Battery grip pins / UART

[vth]

Not found yet working UART pinout for Canon 5D mark II (I need it for repair purpose) and here is one:

Also I digged JTAG pinout, but haven't checked it yet.
Also here is JTAG and UART pinout for processors used in old cameras:Digic 4 CK4-1249 and Digic 4 CH4-6405 (they are same at this small part)

[coon]

Today I've made some further experiments on RP debug connector and I've found out when pulling pin 5 low, MPU gives the following output when battery power is applied:

Code: [Select]

RSTFLG : 0009
!!!MPU Forced Wakeup!!!
setCCSnkRst
disableBattUVLOInt
Reg0D: 00/00, Reg14: 7F/7F
setCCSnkRst
E0ON
E1ON
initBattery

MON>>>sw task Initialize Complete
/USB_DET undetected
batt task Initialize Complete
adapter task Initialize Complete
temp task Initialize Complete
disp task Initialize Complete
acc task Initialize Complete
setCCSnkRst

This will boot MPU and ICU, even when battery door is open, and also won't shut it down when opening battery door. Thus the last unknown pin is /MPU_FORCED_WAKEUP
We do now know the full pinout of the debug connector of modern cams (200D, R, RP, R6, R5 etc.):

Code: [Select]

1: VCC_ICU (1v8)
2: RX_ICU (1v8)
3: TX_ICU (1v8)
4: GND
5: /MPU_FORCED_WAKEUP (3v3)
6: TX_MPU (3v3)
7: RX_MPU (3v3)
8: VCC_MPU (3v3)

It's not possible to power camera through debug connector, as not all parts in camera will be supplied with power. MPU will refuse to boot with low battery warning. Therefore I think the pins are meant so be "sense' pins, so one does now if MPU and ICU are currently powered. Instead 7.2V have to be provided via battery connector, or alternatively via the test pads next to it:

[coon]

Meanwhile I have soldered the unpopulated connector, next to the UART one on RPs mainboard. I can confirm that a JST 08FZC-SM1-GAN-TB(HF) fits perfectly. It can directly be ordered from JST.

While analyzing the port I have found out it exposes JTAG pins:

Code: [Select]

1: SWCLK (3v3)
2: GND
3: SWDIO (3v3)
4:
5:
6:
7: VCC_MPU (3v3)
8: /RST (3v3)



However:
- It's not full JTAG but SWD, a simplified one wire variant of JTAG.
- Only JTAG pins of MPU are available. It would be more interesting of having JTAG for ICU
- Readout protection seems to be activated as I wasn't able to read out anything from MPU. Thus I probably need to erase and reflash MPU firmware before I am able to use SWD features. As I don't want to brick it I won't do this right now.
- 3 pins are still unknown

Kinda interesting but seems not very useful to me yet.

[kitor]

Not found yet working UART pinout for Canon 5D mark II (I need it for repair purpose) and here is one:

As the image URL is broken, here are the images:
https://photo-parts.com.ua/parts/imgbrowse.php?folder=IMG_STORE/Canon%205D%20mark%20II%20PCB/

[Walter Schulz]

17-pin SUR for 5DS/5DS R!

Pinout (top to bottom)
1 VCC. 3v1 off, 3v3 on
2
3
4
5
6 Secondary ICU TX
7 Secondary ICU RX
8 GND
9 FPU TX
10 FPU RX (?)
11
12
13 Primary ICU TX
14 Primary ICU RX
15
16 MPU TX
17 MPU RX

[Walter Schulz]

Created a wiki page for UART connectors for each cam. For cams without SUR/XSR/FZC/FZA connector I tried to link info about UART pins on PCB.
Please check and correct errors.
https://wiki.magiclantern.fm/uart_connectors



Updated links to PCBs in g3gg0's post: https://www.magiclantern.fm/forum/index.php?topic=19378.msg240573#msg240573
(Should be moved to somewhere else ...)

[kitor]

Oh, I forgot to post SX740.
Unfortunately on PCB, requires a complete disassembly. Hard to solder without damaging traces...



EOS R5, under a plastic cover under the screen. FZC8, pinout same as EOS R.

[kitor]

EOS 7D Mark 1

This is actually a success story of unbricking 7D mk1 on our Discord channel.
Photos kudos to @roscombot, who is the owner of now fully functional 7D.

Back story - something had happened during a downgrade from 2.0.5 to 1.2.3 that made camera inoperable.
Story goes that this was many years ago when camera was still on warranty, and Canon service center was not able to fix it.

What we found is Master CPU was running 1.2.3 firmware and screaming about broken properties. Slave CPU was running 2.0.5 and waiting for communication from Master.
Long story short is that after some digging in QEMU and Ghidra we were able to successfully drop to FROMUTILITY menu and start upgrade from there. While downgrading everything to 1.2.3 did not solve the problem, upgrading to 2.0.5 fixed it.

Important notes are:
- one can start FROMUTILITY on both CPUs, but on Master it is broken (?) some options just hang, other appear to work but do nothing. Slave has more options.
- Thanks to Walter for poking around and finding Slave CPU UART. That was a key to unbricking this camera.

btw: Slave CPU runs GUI, etc... and MagicLantern also runs there.

[Walter Schulz]

Canon EOS 7D

Layout for 16-pin XSR (bottom left)
From left to right

Code: [Select]

1                            9
2                           10
3                           11 VCC (2.94 off/3.3 on)
4                           12
5                           13 MPU TX
6                           14 MPU RX
7                           15 GND
8 VCC (3V off, 3v4 on)      16


[Walter Schulz]

7DII:

From top to bottom:
1 MPU Rx
2 MPU Tx
3
4
5 Master ICU Rx
6 Master ICU Tx
7
8 (Some kind of reset when connected to ground. Both ICUs restart but rear display goes black and remains until battery pull and insert)
9 FPU Rx (?)
10 FPU Tx
11Vcc
12 GND
13 Slave ICU Rx
14 Slave ICU Tx

In case you are wondering about order: SUR connector rotated 180° compared to 5D3, 5DS R.

[kitor]

6D mk I:



From top to bottom:

Code: [Select]

1 EEKO_TX
2 EEKO_RX
3 ?? (3v3), trying to transmit resets ICU
4 ICU_TX
5 ICU_RX
6 GND
7 ?? (3v3)
8 MPU_TX
9 MPU_RX
10 ?? (3v3)


Code: [Select]

Dry> vers
DRYOS version 2.3, release #0051
  Dry-MK 2.60
  Dry-DM 1.20
  Dry-stdlib 1.52
  Dry-NET6 0.33 111125+4796
  Dry-ECI6 0.20+110927
  Dry-DNS 1.23pre 120130-4845
  Dry-DHCPC 2.23
  Dry-PX 1.09
  Dry-drylib 1.21
  Dry-shell 1.17
  Dry-command alpha 058

Code: [Select]

Dry> help
[Debug]
 xd  xm  task  PCMcheck  PCMclear
[EekoLog]
 GetEekoLog  PutEekoLog

Fun story: This was a dead camera body, no signs of life. After power was applied it immediately printed "UndefinedInstruction" on ICU UART in loop.
The issue was a blown fuse on power PCB. One of ICU RAM power rails was missing due to that.

[kitor]

BG-R10 aka EOS R5/R6 battery grip

Due to comm connector relocation it is much easier to plug camera in while disassembled





Investigation on Digic X MPU, including... firmware emulation in QEMU 
https://www.magiclantern.fm/forum/index.php?topic=25661.msg242569#msg242569