DIGIC 8+ MPU investigation

[coon]

As already mentioned here https://www.magiclantern.fm/forum/index.php?topic=7531.msg232995#msg232995 we were wrong about the pinout of the service connector. Mike Tornado has found out the correct one which is:

Code Select Expand


1: VCC_ICU (1v8)
2: RX_ICU (1v8)
3: TX_ICU (1v8)
4: GND
5: /MPU_FORCED_WAKEUP (3v3)
6: TX_MPU (3v3)
7: RX_MPU (3v3)
8: VCC_MPU (3v3)


When using this pinout I do now get an echo from MPU. Hitting enter shows a prompt:

Code Select Expand


>>>MON


Typing HELP lists all available commands on MPU:

Code Select Expand


MON>>>HELP

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
INDIINFO INDICLK INDIAVE ACCCAMPOS CYCLE
ADPTEST BATTCLOSE BATTCHECK BCINFO BATTLEVEL
BATTUSEERR BATTREPREQ BATTEXCLU BATTCHECKSPEC
GETRCP GETRC GETSC FGCOMM FGCOMME4 BATTINFO
VLDET CHGBATTLEVEL ABOUT VER FAABOUT FAVER HELP
UPBNY TRMOSC DEBUGLOG ICUREQ DISPPORTKEEP REGR
REGW MEMR MEMW EEPR EEPW EEPCLK ADCHECK
ADCHECK2 ADTIME ADMODE SCOUT UARTMODE UARTBRD
UARTSEND DNFCLK DNFON DNFOFF RTCON RTCOFF
RTCADJON RTCADJOFF TIMEOUT KWUPCNT I2C ICUTEST
MODE MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG
BATSEL GRIPLED LENSPOWER E1ON E1OFF FACMD
TIMERCMD INFOCMD STACKINFO SW MDIALMODE
TEMPINFO TEMPCLK DRYCTEST SYSRESET DLOG DTASK
DUMP LED


Prompt is not available when camera is turned off.

And here we have another set of functions which are waiting to be explored. 

[coon]

ABOUT prints some information about the MPU:

Code Select Expand


MON>>>ABOUT
-----------------------------------------------
             Debug Monitor Version             
                     K433 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x0110
        MPU check sum...0xBB677C8A

        EEP Ver...0x0A


MPU seems to have a Flashrom and an EEPROM, similiar to ICU.

VER, FAABOUT and FAVER do also print this output.

[coon]

DUMP prints all running tasks plus a hex dump of memory region 0x20001000 - 0x20001ffc with unknown content:

Code Select Expand


MON>>>DUMP

    TaskName |         SP |         PC |         LR |        PSR
             |      State | WaitReason |     WaitID |       puID
             |   StackTop |  StackSize |  StackUsed |           
================================================================
     DbgTask | 0x20008ca8 | 0x00008142 | 0x0000c595 | 0x01000000
             |      READY |  536884630 |  536884560 |          0
             | 0x20008c98 |        500 |        500 |           
---------------------------------------------------------------
      SwTask | 0x20007178 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          1 |          0
             | 0x20006fc8 |        660 |        552 |           
---------------------------------------------------------------
    MainTask | 0x20008898 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          2 |          0
             | 0x20008450 |       1200 |        604 |           
---------------------------------------------------------------
    BattTask | 0x200074d8 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          3 |          0
             | 0x20007268 |        752 |        436 |           
---------------------------------------------------------------
    TempTask | 0x20007780 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          4 |          0
             | 0x20007560 |        640 |        460 |           
---------------------------------------------------------------
     AccTask | 0x20007a08 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          5 |          0
             | 0x200077e8 |        640 |        404 |           
---------------------------------------------------------------
    DispTask | 0x20007c58 | 0x00008142 | 0x0000c827 | 0x01000000
             |       WAIT |    W_EVENT |          2 |          0
             | 0x20007a70 |        600 |        412 |           
---------------------------------------------------------------
AdapterTask | 0x20007f00 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          6 |          0
             | 0x20007cd0 |        660 |        408 |           
---------------------------------------------------------------
     LogTask | 0x20009370 | 0x00008142 | 0x0000cbf7 | 0x01000000
             |       WAIT |    W_MQRCV |          7 |          0
             | 0x20008e98 |       1340 |        448 |           
---------------------------------------------------------------
MonitorTask | 0x20008c28 | 0x0004c93c | 0x00000002 | 0x20008d7c
             |       WAIT |    W_MQRCV |          8 |          0
             | 0x20008908 |        900 |        168 |           
---------------------------------------------------------------
    IdleTask | 0x200095c0 | 0x00019c28 | 0x00019c27 | 0x21000000
             |      READY |    W_MQRCV |          8 |          0
             | 0x200093e0 |        500 |        280 |         

MPU Dump Log[0x20001000 - 0x20001ffc]

<hex dump with unknown content here>


Having running tasks suggests that some RTOS is running on MPU.

[coon]

Code Select Expand


MON>>>LED

Type ID = 0
Contrl ID = 7
blink cnt = 0
blink on time  = 0
blink off time = -1
Error! Unknown LED ctrl Cmd


I don't know how to use this yet. Maybe it is possible to control the USB charge LED with that.

[coon]

Code Select Expand


MON>>>INDIINFO
Indicator ave x:103 y:-7 z:-1017 roll:170 pitch:554 HV:Grip Up
Indicator ave x:102 y:-5 z:-1016 roll:172 pitch:554 HV:Grip Up
Indicator ave x:102 y:-5 z:-1018 roll:172 pitch:554 HV:Grip Up
Indicator ave x:101 y:-6 z:-1017 roll:171 pitch:554 HV:Grip Up
Indicator ave x:102 y:-6 z:-1016 roll:171 pitch:554 HV:Grip Up
Indicator ave x:101 y:-6 z:-1014 roll:171 pitch:554 HV:Grip Up


Does start a periodic logging of the cameras gyroscope. Moving the camera does change the values.

[coon]

Code Select Expand


MON>>>BATTINFO

TYPE   :00
NAME   :000000004C502D453137
BNO    :248A0228
FCB    :0442
RV     :1C20
RSVD1  :0000
CYCNT  :0011
CERCNT :00
CARCNT :00
CCNT   :000475
RSVD2  :00000000


Shows information about the battery. Does output nothing, when an AC adapter is used.

[coon]

Code Select Expand


MON>>>BCINFO
BC Result
Battery   :Li-ion
Vop       :0276
Vbc       :0258
Iop       :002A
Ibc       :00D3
R         :2D719
R(ohm)    :0024
Vfo1      :0229
Vfo2      :0000
VfoSt     :0229
VfoMotor  :0229


Starts periodic logging of charge / discharge status of the battery.

[coon]

Code Select Expand


MON>>>STACKINFO
Sw Task Stack Info addr=0x20008C98 size=500 used=448
Main Task Stack Info addr=0x20006FC8 size=660 used=552
Batt Task Stack Info addr=0x20008450 size=1200 used=604
Temp Task Stack Info addr=0x20007268 size=752 used=436
Acc Task Stack Info addr=0x20007560 size=640 used=460
Disp Task Stack Info addr=0x200077E8 size=640 used=404
Adapter Task Stack Info addr=0x20007A70 size=600 used=412
Log Task Stack Info addr=0x20007CD0 size=660 used=408
Monitor Task Stack Info addr=0x20008E98 size=1340 used=536
Idle Task Stack Info addr=0x20008908 size=900 used=432
(null) Task Stack Info addr=0x200093E0 size=500 used=280


Some info about the stack of all running tasks.

[coon]

Code Select Expand


MON>>>TEMPINFO
Battery    : 0x01D4
TEMP(MAIN) : 0x2370 (35.4deg)
TEMP(SH)   : 0x227F (34.4deg)
TEMP(A)    : 0x2BF0 (43.9deg)
TEMP(BACK) : 0x1DB0 (29.6deg)


Displays the values of several temperature sensors. TEMP(A) seems to be the sensor of the main CPU.
When recording a video in 4K @ 25fps on RP, temperature rises over 53C° but I have stopped this after some minutes and may do a long term test later to find out where the temperature maxes out.

Someone with an R5 may try this while doing 8K recording to find out at which temperature the camera is shut down.

[coon]

Code Select Expand


MON>>>I2C

Usage: i2c set   channel prs clk slaveaddr
Usage: i2c write channel addr data [data]
Usage: i2c read  channel count
Usage: i2c read  channel addr count


Can possibly be used to send arbitrary data to the cameras I2C devices. Since I don't know which devices are connected to I2C nor which addresses they have and what commands they do expect, I won't touch this for now.

[coon]

Code Select Expand


MON>>>SW

LockSw                        : UnLock(On)
LockSw(Raw)                   : UnLock(On)
CardCover                     : Open
CardCover(Raw)                : Open
BatCover                      : Close
BatCover(Raw)                 : Close
CF2DetectSw                   : On
ELButton                      : Off
SubDialLockSw                 : Off
Sw1                           : Off
Sw2                           : Off
AELockButton                  : Off
AFStartButton                 : Off
AFFrameSelectButton           : Off
MIFSw                         : Off
ShotModeButton                : Off
M                             : Off
SetButton                     : Off
MenuButton                    : Off
PlayButton                    : Off
InfoButton                    : Off
EraseButton                   : Off
LvMovieStartButton            : Off
NFCDetectSw                   : Off
BLEDetectSw                   : Off
CrossUp                       : Off
CrossDown                     : Off
CrossRight                    : Off
CrossLeft                     : Off
MainDial                      : 0
SubDial                       : 0
ModeDial[d3,d2,d1,d0]         : 1 0 1 1


Displays the current state of all switches.
I may also use this naming convention for the MPU button codes I have found earlier.

Sw2 = Half Shutter
Sw1 = Shutter

MainDial and SubDial values are stored as absolute values and do count from 0 after boot.

[coon]

Code Select Expand


MON>>>EEPR 0 1000
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000 0A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
...


Does a hex dump from a region of the MPUs EEPROM. First argument is start address, second argument is end address.
When dumping from 0x0 to 0x1000, hex data is not displayed anymore after 0x7FF:

Code Select Expand


...
000007E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000007F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000800                                               
00000810                                               
00000820                                               
00000830                                               
00000840                                               
00000850
...


Therefore MPUs EEPROM has a size of 0x800 Bytes (2KB).
A full EEPROM dump can be done by executing:

Code Select Expand


EEPR 0 7FF


Be careful not to type EEPW by accident, which will overwrite data in the EEPROM and may render the MPU unbootable!

The content of the EEPROM is unknown yet. It does probably contain user settings.

[coon]

Code Select Expand


MEMR 0 FFFFF


Does a hex dump from a region of the MPUs memory. First argument is start address, second argument is number of bytes to read.
Maximum value allowed for second argument is FFFFF.

When executing the command above, the complete firmware of MPU is dumped, since firmware is mapped to 0.
From address ~0x60000 to 0xFFFFF data bytes are all 0xFF on EOS RP and do not need to be dumped.

The firmware of MPU on EOS RP can be dumped by executing the following command:

Code Select Expand


MEMR 0 60000


Be careful not to type MEMW by accident, which will overwrite data in RAM and may lead to undefined behaviour of the MPU! This meight destroy hardware components in worst case.

[coon]

Architecture of MPU is 32 bit ARMv7 (little endian) like ICU. Therefore it is not TX19a / MIPS anymore.
Base address of MPU firmware image is 0x20000000.

It looks like that a minimal version of DryOS is running on MPU. I think it should be possible to emulate MPU in qemu now.
We may also abuse the MPUs update mechanism to boot up some MPU version of ML and start our own tasks there, if we should ever be in need for that.

[c_joerg]

Displays the values of several temperature sensors. TEMP(A) seems to be the sensor of the main CPU.

It would be interesting to know which temperature value can be found in the EXIF data of the RAW file.

[kitor]

Just wow!

As already mentioned here https://www.magiclantern.fm/forum/index.php?topic=7531.msg232995#msg232995 we were wrong about the pinout of the service connector.

Completly my fault. I extrapolated TX line based on testpads on PCB, never got a prompt on R.
Lesson learned: never trust random guy in internet, even if he seems to know what's he's doing 

With so many discoveries, i think this is separate thread(s) worthy? One for drysh on Digic8 and one for MPU. I think nobody dug into MPU that far yet.

[coon]

It would be interesting to know which temperature value can be found in the EXIF data of the RAW file.

I am using RAW Therapee which cannot read EXIF data from CR3 RAW files which are used on newer canon models. Therefore I cannot answer that right now. If someone knows another free tool which can do that, please let me know!

Completly my fault. I extrapolated TX line based on testpads on PCB, never got a prompt on R.
Lesson learned: never trust random guy in internet, even if he seems to know what's he's doing 

No worries, it is undocumented hardware and mistakes do happen. Without your post about the existence of the connector I wouldn't have built the cable + dev kit and wouldn't have such a huge progress as I have right now.

With so many discoveries, i think this is separate thread(s) worthy? One for drysh on Digic8 and one for MPU. I think nobody dug into MPU that far yet.

Good point. I may also create some pages on the wiki about my findings.

[c_joerg]

I am using RAW Therapee which cannot read EXIF data from CR3 RAW files, used on newer canon models. Therefore I cannot answer that right now. If someone knows another free tool which can do that, please let me know!

Code Select Expand

exiftool -h IMG_1234.CR3 >t.txt
Writes all EXIF Data to File. Then you can search for Camera Temperature

[coon]

Yep, exiftool worked.

In point of time a picture was taken MPU said:

Code Select Expand


Battery    : 0x03D3
TEMP(MAIN) : 0x2120 (33.1deg)
TEMP(SH)   : 0x1EFF (30.9deg)
TEMP(A)    : 0x2760 (39.3deg)
TEMP(BACK) : 0x1B00 (27.0deg)


EXIF said:

Code Select Expand


Camera Temperature    39 C


Therefore the value of TEMP(A) is taken for EXIF.

[c_joerg]

Thank you, good to know that the highest temperature is in the EXIF data ...

[kitor]

As I was digging inside R today, I decided to play with MPU (and confirm its pinout).

Code Select Expand

MON>>>help

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
INDIINFO INDICLK INDIAVE ACCCAMPOS CYCLE
ADPTEST BATTCLOSE BATTCHECK BCINFO BATTLEVEL
BATTUSEERR BATTREPREQ BATTEXCLU BATTCHECKSPEC
GETRCP GETRC GETSC FGCOMM BATTINFO VLDET ABOUT
VER FAABOUT FAVER HELP UPBNY TRMOSC DEBUGLOG
REGR REGW EEPR EEPW EEPCLK FROMR FROMW FROME
FROMWAKEUP FROMSLEEP FROMCLK ADCHECK ADCHECK2
ADTIME ADMODE SCOUT UARTMODE UARTBRD UARTSEND
DNFCLK DNFON DNFOFF RTCON RTCOFF RTCADJON
RTCADJOFF TIMEOUT KWUPCNT DMACCHK I2C ICUTEST
GRIPSERIOPEN GRIPSERICLOSE GRIPSERISEND
DISPTEST DISPON DISPOFF LIGHTON LIGHTOFF MODE
MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG BATSEL
GRIPLED LENSPOWER E1ON E1OFF FACMD TIMERCMD
INFOCMD STACKINFO SW MDIALMODE TEMPINFO TEMPCLK
GETIDAC TPULOG DRYCTEST SYSRESET

Command set is a little different than in RP.

Code Select Expand


MON>>>ABOUT

-----------------------------------------------
             Debug Monitor Version             
                     K424 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x014D
        MPU check sum...0xFE12FC7E

        EEP Ver...0x10
        FROM Ver...0x15
        TPU Ver...0x14
        FROM gang sum...0x937E

Interesting parts: R MPU has additional SPI flash, 2MB in size (not present in RP). It is exposed via FROM* commands. Parameters for FROMR are the same as for EEPR:

Code Select Expand

MON>>>FROMR 1FFFFF 20000F

address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
001FFFF0                                              FF
00200000

Thus you can dump it using FROMR 0 1FFFFF

EDIT: FROM contains images for top LCD (black and white format). R5 also contains such SPI flash near MPU.

Buttons map:

Code Select Expand

MON>>>sw

LockSw                        : UnLock(On)
LockSw(Raw)                   : UnLock(On)
CardCover                     : Close
CardCover(Raw)                : Close
BatCover                      : Close
BatCover(Raw)                 : Close
CF2DetectSw                   : Off
ELButton                      : Off
SubDialLockSw                 : Off
Sw1                           : Off
Sw2                           : Off
AELockButton                  : Off
AFStartButton                 : Off
AFFrameSelectButton           : Off
MIFSw                         : Off
ShotModeButton                : Off
M                             : Off
SetButton                     : Off
MenuButton                    : Off
PlayButton                    : Off
InfoButton                    : Off
EraseButton                   : Off
LvMovieStartButton            : Off
NFCDetectSw                   : On
BLEDetectSw                   : Off
CrossUp                       : Off
CrossDown                     : Off
CrossRight                    : Off
CrossLeft                     : Off

MainDial                      : 0
SubDial                       : 0
Grip                          : Off

TPULOG unknown. Note TPU version in VER output.
My guess (after camera was reassembled) - Touch Panel Unit?

Spams this over and over again:

Code Select Expand

Pos,255 ,Raw, 0, 0, 0

GETIDAC

Code Select Expand

MON>>>getidac
getidac end(60ms)
MODULATOR_IDAC 0x00000030
SNS0_IDAC      0x00000015
SNS1_IDAC      0x00000018
SNS2_IDAC      0x00000021
SNS0_RAW       0x00002CD0
SNS1_RAW       0x00002C87
SNS2_RAW       0x00002CE9
SNS0_BSLN      0x00002CC6
SNS1_BSLN      0x00002C82
SNS2_BSLN      0x00002CE0
SNS0_DIFF      0x00000000
SNS1_DIFF      0x00000000
SNS2_DIFF      0x00000000

UARTMODE UARTBRD UARTSEND maybe some kind of uart redirection to talk to some MPU slave?

Code Select Expand

MON>>>UARTMODE
Usage: uartmode [master | slave]

MON>>>UARTBRD
Usage: uartbrd prs ken brn brk

MON>>>UARTSEND
Usage: uartsend data

DISPTEST DISPON DISPOFF
LIGHTON LIGHTOFF

Functions for top (settings) display present only on R. DISPON/OFF and LIGHTON/OFF does exactly what you think. DISPTEST takes three arguments, not sure how to use it.

TEMPINFO
The same result as on RP, with the same sensors.

Others
coon was getting a ton of

Code Select Expand

temp_task.c:421 I2C Comm Error ret=1 spam in his RP logs. Mine (R) is spamming this only when main LCD assembly is disconnected from camera.

All tests done on R running latest (1.8.0) firmware.

[kitor]

Code Select Expand

MON>>>about

-----------------------------------------------
             Debug Monitor Version             
                     K429 ES2A
        Internal high-speed oscillation
-----------------------------------------------
        MPU Ver...0x0016
        MPU check sum...0x17927A70

        EEP Ver...0x04

Hello from MPU in... EOS R Battery grip (BG-E22)!

Long story short: Yesterday, before i dug into R i was talking with @coon looking for possible R/RP MPU datasheets. I found a photo of my battery grip internals and we realized that it has exactly the same microcontroller as R/RP MPU. This explains why those things are so damn expensive 

You will find how to access UART in Battery grip pins / UART thread.

Now the fun parts:

Command list:

Code Select Expand

MON>>>help

-----------------------------------------------
             Monitor Command List             
-----------------------------------------------
BATTCLOSE BATTCHECK BCINFO BATTLEVEL BATTUSEERR
BATTREPREQ BATTEXCLU BATTCHECKSPEC GETRCP GETRC
GETSC FGCOMM BATTINFO VLDET ABOUT VER FAABOUT
FAVER HELP UPBNY TRMOSC DEBUGLOG DISPPORTKEEP
REGR REGW MEMR MEMW EEPR EEPW EEPCLK ADCHECK
ADCHECK2 ADTIME ADMODE SCOUT UARTMODE UARTBRD
UARTSEND DNFCLK DNFON DNFOFF RTCON RTCOFF
RTCADJON RTCADJOFF TIMEOUT KWUPCNT I2C ICUTEST
MODE MPUSHUTDOWN MPUMUKO SHUTDOWNDEBUG USBCHG
BATSEL GRIPLED LENSPOWER E1ON E1OFF FACMD
TIMERCMD INFOCMD STACKINFO DRYCTEST SYSRESET

STACKINFO

Code Select Expand

MON>>>stackinfo
Sw Task Stack Info addr=0x20005DB0 size=4000 used=68
Main Task Stack Info addr=0x20007228 size=1200 used=244
Batt Task Stack Info addr=0x20007228 size=1200 used=244
Temp Task Stack Info addr=0x20007228 size=1200 used=244
Acc Task Stack Info addr=0x20007228 size=1200 used=244
Disp Task Stack Info addr=0x20007228 size=1200 used=244
Adapter Task Stack Info addr=0x20007228 size=1200 used=244
Log Task Stack Info addr=0x200076E0 size=1340 used=520
Monitor Task Stack Info addr=0x20007C28 size=900 used=168
Idle Task Stack Info addr=0x20007FB8 size=500 used=156

UPBNY update binary?

DANGEROUS! Grip won't exit this mode even after power was disconnected. But fortunately ctrl+z broke the sequence after tense 5 minutes.

Code Select Expand

MON>>>upbny
RSTFLG : 0100

Please Send *.bny
.

Please Send *.bny
Update File Unknown

GRIPLED - toggle grip (charging) LEDs. Argument is (L)eft / (R)ight / (C)lear

Code Select Expand

MON>>>gripled
Usage:GRIPLED [L/R/C]

[leegong]

Architecture of MPU is 32 bit ARMv7 (little endian) like ICU. Therefore it is not TX19a / MIPS anymore.
Base address of MPU firmware image is 0x20000000.

It looks like that a minimal version of DryOS is running on MPU. I think it should be possible to emulate MPU in qemu now.
We may also abuse the MPUs update mechanism to boot up some MPU version of ML and start our own tasks there, if we should ever be in need for that.

Could you please send MPU firmware dumping to my E-mail? [email protected]
I can analyze the firmware with IDA PRO, add value to your DIGIC 8 MPU investigation.

[leegong]

Debug Commands of DIGIC 8 MPU look like same as that in DIGIC 6/7.
https://www.magiclantern.fm/forum/index.php?topic=17596.0

[leegong]

Just build IDB with RP_MPU Dumping,
ROM:00019E56                 BLX             R2  is call interface of all monitor function found by coon ,
key struc_table at 0x4ED38:
00000000 struc_DbgFunction struc
00000000 lp_DbgCmdString
00000004 lp_funcall
Anybody wants the IDB? send PM to me or let me know in this post please.