DIGIC 8+ MPU investigation

[coon]

As already mentioned here https://www.magiclantern.fm/forum/index.php?topic=7531.msg232995#msg232995 we were wrong about the pinout of the service connector. Mike Tornado has found out the correct one which is:

Code: [Select]

1: VCC_ICU (1v8)
2: RX_ICU (1v8)
3: TX_ICU (1v8)
4: GND
5: /MPU_FORCED_WAKEUP (3v3)
6: TX_MPU (3v3)
7: RX_MPU (3v3)
8: VCC_MPU (3v3)

When using this pinout I do now get an echo from MPU. Hitting enter shows a prompt:

Code: [Select]

>>>MON

Typing HELP lists all available commands on MPU:

Code: [Select]

MON>>>HELP

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
INDIINFO INDICLK INDIAVE ACCCAMPOS CYCLE
ADPTEST BATTCLOSE BATTCHECK BCINFO BATTLEVEL
BATTUSEERR BATTREPREQ BATTEXCLU BATTCHECKSPEC
GETRCP GETRC GETSC FGCOMM FGCOMME4 BATTINFO
VLDET CHGBATTLEVEL ABOUT VER FAABOUT FAVER HELP
UPBNY TRMOSC DEBUGLOG ICUREQ DISPPORTKEEP REGR
REGW MEMR MEMW EEPR EEPW EEPCLK ADCHECK
ADCHECK2 ADTIME ADMODE SCOUT UARTMODE UARTBRD
UARTSEND DNFCLK DNFON DNFOFF RTCON RTCOFF
RTCADJON RTCADJOFF TIMEOUT KWUPCNT I2C ICUTEST
MODE MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG
BATSEL GRIPLED LENSPOWER E1ON E1OFF FACMD
TIMERCMD INFOCMD STACKINFO SW MDIALMODE
TEMPINFO TEMPCLK DRYCTEST SYSRESET DLOG DTASK
DUMP LED

Prompt is not available when camera is turned off.

And here we have another set of functions which are waiting to be explored. 

[coon]

ABOUT prints some information about the MPU:

Code: [Select]

MON>>>ABOUT
-----------------------------------------------
             Debug Monitor Version             
                     K433 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x0110
        MPU check sum...0xBB677C8A

        EEP Ver...0x0A

MPU seems to have a Flashrom and an EEPROM, similiar to ICU.

VER, FAABOUT and FAVER do also print this output.

[coon]

DUMP prints all running tasks plus a hex dump of memory region 0x20001000 - 0x20001ffc with unknown content:

Code: [Select]

MON>>>DUMP

    TaskName |         SP |         PC |         LR |        PSR
             |      State | WaitReason |     WaitID |       puID
             |   StackTop |  StackSize |  StackUsed |           
================================================================
     DbgTask | 0x20008ca8 | 0x00008142 | 0x0000c595 | 0x01000000
             |      READY |  536884630 |  536884560 |          0
             | 0x20008c98 |        500 |        500 |           
 ---------------------------------------------------------------
      SwTask | 0x20007178 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          1 |          0
             | 0x20006fc8 |        660 |        552 |           
 ---------------------------------------------------------------
    MainTask | 0x20008898 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          2 |          0
             | 0x20008450 |       1200 |        604 |           
 ---------------------------------------------------------------
    BattTask | 0x200074d8 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          3 |          0
             | 0x20007268 |        752 |        436 |           
 ---------------------------------------------------------------
    TempTask | 0x20007780 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          4 |          0
             | 0x20007560 |        640 |        460 |           
 ---------------------------------------------------------------
     AccTask | 0x20007a08 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          5 |          0
             | 0x200077e8 |        640 |        404 |           
 ---------------------------------------------------------------
    DispTask | 0x20007c58 | 0x00008142 | 0x0000c827 | 0x01000000
             |       WAIT |    W_EVENT |          2 |          0
             | 0x20007a70 |        600 |        412 |           
 ---------------------------------------------------------------
 AdapterTask | 0x20007f00 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          6 |          0
             | 0x20007cd0 |        660 |        408 |           
 ---------------------------------------------------------------
     LogTask | 0x20009370 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          7 |          0
             | 0x20008e98 |       1340 |        448 |           
 ---------------------------------------------------------------
 MonitorTask | 0x20008c28 | 0x0004c93c | 0x00000002 | 0x20008d7c
             |       WAIT |    W_MQRCV |          8 |          0
             | 0x20008908 |        900 |        168 |           
 ---------------------------------------------------------------
    IdleTask | 0x200095c0 | 0x00019c28 | 0x00019c27 | 0x21000000
             |      READY |    W_MQRCV |          8 |          0
             | 0x200093e0 |        500 |        280 |         

MPU Dump Log[0x20001000 - 0x20001ffc]

<hex dump with unknown content here>

Having running tasks suggests that some RTOS is running on MPU.

[coon]

Code: [Select]

MON>>>LED

Type ID = 0
Contrl ID = 7
blink cnt = 0
blink on time  = 0
blink off time = -1
Error! Unknown LED ctrl Cmd

I don't know how to use this yet. Maybe it is possible to control the USB charge LED with that.

[coon]

Code: [Select]

MON>>>INDIINFO
Indicator ave x:103 y:-7 z:-1017 roll:170 pitch:554 HV:Grip Up
Indicator ave x:102 y:-5 z:-1016 roll:172 pitch:554 HV:Grip Up
Indicator ave x:102 y:-5 z:-1018 roll:172 pitch:554 HV:Grip Up
Indicator ave x:101 y:-6 z:-1017 roll:171 pitch:554 HV:Grip Up
Indicator ave x:102 y:-6 z:-1016 roll:171 pitch:554 HV:Grip Up
Indicator ave x:101 y:-6 z:-1014 roll:171 pitch:554 HV:Grip Up

Does start a periodic logging of the cameras gyroscope. Moving the camera does change the values.

[coon]

Code: [Select]

MON>>>BATTINFO

TYPE   :00
NAME   :000000004C502D453137
BNO    :248A0228
FCB    :0442
RV     :1C20
RSVD1  :0000
CYCNT  :0011
CERCNT :00
CARCNT :00
CCNT   :000475
RSVD2  :00000000

Shows information about the battery. Does output nothing, when an AC adapter is used.

[coon]

Code: [Select]

MON>>>BCINFO
BC Result
Battery   :Li-ion
Vop       :0276
Vbc       :0258
Iop       :002A
Ibc       :00D3
R         :2D719
R(ohm)    :0024
Vfo1      :0229
Vfo2      :0000
VfoSt     :0229
VfoMotor  :0229

Starts periodic logging of charge / discharge status of the battery.

[coon]

Code: [Select]

MON>>>STACKINFO
Sw Task Stack Info addr=0x20008C98 size=500 used=448
Main Task Stack Info addr=0x20006FC8 size=660 used=552
Batt Task Stack Info addr=0x20008450 size=1200 used=604
Temp Task Stack Info addr=0x20007268 size=752 used=436
Acc Task Stack Info addr=0x20007560 size=640 used=460
Disp Task Stack Info addr=0x200077E8 size=640 used=404
Adapter Task Stack Info addr=0x20007A70 size=600 used=412
Log Task Stack Info addr=0x20007CD0 size=660 used=408
Monitor Task Stack Info addr=0x20008E98 size=1340 used=536
Idle Task Stack Info addr=0x20008908 size=900 used=432
(null) Task Stack Info addr=0x200093E0 size=500 used=280

Some info about the stack of all running tasks.

[coon]

Code: [Select]

MON>>>TEMPINFO
Battery    : 0x01D4
TEMP(MAIN) : 0x2370 (35.4deg)
TEMP(SH)   : 0x227F (34.4deg)
TEMP(A)    : 0x2BF0 (43.9deg)
TEMP(BACK) : 0x1DB0 (29.6deg)

Displays the values of several temperature sensors. TEMP(A) seems to be the sensor of the main CPU.
When recording a video in 4K @ 25fps on RP, temperature rises over 53C° but I have stopped this after some minutes and may do a long term test later to find out where the temperature maxes out.

Someone with an R5 may try this while doing 8K recording to find out at which temperature the camera is shut down.

[coon]

Code: [Select]

MON>>>I2C

Usage: i2c set   channel prs clk slaveaddr
Usage: i2c write channel addr data [data]
Usage: i2c read  channel count
Usage: i2c read  channel addr count

Can possibly be used to send arbitrary data to the cameras I2C devices. Since I don't know which devices are connected to I2C nor which addresses they have and what commands they do expect, I won't touch this for now.

[coon]

Code: [Select]

MON>>>SW

 LockSw                        : UnLock(On)
 LockSw(Raw)                   : UnLock(On)
 CardCover                     : Open
 CardCover(Raw)                : Open
 BatCover                      : Close
 BatCover(Raw)                 : Close
 CF2DetectSw                   : On
 ELButton                      : Off
 SubDialLockSw                 : Off
 Sw1                           : Off
 Sw2                           : Off
 AELockButton                  : Off
 AFStartButton                 : Off
 AFFrameSelectButton           : Off
 MIFSw                         : Off
 ShotModeButton                : Off
 M                             : Off
 SetButton                     : Off
 MenuButton                    : Off
 PlayButton                    : Off
 InfoButton                    : Off
 EraseButton                   : Off
 LvMovieStartButton            : Off
 NFCDetectSw                   : Off
 BLEDetectSw                   : Off
 CrossUp                       : Off
 CrossDown                     : Off
 CrossRight                    : Off
 CrossLeft                     : Off
 MainDial                      : 0
 SubDial                       : 0
 ModeDial[d3,d2,d1,d0]         : 1 0 1 1

Displays the current state of all switches.
I may also use this naming convention for the MPU button codes I have found earlier.

Sw2 = Half Shutter
Sw1 = Shutter

MainDial and SubDial values are stored as absolute values and do count from 0 after boot.

[coon]

Code: [Select]

MON>>>EEPR 0 1000
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000 0A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
...

Does a hex dump from a region of the MPUs EEPROM. First argument is start address, second argument is end address.
When dumping from 0x0 to 0x1000, hex data is not displayed anymore after 0x7FF:

Code: [Select]

...
000007E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000007F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000800                                               
00000810                                               
00000820                                               
00000830                                               
00000840                                               
00000850
...

Therefore MPUs EEPROM has a size of 0x800 Bytes (2KB).
A full EEPROM dump can be done by executing:

Code: [Select]

EEPR 0 7FF

Be careful not to type EEPW by accident, which will overwrite data in the EEPROM and may render the MPU unbootable!

The content of the EEPROM is unknown yet. It does probably contain user settings.

[coon]

Code: [Select]

MEMR 0 FFFFF

Does a hex dump from a region of the MPUs memory. First argument is start address, second argument is number of bytes to read.
Maximum value allowed for second argument is FFFFF.

When executing the command above, the complete firmware of MPU is dumped, since firmware is mapped to 0.
From address ~0x60000 to 0xFFFFF data bytes are all 0xFF on EOS RP and do not need to be dumped.

The firmware of MPU on EOS RP can be dumped by executing the following command:

Code: [Select]

MEMR 0 60000

Be careful not to type MEMW by accident, which will overwrite data in RAM and may lead to undefined behaviour of the MPU! This meight destroy hardware components in worst case.

[coon]

Architecture of MPU is 32 bit ARMv7 (little endian) like ICU. Therefore it is not TX19a / MIPS anymore.
Base address of MPU firmware image is 0x20000000.

It looks like that a minimal version of DryOS is running on MPU. I think it should be possible to emulate MPU in qemu now.
We may also abuse the MPUs update mechanism to boot up some MPU version of ML and start our own tasks there, if we should ever be in need for that.

[c_joerg]

Displays the values of several temperature sensors. TEMP(A) seems to be the sensor of the main CPU.

It would be interesting to know which temperature value can be found in the EXIF data of the RAW file.

[kitor]

Just wow!

As already mentioned here https://www.magiclantern.fm/forum/index.php?topic=7531.msg232995#msg232995 we were wrong about the pinout of the service connector.

Completly my fault. I extrapolated TX line based on testpads on PCB, never got a prompt on R.
Lesson learned: never trust random guy in internet, even if he seems to know what's he's doing 

With so many discoveries, i think this is separate thread(s) worthy? One for drysh on Digic8 and one for MPU. I think nobody dug into MPU that far yet.

[coon]

It would be interesting to know which temperature value can be found in the EXIF data of the RAW file.

I am using RAW Therapee which cannot read EXIF data from CR3 RAW files which are used on newer canon models. Therefore I cannot answer that right now. If someone knows another free tool which can do that, please let me know!

Completly my fault. I extrapolated TX line based on testpads on PCB, never got a prompt on R.
Lesson learned: never trust random guy in internet, even if he seems to know what's he's doing 

No worries, it is undocumented hardware and mistakes do happen. Without your post about the existence of the connector I wouldn't have built the cable + dev kit and wouldn't have such a huge progress as I have right now.

With so many discoveries, i think this is separate thread(s) worthy? One for drysh on Digic8 and one for MPU. I think nobody dug into MPU that far yet.

Good point. I may also create some pages on the wiki about my findings.

[c_joerg]

I am using RAW Therapee which cannot read EXIF data from CR3 RAW files, used on newer canon models. Therefore I cannot answer that right now. If someone knows another free tool which can do that, please let me know!

Code: [Select]

exiftool -h IMG_1234.CR3 >t.txtWrites all EXIF Data to File. Then you can search for Camera Temperature

[coon]

Yep, exiftool worked.

In point of time a picture was taken MPU said:

Code: [Select]

Battery    : 0x03D3
TEMP(MAIN) : 0x2120 (33.1deg)
TEMP(SH)   : 0x1EFF (30.9deg)
TEMP(A)    : 0x2760 (39.3deg)
TEMP(BACK) : 0x1B00 (27.0deg)

EXIF said:

Code: [Select]

Camera Temperature    39 C

Therefore the value of TEMP(A) is taken for EXIF.

[c_joerg]

Thank you, good to know that the highest temperature is in the EXIF data ...

[kitor]

As I was digging inside R today, I decided to play with MPU (and confirm its pinout).

Code: [Select]

MON>>>help

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
INDIINFO INDICLK INDIAVE ACCCAMPOS CYCLE
ADPTEST BATTCLOSE BATTCHECK BCINFO BATTLEVEL
BATTUSEERR BATTREPREQ BATTEXCLU BATTCHECKSPEC
GETRCP GETRC GETSC FGCOMM BATTINFO VLDET ABOUT
VER FAABOUT FAVER HELP UPBNY TRMOSC DEBUGLOG
REGR REGW EEPR EEPW EEPCLK FROMR FROMW FROME
FROMWAKEUP FROMSLEEP FROMCLK ADCHECK ADCHECK2
ADTIME ADMODE SCOUT UARTMODE UARTBRD UARTSEND
DNFCLK DNFON DNFOFF RTCON RTCOFF RTCADJON
RTCADJOFF TIMEOUT KWUPCNT DMACCHK I2C ICUTEST
GRIPSERIOPEN GRIPSERICLOSE GRIPSERISEND
DISPTEST DISPON DISPOFF LIGHTON LIGHTOFF MODE
MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG BATSEL
GRIPLED LENSPOWER E1ON E1OFF FACMD TIMERCMD
INFOCMD STACKINFO SW MDIALMODE TEMPINFO TEMPCLK
GETIDAC TPULOG DRYCTEST SYSRESET
Command set is a little different than in RP.

Code: [Select]

MON>>>ABOUT

-----------------------------------------------
             Debug Monitor Version             
                     K424 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x014D
        MPU check sum...0xFE12FC7E

        EEP Ver...0x10
        FROM Ver...0x15
        TPU Ver...0x14
        FROM gang sum...0x937E
Interesting parts: R MPU has additional SPI flash, 2MB in size (not present in RP). It is exposed via FROM* commands. Parameters for FROMR are the same as for EEPR:

Code: [Select]

MON>>>FROMR 1FFFFF 20000F

address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
001FFFF0                                              FF
00200000
Thus you can dump it using FROMR 0 1FFFFF

EDIT: FROM contains images for top LCD (black and white format). R5 also contains such SPI flash near MPU.

Buttons map:

Code: [Select]

MON>>>sw

 LockSw                        : UnLock(On)
 LockSw(Raw)                   : UnLock(On)
 CardCover                     : Close
 CardCover(Raw)                : Close
 BatCover                      : Close
 BatCover(Raw)                 : Close
 CF2DetectSw                   : Off
 ELButton                      : Off
 SubDialLockSw                 : Off
 Sw1                           : Off
 Sw2                           : Off
 AELockButton                  : Off
 AFStartButton                 : Off
 AFFrameSelectButton           : Off
 MIFSw                         : Off
 ShotModeButton                : Off
 M                             : Off
 SetButton                     : Off
 MenuButton                    : Off
 PlayButton                    : Off
 InfoButton                    : Off
 EraseButton                   : Off
 LvMovieStartButton            : Off
 NFCDetectSw                   : On
 BLEDetectSw                   : Off
 CrossUp                       : Off
 CrossDown                     : Off
 CrossRight                    : Off
 CrossLeft                     : Off

 MainDial                      : 0
 SubDial                       : 0
 Grip                          : Off
TPULOG unknown. Note TPU version in VER output.
My guess (after camera was reassembled) - Touch Panel Unit?

Spams this over and over again:

Code: [Select]

Pos,255 ,Raw, 0, 0, 0
GETIDAC

Code: [Select]

MON>>>getidac
getidac end(60ms)
MODULATOR_IDAC 0x00000030
SNS0_IDAC      0x00000015
SNS1_IDAC      0x00000018
SNS2_IDAC      0x00000021
SNS0_RAW       0x00002CD0
SNS1_RAW       0x00002C87
SNS2_RAW       0x00002CE9
SNS0_BSLN      0x00002CC6
SNS1_BSLN      0x00002C82
SNS2_BSLN      0x00002CE0
SNS0_DIFF      0x00000000
SNS1_DIFF      0x00000000
SNS2_DIFF      0x00000000
UARTMODE UARTBRD UARTSEND maybe some kind of uart redirection to talk to some MPU slave?

Code: [Select]

MON>>>UARTMODE
Usage: uartmode [master | slave]

MON>>>UARTBRD
Usage: uartbrd prs ken brn brk

MON>>>UARTSEND
Usage: uartsend data
DISPTEST DISPON DISPOFF
LIGHTON LIGHTOFF

Functions for top (settings) display present only on R. DISPON/OFF and LIGHTON/OFF does exactly what you think. DISPTEST takes three arguments, not sure how to use it.

TEMPINFO
The same result as on RP, with the same sensors.

Others
coon was getting a ton of

Code: [Select]

temp_task.c:421 I2C Comm Error ret=1 spam in his RP logs. Mine (R) is spamming this only when main LCD assembly is disconnected from camera.

All tests done on R running latest (1.8.0) firmware.

[kitor]

Code: [Select]

MON>>>about

-----------------------------------------------
             Debug Monitor Version             
                     K429 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x0016
        MPU check sum...0x17927A70

        EEP Ver...0x04
Hello from MPU in... EOS R Battery grip (BG-E22)!

Long story short: Yesterday, before i dug into R i was talking with @coon looking for possible R/RP MPU datasheets. I found a photo of my battery grip internals and we realized that it has exactly the same microcontroller as R/RP MPU. This explains why those things are so damn expensive 

You will find how to access UART in Battery grip pins / UART thread.

Now the fun parts:

Command list:

Code: [Select]

MON>>>help

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
BATTCLOSE BATTCHECK BCINFO BATTLEVEL BATTUSEERR
BATTREPREQ BATTEXCLU BATTCHECKSPEC GETRCP GETRC
GETSC FGCOMM BATTINFO VLDET ABOUT VER FAABOUT
FAVER HELP UPBNY TRMOSC DEBUGLOG DISPPORTKEEP
REGR REGW MEMR MEMW EEPR EEPW EEPCLK ADCHECK
ADCHECK2 ADTIME ADMODE SCOUT UARTMODE UARTBRD
UARTSEND DNFCLK DNFON DNFOFF RTCON RTCOFF
RTCADJON RTCADJOFF TIMEOUT KWUPCNT I2C ICUTEST
MODE MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG
BATSEL GRIPLED LENSPOWER E1ON E1OFF FACMD
TIMERCMD INFOCMD STACKINFO DRYCTEST SYSRESET
STACKINFO

Code: [Select]

MON>>>stackinfo
Sw Task Stack Info addr=0x20005DB0 size=4000 used=68
Main Task Stack Info addr=0x20007228 size=1200 used=244
Batt Task Stack Info addr=0x20007228 size=1200 used=244
Temp Task Stack Info addr=0x20007228 size=1200 used=244
Acc Task Stack Info addr=0x20007228 size=1200 used=244
Disp Task Stack Info addr=0x20007228 size=1200 used=244
Adapter Task Stack Info addr=0x20007228 size=1200 used=244
Log Task Stack Info addr=0x200076E0 size=1340 used=520
Monitor Task Stack Info addr=0x20007C28 size=900 used=168
Idle Task Stack Info addr=0x20007FB8 size=500 used=156
UPBNY update binary?

DANGEROUS! Grip won't exit this mode even after power was disconnected. But fortunately ctrl+z broke the sequence after tense 5 minutes.

Code: [Select]

MON>>>upbny
RSTFLG : 0100

Please Send *.bny
.

Please Send *.bny
Update File Unknown
GRIPLED - toggle grip (charging) LEDs. Argument is (L)eft / (R)ight / (C)lear

Code: [Select]

MON>>>gripled
Usage:GRIPLED [L/R/C]

[leegong]

Architecture of MPU is 32 bit ARMv7 (little endian) like ICU. Therefore it is not TX19a / MIPS anymore.
Base address of MPU firmware image is 0x20000000.

It looks like that a minimal version of DryOS is running on MPU. I think it should be possible to emulate MPU in qemu now.
We may also abuse the MPUs update mechanism to boot up some MPU version of ML and start our own tasks there, if we should ever be in need for that.

Could you please send MPU firmware dumping to my E-mail? 982573794@qq.com
I can analyze the firmware with IDA PRO, add value to your DIGIC 8 MPU investigation.

[leegong]

Debug Commands of DIGIC 8 MPU look like same as that in DIGIC 6/7.
https://www.magiclantern.fm/forum/index.php?topic=17596.0

[leegong]

Just build IDB with RP_MPU Dumping,
ROM:00019E56                 BLX             R2  is call interface of all monitor function found by coon ,
key struc_table at 0x4ED38:
00000000 struc_DbgFunction struc
00000000 lp_DbgCmdString
00000004 lp_funcall
Anybody wants the IDB? send PM to me or let me know in this post please.