(M)JPEG encoder

Started by Chucho, September 11, 2012, 03:40:07 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

nanomad

Uhm, 1% can you please check
*(0x05724+0x34)
and
*(0x05724+0x38)

The first one should be a pointer and the second one a length of the data contained in the memory pointed by the first...
uhm and +0x4C should be some kind of frame number


LOL
I just realized it's the same address we investigated for the H264 encoder stuff. That memory location is definitely important
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

nanomad

They are null even when recording
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

1%

NSTUB(0xFF111928, str:lvcdevResourceGet_LVC_OUTPUT_DEVICE_T) looks like its supposed to output jpeg or .422 depending on which paths are picked.

nanomad

According to alex it causes Err70 when called :(
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

a1ex

But I've only tried on 5D3.

1%

It doesn't take any parameters? Maybe switch all the a drives to B and then try? Or turn off asserts.

I get this and camera turns off when I call it:

ASSERT: this
at Dev\LiveViewDevState.c:633, task run_test
lv:1 mode:20


Magic Lantern version : v2.3.TRAGIC.2012Sep19.600D102
Mercurial changeset   : 26f1e5f44e73+ (unified) tip
Built on 2012-09-19 17:37:17 by user@D610.
Free Memory  : 333K + 1434K

nanomad

Quote from: 1% on September 19, 2012, 07:37:05 PM
It doesn't take any parameters? Maybe switch all the a drives to B and then try? Or turn off asserts.

It takes a tons of parameters actually, most of them are stack based. Some may be set by the other call Alex mentioned



ROM:FF10DF5C var_D8          = -0xD8
ROM:FF10DF5C var_C4          = -0xC4
ROM:FF10DF5C var_C0          = -0xC0
ROM:FF10DF5C var_BC          = -0xBC
ROM:FF10DF5C var_B8          = -0xB8
ROM:FF10DF5C var_B4          = -0xB4
ROM:FF10DF5C var_B0          = -0xB0
ROM:FF10DF5C var_AC          = -0xAC
ROM:FF10DF5C var_A8          = -0xA8
ROM:FF10DF5C var_A4          = -0xA4
ROM:FF10DF5C var_A0          = -0xA0
ROM:FF10DF5C var_9C          = -0x9C
ROM:FF10DF5C var_98          = -0x98
ROM:FF10DF5C var_94          = -0x94
ROM:FF10DF5C var_90          = -0x90
ROM:FF10DF5C var_8C          = -0x8C
ROM:FF10DF5C var_8A          = -0x8A
ROM:FF10DF5C var_88          = -0x88
ROM:FF10DF5C var_84          = -0x84
ROM:FF10DF5C var_80          = -0x80
ROM:FF10DF5C var_7C          = -0x7C
ROM:FF10DF5C var_78          = -0x78
ROM:FF10DF5C var_74          = -0x74
ROM:FF10DF5C var_70          = -0x70
ROM:FF10DF5C var_6C          = -0x6C
ROM:FF10DF5C var_68          = -0x68
ROM:FF10DF5C var_64          = -0x64
ROM:FF10DF5C var_60          = -0x60
ROM:FF10DF5C var_5C          = -0x5C
ROM:FF10DF5C var_58          = -0x58
ROM:FF10DF5C var_54          = -0x54
ROM:FF10DF5C var_50          = -0x50
ROM:FF10DF5C var_4C          = -0x4C
ROM:FF10DF5C var_48          = -0x48
ROM:FF10DF5C var_44          = -0x44
ROM:FF10DF5C var_40          = -0x40
ROM:FF10DF5C var_3C          = -0x3C
ROM:FF10DF5C var_38          = -0x38
ROM:FF10DF5C var_34          = -0x34
ROM:FF10DF5C var_30          = -0x30
ROM:FF10DF5C var_2C          = -0x2C
ROM:FF10DF5C var_28          = -0x28
ROM:FF10DF5C var_24          = -0x24
ROM:FF10DF5C var_20          = -0x20
ROM:FF10DF5C var_1C          = -0x1C
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

1%

With assert didsabled, lv freezes + turns green with weirdness in it.

nanomad

Quote from: 1% on September 19, 2012, 07:37:05 PM
ASSERT: this
at Dev\LiveViewDevState.c:633, task run_test
lv:1 mode:20
That's sounds like a null-pointer exception since R0 was null


Quote from: 1% on September 19, 2012, 07:46:04 PM
With assert didsabled, lv freezes + turns green with weirdness in it.

Of course, you're missing something like 30 parameters :P
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

1%

So how to try it properly? Also does it delete the jpegs/4.22 afterwards? Some usb functions in there too.. .how does LV data get over USB... as jpeg? Would explain the low res.

nanomad

It looks like that function is actually used to send LV data over PTP to the EOS app...that makes sense
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

1%

Probably have to patch out:

>JPEG Size Over(%#lx-%#lx)'

and a:\ is the USB?

Also are the LV jpeg addresses still deadbeaf when PTP is hooked up and EOS utility streaming LV?

nanomad

A and B are the card drives in dual slot cameras. The code reads the active one (it's a check on R0 to decide wether it should use A vs B and JPG vs YUV)
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

a1ex

JPEG size over => means that current JPEG was too big, reallocate a bigger chunk of RAM and try again.

This thing might be used to send data to EOS utility, but using that in LiveView doesn't seem to help, the buffer and size are still zero (60D).

a1ex

Solved the mistery on 60D. Magic word is WriteEDmacPackMem.

1%


a1ex

That's where you find the jpeg buffer. It's only updated in standby (low-resolution modes), including 50/60p.

Next:
- how to get a FullHD JPEG?
- how to make it work on 5D3, where there's no sign of JPEG in the RAM dump?

ilguercio

Canon EOS 6D, 60D, 50D.
Sigma 70-200 EX OS HSM, Sigma 70-200 Apo EX HSM, Samyang 14 2.8, Samyang 35 1.4, Samyang 85 1.4.
Proud supporter of Magic Lantern.

Chucho

There wasn't any jpeg in ram but I didn't check when recording. I can only dump 8MB at a time of ram when recording before buffer gets filled and this is with the lens cap on.

a1ex

LVCDEV doesn't seem to be active on 600D, so I guess it's disabled (like on 5D3). The 60D was lucky.

1%

Well there is

FF111C58:   STRING: '->lvcdevStartDev'

on 600D. So still has to be started another way.

Also: NSTUB(0xFF11189C, str:Dev\LiveViewDevState.c_lvcdevStartDev)

called_by:str:ptpCacheDataStore_ptpCacheCreateMemo

also have: NSTUB(0xFF111630, str:Dev\LiveViewDevState.c_lvcdevInit)

Maybe it lets you chose:

FF111874:   '->lvcdevInit'    FF111648
FF111888:   'lvcdevStartH264(%d)'    FF1116F4
FF111C58:   '->lvcdevStartDev'    FF1118B8
FF111C78:   '->lvcdevResourceGet(%d,%d,%d)'

Initialize then either start h264 or startdev and then do the resourceget.

Tried init then start:

129:  4865.209 [GUI] MainEventHandler PROP_LV_OUTPUT_DEVICE(1)
    130:  4874.921 [LV] [EVF] Flicker Detect!!!
    131:  4897.217 [LV] [EVF] Flicker Detect!!!
    132:  4942.648 [LV] [EVF] Flicker Detect!!!
    133:  4988.108 [LV] [EVF] Flicker Detect!!!
    134:  5021.262 [LVCDEV] DF 43Hz:   3 50Hz:   3 60Hz:  15 74Hz:  41
    135:  5033.565 [LV] [EVF] Flicker Detect!!!
    136:  5078.963 [LV] [EVF] Flicker Detect!!!
    137:  5110.098 [LVCDEV] DF 43Hz:   3 50Hz:   0 60Hz:  89 74Hz:   4
    138:  5124.420 [LV] [EVF] Flicker Detect!!!
    139:  5169.848 [LV] [EVF] Flicker Detect!!!
    140:  5202.919 [LVCDEV] DF 43Hz:   9 50Hz:   1 60Hz:  18 74Hz:  44
    141:  5215.295 [LV] [EVF] Flicker Detect!!!
    142:  5260.745 [LV] [EVF] Flicker Detect!!!
    143:  5292.132 [LVCDEV] DF 43Hz:  19 50Hz:   3 60Hz:   0 74Hz:  10
    144:  5306.182 [LV] [EVF] Flicker Detect!!!
    145:  5351.621 [LV] [EVF] Flicker Detect!!!
    146:  5384.780 [LVCDEV] DF 43Hz:  34 50Hz:   7 60Hz:   9 74Hz:   6
    147:  5384.941 [LVCDEV] Flicker Detect Complete:0
    148:  5422.840 [LV] [PATH] GetPathDriveInfo[0]
    149:  5669.540 [DISP] Enable Pb 1 (2149)
    150:  5805.148 [DISP] TurnOnDisplay finish Type=0
    151: 12624.688 [STARTUP] ERROR ASSERT : Dev\LiveViewDevState.c, Task = run_test
    152: 12624.793 [STARTUP] ERROR ASSERT : Line 443
    153: 12624.845 [STARTUP] ERROR ASSERT : this
    154: 12625.009 [STARTUP] startupErrorRequestChangeCBR (0x1d)
    155: 12625.077 [STARTUP] startupErrorRequestChangeCBR : ErrorSend (101, ABORT)
    156: 12625.385 [STARTUP] ASSERT : Time 2012/9/19 18:42:9


On newer cameras maybe its only started for "flicker detect".


Write edmacpackmem doesn't exist either....

This does but not sure if its useful.

FF3B040C: '[PATH] WriteEDmacFlickerCompleteCBR' FF3B0210
FF3B0434: '[PATH] Flicker_SetPath' FF3B0240
FF3B0450: '[PATH] ResLock CreateLock Hist NG' FF3B0268
FF3B0474: '[PATH] ResLock Lock Hist NG' FF3B0290
FF3B0494: '[PATH] Flicker_StartPath[%lx]' FF3B0304
FF3B04BC: '[PATH] Flicker_StopPath' FF3B0364
FF3B04D4: '[PATH] FLICKER[W](%#lx->%#lx)'


I tried recording a movie along with PTP and it worked... address is still deadbeaf but got some sort of LVCDEV error before flicker detection.

I get this from StartLVTestImage


  172:  7211.112 [JOB] ERROR GetImageBuffer failed
    173:  7211.223 [LV] ##LV_CaptureTestImage 00000007
    174:  7211.510 [LV] ##ChangeProperty PROP_LV_DISPSIZE = 1 (1)
    175:  7212.062 ERROR [GMT] GmtEvProc_lv_old_start - State:6
    176:  7337.684 [CAPE] ERROR :VRAM(0x445c380)WB(0x40c1260)
    177:  7337.783 [CAPE] ERROR :JUKAI WR(0xf528580)RD(0x0)
    178:  7337.851 [CAPE] ERROR :JPEG WR(0x0)RD(0xc234700)
    179:  7337.918 [CAPE] ERROR :FEN YWR(0x0)WR(0xf6584d0)RD(0x572dc0)
    180:  7337.963 [CAP]:ISR >>>>>>>>> HEAD ERROR >>> FIFO ERROR
    181:  7338.013 [LV] ERROR [EVF] NotifyHeadErrorCBR
    182:  7338.110 [LV] ERROR [PATH] VRAM[W](0xc267a20)   YUV[W](0x40d4b80)
    183:  7338.184 [LV] ERROR [PATH] FENC[W](0xf575c00) QUARK[W](0x0)
    184:  7338.252 [LV] ERROR [PATH] FLIC[W](0x6000978)  TA10[R](0x572dc0)
    185:  7338.308 [LV] ERROR [PATH] JPEG[R](0x729a60)  JPEG[W](0x0)
    186:  7353.176 [LV] ERROR [PATH] Path Incomplete[100]
    187:  7353.364 [LV] ERROR [PATH] (Rec_HD)CRAW[W](0x44332200->0x46e9460)
    188:  7353.933 [LV] ERROR [PATH] (Rec_HD)CRAW[W](0x44332200->0x46e9460)
    189:  7387.811 [MR] mvrFixQScale FIX_QSCALE(0:VBR, 1:FIX) = 0
    190:  7388.091 [MR] mvrSetDeblockingFilter (alpha = -6, beta = -6)
    191:  7388.181 [MR] mvrSetQscaleYC (Y:-12, C:0)
    192:  7390.411 [MR] mvrChangeAckCBR : Video - Mode=0, Type=0, Rate=24, GOP=3
    193:  7713.703 [CAPE] ERROR :VRAM(0x4476fa0)WB(0x40dc620)
    194:  7713.816 [CAPE] ERROR :JUKAI WR(0xf52a380)RD(0x0)
    195:  7713.877 [CAPE] ERROR :JPEG WR(0x0)RD(0xc234700)
    196:  7713.942 [CAPE] ERROR :FEN YWR(0x0)WR(0xf658580)RD(0x572dc0)
    197:  7713.985 [CAP]:ISR >>>>>>>>> HEAD ERROR >>> FIFO ERROR
    198:  7714.036 [LV] ERROR [EVF] NotifyHeadErrorCBR
    199:  7714.125 [LV] ERROR [PATH] VRAM[W](0xf156ce0)   YUV[W](0x40f0cc0)
    200:  7714.186 [LV] ERROR [PATH] FENC[W](0xf575c00) QUARK[W](0x0)
    201:  7714.256 [LV] ERROR [PATH] FLIC[W](0x6000978)  TA10[R](0x572dc0)
    202:  7714.317 [LV] ERROR [PATH] JPEG[R](0x729a60)  JPEG[W](0x0)
    203:  7728.538 [LV] ERROR [PATH] Path Incomplete[100]
    204:  7728.722 [LV] ERROR [PATH] (Rec_HD)CRAW[W](0x44332200->0x46e9460)


LV old didn't start for some reason and it gave all of these errors.

Tried in photo mode... after that LV  is blank. Still visible on external display tho.

Chucho

In 0xb40318 FA_GetJpegSizeForLV has flags 0xb402f0 --> 0x18 0xb40308 --> 0x2c
0xb4035c FA_ GetJpegBufforLV 0xb40334 --> 0x18 0xb4034c --> 0x2c
I don't know what this means? I'm working with firmware 101 still haven't updated to 102.
Dumped 0xb3f0e0 to 0xb444b8 found some new function names.

Edit: it looks like 0xb4035c -->FA_GetJpegBufForLV is some how connected to 0xb4250c -->mvrSetD_HD, I don't understand the structure links in this area.

1%

I'm 101 as well. 102 was almost 0 changes.

a1ex

QuoteOf course, you're missing something like 30 parameters :P

Those, I think:




lock = TwoInTwoOutJpegPath_CreateResLockEntry(ttj_struct)
TwoInTwoOutJpegPath_work_maybe(lock, ttj_struct, &output_size, job_id_maybe)
TwoInTwoOutJpegPath_DeleteResLockEntry(lock)
chunk = GetFirstChunkFromSuite_maybe(ttj_struct.off_0x88)
jpeg_address = GetMemoryAddressOfMemoryChunk(chunk)


Some fields from that big structure:

0x00: always points to 0xa0000, passed to CreateResLockEntry
0x04: always 0x1f, passed to CreateResLockEntry
0x08: engio list, enables c0f13000 and configures a few others
0x0c: 0
0x10: engio list, disables c0f13000
0x14: empty engio list?!
0x18: engio list, starts at c0f03218
0x1c: 0
0x20: 0
0x24: 0
0x28: 0
0x2c: 0
0x30: 0
0x34: 0
0x38: ffff
0x3a: image width (16 bit)
0x3c: image height (16 bit)
0x3e: some sort of counter, increases when changing video modes
0x40: 0
0x44: resource lock gets saved there
0x48: a
0x4c: 5
0x50: -1
0x54: 3
0x58: input image buffer address
0x5c: 0

0x80: assigned with 0x20000001
0x88: memory suite where the jpeg data will be written (it's pre-allocated)
fields pointing to ROM addresses seem to be engio structures, they change with video modes

1%

That's a lot of parameters....

But lvcdev seems there, + functions to start it. Just never used in normal mode so no examples on how to get it going.

What is jukai (its some sort of food topping) and quark? Both of those have no write address in the log.