DIGIC 8 'PowerShot' development (M50, SX70, SX740)

[srsa]

Not sure where to post this as it's both DIGIC 7 and 8 related.
I've noticed that D7 and D8 ports still have

Code: [Select]

-march=armv7-rin platform/(cam)/Makefile.platform.default
"armv7-r" means ARM Cortex R. The Cortex R supports integer divide instructions in Thumb mode, whereas the Cortex A9 does not. To avoid getting undefined instruction exceptions in the future, I'd suggest using

Code: [Select]

-march=armv7-ainstead.

[a1ex]

Thanks, I wasn't aware of this difference.

[tn322201]

I am a new comer to magic lantern community. I have successfully dumped the ROM and CPU info from my M50. May I ask what this the next step in the development?

I was trying to use QEMU but do not know how to "clone" it to my computer. Consulting someone with experience could provide me with further steps in development.

Here is the attached CPU info:

Code: [Select]

 
Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/
1900.JPG
 - User PS: ??? ??? ???
 - Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - boot_read_sector 103604
 - boot_write_sector 10361a
 - 10362a: BL 104dc4
 - 10180B Card init => 2
 - Saving RESCUE.LOG ...


[srsa]

Just FYI, Canon has released firmware updates for
EOS M50 (1.0.2)
PowerShot SX740 (1.0.1)
PowerShot SX70 (1.1.0)

[a1ex]

In this case, it's probably best to upgrade the codebase now, while there are not too many stubs and other firmware-specific constants. That could be an easy coding task for newcomers, as it's just a matter of pattern matching between the two firmware versions (and it helps you get familiar, to some extent, with Canon's code structure).

For QEMU, if the main guide is hard to follow, refer to the sticky tweet and other videos on the forum (todo: link them in the guide), then apply the patch linked earlier. I'm cleaning up my local changes and putting them through the test suite for quite some time, but I keep bumping into test failures, so it's taking a bit longer, sorry about that...

As usual, once you are ready to run and debug the proof of concept code on the camera, I'm also ready to enable the boot flag. The procedure was already tested on EOS R, so I don't expect any surprises.

[Greg]

EOS M50 (1.0.2)

Code: [Select]

Firmware Version 1.0.2 incorporates the following fix:
1. Improves reliability of communication with external flashes.
It now works with yongnuo flash triggers.

[a1ex]

Please find the FIR file for enabling the boot flag on the EOS/PowerShot M50:

BOOT_M50.FIR (confirmed by 71m363nd3r; works on any Canon firmware version)

This will modify your camera.

The FIR for enabling the boot flag is expected to work with any Canon firmware version (1.0.1 or 1.0.2 or any future version). However, the code from the digic6-dumper branch ("Hello World") expects firmware 1.0.1; otherwise, it simply won't boot. Support for firmware 1.0.2 is left as an easy coding "qualification" task for whoever is willing to help me on this long jurney.

After enabling the boot flag, you will need to make your card bootable (EosCard/MacBoot/make_bootable.sh) and compile the proof of concept code from the digic6-dumper branch.

Logging code:

Code: [Select]

hg up digic6-dumper -C
cd platform/M50.101
make clean; make

"Hello World" code:

Code: [Select]

hg up digic6-dumper -C
cd minimal/hello-world
make MODEL=M50 clean; make MODEL=M50

"Hello World" binary (for firmware 1.0.1 only): autoexec.bin



Happy April 1st

[KelvinK]

"Hello World" binary (untested, for firmware 1.0.1 only): autoexec.bin

Happy April 1st

Great! Thanks Alex )

[Greg]

[a1ex]

magiclantern-fishy.2019Apr01.M50101.zip

[KelvinK]

Awesome, Alex! Might be the most hardest camera to port?

[a1ex]

It has some bits from PowerShot firmware, which makes it a bit different from all other EOS models. I mean, porting ML is no longer going to be "just" pattern matching; there will be parts of the code requiring wrappers or other "creative" solutions, not required on other models. That's where the difficulty comes from.

Trivial example: I could not find one of the stubs (GUI_Control), so I wrote a function that did the same thing, from scratch. I believe it's present on all regular EOS models (80D, 5D4, 200D, 77D, 7D2 and so on).

Another example - Canon blocked the Delete button in plain LiveView (since it's unused in their firmware in that mode), but I wanted it for ML menu, for consistency with all other models. This camera doesn't have a MPU, but has the PhySw task (like any other PowerShot), i.e. physical button status is directly visible from the main CPU. So, I've used that to detect the Delete button. That trick is not applicable to 80D, 5D4, 200D, 77D and others - these are "classic" EOS firmwares, with MPU. However, I see this as an advantage of the PowerShot firmware - if Canon did the same with the Delete button on say 200D (I don't know if they did or not), I might not be able to find a workaround.

Another quirk: exposure is stored internally in 1/3 EV steps (1 raw unit = 1/3 EV). On DIGIC 5 and earlier models, they use 1/8 EV steps (so 1/3 is actually 3/8, and 2/3 is actually 5/8). Not sure if this applies to other new models, or it might be a M50 quirk; need to check.

Another one: the shooting settings screen (i.e. what looks like plain photo mode on all other EOS models), is now running in LiveView, unlike on M/M2; it just hides the live image. Figure out how to handle it

You'll see these bits once I'll clean up and publish the source code.

Unsure about the EOS R - that one seems closer to "classic" EOS firmware, at first sight. For example, there are signs of a MPU being present, but button handling code looks similar to M50 (or, rather, something in-between M50 and "classic" EOS firmware).

BTW, Greg already sent me the updated stubs for 1.0.2, so the next build will run on latest firmware.

[Sapporo]

I saw the bench.mo in the software. Anyone tried the fastest write speed in play mode?

[Walter Schulz]

Scroll up ...

[a1ex]

That screenshot was with SanDisk Extreme Pro 32GB UHS-I (this one). Didn't try others yet.

I think Walter mentioned something about an overclockable (?) SanDisk somewhere... found:

170 MByte/s is for read only and the only devices known today to use Sandisk's proprietary overclocking mode are Sandisk's newest cardreaders. Running there write rate is indeed higher, too. But with other devices they are only a tad slower compared to 95 MB/s and we don't know if older controllers (used in your M) are able to get unlocked.
See www.cameramemoryspeed.com

Do they have any documentation on this overclocking mode?

[Levas]

Write speed...not bad.
At the moment all I want to know is how fast is this sensor (Mhz) and how many columns does it read simultaneously 

[a1ex]

I believe it's 27 MHz x 12 channels (from the silent picture mode, which runs at about 300 MPix/s).

Code: [Select]

timer A =  534, B = 4061 (6408x4061  12.451 fps?) @ e19ebbd0


[Walter Schulz]

Do they have any documentation on this overclocking mode?

Haven't found anything yet. SanDisk states it is proprietary. A compatible adapter is pretty cheap: SDDR-C531/SDDR-399-G46. Happy re-engineering! ;-)

[Levas]

Nice, faster then 5d3.

Makes the 6K April fools joke (sort of) doable, in 3:1 aspect ratio 
https://www.eoshd.com/2019/04/canon-m50-hacked-features-6k-raw-and-a-i-driven-menus/

[a1ex]

Yeah. I'm rather interested in capturing unpredictable action (i.e. kids), and a 12-fps full-res burst could be exactly what I need. I'm not going to save all these frames - only 2 or 3 of the best ones, as selected by the AI.

The feature is already implemented in the regular silent picture module (Best shots), but is limited to 1080p resolution (and, unfortunately, focus evaluation is broken when using crop_rec).

There is another nice feature in DIGIC 7 and 8  - they both use dual-core Cortex A9, with MMU. That is, we can easily remap the entire ROM contents into RAM and patch it away! You've read that right - it is *trivial* to make *any* temporary changes to ROM contents!

No other camera generation has this ability! DIGIC <= 5 have this ability to a very limited extent ("cache hacks"). All our attempts to unlock this ability DIGIC 6 were... unsuccessful. This (ability to patch the ROM contents) is not required for porting the basic ML functionality, but it is certainly helpful with the advanced stuff (crop_rec, adtg_gui, sd_uhs and others are using it).

Other reasons I've picked this camera:
- EOS firmware (yes, most of its firmware *is* EOS codebase, with some bits from PowerShot - totally different from M3, M5 & others, where the firmware is... PowerShot with a few EOS bits)
- DIGIC 8, 1GB RAM (!)
- form factor, lens compatibility (EF + EF-M + third party adapters), speed booster availability
- working autofocus (I hope; didn't test it yet, but on 5D3 I consider it unusable)
- dual pixel (remember my notes?)
- EOSHD review
- price!

Yep, I've got it to replace the good old 5D3.

[KelvinK]

- price!

Yep, I've got it to replace the good old 5D3.

Ok Alex, when we can go to the shop and buy it ... with ML on board? Honestly never thought my next camera could be "M"... in world of Fuji&Sony alternatives 

[a1ex]

I'm not selling preinstalled versions of ML, sorry. You can install it yourself - EOSHD already did, and I hope he's not the only one

The "when" question is well covered in the FAQ and previous topics, but I'm trying to find a way to speed up the process.

[KelvinK]

I know about "when", just kidding  Just happy with fact there's some "visual" progress after 2 or even 3 years of researching.

What's difference that M50 has EOS firmware?

[a1ex]

... one doesn't have to rewrite ML from scratch.

[shadimar69]

You can install it yourself - EOSHD already did, and I hope he's not the only one

Not the only one to try it... I love living on the bleeding edge!
We are all really looking forward to seeing where this beautiful work will end up... Thank you very much @a1ex for all your hard work so far!