Official Firmware Update
Canon has released an update to version 1.0.1.0.
Where and how to get the firmware and a serial number:
http://www.dvinfo.net/conf/showthread.php?t=121518
Encryption
The encryption key is the same as for the HF10/100. Firmware decoder [1]
File Structure
The basic firmware update file structure is the same as for the HF10/100, see HF10/100 File Structure.
The differences are:
- 4 bytes at 0x10004, which need to match VEFX
- 2 bytes at 0x10008 (???)
Version 1.0.1.0
This update consists of 1 section only, although it contains code for at least two different targets.
Content Overview
- 0x0 - 0x600000 First and only section, including the first unencrypted 0x10010 bytes
- 0x200000 MIPS
- 0x400000 FR71
- 0x2C footer
Interesting Addresses
- 8bit monochromatic bitmaps
These bitmaps consist of a 2-byte header containing the bitmap width (first byte) and the width that the bitmaps gets stretched to when displayed. The bitmaps are always 18 pixels high and aligned to 2 bytes (probably, can't remember). All fonts are included as well.- 0x49EC00 - 0x52719E
- bitmaps of variable size
There's a second type of bitmap with a 4-byte header, with the first 2 bytes being the bitmap width and the other 2 bytes the bitmap height. There are probably more bitmaps / bitmap sections than listed here, unfortunately it's not one continuous section.- 0x35441A to ?? (a few ones) 1byte align
- 0x35E30A
- 0x357FAC - 0x3A917F 1byte align (includes e.g. the transition effects animations)
Update Process
The update process is basically the same as the HF10/100 Update Process.
The differences are:
- The filename has to be VEF[0-9].FIM
- The firmware searches for a file in descending order from 9 to 0. On the HF10/100 its 9 to 1.
Processor and architecture
Fujitsu FR71 core
MB8AA101
http://www.compitech.ru/html.cgi/arhiv/04_07/stat_fuj2.htm
FR FAMILY INSTRUCTION MANUAL http://edevice.fujitsu.com/fj/MANUAL/MANUALp/en-pdf/CM71-00101-5E.pdf
MIPS core
MIPS INSTRUCTION MANUAL http://www.cs.tau.ac.il/~afek/MipsInstructionSetReference.pdf
MIPS16 EXTENSION MANUAL http://www.weblearn.hs-bremen.de/risse/RST/docs/MIPS/MD00076-2B-MIPS1632-AFP-00.96.pdf
MIPS Core memory map
0xBFA00000 - 0xBFBFFFFF is the lower 2MB block of DATA/CODE where the first block (0x000000 - 0x200000) of the FW update file is mapped to.
0xBFC00000 - 0xBFDFFFFF is another block of 2MB ROM containing additional code/data for the MIPS core, not present in the FW update file; this block also contains MIPS16 code, which means the MIPS core also supports the MIPS16 instruction set.
FR71 Core memory map
0x00000000 - 0x000FFFFF RAM block where part of the ROM code is copied to
0x00100000 - MMIO Data Registers
0x001000F8 - MMIO Control Register
0x00120000 - 0x0012FFFF RAM
0x00140000 - 0x0014FFFF RAM
0x00150000 - 0x0015003F RAM Camera configuration?
0x00160000 - 0x0016FFFF RAM
0x001D0000 - 0x001D003F Copy of RAM Camera configuration?
0x002C0000 - 0x002DFFFF RAM block where part of the ROM code is copied to
0x00400000 - 0x0047FFFF SRAM
0x01000000 - 0x015FFFFF RAM: LCD Picture/Video Framebuffers
0x016C0000 - 0x016DFFFF RAM: Copy of 0x002C0000
0x01723000 - RAM:
0x01725E00 - ???????? RAM: global data for IEEE 1394 (Firewire) communication
0x01725ED4 - 0x01725FA4 RAM: IEEE 1394 Control ROM Storage
0x01800000 - 0x0183FFFF RAM: LCD OSD Framebuffer ?
0x01840000 - 0x0187FFFF RAM: LCD OSD Framebuffer ?
0x01900000 - 0x0193FFFF RAM: LCD OSD Framebuffer 1 RAM (Looks like 512 x 288)
0x01940000 - 0x0197FFFF RAM: LCD OSD Framebuffer 2 RAM (Looks like 512 x 288)
0x01980000 - 0x0193FFFF RAM: LCD OSD Framebuffer 1 Output (64 bytes blocks?)
0x019C0000 - 0x0197FFFF RAM: LCD OSD Framebuffer 2 Output (64 bytes blocks?)
0x01A00000 - ???????? RAM: Seems to be a storage for outgoing packet in response to IEEE 1394 CSR read requests
0x02000000 - 0x02090074 MMIO: Triplet control MMIO
0x021D0000 - ???????? MMIO: Basil control MMIO
0x021E0000 - ???????? MMIO
0x021F2000 - ???????? MMIO
0x05000000 - ???????? MMIO Firewire port controls
0x04000000 - 0x043FFFFF ROM: this is the main 4MB block of DATA/CODE where the second block (0x200000 - 0x600000) of the FW update file is mapped to.
Things TODO
- many