Canon 40D Register Map
CFDMA[]
0xC0700000 CF Base #0 link: http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf link: https://www.mouser.com/catalog/specsheets/CF4_DS_Rev1.0.pdf Request Configuration Block +0x200 [8] CF/IDE Interface block +0x2000 [8] PIO DATA (used to transfer data in polled mode) +0x2001 [8] Read: Error data, Write: Features +0x2002 [8] Sector count +0x2003 [8] Sector number +0x2004 [8] Cylinder low byte +0x2005 [8] Cylinder high byte +0x2006 [8] Drive/Head +0x2007 [8] Read: Status, Write: CF command +0x200E [8] Read: Alt Status, Write: Device control Extern DMA Controller Interface (DMA PIO mode - not polled mode) (digic3<->cf controller<?) +0x8000 [32] 0x1 (changing these will make the CF controller disapper, clk or css?) +0x8004 [32] 0x3 (changing these will make the CF controller disapper, clk or csi?) +0x8008 [32] 0x1FF (changing these will make the CF controller disapper, clk or csd?) +0x800C [32] Data register to feed with data (usually 0x2000) +0x8010 [32] unknown, set to 0x100. maybe sector size? +0x8014 [32] unknown, set to PIO_W:0x1E, PIO_R:0x16, DMA:0x00, +0x8024 [32] PIO: CF Command register to use, OR'ed with 0xA000 +0x8028 [32] PIO: set to0? +0x8030 [32] PIO: set to+? +0x8034 [32] PIO: set to ? or0? depending on command reg +0x8038 [32] PIO: set to ? or8? depending on command reg +0x8040 [32] Enable interrupt when flag changed? 0, 1, 0x2000000 +0x8044 [32] Interrupt reason, write with negated value upon interrupt +0x8048 [32] set to 1, maybe transfer count? Tranfer mode control registers ? (cf controller <-> cf carde?) +0x8100 [32] 0x0 (init) or 0x2 (software OR's with 0xFFFFFFF9 then AND with 0x2) +0x8104 [32] 0x4 PIO access timing registers (cf controller <-> cf carde?) +0x8108 [32] timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x810C [32] timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x8110 [32] timing PIO mode - fastest mode = 0xC0 ~ 20mb/s +0x8114 [32] timing PIO mode - fastest mode = 0xC0 ~ 20mb/s Notes: When setting timing registers 0x8108-0x8114 incorrectly, the FIO_Write function will recover from any errors and return a error to the caller via return value. The FIO_Read will not, and a call will FIO_read will stall the camera. UDMA support ? +0x8200 [32] 0x0 (?) +0x8204 [32] 0x0 (?) +0x8208 [32] 0x3FFFF (?) +0x820C [32] 0x3FFFF (?) +0x8210 [32] 0x3FFFF (register is changable) +0x8214 [32] 0x3FFFF (register is changable) SDCON Interface used by CF 0xC0C.....
EDMAC
16 channels only (0xC0F04000)
EDMAC0 - EDMAC15
0xC0F04000
0xC0F04100
..
0xC0F04F00
+0x00 [32] DMA control
-------- -------1 Start transfer / Transfer in progress
+0x04 [32] flags
-------- -----xxx -------- -------- flags for read channels when calling StartEDmac
-------- -------- -------- xx------ flags for write channels when calling StartEDmac
xxx----- -------- ---x---- -----xxx flags for SetEDmac (but you can set any bit)
1------- -------- -------- -------- only one transfer, causes errors on other DMAs
-10----- -------- ---1---- -------- 16 byte per transfer
-01----- -------- ---1---- -------- 8 byte per transfer
-10----- -------- ---0---- -------- 4 byte per transfer
-01----- -------- ---0---- -------- 2 byte per transfer
+0x08 [32] SDRAM destination offset
+0x0C [32] ((yn << 16) | xn) & 0x0FFF1FFF
+0x10 [32] ((yb << 16) | xb) & 0x7FFFFFFE
+0x14 [32] ((ya << 16) | xa) & 0x0FFF1FFF
+0x18 [32] off1b & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE
+0x1C [32] off2b & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
+0x20 [32] off1a & 0x0001FFFE if DIGIC <= 4 else 0x0007FFFE
+0x24 [32] off2a & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
+0x28 [32] off3 & 0x0FFFFFFE if DIGIC <= 4 else 0xFFFFFFFE
off1*: signed, 17 bits for DIGIC 4 or lower, 19 bits for DIGIC 5.
off2*: signed, 28 bits for DIGIC 4 or lower, 32 bits for DIGIC 5.
+0x30 [32] interrupt reason (read on interrupt)
0x01 = normal? (used with PackMem)
0x02 = normal (transfer finished)
0x04 = pop (memsuite finished?)
0x10 = abort
+0x34 [32] 3 = AbortEDmac
+0x40 [32] (fencing uses it and sets it to 0x23 which might be a connection)
Current assumption:
(
((xa, skip off1a) * ya, xa, skip off2a) * xn
(xb, skip off1b) * ya, xb, skip off3
) * yn,
(
((xa, skip off1a) * yb, xa, skip off2b) * xn
(xb, skip off1b) * yb, xb, skip off3
)
Previous assumption:
xb: block size - number of bytes per copy operation
this number must be >1 and a multiple of two (write) or four bytes (read)
after this number of bytes were transmitted, an commit command is issued.
write channels wait for a commit command before the block is written into memory fully.
yb: block count | number of blocks to transfer
xn: transaction count | how often above should get transferred
ya: same as xb when more transactions?
off2b: padding (positive) or cropping
edmac Channels ..
0x0 ; LiveView, Craw, WhiteBalance
0x1 ; LiveView, Craw, DefectsDetectPass
0x2 ; DarkSubStrctionPass, DefectsCorrectPass, BathtubCorrectPass, BathtubCorrectPass, RawEncodePath, JpegEncodePath
0x3 ; RawEncodePath, JpegEncodePath, DCF, Pony2
0x4 ; LiveView, DirectEdmacPass, VShadingCorrectionPass
0x5 ; LiveView(white balance) - this is hijacked in MLV mode "Raw Video"
0x6 ; FencingB
0x7 ;
0x8 ; LiveView, Craw
0x9 ; LiveView, Craw, BathtubCorrectPass
0xa ; DarkSubStrctionPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, DirectEdmacPass, VObIntegPass, RawEncodePath, JpegEncodePath, DCF, Pony2
0xb ; DarkSubStrctionPass, VShadingCorrectionPass, BathtubCorrectPass, DetectFace
0xc ; VShadingCorrectionPass, FencingB
0xd ; FencingC
0xe ;
0xf ;
Connections
0x0 ; SENSOR
0x1 ; DarkSubStrctionPass, FA_DefectsCorrectPass, obi_ObIntegPass, WhiteBalance, DefectsDetectPass, VShadingCorrectionPass, VObIntegPass, BathtubCorrectPass
0x2 ; Craw, WhiteBalance, JpegEncodePath
0x3 ; JpegEncodePath, DCF
0x4 ; LiveView
0x5 ; RawEncodePath, JpegEncodePath, DCF
0x6 ; LiveView, DirectEdmacPass
0x7 ; MLV raw video recording
0x8 ; LiveView, Craw
0x9 ; LiveView, Craw
0xa ; DarkSubStrctionPass, DefectsCorrectPass
0xb ;
0xc ; RequestHistPass
0xd ;
0xe ; FencingB, FencingC
0xf ; Craw, BathtubCorrectPass
0x10; VShadingCorrectionPass, BathtubCorrectPass, BathtubCorrectPass
0x11; DetectFace
0x12; Pony2, FencingB
0x13;
0x14;
0x15; LiveView
0x16; RawEncodePath
Active DMA channels in x1 live mode === mem = internal memory (ram) ext = external peripheral con = connection edmac 0 = Transfer to mem (con 1). HD image. YUV(4:2:2) size = 680*1024*2 = 1392640 = 680x1024(x2) edmac 1 = Transfer to mem (con 4). Display image. ???(1:1:1) size = 214*1080 = 231120 = 321x240(x3) edmac 2 = Transfer to mem (con 3). YUV(4:1:1) miniature edmac 3 = Transfer to mem (con 5). JPEG max jpeg size = 510*4096 = 2088960 edmac 4 = Transfer to mem (con 0). BAYER(raw) size = 872*2338 = 2038736 = 1336x872(x 14/8) edmac 5 = Transfer to mem (con 2). Whitebalance size = 120x32 = 3840 edmac 6 = edmac 7 = edmac 8 = Transfer to ext (con 8). WhiteBalance(?) size = 1250x32 = 40000 edmac 9 = Transfer to ext (con 15).AutoExposure(?) size = 167x32 = 5344 edmac 10= Transfer to ext (con 3). HD image. YUV(4:2:2) - Transffered in macro block/lines edmac 11= edmac 12= edmac 13= edmac 14= edmac 15=
SDCON
The Canon 40D has complete software for SD support, but was released without a SD Slot. 0xC0C00000 SDCON Base (slot 0) 0xC0C10000 SDCON Base (slot 1)
GPIO
GPIO usage on 40D : 0xC0220050 Sdcard 0xC0220054 Sdcard 0xC02200A0 Sdcard 0xC02200A4 Sdcard 0xC02200C0 Sdcard 0xC02200C4 Sdcard 0xC02200C8 Sdcard 0xC02200CC Sdcard 0xC02200E0 camera red led 0x44/0x46 0xC02200E8 print button blue led, 0x44/0x46 0xC02200EC ? 0xC0220098 Intercom 0xC0203034 Intercom 0xC0220120 SD Power on/off 0xC0220004 chipselect ? 0xC02200D0 sio chip select channel 1 - (Display,RTC function ?) 0xC02200D4 sio chip select channel 1 - (Display,RTC function ?) 0xC02200DC sio chip select channel 1 - (Display,RTC function ?) 0xC02200EC Display ? 0xC0220104 Display, 0x44/0x46 ; display clear/ready 0xC0220108 Display ? 0xC022010C Display, 0x44/0x46 ; turn off/on LCF power 0xc022004C CS ADTG - used in writing to adtg 0xc0220114 gpio 0xc0220118 gpio 0xc0220124 cmos latchup error register 0xc022011c USB 0xc0220100 USB 0xc0220128 USB 0xc0220094 Real time clock 0xc022005C Real time clock 0xc022006c Capture 0xC0223010 Display ? 0xC0238084 Display ? 0xC0238060 Display ?
JPEG CORE
only the standard core is present at 0xC0E00000
Others
0xC0F09xxx WB related ?