Canon EOS R / RP

[coon]

I've applied the M50 DIGIC8 QEMU draft patch by alex (https://www.magiclantern.fm/forum/index.php?topic=23296.msg210088#msg210088) and used the M50 instead of 200D as a template for the RP.
It immediately crashed on the first try with the following error:

Code: [Select]

qemu-system-arm: /home/nimble-test/ML/qemu-eos/qemu-2.5.0/hw/arm/../eos/eos.c:2568: eos_handle_card_led: Assertion `s->card_led' failed.

After changing the RPs LED Address in model_list.c from M50 to 200D it is now booting even further. It is now booting the second core of the CPU and locks up a little bit later then before:

Code: [Select]

00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F1FFFFFF: eos.rom1
F2000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling memory access logging (RW).
[EOS] loading './EOSRP/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './EOSRP/ROM1.BIN' to 0xF0000000-0xF1FFFFFF
[MPU] FIXME: using generic MPU spells for EOSRP.
[MPU] FIXME: no MPU button codes for EOSRP.
Start address: 0xE0000000
Setting BOOTDISK flag to 0
[CPU0] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[ROMCPY] 0xE0008634 -> 0xDF001000 size 0x600      at 0xE000699C
Logging ROM-copied blocks to EOSRP/romcpy.sh.

[CPU0] E00084D8: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004C50: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E00049A6: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
[ROMCPY] 0xE0008C34 -> 0xDF000000 size 0x100      at 0xE0004966
BootL[ROMCPY] 0xE0008D50 -> 0x40100000 size 0x116D4    at 0xE0007F4C
[ROMCPY] 0xE0000000 -> 0x40700000 size 0x4900     at 0x10F46C 
oade[CPU0] 001008F6: MCR p15, ...          : CACHEMAINT x584 (omitted)
[CPU0] E0040000: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE073A000
[CPU0] E004000A: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
Wake up CPU1
Wake up CPU1
[ROMCPY] 0xE12F43EC -> 0x4000     size 0x247CC    at 0xE004003C
[CPU1] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU1] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU1] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU1] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU1] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU1] E0004C40: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU1] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004880
[CPU1] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU1] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x1       
[CPU1] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU1] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU1] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU1] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU1] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU1] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU1] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU1] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU1] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU1] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU1] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU1] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU1] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU1] E0004AA2: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C5187D
[CPU1] E0004AA2: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5107D
[ROMCPY] 0xE1318BB8 -> 0x223B000  size 0xD1748    at 0xE0040050
[CPU0] E0040104: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[ROMCPY] 0xE13EA300 -> 0xDF002800 size 0xB94      at 0xE0040088
K433 READY
        4:4294966.271 [EEP] InstEEP: Rng_MDS(0x0 != 0x8000)
        5:4294966.271 [EEP] InstEEP: Srvc_MDS(0x0 != 0x100)
        8:4294966.271 [EEP] Rng_EEPH_RDS Invalid:0x0
        9:4294966.271 [EEP] Srvc_EEPH_RDS Invalid:0x0
       12:4294966.271 [STARTUP] K433 ICU Firmware Version 1.5.0 ( 3.8.7 )

romcpy does now generate a few more address:

Code: [Select]

dd if=ROM0.BIN of=EOSRP.0xDF001000.bin bs=1 skip=$((0x8634)) count=$((0x600))
dd if=ROM0.BIN of=EOSRP.0xDF000000.bin bs=1 skip=$((0x8C34)) count=$((0x100))
dd if=ROM0.BIN of=EOSRP.0x40100000.bin bs=1 skip=$((0x8D50)) count=$((0x116D4))
dd if=ROM0.BIN of=EOSRP.0x40700000.bin bs=1 skip=$((0x0)) count=$((0x4900))
dd if=ROM0.BIN of=EOSRP.0x4000.bin bs=1 skip=$((0x12F43EC)) count=$((0x247CC))
dd if=ROM0.BIN of=EOSRP.0x223B000.bin bs=1 skip=$((0x1318BB8)) count=$((0xD1748))
dd if=ROM0.BIN of=EOSRP.0xDF002800.bin bs=1 skip=$((0x13EA300)) count=$((0xB94))

This is my current EOSRP definition in models_list.c:

Code: [Select]

{
        .name                   = "EOSRP",
        .digic_version          = 8,
        .ram_size               = 0x40000000,   /* 1GB */
        .card_led_address       = 0xD208016C,   // 200D /* WLAN LED 0xD2080190 */
        .current_task_addr      = 0x28,         /* fixme: read from virtual memory */
        .uart_rx_interrupt      = 0x15D,
        .uart_tx_interrupt      = 0x16D,
        .rom0_size              = 0x02000000,   /* 32MB (main ROM) */
        .rom1_size              = 0x02000000,   /* 32MB (secondary ROM) */
        .dedicated_movie_mode   = 0, // camera has support for it. Set to 1 later.
    },


[coon]

Not sure if it helps, but when executing qemu with firmware="boot=1" with a bootflag enabled sd card image with Magic Lantern on it, I get some SDIO errors and I can see that it is trying to execute AUTOEXEC.BIN before it locks up:

Code: [Select]

00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F1FFFFFF: eos.rom1
F2000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] loading './EOSRP/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './EOSRP/ROM1.BIN' to 0xF0000000-0xF1FFFFFF
[MPU] FIXME: using generic MPU spells for EOSRP.
[MPU] FIXME: no MPU button codes for EOSRP.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878

[CPU0] E00084D8: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004C50: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E00049A6: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
BootLoad[SDIO] Error
[SDIO] Error
Now jump to AUTOEXEC.BIN(0x00800000)!!

I think I am now at a point where I have to dive deeper into how the initialization process works and how to find out the proper device addresses / RAM size etc. to get even further on the boot process.

[aprofiti]

I suggest you to start reading posts from Digic 7 development thread, it has very useful information on how progress was made by other users to make digic6-dumper branch to work on D7 cameras and will help you to have an idea on what to do to start porting ML for EOS RP.

Starting from here there are some of my previous posts of me understanding how to port code to 77D using only emulator as I don't have a real camera, also looks for posts from calle2010 who kept progressing the work.

After that you will like to print an Hello World on EOS RP and share a picture!

I think I am now at a point where I have to dive deeper into how the initialization process works and how to find out the proper device addresses / RAM size etc. to get even further on the boot process.

Does the emulation looks like it keep running or instead it hangs up?

You can also try to improve emulation for Digic X camera to have Canon GUI to render and navigate from QEMU, here you would certainly like some hints from a1ex to address you into the right direction

[coon]

Will check the Digic 7 thread out, thanks for that advice!
Actually I am already able to print hello world on the physical RP since ML recovery already boots. It just doesen't run in the emulator yet.

QEMU doesn't segfault but seems to wait for something after it has passed the bootloader and gets stuck when executing the actual firmware:



Maybe I should do a dump of both UART interfaces of the physical RP to have an idea what should happen next. But for that I need a 0.4mm 8pin FPC cable first. It is like impossible getting such... At least in an affordable way. :/.

[coon]

Just found out that AUTOEXEC.BIN is actually executed and Magic Lantern Rescue code does already run on RP firmware within QEMU.
Emulated display does work, which meight help in finding stubs.



A first milestone I want to achieve is getting the portable dumper running. Even if technically not necessary due to the possibility of dumping via canon basic it will give me some practice in finding stubs hopefully.
After that I'll try getting the cpuinfo code running, do a dump of it on the real hardware and post its output here.

[srsa]

After that I'll try getting the cpuinfo code running, do a dump of it on the real hardware and post its output here.

If you do that, please use the updated code from CHDK svn. The old Cortex R4 specific code is not very useful on Cortex A9.

[nikfreak]

some auto-method to find / extract stubs would be handy now

[coon]

If you do that, please use the updated code from CHDK svn. The old Cortex R4 specific code is not very useful on Cortex A9.

Good to know, I will do that, thx!

some auto-method to find / extract stubs would be handy now

Back in the days when I have written some Gametrainers I have used a simple pattern matching algorithm for an almost game version independent way to apply a code injection to a specific code location. Maybe I can modify and use that for ML as an automated way to find stubs. However, the found stubs should always be reviewed by a developer before running them on real HW since pattern matching meight not always work 100% correct.

[names_are_hard]

For automating stub hunting...  Ghidra has a Python scripting engine (well, Jython.  Or native Java).  That gives you access not just to the disassembly, but the decompiled forms.  I believe you can also access Ghidra's IL, Pcode.  So you can in theory do some pretty cool searches and comparisons.  You can do this from the CLI, you can spin up Ghidra without needing to start the frontend.

[coon]

Got CPU info of RP dumped via Canon Basic Dumper script and parsed via x86 port of CHDK cpuinfo tool:

Code: [Select]

ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
TLB type   0x00000404
  TLB                  0x0 0 [Unified TLB]
  TLB entries          0x2 2 [256]
  -                    0x0 0
  Lockable unified or data entries 0x4 4
  Lockable instruction entries 0x0 0
  (zero)               0x0 0
TTBCR      0x00000007
  N                    0x7 7 [TTBR0 table size 128 bytes]
  (zero)               0x0 0
  TTBR0 walks disabled 0x0 0
  TTBR1 walks disabled 0x0 0
  (zero)               0x0 0
  Long descriptors     0x0 0
TTBR0      0xE0004800
  IRGN[1]              0x0 0
  Shareable            0x0 0
  (impl. defined)      0x0 0
  RGN (Outer cacheability) 0x0 0
  NOS (Inner shareable) 0x0 0
  IRGN[0]              0x0 0
  Table address        0x1C00090 29360272 [0xe0004800]
TTBR1      0xE0000000
  IRGN[1]              0x0 0
  Shareable            0x0 0
  (impl. defined)      0x0 0
  RGN (Outer cacheability) 0x0 0
  NOS (Inner shareable) 0x0 0
  IRGN[0]              0x0 0
  Table address        0x1C00000 29360128 [0xe0000000]
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Revision ID 0x00000000
  (raw value)          0x0 0
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  Virt. extensions     0x0 0
  Generic timer ext.   0x0 0
  -                    0x0 0
Debug feature 0x00010444
  Coproc. dbg model    0x4 4
  Coproc. secure dbg model 0x4 4
  Memory-mapped dbg model 0x4 4
  Coproc. trace model  0x0 0
  Memory-mapped trace model 0x1 1
  Debug model M        0x0 0
  Perf. monitors       0x0 0
  -                    0x0 0
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1 [Supported]
  Cache maintain set/way 0x1 1 [Supported]
  Branch predictor maintenance 0x1 1 [Invalidate all]
  Maintenance broadcast 0x2 2
  -                    0x0 0
  Transl. table coherent walk 0x1 1
  Cached memory size   0x0 0 [4 GByte]
  Supersection support 0x0 0 [Supported]
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Level of unification Inner Shareable 0x1 1
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MMU Enable           0x1 1
  Strict Align         0x0 0
  Data or Unified Cache Enable 0x1 1
  CP15 Barrier Enable  0x1 1
  - (SBO)              0x7 7
  - (SBZ)              0x0 0
  SWP/SWPB Enable      0x0 0
  Branch Pred Enable   0x1 1
  ICache Enable        0x1 1
  High Vector          0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  HA flag              0x0 0
  - (SBO)              0x1 1
  WXN (virt. ext. only) 0x0 0
  UWXN (virt. ext. only) 0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VE                   0x0 0
  CPSR E               0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  - (SBZ)              0x0 0
ACTLR      0x00000045
  Cache & TLB maint. broadcast 0x1 1
  L2 prefetch enable   0x0 0
  L1 prefetch enable   0x1 1
  Write full line of zeroes 0x0 0
  (zero)               0x0 0
  SMP                  0x1 1
  Exclusive cache      0x0 0
  Alloc in one way     0x0 0
  Parity on            0x0 0
  -                    0x0 0
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (zero)               0x0 0
  CP10 access permission 0x0 0
  CP11 access permission 0x0 0
  (zero)               0x0 0
  D32DIS               0x1 1
  ASEDIS               0x1 1
DACR       0x0000C000
  (raw value)          0xC000 49152
NSACR (sec. ext. only) 0x55555555
  (raw value)          0x55555555 1431655765
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0
Config base addr reg 0xC1000000
  (raw value)          0xC1000000 -1056964608
PLEIDR     0x00000000
  (raw value)          0x0 0
TLB lockdown reg 0x00000000
  (raw value)          0x0 0
PRRR       0x00098AA4
  (raw value)          0x98AA4 625316
NMRR       0x44E048E0
  (raw value)          0x44E048E0 1155549408



[Corallaro]

Great work!! Wonderful!!
I also have an EOS RP and I am available to test.
I've been using ML on EOS M for a while
Thank you
Giovanni

[coon]

Like already mentioned here: https://www.magiclantern.fm/forum/index.php?topic=25305.msg231013#msg231013

I've ran this Canon Basic script on my RP:

Code: [Select]

private sub Initialize()
    System.Create()
    CamInfo_Debug(1)
end sub

Which has generated a CAM_INFO.XML file with the following content:

Code: [Select]

<?xml version="1.0"?>
<Canon>
    <CameraInfo>
        <Serial>xxxxxxxxxxxx</Serial>
        <FirmwareVer>
            <Internal>0.3.8.7</Internal>
            <Major>1.5.0</Major>
        </FirmwareVer>
        <ErrorList></ErrorList>
        <TotalShoot>1780</TotalShoot>
        <TotalShutter>1086948659</TotalShutter>
        <PowerOnCount>229</PowerOnCount>
        <TotalRunningTime>148394</TotalRunningTime>
    </CameraInfo>
</Canon>

TotalShutter value seems to be invalid here. Could someone else with an RP run that script too and post the results here?

[kitor]

Unless it counts every movie frame as one shot 
Suspicious is that looks like just signed 32 bit integer.
Using only half MSB gives 8393 base 10, which is more realistic, but still huge compared to total shots.
I'll try later on R.

[Corallaro]

Hi
if you tell me step by step instruction how to execute script with my EOS RP, i can make the test.
Ciao
Giovanni

[kitor]

Code: [Select]

<?xml version="1.0" encoding="UTF-8"?>
<Canon>
   <CameraInfo>
      <Serial>xxxxxxx</Serial>
      <FirmwareVer>
         <Internal>0.7.3.5</Internal>
         <Major>1.7.0</Major>
      </FirmwareVer>
      <ErrorList>
         <Kind>
            <ID>E01</ID>
            <Count>4</Count>
            <ErrorLog>
               <BatTemperature>max:0 min:0</BatTemperature>
               <FirstOccurTime>2019.07.26 19:26:06</FirstOccurTime>
               <LastOccurTime>2019.07.27 08:52:14</LastOccurTime>
               <Log>
                  <DateTime>2019.07.27 08:52:14</DateTime>
                  <Reason>DS-EID:061</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2228</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.27 08:51:47</DateTime>
                  <Reason>DS-EID:061</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2224</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.26 19:26:19</DateTime>
                  <Reason>DS-EID:064</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2204</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.26 19:26:06</DateTime>
                  <Reason>DS-EID:063</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2204</ReleaseCount>
               </Log>
            </ErrorLog>
         </Kind>
         <Kind>
            <ID>E70</ID>
            <Count>1</Count>
            <ErrorLog>
               <BatTemperature>max:0 min:0</BatTemperature>
               <FirstOccurTime>2020.09.02 15:03:04</FirstOccurTime>
               <LastOccurTime>2020.09.02 15:03:04</LastOccurTime>
               <Log>
                  <DateTime>2020.09.02 15:03:04</DateTime>
                  <Reason>DS-EID:101</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>0102eefe</LensID>
                  <ReleaseCount>3018</ReleaseCount>
               </Log>
            </ErrorLog>
         </Kind>
      </ErrorList>
      <TotalShoot>3019</TotalShoot>
      <TotalShutter>2845</TotalShutter>
      <PowerOnCount>890</PowerOnCount>
      <TotalRunningTime>115710</TotalRunningTime>
   </CameraInfo>
</Canon>
There are some interesting logs here

Hi
if you tell me step by step instruction how to execute script with my EOS RP, i can make the test.
Ciao
Giovanni

Look at linked topic. There's everything explained in first post.

[c_joerg]

https://www.magiclantern.fm/forum/index.php?topic=25305.0

TotalShutter value seems to be invalid here. Could someone else with an RP run that script too and post the results here?

Have you tried to make one shoot and  a second dump?     

[c_joerg]

There are some interesting logs here

Du you use original Batterie?
BatTemperature is always 0.

[kitor]

Yes and no. I have two 100% original LP-E6N, and two LP-E6 that looks original but were bought in China a few years ago. Still holds charge properly and I never had problems with those in 5D2, 5D3 and now in R.

But IIRC I fixed some old non-Canon battery that had cold solder joints inside, this may be it. I can't put it exactly in time, but this was for sure not when I played with ML.
ERR70 was a result of my broken Basic script.

[c_joerg]

ERR70 was a result of my broken Basic script.

Then try it again with original LP-E6N,

[kitor]

No, it was an actual error in script code. I made a rom dump just before that (and on those LP-E6's as N were discharged so bad I had to charge them externally), and started experimenting with calling some functions

[coon]

https://www.magiclantern.fm/forum/index.php?topic=25305.0
Have you tried to make one shoot and  a second dump?     

I'll give it a shot (pun intended).

[coon]

Code: [Select]

<?xml version="1.0"?>
<Canon>
    <CameraInfo>
        <Serial>xxxxxxxxxxxx</Serial>
        <FirmwareVer>
            <Internal>0.3.8.7</Internal>
            <Major>1.5.0</Major>
        </FirmwareVer>
        <ErrorList></ErrorList>
        <TotalShoot>1781</TotalShoot>
        <TotalShutter>1086948660</TotalShutter>
        <PowerOnCount>232</PowerOnCount>
        <TotalRunningTime>148548</TotalRunningTime>
    </CameraInfo>
</Canon>

Counter increased by one but is still invalid.
It should be below 1781 since I have done some bracketing shots which are taken by electronic shutter.

[c_joerg]

Counter increased by one but is still invalid.

Intresting...
Maybe the memory is brocken.
Would be intresting to see a dump from an other RP.

[coon]

Unless it counts every movie frame as one shot 
...

I have recorded a video for a few seconds, just to be sure. ShutterCount stays the same here.

[Corallaro]

Hi
this is the CAM_INFO.XML of my RP

Code: [Select]

<?xml version="1.0"?><Canon>
<CameraInfo>
<Serial>xxxxxxxxxxxx</Serial>
<FirmwareVer>
<Internal>0.3.8.7</Internal>
<Major>1.5.0</Major>
</FirmwareVer>
<ErrorList><Kind><ID>E60</ID><Count>1</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.02.02 17:40:00</FirstOccurTime><LastOccurTime>2020.02.02 17:40:00</LastOccurTime><Log><DateTime>2020.02.02 17:40:00</DateTime><Reason>DS-EID:067</Reason><BatTemperature>0</BatTemperature><LensID>010aeefe</LensID><ReleaseCount>7759</ReleaseCount></Log></ErrorLog></Kind></ErrorList>
<TotalShoot>12292</TotalShoot>
<TotalShutter>1086959388</TotalShutter>
<PowerOnCount>1127</PowerOnCount>
<TotalRunningTime>441761</TotalRunningTime>
</CameraInfo>
</Canon>