FANDOM


Canon 40D Register Map

CFDMAEdit

0xC0700000 CF Base #0 

link: http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf
link: https://www.mouser.com/catalog/specsheets/CF4_DS_Rev1.0.pdf

Request Configuration Block 
 +0x200  [8]    

CF/IDE Interface block
 +0x2000 [8]   PIO DATA (used to transfer data in polled mode)
 +0x2001 [8]   Read: Error data, Write: Features
 +0x2002 [8]   Sector count
 +0x2003 [8]   Sector number
 +0x2004 [8]   Cylinder low byte
 +0x2005 [8]   Cylinder high byte
 +0x2006 [8]   Drive/Head
 +0x2007 [8]   Read: Status, Write: CF command 
 +0x200E [8]   Read: Alt Status, Write: Device control

Extern DMA Controller Interface (DMA PIO mode - not polled mode) (digic3<->cf controller ?) 
 +0x8000 [32]  0x1   (changing these will make the CF controller disapper, clk or cs ?)
 +0x8004 [32]  0x3   (changing these will make the CF controller disapper, clk or cs ?)
 +0x8008 [32]  0x1FF (changing these will make the CF controller disapper, clk or cs ?) 
 +0x800C [32]  Data register to feed with data (usually 0x2000)
 +0x8010 [32]  unknown, set to 0x100. maybe sector size?
 +0x8014 [32]  unknown, set to PIO_W:0x1E, PIO_R:0x16, DMA:0x00, 
 +0x8024 [32]  PIO: CF Command register to use, OR'ed with 0xA000
 +0x8028 [32]  PIO: set to ?
 +0x8030 [32]  PIO: set to ?
 +0x8034 [32]  PIO: set to ? or ? depending on command reg
 +0x8038 [32]  PIO: set to ? or ? depending on command reg
 +0x8040 [32]  Enable interrupt when flag changed? 0, 1, 0x2000000
 +0x8044 [32]  Interrupt reason, write with negated value upon interrupt
 +0x8048 [32]  set to 1, maybe transfer count?

Tranfer mode control registers ? (cf controller <-> cf card ?)
 +0x8100 [32]  0x0 (init) or 0x2 (software OR's with 0xFFFFFFF9 then AND with 0x2)
 +0x8104 [32]  0x4
PIO access timing registers (cf controller <-> cf card ?) 
 +0x8108 [32]  access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s
 +0x810C [32]  access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s
 +0x8110 [32]  access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s
 +0x8114 [32]  access timing PIO mode - fastest mode = 0xC0 ~ 20mb/s

Notes:
When setting timing registers 0x8108-0x8114 incorrectly, the FIO_Write function will recover from any 
errors and return a error to the caller via return value. The FIO_Read will not, and a call will FIO_read 
will stall the camera.
 
Secondary CF slot ?
 +0x8200 [32] 0x0     (?)
 +0x8204 [32] 0x0     (?)
 +0x8208 [32] 0x3FFFF (?)
 +0x820C [32] 0x3FFFF (?)
 +0x8210 [32] 0x3FFFF (register is changable)
 +0x8214 [32] 0x3FFFF (register is changable)


SDCON Interface used by CF
0xC0C.....




EDMAC 16 channels only (0xC0F04000)

EDMAC0 - EDMAC15
  0xC0F04000
  0xC0F04100
  ..
  0xC0F04F00
    +0x00 [32]  DMA control 
       -------- -------1  Start transfer / Transfer in progress

    +0x04 [32]  flags
       -------- -----xxx -------- -------- flags for read channels when calling StartEDmac
       -------- -------- -------- xx------ flags for write channels when calling StartEDmac

       xxx----- -------- ---x---- -----xxx flags for SetEDmac (but you can set any bit)
       1------- -------- -------- --------   only one transfer, causes errors on other DMAs
       -10----- -------- ---1---- --------   16 byte per transfer
       -01----- -------- ---1---- --------    8 byte per transfer
       -10----- -------- ---0---- --------    4 byte per transfer
       -01----- -------- ---0---- --------    2 byte per transfer

    +0x08 [32]  SDRAM destination offset
    +0x0C [32]  ((yn << 16) | xn) & 0x0FFF1FFF
    +0x10 [32]  ((yb << 16) | xb) & 0x7FFFFFFE 
    +0x14 [32]  ((ya << 16) | xa) & 0x0FFF1FFF 
    +0x18 [32]  off1b & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE
    +0x1C [32]  off2b & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
    +0x20 [32]  off1a & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE
    +0x24 [32]  off2a & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
    +0x28 [32]  off3  & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
                off1*: signed, 17 bits for DIGIC 4 or lower, 19 bits for DIGIC 5.
                off2*: signed, 28 bits for DIGIC 4 or lower, 32 bits for DIGIC 5.
    +0x30 [32]  interrupt reason (read on interrupt)
                0x01 = normal? (used with PackMem)
                0x02 = normal (transfer finished)
                0x04 = pop (memsuite finished?)
                0x10 = abort
    +0x34 [32]  3 = AbortEDmac
    +0x40 [32]  (fencing uses it and sets it to 0x23 which might be a connection)
       Current assumption:
       (
          ((xa, skip off1a) * ya, xa, skip off2a) * xn
           (xb, skip off1b) * ya, xb, skip off3
       ) * yn,
        
       (
          ((xa, skip off1a) * yb, xa, skip off2b) * xn
           (xb, skip off1b) * yb, xb, skip off3
       )
       Previous assumption:
          xb: block size - number of bytes per copy operation
              this number must be >1 and a multiple of two (write) or four bytes (read)
              after this number of bytes were transmitted, an commit command is issued.
              write channels wait for a commit command before the block is written into memory fully.
          yb: block count | number of blocks to transfer
          xn: transaction count | how often above should get transferred
          ya: same as xb when more transactions?
          off2b: padding (positive) or cropping 

edmac Channels .. 

0x0 ; LiveView, Craw, WhiteBalance
0x1 ; LiveView, Craw, DefectsDetectPass
0x2 ; DarkSubStrctionPass, DefectsCorrectPass, BathtubCorrectPass, BathtubCorrectPass, RawEncodePath, JpegEncodePath
0x3 ; RawEncodePath, JpegEncodePath, DCF, Pony2
0x4 ; LiveView, DirectEdmacPass, VShadingCorrectionPass
0x5 ; LiveView(white balance) - this is hijacked in MLV mode "Raw Video"
0x6 ; FencingB
0x7 ;  
0x8 ; LiveView, Craw
0x9 ; LiveView, Craw, BathtubCorrectPass
0xa ; DarkSubStrctionPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, DirectEdmacPass, VObIntegPass, RawEncodePath, JpegEncodePath, DCF, Pony2
0xb ; DarkSubStrctionPass, VShadingCorrectionPass, BathtubCorrectPass, DetectFace
0xc ; VShadingCorrectionPass, FencingB
0xd ; FencingC
0xe ; 
0xf ; 

Connections

0x0 ; SENSOR
0x1 ; DarkSubStrctionPass, FA_DefectsCorrectPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, VShadingCorrectionPass, VObIntegPass, BathtubCorrectPass
0x2 ; Craw, WhiteBalance, JpegEncodePath
0x3 ; JpegEncodePath, DCF
0x4 ; LiveView
0x5 ; RawEncodePath, JpegEncodePath, DCF
0x6 ; LiveView, DirectEdmacPass
0x7 ; MLV raw video recording
0x8 ; LiveView, Craw
0x9 ; LiveView, Craw
0xa ; DarkSubStrctionPass, DefectsCorrectPass
0xb ;
0xc ; RequestHistPass
0xd ; 
0xe ; FencingB, FencingC
0xf ; Craw, BathtubCorrectPass
0x10; VShadingCorrectionPass, BathtubCorrectPass, BathtubCorrectPass
0x11; DetectFace
0x12; Pony2, FencingB
0x13;
0x14;
0x15; LiveView
0x16; RawEncodePath





..

SDCON

The Canon 40D has complete software for SD support, but was released without a SD Slot.

0xC0C00000 SDCON Base (slot 0)
0xC0C10000 SDCON Base (slot 1)

GPIO

GPIO usage on 40D :


0xC0220050      Sdcard 
0xC0220054      Sdcard 
0xC02200A0      Sdcard 
0xC02200A4      Sdcard 

0xC02200C0      Sdcard 
0xC02200C4      Sdcard 
0xC02200C8      Sdcard 
0xC02200CC      Sdcard 

0xC02200E0      camera red led 0x44/0x46 
0xC02200E8      print button blue led, 0x44/0x46
0xC02200EC      ?

0xC0220098      Intercom
0xC0203034      Intercom

0xC0220120      SD Power on/off 

0xC0220004      chipselect ? 

0xC02200D0      sio chip select channel 1 - (Display,RTC function ?)
0xC02200D4      sio chip select channel 1 - (Display,RTC function ?)
0xC02200DC      sio chip select channel 1 - (Display,RTC function ?)
0xC02200EC      Display ?

0xC0220104      Display, 0x44/0x46 ; display clear/ready
0xC0220108      Display ?
0xC022010C      Display, 0x44/0x46 ; turn off/on LCF power

0xc022004C      CS ADTG - used in writing to adtg  
0xc0220114      gpio  
0xc0220118      gpio 
0xc0220124      cmos latchup error register

0xc022011c      USB
0xc0220100      USB
0xc0220128      USB 

0xc0220094      Real time clock
0xc022005C      Real time clock


0xc022006c      Capture

0xC0223010      Display ?
0xC0238084      Display ?
0xC0238060      Display ?


JPEG CORE

only the standard core is present at 0xC0E00000

Others

0xC0F09xxx      WB related ?
Community content is available under CC-BY-SA unless otherwise noted.