Author Topic: Canon EOS R / RP  (Read 74047 times)

garry23

  • Contributor
  • Hero Member
  • *****
  • Posts: 2075
Re: Canon EOS R / RP
« Reply #175 on: October 06, 2020, 11:35:17 PM »
@srsa

Thanks for the insight.

BTW I looked over on the CHDK site and now understand the limitations of Canon Basic.

Cheers

Garry

Nigel95

  • New to the forum
  • *
  • Posts: 13
Re: Canon EOS R / RP
« Reply #176 on: October 06, 2020, 11:38:08 PM »
I don't get the colors right yet, but I can draw proper shapes on the screen. We have debug output now. :)


Great to see progress. As a noob I am wondering. In terms of any basic first version that requires testing. Is the current stage at something like 5% progress, 20%?
Is it possible at all to tell?

In no way I'm trying to push just curious how to interpret some posts over here as a noob. I will just think like there will never be a ML on this cams :) Thanks for the hard work.

names_are_hard

  • Contributor
  • Senior
  • *****
  • Posts: 294
  • 200D idiot
Re: Canon EOS R / RP
« Reply #177 on: October 07, 2020, 01:03:17 AM »
Early, 1% perhaps.  There is no real way to tell.  This is a puzzle game, you don't know how many levels there are, and you don't know if one of the levels will be a puzzle that is too hard for you to solve.

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #178 on: October 07, 2020, 11:14:18 AM »
All what we have done so far (and are still doing) is preparatory work so we will have a fundament for beginning the actual ML port.

What happened until now:
- FIR encryption on newer models has changed so we had no easy option anymore (only UART) to set the boot flag, which is required for ML to boot. Luckily Canon Basic support has been added which allowed it again, so we used it.

- Portable dumper was bootable after finding some required routines in the original firmware and after a little fix in the display code. This showed that we can execute arbitrary code in general. However, portable dumper starts before the firmware has booted and all hardware is initialized. Most of the cameras functions cannot be used at this stage. Therefore our next goal was to boot digic6-dumper, which is a minimal version of ML.

- After finding some more routines in the firmware we were able to boot digic6-dumper and let the SD card access LED blink. We can now execute arbitrary code while hardware is initialized. We can also use the LED to give us some feedback of what our code does.

- We found out where the frame buffers are and what their image format is. We are now able to draw on the screen and can use it for a very convenient debug output.

What happens next:
- Find out how the buttons work, so we can interact with our code and don't have to compile a new firmware every time if we want to test something. Maybe implementing some interactive RAM dumper where target address and dump size can be set by user for example. We could also use that to write to specific RAM addresses, to test if we found correct hardware addresses.
- Get stock firmware of RP run in QEMU.


Great to see progress. As a noob I am wondering. In terms of any basic first version that requires testing. Is the current stage at something like 5% progress, 20%?
Is it possible at all to tell?

In no way I'm trying to push just curious how to interpret some posts over here as a noob. I will just think like there will never be a ML on this cams :) Thanks for the hard work.

I don't expect anything usable before mid 2021.
EOS RP

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7616
Re: Canon EOS R / RP
« Reply #179 on: October 07, 2020, 11:30:57 AM »
What you wrote:

I don't expect anything usable before mid 2021.

What average user reads
Quote
You have the right to go ballistic if there isn't a full working ML at 01.07.2021 00:00:01.

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #180 on: October 07, 2020, 11:59:03 AM »
And then what? I am doing this in my free time. I am doing this to make my fancy camera even more fancy. Other people may profit from that as well. Nobody pays me so I don't owe someone something.

What I have meant: An unstable ML with minimal features, which I wouldn't recommend for daily use, could be available at the earliest mid 2021 for alpha testing, if we are very very lucky.
EOS RP

theBilalFakhouri

  • Contributor
  • Hero Member
  • *****
  • Posts: 543
  • I am not active currently
Re: Canon EOS R / RP
« Reply #181 on: October 07, 2020, 12:34:59 PM »
I don't owe someone something.

Of course, some users might build their dreams in that date you gave, like We will have 4K RAW capability on EOS RP in mid 2021! or something like that, they would think you gave a promise at that date, be prepared for some aggressive users :P

Otherwise the most users understand what porting ML is, and they understand what you mean.

Nice work by the way! :D
700D 1.1.5 | no more ISOless LV err 8 / SDR104 @ 240 MHz - Constant! | Fixed Scrambled LiveView in Higher resolution | Real-Time correct framing in the Way

Nigel95

  • New to the forum
  • *
  • Posts: 13
Re: Canon EOS R / RP
« Reply #182 on: October 07, 2020, 01:40:38 PM »
Good to clarify this up indeed. Work on the project whenever you want and try to enjoy it as much as possible. If you and others ever succeed to put ML on this camera that would be amazing! And if it doesn't get to that stage. Well at least you had fun in it if you work on it when you want and you also learned something along the way.

BTW is there a reason why ML is free? Has this something to do with Canon to avoid any law suits?

If it takes so much work for developers I think it would be fair to compensate them for firmware that works properly. (if it's stable and sort of reliable). Maybe people don't like to donate in advance in the hope there ever will be ML on a cam. Although for 'stable firmware' I think people would like to pay some money? This would be nice for developers to earn a bit of money by doing their hobby. It's probably not enough for all the hours that go into it. But it's always nice to gain a little bit of money by doing what you love.

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7616
Re: Canon EOS R / RP
« Reply #183 on: October 07, 2020, 01:49:43 PM »
If it takes so much work for developers I think it would be fair to compensate them for firmware that works properly. (if it's stable and sort of reliable). Maybe people don't like to donate in advance in the hope there ever will be ML on a cam. Although for 'stable firmware' I think people would like to pay some money?

Lookup your fallacy here. Poll result: https://mobile.twitter.com/autoexec_bin/status/1182941915337150464

Nigel95

  • New to the forum
  • *
  • Posts: 13
Re: Canon EOS R / RP
« Reply #184 on: October 07, 2020, 03:09:12 PM »
Lookup your fallacy here. Poll result: https://mobile.twitter.com/autoexec_bin/status/1182941915337150464

To lazy to read it all. Based on what I know about fallacies. I would assume you mean faulty generalization. Good one, it was my own opinion and shouldn't sell it as the opinion of a larger sample :)

Your comments make me laugh sometimes on the forum here. To the point although a bit cocky. Maybe it's the result of all the noob questions here. Maybe it's the way you are as a person. Or both?

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #185 on: October 11, 2020, 06:21:01 PM »
Finding button states in RAM is not an easy task (at least for me) so after hours of searching I have given up that route for now and did some research on the MPU instead.
I have used this post from a1ex as a reference: https://magiclantern.fm/forum/index.php?topic=2864.msg169517#msg169517

By reading mpu_recv_ring_buffer and using the LCD to display all received mpu messages I have retreived almost all button codes of RP:

Code: [Select]
Power Switch:               0x00 => params: on: 0x01, off: 0x00
half shutter:               0x05
shutter:                    0x06
* AE-Lock/FE-Lock           0x07
AF-ON:                      0x08
AF Point/Index/Magnify:     0x0B
M-Fn:                       0x0C
Q/set:                      0x0D
menu:                       0x0E
Playback:                   0x0F
info:                       0x10
Trashcan:                   0x11
movie shooting:             0x14
up:                         0x15
down:                       0x16
right:                      0x17
left:                       0x18
Main dial:                  0x19 => params: clockwise: 0x01, anti clockwise: 0xFF
Quick control dial:         0x1A => params: clockwise: 0xFF, anti clockwise: 0x01
multi-function lock switch: 0x1B
Mode dial:                  0x23 => params:
  0x01: C1
  0x02: Tv
  0x05: Movie
  0x06: P
  0x07: SCN
  0x08: Manual
  0x09: C2
  0x0A: Av
  0x0C: Bulb
  0x0D: C1
  0x0E: Fv
  0x0F: Auto

Reading mpu ring buffer via polling should make simple helper menus for convenient developing possible now.
EOS RP

71m363nd3r

  • New to the forum
  • *
  • Posts: 35
Re: Canon EOS R / RP
« Reply #186 on: October 12, 2020, 05:24:04 AM »
nice work coon!  8)

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #187 on: October 22, 2020, 12:11:57 AM »
As already mentioned in Battery grip pins / UART Thread, I've managed to get access to physical UART on RP without the need of disassembling the camera. I have found out the following pinout so far:

Code: [Select]
1: (Unknown traffic on boot) (1v8)
2: Maybe RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7: Unknown (3v3)
8: Unknown (3v3)

Here is some UART traffic I have received:

MPU output when switching on camera:
Code: [Select]
RSTFLG : 0010
E0ON
E1ON
openBattery

MON>>>sw task Initialize Complete
/USB_DET undetected
batt task Initialize Complete
adapter task Initialize Complete
temp_task.c:356 I2C Comm Error ret=1
disp task Initialize Complete
acc task Initialize Complete
setCCSnkRst
temp task Initialize Complete
Main Task receive from ICU ptr(0x20003940) size=0x04 cmmand=0x01 dataId=0x00
================SD send recode 0 0
Main Task receive from ICU ptr(0x20003940) size=0x0A cmmand=0x02 dataId=0x10
temp_task.c:421 I2C Comm Error ret=1
Main Task receive from ICU ptr(0x20003940) size=0x0B cmmand=0x0C dataId=0x00
Main Task receive from ICU ptr(0x20003940) size=0x0B cmmand=0x0C dataId=0x00
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1

I don't know why there are so many I2C errors. Maybe because I didn't had any lens attached.

ICU output when switching on camera:
Code: [Select]
BootLoade[00]K433 READY
       31:      8.828 [STARTUP] K433 ICU Firmware Version 1.5.0 ( 3.8.7 )
      169:    116.237 [BATCHK] ERROR PROP_ACTIVE_SWEEP_STATUS : 0
      178:    116.696 [BATCHK] ERROR PROP_ACTIVE_SWEEP_STATUS : 0
      570:    155.915 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0
      980:    250.283 [PROPAD] ERROR GetPropertyData ID (0) = 0x0E090000
      981:    250.289 [PRP] ERROR NotFoundID:0x0E090000,Func:0xE0447AA4
     2002:    497.515 [GUI] ERROR m_hThisBDialog NULL !!
     2003:    497.645 [GUI] ERROR RefreshAfFrameSelectDialog NULL !!
     2083:    634.894 [FM] EV_INSERTION_COMPLETE : ID = 1(0), stat = 8192
     2337:    853.225 ------------------------------
     2338:    853.233 Camera Flag Current Setting
     2339:    853.238 ------------------------------
     2340:    853.242       14 Mode ON
     2341:    853.266 ------------------------------
     2427:    900.955 [GUI] ERROR RefreshAfFrameSelectDialog NULL !!
     2514:    948.596 ERROR [MEM] Over Permanet Memory cache 48 18100

Now this is a bit disappointing. I was expecting a more detailed output here. When using QEMU with gdb attached I can see some NotifyComplete messages. These would be interesting to see on real HW. Is there a way to enable those?
EOS RP

deviousfusion

  • Just arrived
  • *
  • Posts: 1
Re: Canon EOS R / RP
« Reply #188 on: October 30, 2020, 12:41:13 PM »
Interesting. Shutter count also broken here or has some encoding scheme.
Thanks for providing this!

Could you edit your post and wrap the XML output into code blocks like this?

[code]
<xml code here>
[/code]

It's easier to read like this.

It meight be interesting getting a dump of a fresh RP with 0 shots taken to find out the origin value. But it will be very hard to find such I guess...

Not sure if this is still applicable or needed, but I just bought a RP and have taken a single shot. Here is my XML:
Code: [Select]
<?xml version="1.0"?>
  <Canon>
    <CameraInfo>
      <Serial>XXXXX</Serial>
      <FirmwareVer>
        <Internal>0.3.8.7</Internal>
        <Major>1.5.0</Major>
      </FirmwareVer>
      <ErrorList></ErrorList>
      <TotalShoot>1</TotalShoot>
      <TotalShutter>1086947310</TotalShutter>
      <PowerOnCount>16</PowerOnCount>
      <TotalRunningTime>1829</TotalRunningTime>
    </CameraInfo>
  </Canon>

Based on this the origin value appears to be 1086947309

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #189 on: November 20, 2020, 08:58:09 PM »
Canon has released Firmware Update 1.6.0 for RP recently which I have applied today. Canon Basic does still work. I have taken a dump already.

I also got some E70 errors in the error log, which I have triggered in the past by my code accidentally:

Code: [Select]
<ErrorList>
  <Kind>
  <ID>E70</ID>
  <Count>4</Count>
  <ErrorLog>
    <BatTemperature>max:0 min:0</BatTemperature>
    <FirstOccurTime>2020.10.03 00:28:07</FirstOccurTime>
    <LastOccurTime>2020.11.20 21:05:14</LastOccurTime>
    <Log>
      <DateTime>2020.11.20 21:05:14</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1844</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.24 00:47:12</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1833</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.24 00:46:04</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1833</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.03 00:28:07</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1830</ReleaseCount>
    </Log>
  </ErrorLog>
  </Kind>
</ErrorList>

I have triggered them when trying to read from memory >= 0x8000000 via DMA access. I think these memory regions may be read via buffered reads.

Downgrade back to 1.5.0 was possible out of the box. No battery door trick or similiar was needed.
EOS RP

coon

  • Contributor
  • New to the forum
  • *****
  • Posts: 44
Re: Canon EOS R / RP
« Reply #190 on: November 27, 2020, 08:49:11 PM »
Not sure if this is still applicable or needed, but I just bought a RP and have taken a single shot. Here is my XML:
Code: [Select]
<?xml version="1.0"?>
  <Canon>
    <CameraInfo>
      <Serial>XXXXX</Serial>
      <FirmwareVer>
        <Internal>0.3.8.7</Internal>
        <Major>1.5.0</Major>
      </FirmwareVer>
      <ErrorList></ErrorList>
      <TotalShoot>1</TotalShoot>
      <TotalShutter>1086947310</TotalShutter>
      <PowerOnCount>16</PowerOnCount>
      <TotalRunningTime>1829</TotalRunningTime>
    </CameraInfo>
  </Canon>

Based on this the origin value appears to be 1086947309

Sorry, I have overlooked your answer until now. Thanks for that interesting information! Yes, it seems the shutter count starts at 1086947309 for some reason.
EOS RP