Author Topic: DIGIC 8 'PowerShot' development (M50, SX70, SX740) (Read 226717 times)

Ant123 · « **Reply #50 on:** January 08, 2019, 06:43:39 PM »

SX70HS

nikfreak · « **Reply #51 on:** January 08, 2019, 06:48:54 PM »

Canon PowerShot G1 X Mark III

nikfreak · « **Reply #52 on:** January 08, 2019, 06:53:50 PM »

EOS M5?

dfort · « **Reply #53 on:** January 08, 2019, 08:41:13 PM »

Somebody here got it right.

a1ex · « **Reply #54 on:** January 08, 2019, 10:39:27 PM »

Yes, it's a Canon. Yes, it has DIGIC 8 on board. Yes, it has a 4:3 screen.

Quote from: Ant123 on January 08, 2019, 06:43:39 PM

SX70HS

... running EOS firmware!

Quote from: srsa on January 08, 2019, 05:45:21 PM

@a1ex Can it save files yet?

Yes, just got a ROM dump.

Dumper (really hackish): SX70DUMP.FIR. I'll upload a nicer one later. I've used g3gg0's FullFAT-based dumper from the "recovery" branch; other than that, it was code written for M50 running from bootloader context.

The SX740 probably belongs to the same group, according to CHDK folks; I didn't look into it yet.

Have fun!

P.S. QEMU patches for M50 (linked earlier) worked out of the box for the SX70 bootloader:

Walter Schulz · « **Reply #55 on:** January 08, 2019, 11:05:45 PM »

Where does EOS R fit in? DiGiC 8 but EOS or Powershot codebase or mixed-breed?

a1ex · « **Reply #56 on:** January 08, 2019, 11:14:29 PM »

I did not see the EOS R firmware yet, but previous experiments suggest it might be significantly different from the smaller models.

Though I'm tempted to repeat the tests, now that we've got the display working.

leathc · « **Reply #57 on:** January 09, 2019, 03:53:26 AM »

Quote from: a1ex on January 03, 2019, 06:09:06 PM

The M50 also has a serial flash, so one of the next steps is dumping its contents (easy; one way is to adapt this code on the minimal codebase, which is not able to load modules yet, and the other is to work from the "recovery" branch, i.e. directly from bootloader). Probably not a very straightforward task for a newcomer, but it's not very hard either.

Did this ever get done? I have to say, it's certainly not very straightforward.

I have the green screen running on QEMU for the M50, but I can't get the screen you posted.

LebedevRI · « **Reply #58 on:** January 09, 2019, 09:32:15 AM »

Quote from: a1ex on January 08, 2019, 10:39:27 PM

Quote from: Ant123 on January 08, 2019, 06:43:39 PM
SX70HS
... running EOS firmware!

While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.

leathc · « **Reply #59 on:** January 10, 2019, 02:07:00 AM »

oooh now I have a blinking LED on my M50 qemu, pls advise

DeafEyeJedi · « **Reply #60 on:** January 11, 2019, 04:45:57 AM »

Great work, @leathc!

leathc · « **Reply #61 on:** January 11, 2019, 04:57:29 AM »

Quote from: DeafEyeJedi on January 11, 2019, 04:45:57 AM

Great work, @leathc!

Thanks! and thanks dfort for helping me! haha

oswa · « **Reply #62 on:** January 11, 2019, 06:40:13 AM »

Quote from: LebedevRI on January 09, 2019, 09:32:15 AM

... running EOS firmware!

While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.

Below you can dl all the raw samples.

https://we.tl/t-X8KcVPjtVX

dfort · « **Reply #63 on:** January 14, 2019, 08:12:01 AM »

This might help the M50 port.

Code: [Select]

  Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS M50 / KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/IMG_2868.JPG
 - User PS: CineStyle  
 - Boot flags: FIR=0 BOOT=-1 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x48C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x1 1
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000001
  (raw value)          0x1 1
CPACR      0x00000000
  (raw value)          0x0 0
DBGDIDR    0x35141000
  Revision             0x0 0
  Variant              0x0 0
  - (RAZ)              0x10 16
  Version              0x4 4 [v7 basic]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSCR    0x00000000
  HALTED               0x0 0
  RESTARTED            0x0 0
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x0 0
  PipeAdv              0x0 0
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - DONE!

a1ex · « **Reply #64 on:** January 15, 2019, 01:26:02 PM »

It's worth noting the above log was not from a real M50, but from the emulator. In other words, it's what I thought it might be, i.e. what I knew from DIGIC 7 (alongside with a few emulator quirks).

CPU info log from a real M50 / real SX70:

Code: [Select]

CHDK CPU info for 0x412 M50 / 0x805 SX70
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

Difference from 200D: CPUINFO-200D-vs-M50.html

edit: updated ROM dumpers (SX740 untested):

Quote from: a1ex on January 16, 2019, 09:06:18 AM

DIGIC 8: M50 SX70 SX740

and uploaded FIRs for getting the CPU info:

Quote from: a1ex on January 16, 2019, 09:19:19 AM

DIGIC 8: M50 SX70 SX740

leathc · « **Reply #65 on:** January 16, 2019, 10:52:27 PM »

Quote from: a1ex on January 15, 2019, 01:26:02 PM

edit: updated ROM dumpers (SX740 untested):
and uploaded FIRs for getting the CPU info:

I'll try these out on the real hardware. EDIT: for the M50 that is

leathc · « **Reply #66 on:** January 16, 2019, 11:03:23 PM »

those both run great on the M50, but I'm not actually seeing the dumps

it could be because I didn't format the card correctly or something I suppose

dfort · « **Reply #67 on:** January 17, 2019, 06:34:02 AM »

Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.

leathc · « **Reply #68 on:** January 17, 2019, 07:14:45 PM »

Quote from: dfort on January 17, 2019, 06:34:02 AM

Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.

no I'm an idiot, I didn't do low level format

I have the dumps now, and RESCUE.log for the CPU info

cmku · « **Reply #69 on:** January 21, 2019, 11:45:14 PM »

I run this dump firmware on my M50

there is the log

Code: [Select]

Magic Lantern Rescue
 ----------------------------
 - Model ID: 0x412 M50
 - Camera model: Canon EOS KISS M
 - Firmware version: 1.0.1 / 6.8.0 34(00)
 - IMG naming: 100CANON/0127.JPG
 - User PS: ??? ??? ???
 - Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
 - ROMBASEADDR: 0xE0040000

CHDK CPU info for 0x412 M50
------------------------------
ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
MPU type   0x414FC091
  S                    0x1 1
  -                    0x48 72
  Num of MPU regions   0xC0 192
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  -                    0x0 0
Debug feature 0x00010444
  (raw value)          0x10444 66628
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1
  Cache maintain s/w   0x1 1
  BP maintain          0x1 1
  -                    0x102 258
  Supersection support 0x0 0
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Cache type, level8   0x1 1 [Icache only]
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MPU Enable           0x1 1
  Strict Align         0x0 0
  L1 DCache Enable     0x1 1
  - (SBO)              0xF 15
  - (SBZ)              0x0 0
  Branch Pred Enable   0x1 1
  L1 ICache Enable     0x1 1
  High Vectors         0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  MPU background reg   0x0 0
  - (SBO)              0x1 1
  Div0 exception       0x0 0
  - (SBZ)              0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VIC                  0x0 0
  CPSR E bit           0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  Big endian           0x0 0
ACTLR      0x00000045
  (raw value)          0x45 69
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (raw value)          0xC0000000 -1073741824
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0

 - boot_read_sector 103604
 - boot_write_sector 10361a
 - 10362a: BL 104dc4
 - 10180B Card init => 2
 - Saving RESCUE.LOG ...

digiboy · « **Reply #70 on:** February 05, 2019, 11:16:44 AM »

Hello,
I have M50. I am Android programmer and my knowledge in embedded systems is small (easy AVR programming)
Are there any simple tasks that I could do?

a1ex · « **Reply #71 on:** February 05, 2019, 03:54:06 PM »

Since you mentioned AVR, what about this?

Quote from: a1ex on September 08, 2017, 09:47:36 AM

- find some UART or JTAG port and attempt to communicate with it

Related: 600D (successful) and R (unsuccessful).

However, that would be of secondary importance for models in this thread, since we are already able to execute code alongside Canon's main firmware. It could be useful for interfacing with other peripherals, or - better not get there - for unbricking.

A better idea would be to start reading the thread, and also the threads for other recent models. Are there any tasks you could do? Are you able to run the firmware in QEMU? Are you able to push the emulation even further? Are you able to fix the logging code, which worked out of the box on 80D, 5D4 and 200D, but crashed on M50? (you will need QEMU for this one)

BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.

Karim · « **Reply #72 on:** February 08, 2019, 04:56:36 AM »

Quote from: a1ex on February 05, 2019, 03:54:06 PM

BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.

Is that digic6-dumper branch not safe to run on camera or what?
If my camera won't turn into a brick maybe I'll give it a shot

Walter Schulz · « **Reply #73 on:** February 08, 2019, 05:16:07 AM »

https://mobile.twitter.com/autoexec_bin/status/1086653394142617601?p=p#
See a1ex's answer dated 07:55 - 19. Jan. 2019

a1ex · « **Reply #74 on:** February 08, 2019, 09:54:24 PM »

Quote from: Walter Schulz on February 08, 2019, 05:16:07 AM

See a1ex's answer dated 07:55 - 19. Jan. 2019

That answer was about ROM dumpers - these carry very little risk on new models. On M50, the ROM dumper was already confirmed to work, so the answer no longer applies.

Quote from: Karim on February 08, 2019, 04:56:36 AM

Is that digic6-dumper branch not safe to run on camera or what?

The digic6-dumper branch works out of the box, but once you attempt to run the 80D experiments, it will fail. The issue is that Canon's DebugMsg is in RAM on DIGIC 6/7 (where we can override it easily), while on DIGIC 8 is in ROM (where we can override it with a little more coding). I didn't attempt to solve it yet, but I've documented the MMU configuration about 2 years ago.

Safety-wise, it's probably OK (but it's worth noting that Canon firmware reflashes the main ROM at shutdown, so...)

Quote from: Karim on February 08, 2019, 04:56:36 AM

If my camera won't turn into a brick maybe I'll give it a shot

I cannot guarantee that. Risks were explained for e.g. DIGIC 7, 5D4 etc. Enabling the boot flag will modify your camera, so there is a tiny chance of things going wrong when running this procedure on a new camera model.

Enabling the boot flag will enable anyone with (basic) programming skills to run the proof of concept code on their camera and experiment with it. You will still need QEMU for debugging and for understanding how your code will run. The logging code does not work yet; debugging will have to be done in QEMU. On hardware, you've only got LED blinks, file I/O (as long as the camera doesn't crash) and... display from bootloader context (but do check the 80D thread).

Still with me? If you are OK with the risks, just drop me a PM.

News:

Author Topic: DIGIC 8 'PowerShot' development (M50, SX70, SX740) (Read 226717 times)

dfort

dfort

dfort