- 0x88      : Response size (bits)
[CPU0] [SDIO]         at 0x001075DE:00106E4B [0xC805002C] <- 0x7F08    : response setup?
[CPU0] [SDIO]         at 0x00106D00:001075FD [0xC8050024] <- 0x4945    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:001075FD [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:001075FD [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:001075FD [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:001075FD [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107602:001075FD [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107604:001075FD [0xC8050040] -> 0x26005A  : Response[3]
[CPU0] [SDIO]         at 0x00107606:001075FD [0xC805003C] -> 0x5F59E0F7: Response[2]
[CPU0] [SDIO]         at 0x00107608:001075FD [0xC8050038] -> 0x7FFFDFFF: Response[1]
[CPU0] [SDIO]         at 0x0010760A:001075FD [0xC8050034] -> 0x92600047: Response[0]
[CPU0] [SDIO]         at 0x0010754C:00106BED [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106BED [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4745    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x70000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00106BFD [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106BFD [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x7745    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x92000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00106C0D [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106C0D [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x6A45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x92000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00106E69 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106E69 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x7745    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x92000   : Response[0]
[CPU0] [SDIO]         at 0x00106E82:00106E69 [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106E84:00106E69 [0xC805007C] <- 0x1       : transfer block count
[CPU0] [SDIO]         at 0x00106E86:00106E69 [0xC8050068] <- 0x40      : read block size
[CPU0] [SDIO]         at 0x001074EA:00106E8D [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106F48:00106E99 [0xC8050024] <- 0x4D00    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:00106E99 [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:00106E99 [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106F4E:00106E99 [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDIO]         at 0x00106EA4:00106E99 [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00106EB4:00106E99 [0xC8050010] <- 0xFFDFFFFE: Status
[CPU0] [SDIO]         at 0x00106EBA:00106E99 [0xC8050010] -> 0x0       : Status
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EBA:00106E99 [0xC8050010] -> 0x0       : Status
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EBA:00106E99 [0xC8050010] -> 0x0       : Status
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EBA:00106E99 [0xC8050010] -> 0x0       : Status
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106EE2:00106E99 [0xC805006C] -> 0x0       : FIFO data
[CPU0] [SDIO]         at 0x00106EEC:00106E99 [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00106EF4:00106E99 [0xC8050084] -> 0x0       : SDREP: Status register/error codes
[CPU0] [SDIO]         at 0x00106C42:00106C11 [0xC8050064] <- 0x61000A  : bus width
[CPU0] [SDIO]         at 0x00106C46:00106C11 [0xC8050058] <- 0x41000A  : bus width
[CPU0] [DIGIC6]       at 0x001074B8:00106C4D [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:00106C4D [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:00106C4D [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:00106C4D [0xD2090608] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010742A:00106C51 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00106C51 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00106C51 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00106C51 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00106C51 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00106C51 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00106C51 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00106C51 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00106C51 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00106C51 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00106C51 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00106C51 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00106C51 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00106C51 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00106C51 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00106C51 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106C58:00106C51 [0xC8050058] -> 0x0       : bus width
[CPU0] [SDIO]         at 0x00106C62:00106C51 [0xC8050058] <- 0x1       : bus width
[CPU0] [SDIO]         at 0x00106C66:00106C51 [0xC8050064] -> 0x0       : bus width
[CPU0] [SDIO]         at 0x00106C70:00106C51 [0xC8050064] <- 0x1       : bus width
[CPU0] [SDIO]         at 0x0010754C:00106C87 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106C87 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x7745    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x92000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00106C97 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00106C97 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4600    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x201     : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x92000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x1       : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44000000: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x200     : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:00106FFF [0xC8050024] <- 0x5100    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:00106FFF [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:00106FFF [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:00106FFF [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:00106FFF [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:00106FFF [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:00106FFF [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:00106FFF [0xC8050080] -> 0x1       : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x1       : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44000000: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x200     : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:00106FFF [0xC8050024] <- 0x5100    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:00106FFF [0xC8050020] <- 0xC60001  : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:00106FFF [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:00106FFF [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:00106FFF [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:00106FFF [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:00106FFF [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:00106FFF [0xC8050080] -> 0x1       : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
SLOT_A LOAD OK.
[CPU0] [GPIO]         at 0x00101774:00101A57 [0xD208016C] <- 0xD0002   : Card LED
Open file for read : AUTOEXEC.BIN
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x1       : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44000000: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x200     : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:00106FFF [0xC8050024] <- 0x5100    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:00106FFF [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:00106FFF [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:00106FFF [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:00106FFF [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:00106FFF [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:00106FFF [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:00106FFF [0xC8050080] -> 0x1       : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x1       : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44000000: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x200     : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:00106FFF [0xC8050024] <- 0x5100    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:00106FFF [0xC8050020] <- 0xC60001  : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:00106FFF [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:00106FFF [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:00106FFF [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:00106FFF [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:00106FFF [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:00106FFF [0xC8050080] -> 0x1       : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x3E      : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x46001E00: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x7C00    : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:0010700B [0xC8050024] <- 0x5200    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:0010700B [0xC8050020] <- 0xC80001  : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:0010700B [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:0010700B [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:0010700B [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:0010700B [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:0010700B [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:0010700B [0xC8050080] -> 0x3E      : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107061 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107061 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4C00    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0xB0000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x20      : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x48001E00: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x4000    : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:0010700B [0xC8050024] <- 0x5200    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:0010700B [0xC8050020] <- 0x1C00001 : cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:0010700B [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:0010700B [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:0010700B [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:0010700B [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:0010700B [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:0010700B [0xC8050080] -> 0x20      : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107061 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107061 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4C00    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0xB0000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
File size : 0x71A0
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x20      : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44001800: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x4000    : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:0010700B [0xC8050024] <- 0x5200    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:0010700B [0xC8050020] <- 0x23800001: cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:0010700B [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:0010700B [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:0010700B [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:0010700B [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:0010700B [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:0010700B [0xC8050080] -> 0x20      : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107061 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107061 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4C00    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0xB0000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [SDIO]         at 0x00106FB0:00105C5F [0xC8050010] <- 0x0       : Status
[CPU0] [SDIO]         at 0x00106FB6:00105C5F [0xC8050068] <- 0x200     : read block size
[CPU0] [SDIO]         at 0x00106FBC:00105C5F [0xC805007C] <- 0x20      : transfer block count
[CPU0] [SDIO]         at 0x001074EA:00106FC3 [0xC8050088] <- 0x30      : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x001074B8:001074FB [0xD209063C] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074C0:001074FB [0xD2090614] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x001074D0:001074FB [0xD2090610] <- 0x80000000: ???
[CPU0] [DIGIC6]       at 0x001074D8:001074FB [0xD2090608] <- 0x0       : ???
[CPU0] [SDIO]         at 0x00107508:001074FB [0xC8050088] <- 0x0       : SDBUFCTR: Set to 0x03 before reading
[CPU0] [DIGIC6]       at 0x0010742A:00107511 [0xD209F100] <- 0xA       : ???
[CPU0] [DIGIC6]       at 0x00107430:00107511 [0xD2090600] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107438:00107511 [0xD2090618] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010743E:00107511 [0xD209061C] <- 0x1D000901: ???
[CPU0] [DIGIC6]       at 0x00107446:00107511 [0xD2090620] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010744E:00107511 [0xD209062C] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x00107456:00107511 [0xD2090630] <- 0x807     : ???
[CPU0] [DIGIC6]       at 0x0010745E:00107511 [0xD2090624] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x00107466:00107511 [0xD2090628] <- 0xF       : ???
[CPU0] [DIGIC6]       at 0x0010746E:00107511 [0xD2090638] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x00107476:00107511 [0xD2090604] <- 0x0       : ???
[CPU0] [DIGIC6]       at 0x0010747E:00107511 [0xD209060C] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010748E:00107511 [0xD2090608] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x00107496:00107511 [0xD2090610] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x0010749E:00107511 [0xD2090614] <- 0x1       : ???
[CPU0] [DIGIC6]       at 0x001074A6:00107511 [0xD209063C] <- 0x1       : ???
[CPU0] [SDIO]         at 0x00106FC8:00106FC3 [0xC8050008] <- 0xF1      : DMA
[CPU0] [SDDMA]        at 0x00106FD0:00106FC3 [0xC8020000] <- 0x44001800: Transfer memory address
[CPU0] [SDDMA]        at 0x00106FE0:00106FC3 [0xC8020004] <- 0x4000    : Transfer byte count
[CPU0] [SDDMA]        at 0x00106FE6:00106FC3 [0xC8020018] <- 0x0       : ???
[CPU0] [SDDMA]        at 0x00106FEC:00106FC3 [0xC8020010] <- 0x39      : Command/Status?
[CPU0] [SDIO]         at 0x00106F48:0010700B [0xC8050024] <- 0x5200    : cmd_hi
[CPU0] [SDIO]         at 0x00106F4A:0010700B [0xC8050020] <- 0x23C00001: cmd_lo
[CPU0] [SDIO]         at 0x00106F4C:0010700B [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[EOS] trigger int 0xBE (delayed!)
[CPU0] [SDIO]         at 0x00106F4E:0010700B [0xC805000C] <- 0x14      : Command flags?
[CPU0] [SDDMA]        at 0x0010700C:0010700B [0xC8020010] -> 0x0       : Command/Status?
[CPU0] [SDIO]         at 0x00107016:0010700B [0xC8050010] -> 0x200001  : Status
[CPU0] [SDIO]         at 0x00107024:0010700B [0xC8050008] <- 0x0       : DMA
[CPU0] [SDIO]         at 0x00107032:0010700B [0xC8050080] -> 0x20      : transferred blocks
[CPU0] [SDIO]         at 0x0010754C:00107061 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107061 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4C00    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x1       : cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0xB0000   : Response[0]
[CPU0] [SDIO]         at 0x0010754C:00107071 [0xC8050028] <- 0x30      : Response size (bits)
[CPU0] [SDIO]         at 0x0010754E:00107071 [0xC805002C] <- 0x2701    : response setup?
[CPU0] [SDIO]         at 0x00106D00:0010756D [0xC8050024] <- 0x4D45    : cmd_hi
[CPU0] [SDIO]         at 0x00106D02:0010756D [0xC8050020] <- 0x67000001: cmd_lo
[CPU0] [SDIO]         at 0x00106D04:0010756D [0xC8050010] <- 0x0       : Status
[EOS] trigger int 0xEE (delayed!)
[CPU0] [SDIO]         at 0x00106D06:0010756D [0xC805000C] <- 0x12      : Command flags?
[CPU0] [SDIO]         at 0x00106D08:0010756D [0xC8050010] -> 0x1       : Status
[CPU0] [SDIO]         at 0x00107572:0010756D [0xC8050044] -> 0x0       : ???
[CPU0] [SDIO]         at 0x00107574:0010756D [0xC8050040] -> 0x0       : Response[3]
[CPU0] [SDIO]         at 0x00107576:0010756D [0xC805003C] -> 0x0       : Response[2]
[CPU0] [SDIO]         at 0x00107578:0010756D [0xC8050038] -> 0x0       : Response[1]
[CPU0] [SDIO]         at 0x0010757A:0010756D [0xC8050034] -> 0x90000   : Response[0]
[CPU0] [GPIO]         at 0x00101782:00104E95 [0xD208016C] <- 0xC0003   : Card LED
[CPU0] [DIGIC6]       at 0x0010162C:00101955 [0xD2080114] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x00101630:00101955 [0xD2080118] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x00101634:00101955 [0xD208011C] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x00101638:00101955 [0xD2080120] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x0010163C:00101955 [0xD2080124] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x00101640:00101955 [0xD2080128] <- 0x4C0083  : ???
[CPU0] [DIGIC6]       at 0x00101646:00101955 [0xD208015C] <- 0xC0003   : ???
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] [GPIO]         at 0x008065EE:008064BB [0xD208016C] <- 0x20D0002 : Card LED
[CPU0] 00806ABE: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 001008C0: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] 00806AD6: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 00806ADA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[CPU0] [*unk*]        at 0x00806B46:00000005 [0xC1100730] <- 0x0       : ???
[boot] copy_and_restart 0x1b5700 (1791744)
[BOOT] reserving memory: 0x40000 (262144)
before: user_mem_size = 0x114988 (1132936)
 after: user_mem_size = 0xd4988 (870792)
[BOOT] fixing up branch at 0x1b7ba0 (1801120)  (ROM: 0xe0040058 (-536608680) ) to 0x1b5769 (1791849)
[BOOT] fixing up branch at 0x1b7bd8 (1801176)  (ROM: 0xe0040090 (-536608624) ) to 0x1b5769 (1791849)
[BOOT] fixing up branch at 0x1b7baa (1801130)  (ROM: 0xe0040062 (-536608670) ) to 0x1b5759 (1791833)
[BOOT] fixing up branch at 0x1b7be2 (1801186)  (ROM: 0xe004009a (-536608614) ) to 0x1b5759 (1791833)
[BOOT] fixing up branch at 0x1b7bf8 (1801208)  (ROM: 0xe00400b0 (-536608592) ) to 0x1b7c34 (1801268)
[BOOT] fixing up branch at 0x1b7c82 (1801346)  (ROM: 0xe004013a (-536608454) ) to 0x1b5751 (1791825)
[BOOT] fixing up branch at 0x1b7ce4 (1801444)  (ROM: 0xe004019c (-536608356) ) to 0x1b5749 (1791817)
[BOOT] changing init_task from 0xe0040215 (-536608235) to 0x1b577d (1791869)
[CPU0] 001B5F9E: MRC p15,1,Rd,cr0,cr0,1:      CLIDR -> 0x9200003
[CPU0] 00806A98: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B5FB6: MCR p15,2,Rd,cr0,cr0,0:     CSSELR <- 0x0       
[CPU0] 001B5FBA: MRC p15,1,Rd,cr0,cr0,0:     CCSIDR -> 0x700FE019
[CPU0] [*unk*]        at 0x001B6026:00000005 [0xC1100730] <- 0x0       : ???
[BOOT] jumping to relocated startup code at 0x1b7b49 (1801033)
[CPU0] 001B5F78: MCR p15, ...          : CACHEMAINT x514 (omitted)
[CPU0] 001B7B4A: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE02427A0
[CPU0] 001B7B5C: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
E065E27C: Taking exception 2 [SVC]

Did you only changed stubs values by adding +1 to the address?

I have some warnings while compiling, can you check if you get the same?

Code: [Select]

../../src/minimal-d678.c: In function 'FIO_WriteFile':
../../src/minimal-d678.c:140:1: warning: control reaches end of non-void function [-Wreturn-type]
 int FIO_WriteFile( FILE* stream, const void* ptr, size_t count ) { };
 ^
[ CC       ]   cache.o
[ CC       ]   font_direct.o
[ AS       ]   ../../platform/77D.100/stubs.o
[ CC       ]   log-d678.o
../../src/log-d678.c: In function 'my_DebugMsg':
../../src/log-d678.c:64:23: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
     char* task_name = get_current_task_name();
                       ^
...

[ XOR_CHK  ]   ../../build_tools/xor_chk
../../build_tools/xor_chk.c:48:88: warning: format specifies type
      'unsigned long' but the argument has type 'uint64_t' (aka
      'unsigned long long') [-Wformat]
  ...error (expected 0x%lX, got 0x%lX)\n", 0xCCCCCCCCE12FFF13, footer_magic);
                                  ~~~                          ^~~~~~~~~~~~
                                  %llX

I need to try using linux to see if this is the problem to me.

[calle2010]

Mostly I added 1 for the function calls. I will clean up a bit and then create a fork on Bitbucket with the update. It may take some days but I hope to get it done on the weekend.

I use Ubuntu bionic64 in MacOS through VirtualBox and Vagrant. Basically Vagrant allows you to discard and create the dev environment anytime. All files will be mirrored to the MacOS host.
Have a look here https://github.com/calle2010/magic-lantern-77d-vagrant

But I don't think the issues are caused by MacOS. Your output is very similar to mine.

[calle2010]

The TotalSheets and EstimatedSize errors are likely caused by wrong / incomplete MPU messages (these will have to be logged from a real camera);

I spent the evening trying to find the cause for the ASSERT EstimatedSize.c Task = RscMgr Line=1483 error.
Finally I figured out that a wrong value is passed from GetEstimatedSizeOfMovie or similar and when I wanted to use gdb to put a breakpoint I found that Alex did this already, including the workaround, in a20c79b.

So that means this assertion doesn't happen anymore when running with GDB debugmsg.gdb.
At least I learned a lot so far.

Next is an exception:

Code: [Select]

< Error Exception>
CORE        : 0
TYPE        : 16
ISR         : 0
TASK IDSR   : 11534368
TASK Name   : ShootCapture
R 0         : e018a2cd
R 1         : 0
R 2         : 0
R 3         : 1
R 4         : a1bb0
R 5         : 0
R 6         : 10000
R 7         : e0042c9f
R 8         : 40b65600
R 9         : 19980218
R10         : 19980218
R11         : 19980218
R12         : 48
R13         : 1ffebc
R14         : e018a315
PC          : e04108b2
CPSR        : 73
The code at this PC is

Code: [Select]

e04108b2:       f845 0022       str.w   r0, [r5, r2, lsl #2]If I understand it right, it tries to store the value in r0 to the address r5+r2, which happens to be 0.

Is this also a known problem and perhaps solved already?

[a1ex]

It is a known problem, but not solved yet. On 80D, I've got similar issues after skipping Omar initialization. On DIGIC 7, I'm currently emulating only the main CPU core, and the early startup for the other. Previously, I had unsuccessful attempts at guessing the interrupts used by the two cores, but nothing worth showing.

Recently we've got detailed logs from 200D, that I can use to fix the emulation, but didn't look into them yet. The cleanest one seems to be this: DEBUGMSG-mpu-int.LOG

For porting ML, full emulation is not strictly required; after checking the stubs (just in case) I'll publish the FIR for enabling the boot flag, so you'll be able to debug directly on the camera.

You may also want to join the IRC channel, as @names_are_hard and others are active there.

[calle2010]

What I don't understand: Why can't GDB read the memory at addresses 0x000-0xFFF? Initially that works, but when I set a breakpoint later in the boot process, e. g. at 0xe04108b2, GDB says it can't access these addresses. Does it have to do with the MMU? I think I read elsewhere in the forum that this address range is separate for the two processors?

I think I understand now:
#112 and #43 from EOS R/RP: This area is unavailable, perhaps to catch null pointer exceptions, if I understand correctly.

I wanted to look at the interrupt vector table as you did in the M2 porting tutorial. But I never see anything valid there.

Alex, thank you for all the information, I find a new piece everyday. But I think I'm stuck here. May try to use IRC when I have the time, never used that before. :-)

[calle2010]

Here is the stubs.S I am working with right now: https://bitbucket.org/calle2010/magic-lantern/src/f387fc148a1c4c5e4c1517a42226bcc0c17ded9f/platform/77D.102/stubs.S

Alex, if you could have a look and verify? I am not very confident...

I run the Canon firmware with

./run_canon_fw.sh 77D,firmware="boot=0" -d callstack -s -S  & gdb-multiarch -x 77D/debugmsg.gdb

It is possible to open the drysh console. Memory information:

Code: [Select]

Open Console K408[1]>...

K408[1]>dryshDry[MusaPUX]> Dry[MusaPUX]> meminfo -m
Malloc Information (onetime type)
  Start Address       = 0x000e0fa8
  End Address         = 0x001f5658
  Total Size          = 0x001146b0 (  1132208)
  Allocated Size      = 0x00007608 (    30216)
  Allocated Peak      = 0x00007608 (    30216)
  Allocated Count     = 0x00000050 (       80)
  Free Size           = 0x0010d0a8 (  1101992)
  Free Block Max Size = 0x0010d0a8 (  1101992)
  Free Block Count    = 0x00000001 (        1)
Dry[MusaPUX]> memmap
e02427a0 : Exception vector
000e0fa0 : Heap start
           0x00114988(1132936)
001f5928 : Heap end
001f5928 : DRYOS system object
           0x00009478(38008)
001feda0 : DRYOS system memory
           0x000e2200(926208)
000e07a0 : Error exception stack start (PU0)
           0x00000400(1024)
000e0ba0 : Error exception stack end (PU0)
000e0ba0 : Error exception stack start (PU1)
           0x00000400(1024)
000e0fa0 : Error exception stack end (PU1)
df000000 : IRQ exception stack start (PU0)
           0x00001000(4096)
df001000 : IRQ exception stack end (PU0)
df001000 : IRQ exception stack start (PU1)
           0x00001000(4096)
df002000 : IRQ exception stack end (PU1)

Tasks:

Code: [Select]

Dry[MusaPUX]> extask
 Name            ID   State Pri         Wait(ID)      Stack  % StackTop StackEnd       SP Bound(ID)
init1      000d0004   READY   0         -------   0008/1000 00 001fffc8 00200fc8 00200fc8    BND(1)
DbgMgr     00260006   READY  13         -------   02a0/1000 16 002013d8 002023d8 002022f0    BND(1)
EventMgr   0038000d    WAIT  14  RCVMQ(00370005)  01a8/1000 10 00207408 00208408 00208340    BND(0)
RTCMgr     004e0011    WAIT  14  RCVMQ(004d000c)  0330/0400 79 00209418 00209818 00209750    BND(0)
ShootCaptu 00af001f SUSPEND  14         -------   01f0/1000 12 00215c88 00216c88 000e0b28    BND(0)
EFLensComT 0040000e    WAIT  16  RCVMQ(003e0008)  00b8/0400 17 00204be8 00204fe8 00204f60    BND(0)
MainCtrl   00840017    WAIT  16  RCVMQ(00830013)  0190/1000 09 0020e848 0020f848 0020f7c0    BND(0)
RscMgr     005e0014    WAIT  18  RCVMQ(005d000e)  03f0/1000 24 0020b830 0020c830 0020c768    BND(0)
Panning    00c40022    WAIT  18  RCVMQ(00c3001f)  0170/0c00 11 0021cca0 0021d8a0 0021d7d8    BND(0)
PropMgr    0032000b    WAIT  20  RCVMQ(00310003)  0428/1000 25 001fefc0 001fffc0 001ffef8    BND(0)
MainSubTas 0043000f    WAIT  20  RCVMQ(00410009)  00b0/0400 17 00204ff0 002053f0 00205370    BND(0)
FileCache  005b0013    WAIT  20  RCVMQ(005a000d)  00f8/1000 06 0020a828 0020b828 0020b760    BND(0)
ShootBlack 00bd0020    WAIT  21  RCVMQ(00bc001d)  0138/2000 03 00216c90 00218c90 00218bc8    BND(0)
ShootPreDe 00c10021    WAIT  22  RCVMQ(00c0001e)  00f8/4000 01 00218c98 0021cc98 0021cbd0    BND(0)
GuiLockTas 007e0015    WAIT  23  RCVMQ(007d0011)  00b0/1000 04 0020c838 0020d838 0020d7b8    BND(0)
EvShel     00c60023 RUNNING  24         -------   0358/8000 02 0021d8a8 002258a8 --------    BND(0)
ConsoleSvr 00ce0025    WAIT  24  RCVMQ(00c90020)  01f8/0800 24 002260b8 002268b8 00226820    BND(0)
Startup    002a0007    WAIT  25  RCVMQ(00290002)  0398/2800 08 002023e0 00204be0 00204b50    BND(0)
FileMgr    00470010    WAIT  25  RCVMQ(0046000b)  0820/1000 50 00208410 00209410 00209348    BND(0)
Fstorage   00820016    WAIT  25  RCVMQ(00810012)  00f8/1000 06 0020d840 0020e840 0020e778    BND(0)
Ta10Mgr    00880019    WAIT  25  RCVMQ(00870014)  00f8/1000 06 0020fc58 00210c58 00210b90    BND(0)
HDRMgr     008b001a    WAIT  25  RCVMQ(008a0015)  00f8/1000 06 00210c60 00211c60 00211b98    BND(0)
HDRStage   008d001b    WAIT  25  RCVMQ(008c0016)  00f8/1000 06 00211c68 00212c68 00212ba0    BND(0)
GISMgr     0091001c    WAIT  25  RCVMQ(00900017)  00f8/1000 06 00212c70 00213c70 00213ba8    BND(0)
GISStage   0093001d    WAIT  25  RCVMQ(00920018)  00f8/1000 06 00213c78 00214c78 00214bb0    BND(0)
LowConsole 00cd0024 SUSPEND  25         -------   00d0/0800 10 002258b0 002260b0 00226040    BND(0)
NFCMgr     0035000c    WAIT  26  RCVMQ(00340004)  01e8/1000 11 00206400 00207400 00207338    BND(0)
DOSDriver  00590012    WAIT  26  EVENT(0058000c)  00d8/1000 05 00209820 0020a820 0020a778    BND(0)
AEmodeJudg 00860018    WAIT  26    SEM(0085004d)  0088/0400 13 0020f850 0020fc50 0020fc00    BND(0)
CSMgrTask  0099001e    WAIT  28  RCVMQ(00970019)  0530/1000 32 00214c80 00215c80 00215bd8    BND(0)
PowerMgr   00240005   READY  32         -------   0080/0400 12 00200fd0 002013d0 002013b8    BND(0)
idle       00010001   READY  33         -------   0060/0100 37 001fedb0 001feeb0 001fee80    BND(0)
idle       00020002   READY  33         -------   0008/0100 03 001feeb8 001fefb8 001fefb8    BND(1)


[a1ex]

Alex, if you could have a look and verify?

Done, mostly good. Even the interrupt logging stubs (pre/post_isr_log) happened to be correct, i.e. the same as 200D.

Would be nice to have minimal-d78 working as well; this one uses regular file I/O functions (rather than dump_file) and needs some more memory allocation functions.

[calle2010]

Thank you! I worked on your comments and I think I found the memory stubs.
Next I would work on the File I/O stubs.

[aprofiti]

Try these one:

Code: [Select]

/** File I/O **/
NSTUB(0xe04d714d, _FIO_OpenFile)
NSTUB(0xe04d71b7, _FIO_CreateFile)
NSTUB(0xe04d7271, _FIO_ReadFile)
NSTUB(0xe04d7389, _FIO_WriteFile)
NSTUB(0xe04d7317,  FIO_SeekSkipFile)
NSTUB(0xe04d7389,  FIO_CloseFile)
NSTUB(0xe04d7cb1, _FIO_CreateDirectory)
NSTUB(0xe04d7fc1, _FIO_FindFirstEx)
NSTUB(0xe04d804f,  FIO_FindNextEx)
NSTUB(0xe04d80bb,  FIO_FindClose)
NSTUB(0xe04d74a7, _FIO_GetFileSize)
NSTUB(0xe04d7225, _FIO_RemoveFile)
NSTUB(0xe04d7b2b, _FIO_RenameFile)
NSTUB(0xe04d7dd5,  FIO_Flush)               // to be called after FIO_CloseFile?


[calle2010]

Many thanks, aprofiti. I double checked the stubs and found two that I had to change:

Code: [Select]

NSTUB(0xe04d7317, _FIO_WriteFile) //!
NSTUB(0xe04d8895,  FIO_SeekSkipFile) //!

Your FIO_SeekSkipFile stub I think referred to _FIO_WriteFile.
_FIO_WriteFile was the same as _FIO_CloseFile. (copy&paste error?)

All the stubs you posted have a difference of 0x1AF60 to the 200D. So I did the same for _FIO_SeekSkipFile. I could match it with some error messages, but it looks very different from all the other FIO functions. Especially I couldn't find it calling the function at 0xe04d70e8, which seems to be a kind of debug function for the FIO functions.

Also I'm not so sure about these three:

Code: [Select]

NSTUB(0xe04d80db, _FIO_FindFirstEx) /* 0xe04d7fc1 is FIO_FindFirst */
NSTUB(0xe04d8173,  FIO_FindNextEx) /* 0xe04d804f is FIO_FindNext */
NSTUB(0xe04d80bb,  FIO_FindClose) /* 0xe04d81de is FIO_FincCloseEx(!) */

FindFirst/FindNext/FindClose seem to come in two flavors: With or without "Ex".
The difference seems to be that FindFirstEx does a FIO_Flush before it does whatever it does.
I think FindNext/FindNextEx and FindClose/FindCloseEx are functionally identical.

I changed the stubs to match the names, but I am not sure if this is correct.
If correct, than perhaps the same change applies to the 200D as well? Because these would not match with the same address offset of 0x1AF60 to the 200D.

[aprofiti]

FindFirst/FindNext/FindClose seem to come in two flavors: With or without "Ex".
The difference seems to be that FindFirstEx does a FIO_Flush before it does whatever it does.
I think FindNext/FindNextEx and FindClose/FindCloseEx are functionally identical.

Noticed that 2-3 stubs where having some sort of mirror, same code at another offset. Was the same with 200D, where the ones with lower address where used.

Your FIO_SeekSkipFile stub I think referred to _FIO_WriteFile.
_FIO_WriteFile was the same as _FIO_CloseFile. (copy&paste error?)

I mixed one time so maybe I missed these when redoing.
Can't check right now...

Offset of FIO stubs should be right, but I may expect some slightly change in code which can broke it, it need to be rechecked.

It's missing uart_printf stub, 200d doesn't use it and I don't have R or M50 rom to check for; maybe can be found using GDB and some breakpoint, message printed can be easily found as string when looking at the disassembly.

Should be possible to temporarily change the code to use something else, to make it compile and experiment with marking unused memory.

[calle2010]

I'm experimenting with minimal-d78.c.

dump_task is started, I can blink the LED in different ways, qprint messages are printed.

But I can't get anything saved to the SD image. Neither dumpf, nor backup_region or dump_file is doing anything.

Also when I start the firmware with boot=0 and type dumpf in the event shell nothing is written to the SD card.

I couldn't find uart_printf stub so far, only many low-level UART related functions to write a byte or a string. Nothing that takes a format.

[aprofiti]

I can confirm that I copy pasted wrong and lost some values, writeFile/seeSkipFile and closeFile were found like your post.

If I try to use "dump" with bootflag disable, I get this:

Code: [Select]

K408[1]>dumpf
 dumpf returned 0(0x0)
K408[1]>[DM] ERROR : FIO_FindFirstEx fail
ASSERT : ./FileIO/FileIO.c, Task = DbgMgr, Line 86

I have also this error with and without bootflag enabled:

Code: [Select]

   228:4294889.983 [TA10] ERROR Irregular TotalSheets 0 !!
But I imagine there is something wrong on my side... because none of the debug message from qprintf are printed and led doesn't look like is blinking...

[calle2010]

Screenshot of the "broken line". Already visible with a break-point at 0x00800000, so after AUTOEXEC.BIN is loaded but before it is relocated.

[aprofiti]

@calle2010 Did you already read a1ex's comments about isr and memory stubs on bitbucket?

I can see you didn't updated your repository with the changes

[calle2010]

It's updated in commit 0264f84. I hadn't time to replicate any of these tests yet that Alex did with File I/O.

[calle2010]

Screenshot of the "broken line". Already visible with a break-point at 0x00800000, so after AUTOEXEC.BIN is loaded but before it is relocated.

I'm pretty sure now this is the AUTOEXEC.BIN which is loaded by the boot loader. After the function at 0x00104DA4, which I believe does the loading, the line appears.

Since Canon boot loader code is doing this it should be fine. I guess Qemu just happens to pick this RAM area as a screen buffer because it is not adapted to the 77D yet?