- try random values (it may even work for simple handshakes)
Example for 5D3: comment out register ``0xC0400204`` (``case 0x204`` under ``C0400000``,
introduced in `b79cd7a <https://bitbucket.org/hudson/magic-lantern/commits/b79cd7a>`_)
introduced in `b79cd7a <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/e40aeb41b3846aa30ea94b44ab49aeab9a4f19a5>`_)
and run with ``-d io``::
[BASIC] at 0xFFFF066C:00000000 [0xC0400204] -> 0x0 : ???
...
...
@@ -550,7 +548,7 @@ Easy, right?
Harder case: the value of some MMIO register steers the code on a path you don't want.
Example for 1300D, before changeset `cbf042b <https://bitbucket.org/hudson/magic-lantern/commits/cbf042b>`_
Example for 1300D, before changeset `cbf042b <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/57fb8141f01065195279fabbc5704855b10ba3f1>`_
(to try this, manually undo the linked change):
After adding the basic definition, the bootloader shows a factory menu, rather than jumping to main firmware.
...
...
@@ -625,7 +623,7 @@ Step by step:
- make sure you get periodical interrupts when running with ``-d io,int``, even when all DryOS tasks are idle
Example: 1300D (comment out ``dryos_timer_id`` and ``dryos_timer_interrupt`` from the 1300D section
in ``model_list.c`` to get the state before `7f1a436 <https://bitbucket.org/hudson/magic-lantern/commits/7f1a436#chg-contrib/qemu/eos/model_list.c>`_)::
in ``model_list.c`` to get the state before `7f1a436 <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/7d7c4247e2752c603e945b1f39498194f7cc14c7#ab988524dbc98fad520db2edfb579770144b8234>`_)::
[INT] at 0xFE0C3E10:FE0C0C18 [0xC0201010] <- 0x9 : Enabled interrupt 09h
...
...
...
@@ -646,13 +644,13 @@ Step by step:
- identify the pointer to current DryOS task
This is called ``current_task_addr`` in ``model_list.c``, ``CURRENT_TASK`` in ``debugmsg.gdb`` or ``current_task`` in ML stubs —
see `debug-logging.gdb <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/scripts/debug-logging.gdb#debug-logging.gdb>`_
see `debug-logging.gdb <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/scripts/debug-logging.gdb>`_
for further hints.
- identify where the current interrupt is stored
Look in the interrupt handler — breakpoint at 0x18 to find it — and find ``CURRENT_ISR`` in
- make sure the display is initialized, identify the image buffers etc.
EOS firmware startup sequence
...
...
@@ -747,7 +745,7 @@ The DryOS timer interrupt (heartbeat) was different from *all other* DIGIC 4 and
the emulation to go **that** far without a valid heartbeat (that way, we've lost many hours of debugging).
Now scroll up and read that section again ;)
Fixing that and a few other things (`commit 7f1a436 <https://bitbucket.org/hudson/magic-lantern/commits/7f1a436>`_)
Fixing that and a few other things (`commit 7f1a436 <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/7d7c4247e2752c603e945b1f39498194f7cc14c7>`_)
were enough to bring the GUI on 1300D.
PowerShot firmware startup sequence
...
...
@@ -812,7 +810,7 @@ hiding the error message from the user is *not* the way to solve it!**
Examples:
**Patching the UTimer waiting routine on 80D** (``80D/patches.gdb``, commit `7ea57e7 <https://bitbucket.org/hudson/magic-lantern/commits/7ea57e73c09#chg-contrib/qemu/scripts/80D/patches.gdb>`_):
**Patching the UTimer waiting routine on 80D** (``80D/patches.gdb``, commit `7ea57e7 <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/a683fdb973e6140fae0c1ac054f101ce76b5a8d5>`_):
.. code::
...
...
@@ -828,7 +826,7 @@ See arm-mcr.h for a few useful instructions encodings, use an assembler or read
(in particular, `ARM Architecture Reference Manual <http://www.scss.tcd.ie/~waldroj/3d1/arm_arm.pdf>`_
and `Thumb-2 Supplement Reference Manual <http://read.pudn.com/downloads159/doc/709030/Thumb-2SupplementReferenceManual.pdf>`_).
**Patching the EstimatedSize assertion on 80D** (``80D/patches.gdb``, commit `b6c5710 <https://bitbucket.org/hudson/magic-lantern/commits/b6c5710afebbffbb194f9102fbfa9798b99fde1b?at=qemu#chg-contrib/qemu/scripts/80D/patches.gdb>`_)
**Patching the EstimatedSize assertion on 80D** (``80D/patches.gdb``, commit `b6c5710af <https://foss.heptapod.net/magic-lantern/magic-lantern/-/commit/8b508a551481e1fc31c0551fb765d58c7937ac6c#a00dc09672f2d3657f02a954e0f25f464763b032>`_)
After enabling the above UTimer patch, with the generic MPU messages you may get this error::
...
...
@@ -853,7 +851,7 @@ then run the firmware under GDB, with ``-d callstack``:
...
The function you are looking for is ``0xFE19B03B`` (could have been any of the callers) and the assertion was triggered at ``0xfe19b14b``.
is at ``0xFE19B06A``, in the function identified with this method.
Incorrect firmware version?
...
...
@@ -895,7 +893,7 @@ Payload format is: ``[class] [id] <data> [ack_requested]``.
The first two bytes can be used to identify the message
(and for messages that refer to a property, to identify the property).
Property events are in `known_spells.h <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_;
Property events are in `known_spells.h <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_;
GUI events (button codes) have ``class = 06``.
To log the MPU communication:
...
...
@@ -932,7 +930,7 @@ The message sent by the main CPU is::
- ``04`` is payload size (always ``message_size - 1`` or ``message_size - 2``)
- ``02 00 00 00`` is the payload:
- ``02 00`` identifies the message (look it up in `known_spells.h <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_)
- ``02 00`` identifies the message (look it up in `known_spells.h <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_)
- the last ``00`` means no special confirmation was requested (``Complete WaitID`` string)
- the remaining ``00`` may contain property data or other information (nothing interesting here)
...
...
@@ -960,10 +958,10 @@ The second and third messages are easier to grasp::
How do you get these messages?
From a `startup log <http://builds.magiclantern.fm/jenkins/view/Experiments/job/startup-log/>`_ (`dm-spy-experiments <http://www.magiclantern.fm/forum/index.php?topic=2388.0>`_), use
to parse the MPU communication into C code (see `make_spells.sh <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/make_spells.sh>`_).
to parse the MPU communication into C code (see `make_spells.sh <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/make_spells.sh>`_).
There are also generic spells in `generic.h <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/generic.h>`_
There are also generic spells in `generic.h <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/generic.h>`_
that are recognized by most EOS models and are good enough to enable navigation on Canon menus.
Things to check:
...
...
@@ -984,11 +982,11 @@ define ``.serial_flash_size`` in ``model_list.c`` and a few other parameters:
- SIO channel (used for SPI transfers)
- check SFIO and SFDMA in ``eos_handlers`` (for DMA transfers — Canon reused the same kind of DMA used for SD card).
To extract MPU messages from a `startup log <http://builds.magiclantern.fm/jenkins/view/Experiments/job/startup-log/>`_,
use `extract_init_spells.py <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/extract_init_spells.py>`_ (see `MPU communication`_).
use `extract_init_spells.py <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/extract_init_spells.py>`_ (see `MPU communication`_).
To customize keys or add support for new buttons or GUI events,
and `extract_button_codes.py <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/extract_button_codes.py>`_.
Known MPU messages and properties are exported to `known_spells.h <https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_.
Known MPU messages and properties are exported to `known_spells.h <https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/eos/mpu_spells/known_spells.h>`_.