DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)

Started by feedrail, June 12, 2017, 07:05:50 AM

Previous topic - Next topic

0 Members and 4 Guests are viewing this topic.

calle2010

Quote from: names_are_hard on April 03, 2019, 11:25:41 PM
I made some changes but git push gave me a 403, so I guess I can't submit a pull request?

You could create a PR from your own fork. But you can't directly push to another repository if permissions haven't been setup.

Thank you very much for the edits. I took them over manually. What started as my personal notes for the 77D may turn into a ML Ghidra guide.  :)

QuoteI think you have the "language" wrong, and should be using ARM Cortex 32 little endian, not ARM v7.

I will check this. I though ARM v7 architecture is correct for the Cortex A9 processor? Actually I'm a bit confused by the choices in Ghidra...

QuoteSecond, you shouldn't load each ROM as a file in your Ghidra project (I made this mistake too).  This makes each file separate and disassembly can't see stuff in the other files, so you will get lots of broken refs.  Instead, load the main ROM, then use File -> Add To Program.  This puts all the files in the same address space and disassembly works much better.

Actually this is what I do, but my language was not clear enough.

Quote
Third...  I should really write a Ghidra script that reads stubs.S and disassembles and labels every code address.

...and also for named_functions.idc :-)

Btw: I use F12 always instead of D since the thumb flag is not persisted. In the next session "D" may try to analyze ARM instead of Thumb again. Nearly all code of the 77D seems to be Thumb.

names_are_hard

Quote from: calle2010 on April 04, 2019, 12:49:18 AM
You could create a PR from your own fork. But you can't directly push to another repository if permissions haven't been setup.
Okay, makes sense, thanks.

Quote
I will check this. I though ARM v7 architecture is correct for the Cortex A9 processor? Actually I'm a bit confused by the choices in Ghidra...
Earlier in this thread Alex says it's Cortex.  I may be wrong that it makes a difference, I thought that all Cortex were v7 but not all v7 were Cortex, but now I'm not sure.  I looked at the Ghidra definitions in Ghidra/Processors/ARM/data/languages and it seems they're treated very similarly.  I think Cortex might default to Thumb, where v7 doesn't.  Might explain why D works fine for me most of the time?

Quote
...and also for named_functions.idc :-)
Yes, similar thing, should be easy.  Although named_functions doesn't find much for me.  I guess because emulation is quite limited so far.

aprofiti

Found stubs for 800D 1.0.1 and 6D2 1.0.3 6D2 1.0.4; now they have possibility to join the party :)

You should be able to save a log from startup as the other d7 cameras (please test and report).
Next step will be to find bmp_vram_info for hello world code, then start to port ML.

Is there someone who has these cameras and is willing to try bootflag enabler?

edit: Updated 6D2 stubs list to 1.0.4

totalmichel

Quote from: aprofiti on April 04, 2019, 08:22:21 AM
Found stubs for 800D 1.0.1 and 6D2 1.0.3; now they have possibility to join the party :)

You should be able to save a log from startup as the other d7 cameras (please test and report).
Next step will be to find bmp_vram_info for hello world code, then start to port ML.

Is there someone who has these cameras and is willing to try bootflag enabler?

i have an 6D2 but it has the latest firmware 1.0.4

aprofiti

You can try the FIR version of the rom dumper and ask a1ex for bootflag enabler (after that It is possibile to run custom binary on camera).

Then share the dump (send a PM) so we can work on an updated version (time consuming but it should be worth if there is collaboration) for 1.0.4.

totalmichel

a1ex can you send me the bootflag enabler for 6D2?

just finished sending the 1.0.4 dump to aprofiti

buro341

just a supporter here, how are things going guys?  :D

names_are_hard

There is the expected slow progress.  It will likely be several months minimum before anything major happens.

Nicolas Apud


buro341

Thnx for the info. I really don't like ipb for the 77d  :'(

tekrevz

I know this is a naive question. But how quickly /easy would a change to bitrate of the 6dm2 video be. Could you theoretically go into the code and just change the number?

scrax

Quote from: tekrevz on April 16, 2019, 03:12:30 AM
I know this is a naive question. But how quickly /easy would a change to bitrate of the 6dm2 video be. Could you theoretically go into the code and just change the number?
ML don't changes any code in canon firmware, so for any function ML need to be ported for the cam at first, before doing anything
I'm using ML2.3 for photography with:
EOS 600DML | EOS 400Dplus | EOS 5D MLbeta5- EF 100mm f/2.8 USM Macro  - EF-S 17-85mm f4-5.6 IS USM - EF 70-200mm f/4 L USM - 580EXII - OsX, PS, LR, RawTherapee, LightZone -no video experience-

names_are_hard

I'm having problems finding stubs for 200D.  I have almost all of them found (can probably mock out the rest for now), except the EDMAC family, which look quite important.  Does anybody on a Digic 7 cam have any found?  It looks to me that something important changed.  There are very few EDMAC related strings on 200D.  Case insensitive grep for edmac gives me 138 unique strings on 50D, 12 on 200D.

The only one that looks like a function name is WriteEDmacCompleteCBR, but that's not in stubs for other cams and hasn't been a good enough clue for me so far to locate the rest.

names_are_hard

Possibly related, 200D has PCIe related strings, including:

WriteDMAPCIeCom
WriteDMAPCIeCom
ReadDMAPCIeCom
ReadDMAPCIeCom
CompletePCIe_DMA
CompletePCIe_DMA

There are also xdmac strings, not very many, some are close to some PCIe strings.  I'm not convinced there's a link to edmac, but I'll explore further.

calle2010

Quote from: names_are_hard on April 25, 2019, 12:16:49 AM
There are also xdmac strings, not very many, some are close to some PCIe strings.  I'm not convinced there's a link to edmac, but I'll explore further.

Thank you for sharing the information. Currently I have very little time to spend on ML. I think in May I would try to catch up with the 77D stubs based on yours and also try to understand the EDMAC.

names_are_hard

Also perhaps noteworthy, a family of new "lime" strings, eg:

LimeXdmac/XdmacApi.c
LimeSdIo/SdWlanIf/SdWlanIf.c
[NWCOM] Lime WorkLoad DMA
LimeSdIo/SdWlanIf/SdWlanIf.c
platform/lime/sd_wif11n.c

Many, though not all, seem to be wifi related - 200D does have wifi.  So perhaps this is a dma controller for that only, and doesn't replace Edmac?  Or perhaps Canon consolidated all DMA with a new controller.
I found this Fujitsu link which might be relevant, but could just be a naming coincidence:
https://www.fujitsu.com/us/products/devices/semiconductor/gdc/doc/an-dma.html

kitor

As for lime strings, from EOS R:

"NetDomain::LimeKick.c":
"LimeInit":
"Error : bad parameter(LimeClock).":
"Inport(CCLIME_TIC_WDLPS_ADDR) == val":
"Inport(CCLIME_TIC_WDLP_EN_ADDR) == val":

"LimeSdIo/SdDom/SdClk.c":
"LimeSdIo/SdDom/SdCmd.c":
"LimeSdIo/SdDom/SdCommon.c":
"LimeSdIo/SdDom/SdCon.c":
"LimeSdIo/SdDom/SdDebug.c":
"LimeSdIo/SdDom/SdDma.c":
"LimeSdIo/SdDom/SdDom.c":
"LimeSdIo/SdDom/SdIo.c":
"LimeSdIo/SdDom/SdLog.c":
"LimeSdIo/SdDom/SdReg.c":
"LimeSdIo/SdDom/SdResource.c":
"LimeSdIo/SdWlanIf/SdWlanIf.c":
"LimeSdIo/SdWlanIf/SdWlanIfConfig.c":
"LimeXdmac/XdmacApi.c":
"LimeXdmac/XdmacDrv.c":
"LimeIntc.c":
"LimeKick.c":
"CclimeSdIo/TsumSd/SdCmd.c":
"CclimeSdIo/TsumSd/SdCon.c":
"CclimeSdIo/TsumSd/SdDma.c":
"CclimeSdIo/TsumSd/SdIo.c":
"CclimeSdIo/SdWlanIf/SdWlanIf.c":

"[NWCOM] Lime Load Complete For XDmac(Ch=%d)":
"[NWCOM] Lime Load Complete For CPU":
"[NWCOM] LimePanic":
"[NWCOM] LimeExcept":
"[NWCOM] LimeAssert":
"[NWCOM] Lime WorkLoad CPU":
"[NWCOM] Lime WorkLoad (DMA)->CPU":
"[NWCOM] Lime Init":
"[NWCOM] Lime Uninit":

and more. So seems to be related to WiFi / SDIO is used for WiFi card internally (that's interesting)
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

names_are_hard

Thanks for the comparison.  How many edmac strings do you have?  EOS R is Digic 8, it would be interesting if it still had the 100s that old cameras have.  My guess is it'll have 10s like 200D.

kitor

kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i edmac | wc -l
121
kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i pcie | wc -l
70

:)
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

josecarlosss

Hi guys, i am an owner of a Canon 77D, and i was wondering  how can i help to make the magic lantern useable for 77D.

Is there any news about the built for 77D?

Best regards
Stelios

Walter Schulz

Quote from: josecarlosss on May 04, 2019, 02:41:40 AM
Hi guys, i am an owner of a Canon 77D, and i was wondering  how can i help to make the magic lantern useable for 77D.

Build a development environment, startup QEMU, dump ROM files and make your first steps inside the emulator.
Tutorials how to make QEMU run are available.

names_are_hard

Quote from: kitor on April 29, 2019, 09:45:32 PM
kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i edmac | wc -l
121
kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i pcie | wc -l
70

:)

So it seems Digic 7 is the strange one! I have found some DMA related code now, "DmacCh" was a useful string. I can see some possible init code around 0xe007e02c.

kitor

Quote from: Walter Schulz on May 04, 2019, 02:49:20 AM
Build a development environment, startup QEMU, dump ROM files and make your first steps inside the emulator.
Tutorials how to make QEMU run are available.

Walter, I see a similar post from time to time.
Unfortunately (from few years experience working with developers (!, so people who should know the drill) in quite large project), I don't think people who ask those questions does understand problem at all.

For average person installing software on new PC is like... download it and install. They think that the problem is that with their new camera no one yet tried to download and install ML and provide feedback that it works (yup, I'm oversimplifying, but again, experience tells me to expect low unless proven wrong).

We know that ML code doesn't grow on trees. (great quote btw!). But this means nothing even for pro photo/videographers who used ML for living, if they don't have any computer engineering background.

IMO, the real answer should be like:

Quote from: kitor's alter egoUnless you know or want to learn how to do any of this, wait patiently for news containing download links, or grab a camera that is supported now.

Sorry for OT, but something tells me this post may be much better answer for all people asking.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

totalmichel

Im willing to test the bootloader enabler on my spare 6D2 and also run any test

totalmichel

maybe its a dumb question
the 6d2 was a mov 4k codec available for timelapse mode
is there any way to activate it for regular movie without the need to fully develop magic lantern for it? maybe some special code that if the cam turns on on movie mode enables it?