FPS control on 500d - first implementation!!!

1,082 views
Skip to first unread message

Andrew Coutts

unread,
Aug 16, 2011, 4:54:52 PM8/16/11
to Magic Lantern firmware development
success!! I have successfully recorded 480p @ 20fps, which means that
this is the first progress to unlocking more recording resolutions for
the 500d/T1i. The 500d only allows 1080p @ 20fps and 720p / 480p @
30fps; no other options.

Now onto the code:

PROP_VIDEO_MODE property at 0x2050010:
buf[0] = 0, 1, or 2 (0 = 1080p, 1 = 720p, 2 = 480p)
buf[1] = frame rate
buf[2] = 2x frame rate (it's always double the framerate, not sure
what it's used for).

There's a function at 0xFF1BED38 that calls prop_request_change on the
video_mode property above. Before it calls the prop_change it sets a
few memory values:
- 0x33333C = buf[0]
- 0x333340 = buf[1]
- 0x333344 = buf[2]

So I have done my testing in magic lantern with this:

uint32_t mov[3];
PROP_HANDLER(PROP_VIDEO_MODE)
{
mov[2] = buf[2];
mov[1] = buf[1];
mov[0] = buf[0];

bmp_printf(FONT_MED, 0, 400, "prop_video_mode: %x / %x / %x", buf[0],
buf[1], buf[2]);
msleep(1000);
return prop_cleanup( token, property );
}


void xx_test(void* priv)
{
MEM(0x33340) = 20;
MEM(0x33344) = 10;
mov[1] = 20;
mov[2] = 10;
prop_request_change(PROP_VIDEO_MODE, mov, 0xC);
}


This is what I did for my 20fps test in 480p mode. Unfortunately due
to a bug in the 500d ML that I have been unable to track down for
several months, recording in 1080p and 720p mode usually end
immediately with err70, so I can't tell if it's that bug or the fps
changing that causes the crash. 480p mode still works though.

The resulting video looks odd - it's definitely not 30fps, but it
almost just looks like a slowed down clip or something. You can see
the test recording here:

http://tinypic.com/r/11so8qv/7

According to QuickTime, the video is 20fps, so I think I'm on to the
right track!! When I tried 60fps or 24fps it would err70, but 20fps /
30fps seem to be acceptable values to the camera (possibly?). The
function at 0xFF0EC638 seems to deal with the actual h264 encoding, I
am going to look into this to see if I need to correct more memory
values to reflect my new FPS rate.

Anyone have any further input / information that could be helpful???

arm.indy

unread,
Aug 16, 2011, 5:01:53 PM8/16/11
to Magic Lantern firmware development
Good work, go on !

K.

unread,
Aug 16, 2011, 5:04:12 PM8/16/11
to ml-d...@googlegroups.com
wow this is definitely very huge breakthrough, i admire your courage to even test it :)

2011/8/16 arm.indy <arm.i...@gmail.com>
--
http://magiclantern.wikia.com/

To post to this group, send email to ml-d...@googlegroups.com
To unsubscribe from this group, send email to ml-devel+u...@googlegroups.com
For more options, visit this group at http://groups.google.com/group/ml-devel?hl=en

Andrew Coutts

unread,
Aug 17, 2011, 8:36:50 AM8/17/11
to Magic Lantern firmware development
ROM:FF1787A8 @ =============== S U B R O U T I N E
=======================================
ROM:FF1787A8
ROM:FF1787A8
ROM:FF1787A8 sub_FF1787A8: @ CODE XREF:
sub_FF0EC270+9C p
ROM:FF1787A8 @
sub_FF0EC270+B4 p ...
ROM:FF1787A8 STMFD SP!, {R4,LR}
ROM:FF1787AC MOV R4, R0
ROM:FF1787B0 MOV R3, R0
ROM:FF1787B4 MOV R0, #0x1A
ROM:FF1787B8 ADR R2, aH264eSetparame @ "H264E
SetParameterH264Encode PassNo:%d"
ROM:FF1787BC MOV R1, #1
ROM:FF1787C0 BL DryosDebugMsg
ROM:FF1787C4 LDR R0, =0x83DC
ROM:FF1787C8 STR R4, [R0,#0x24]
ROM:FF1787CC LDR R1, [R0,#8]
ROM:FF1787D0 CMP R1, #1
ROM:FF1787D4 CMPEQ R4, #0xA @ 1080p recording
profile
ROM:FF1787D8 BNE loc_FF178824
ROM:FF1787DC LDR R1, [R0,#0x68]
ROM:FF1787E0 STR R1, [R0,#0x64]
ROM:FF1787E4 LDR R1, [R0,#0x78]
ROM:FF1787E8 STR R1, [R0,#0x74]
ROM:FF1787EC LDR R1, [R0,#0x88]
ROM:FF1787F0 STR R1, [R0,#0x84]
ROM:FF1787F4 LDR R1, [R0,#0x98]
ROM:FF1787F8 STR R1, [R0,#0x94]
ROM:FF1787FC LDR R1, [R0,#0xA8]
ROM:FF178800 STR R1, [R0,#0xA4]
ROM:FF178804 LDR R1, [R0,#0xBC]
ROM:FF178808 STR R1, [R0,#0xB4]
ROM:FF17880C LDR R1, [R0,#0xC0]
ROM:FF178810 STR R1, [R0,#0xB8]
ROM:FF178814 LDR R1, [R0,#0xDC]
ROM:FF178818 STR R1, [R0,#0xD4]
ROM:FF17881C LDR R1, [R0,#0xE0]
ROM:FF178820 B loc_FF1788E4
ROM:FF178824 @
---------------------------------------------------------------------------
ROM:FF178824
ROM:FF178824 loc_FF178824: @ CODE XREF:
sub_FF1787A8+30 j
ROM:FF178824 LDR R1, [R0,#0xC]
ROM:FF178828 CMP R1, #1
ROM:FF17882C CMPEQ R4, #7 @ 720p recording
profile
ROM:FF178830 BNE loc_FF17887C
ROM:FF178834 LDR R1, [R0,#0x6C]
ROM:FF178838 STR R1, [R0,#0x64]
ROM:FF17883C LDR R1, [R0,#0x7C]
ROM:FF178840 STR R1, [R0,#0x74]
ROM:FF178844 LDR R1, [R0,#0x8C]
ROM:FF178848 STR R1, [R0,#0x84]
ROM:FF17884C LDR R1, [R0,#0x9C]
ROM:FF178850 STR R1, [R0,#0x94]
ROM:FF178854 LDR R1, [R0,#0xAC]
ROM:FF178858 STR R1, [R0,#0xA4]
ROM:FF17885C LDR R1, [R0,#0xC4]
ROM:FF178860 STR R1, [R0,#0xB4]
ROM:FF178864 LDR R1, [R0,#0xC8]
ROM:FF178868 STR R1, [R0,#0xB8]
ROM:FF17886C LDR R1, [R0,#0xE4]
ROM:FF178870 STR R1, [R0,#0xD4]
ROM:FF178874 LDR R1, [R0,#0xE8]
ROM:FF178878 B loc_FF1788E4
ROM:FF17887C @
---------------------------------------------------------------------------
ROM:FF17887C
ROM:FF17887C loc_FF17887C: @ CODE XREF:
sub_FF1787A8+88 j
ROM:FF17887C LDR R1, [R0,#0x10]
ROM:FF178880 CMP R1, #1
ROM:FF178884 CMPEQ R4, #5 @ 480p recording
profile
ROM:FF178888 MOVNE R3, R4
ROM:FF17888C LDMFDNE SP!, {R4,LR}
ROM:FF178890 ADRNE R2, aH264eInvalidPa @ "H264E
Invalid PassNo:%d"
ROM:FF178894 MOVNE R1, #6
ROM:FF178898 MOVNE R0, #0x1A
ROM:FF17889C BNE DryosDebugMsg
ROM:FF1788A0 LDR R1, [R0,#0x70]
ROM:FF1788A4 STR R1, [R0,#0x64]
ROM:FF1788A8 LDR R1, [R0,#0x80]
ROM:FF1788AC STR R1, [R0,#0x74]
ROM:FF1788B0 LDR R1, [R0,#0x90]
ROM:FF1788B4 STR R1, [R0,#0x84]
ROM:FF1788B8 LDR R1, [R0,#0xA0]
ROM:FF1788BC STR R1, [R0,#0x94]
ROM:FF1788C0 LDR R1, [R0,#0xB0]
ROM:FF1788C4 STR R1, [R0,#0xA4]
ROM:FF1788C8 LDR R1, [R0,#0xCC]
ROM:FF1788CC STR R1, [R0,#0xB4]
ROM:FF1788D0 LDR R1, [R0,#0xD0]
ROM:FF1788D4 STR R1, [R0,#0xB8]
ROM:FF1788D8 LDR R1, [R0,#0xEC]
ROM:FF1788DC STR R1, [R0,#0xD4]
ROM:FF1788E0 LDR R1, [R0,#0xF0]
ROM:FF1788E4
ROM:FF1788E4 loc_FF1788E4: @ CODE XREF:
sub_FF1787A8+78 j
ROM:FF1788E4 @
sub_FF1787A8+D0 j
ROM:FF1788E4 STR R1, [R0,#0xD8]
ROM:FF1788E8 ADR R1, sub_FF178540
ROM:FF1788EC STR R1, [R0,#0x50]
ROM:FF1788F0 LDR R1, =sub_FF17814C
ROM:FF1788F4 STR R1, [R0,#0x4C]
ROM:FF1788F8 LDMFD SP!, {R4,PC}
ROM:FF1788F8 @ End of function sub_FF1787A8


this seems to setup the encoding parameters for each recording
profile. It's called by sub_FF0EC638:

ROM:FF0EC638 @ =============== S U B R O U T I N E
=======================================
ROM:FF0EC638
ROM:FF0EC638
ROM:FF0EC638 sub_FF0EC638:
ROM:FF0EC638
ROM:FF0EC638 var_40 = -0x40
ROM:FF0EC638 var_34 = -0x34
ROM:FF0EC638 var_24 = -0x24
ROM:FF0EC638 var_14 = -0x14
ROM:FF0EC638 var_10 = -0x10
ROM:FF0EC638
ROM:FF0EC638 STMFD SP!, {R4,R5,LR}
ROM:FF0EC63C LDR R0, [R1,#0x18]
ROM:FF0EC640 LDR R5, =0x49D0
ROM:FF0EC644 SUB SP, SP, #0x34
ROM:FF0EC648 STR R0, [R5,#0xC]
ROM:FF0EC64C LDR R3, [R1,#0x14]
ROM:FF0EC650 MOV R4, R1
ROM:FF0EC654 MOV R1, #1
ROM:FF0EC658 MOV R0, #0x3D
ROM:FF0EC65C ADR R2, aLvcdevstarth264D @
"lvcdevStartH264(%d)"
ROM:FF0EC660 BL DryosDebugMsg
ROM:FF0EC664 LDR R3, [R4]
ROM:FF0EC668 ADR R2, aPinputaddressL @
"pInputAddress(%#lx)"
ROM:FF0EC66C MOV R1, #1
ROM:FF0EC670 MOV R0, #0x3D
ROM:FF0EC674 BL DryosDebugMsg
ROM:FF0EC678 LDR R3, [R4,#8]
ROM:FF0EC67C ADR R2, aPstreamaddress @
"pStreamAddress1(%#lx) Size1(%#lx)"
ROM:FF0EC680 STR R3, [SP]
ROM:FF0EC684 LDR R3, [R4,#4]
ROM:FF0EC688 MOV R1, #1
ROM:FF0EC68C MOV R0, #0x3D
ROM:FF0EC690 BL DryosDebugMsg
ROM:FF0EC694 LDR R3, [R4,#0x10]
ROM:FF0EC698 ADR R2, aPstreamaddre_0 @
"pStreamAddress2(%#lx) Size2(%#lx)"
ROM:FF0EC69C STR R3, [SP]
ROM:FF0EC6A0 LDR R3, [R4,#0xC]
ROM:FF0EC6A4 MOV R1, #1
ROM:FF0EC6A8 MOV R0, #0x3D
ROM:FF0EC6AC BL DryosDebugMsg
ROM:FF0EC6B0 LDR R3, [R5,#0xC]
ROM:FF0EC6B4 CMP R3, #0
ROM:FF0EC6B8 MOVEQ R0, #0xA
ROM:FF0EC6BC BEQ loc_FF0EC6D8
ROM:FF0EC6C0 CMP R3, #1
ROM:FF0EC6C4 MOVEQ R0, #7
ROM:FF0EC6C8 BEQ loc_FF0EC6D8
ROM:FF0EC6CC CMP R3, #2
ROM:FF0EC6D0 BNE loc_FF0EC760
ROM:FF0EC6D4 MOV R0, #5
ROM:FF0EC6D8
ROM:FF0EC6D8 loc_FF0EC6D8: @ CODE XREF:
sub_FF0EC638+84 j
ROM:FF0EC6D8 @
sub_FF0EC638+90 j
ROM:FF0EC6D8 BL sub_FF1787A8
ROM:FF0EC6DC LDR R1, [R4,#0x14]
ROM:FF0EC6E0 LDR R2, [R4,#0x1C]
ROM:FF0EC6E4 ADD R3, SP, #0x2C
ROM:FF0EC6E8 MOV R0, #0x780
ROM:FF0EC6EC ADD R12, SP, #0x1C
ROM:FF0EC6F0 STMIA R12, {R0-R3}
ROM:FF0EC6F4 MOV R3, #1
ROM:FF0EC6F8 MOV R2, #0
ROM:FF0EC6FC MOV R1, #0
ROM:FF0EC700 ADD R0, SP, #0x30
ROM:FF0EC704 ADD R12, SP, #0xC
ROM:FF0EC708 STMIA R12, {R0-R3}
ROM:FF0EC70C ADD R3, R4, #8
ROM:FF0EC710 LDMIA R3, {R1-R3}
ROM:FF0EC714 STMEA SP, {R1-R3}
ROM:FF0EC718 LDMIA R4, {R0,R3}
ROM:FF0EC71C LDR R2, =0x438
ROM:FF0EC720 MOV R1, #0x780
ROM:FF0EC724 BL H264E_RequestH264Encode
ROM:FF0EC728 LDR R0, [R5,#4]
ROM:FF0EC72C MOV R1, #0
ROM:FF0EC730 BL take_semaphore
ROM:FF0EC734 LDR R0, [SP,#0x2C]
ROM:FF0EC738 TST R0, #1
ROM:FF0EC73C BEQ loc_FF0EC778
ROM:FF0EC740 LDR R3, [R4,#0x14]
ROM:FF0EC744 ADR R2, aDFrame @ "[%d] Frame"
ROM:FF0EC748 MOV R1, #6
ROM:FF0EC74C MOV R0, #0x3D
ROM:FF0EC750 BL DryosDebugMsg
ROM:FF0EC754 LDR R0, [SP,#0x2C]
ROM:FF0EC758
ROM:FF0EC758 loc_FF0EC758: @ CODE XREF:
sub_FF0EC638+13C j
ROM:FF0EC758 @
sub_FF0EC638+16C j
ROM:FF0EC758 ADD SP, SP, #0x34
ROM:FF0EC75C LDMFD SP!, {R4,R5,PC}
ROM:FF0EC760 @
---------------------------------------------------------------------------
ROM:FF0EC760
ROM:FF0EC760 loc_FF0EC760: @ CODE XREF:
sub_FF0EC638+98 j
ROM:FF0EC760 ADR R2, aIllegal_parame @
"ILLEGAL_PARAMETER MovieSize:%d"
ROM:FF0EC764 MOV R1, #6
ROM:FF0EC768 MOV R0, #0x3D
ROM:FF0EC76C BL DryosDebugMsg
ROM:FF0EC770 MOV R0, #0
ROM:FF0EC774 B loc_FF0EC758
ROM:FF0EC778 @
---------------------------------------------------------------------------
ROM:FF0EC778
ROM:FF0EC778 loc_FF0EC778: @ CODE XREF:
sub_FF0EC638+104 j
ROM:FF0EC778 MOV R0, #1
ROM:FF0EC77C BL H264E_CancelH264Encode
ROM:FF0EC780 LDR R0, [R4,#0x14]
ROM:FF0EC784 CMN R0, #2
ROM:FF0EC788 BLEQ H264E_FinishH264EncPass
ROM:FF0EC78C LDR R2, [R5,#0x48]
ROM:FF0EC790 CMP R2, #0
ROM:FF0EC794 LDRNE R1, [SP,#0x30]
ROM:FF0EC798 LDRNE R0, [R5,#8]
ROM:FF0EC79C BLXNE R2
ROM:FF0EC7A0 LDR R0, [R5,#0x3C]
ROM:FF0EC7A4 B loc_FF0EC758
ROM:FF0EC7A4 @ End of function sub_FF0EC638
ROM:FF0EC7A4
ROM:FF0EC7A4 @
---------------------------------------------------------------------------


I'm going to bmp_printf the structs at 0x49D0 and 0x83DC and see
what's there. I think this all happens when recording starts so maybe
I can change these settings and the camera will encode whatever I
change things to??

We'll see :) I think I'm getting closer.

Andrew Coutts

unread,
Aug 17, 2011, 8:39:38 AM8/17/11
to Magic Lantern firmware development
0x49D0 off_0xC looks to hold the same value as buf[0] of
PROP_VIDEO_MODE, 0, 1, or 2 (1080p, 720p and 480p respectively).
> ROM:FF0EC758              ...
>
> read more »

Andrew Coutts

unread,
Aug 17, 2011, 1:10:21 PM8/17/11
to Magic Lantern firmware development
it works on 1080p!!

http://www.youtube.com/watch?v=TkaRmCTz7cQ


I can't shoot more than a few seconds of video though before it
buffers out. Even shooting at 0.1x CBR only let me record for ~15
seconds or so. I think the buffers aren't made to support 30fps, so
that's the next thing to look into!!
> > ROM:FF0EC6D8...
>
> read more »

K.

unread,
Aug 17, 2011, 1:45:54 PM8/17/11
to ml-d...@googlegroups.com
So is it real 30fps? can you upload the video somewhere to download it and check smoothness and fps ?

2011/8/17 Andrew Coutts <andrewjo...@gmail.com>

K.

unread,
Aug 17, 2011, 1:50:05 PM8/17/11
to ml-d...@googlegroups.com

OK I got if off youtube :) its real 30fps ! Wow this is amazing i must say haha, so can you make 24fps as well ? I see rolling shutter is as bad as it was with 20fps :) But it doesnt matter, congrats for your work and courage to dig in the firmware.
I had 500D but sold it because of not acceptable 20fps.
2011/8/17 K. <justyna...@gmail.com>

Andrew Coutts

unread,
Aug 17, 2011, 1:56:13 PM8/17/11
to Magic Lantern firmware development
unfortunately anything other than 20 or 30 just causes err70 as soon
as I hit record, so I think the camera only knows how to handle
20/30fps.

If someone wants to start looking at the 60d and see how it differs
from the 500d to implement other frame rates, maybe we could figure it
out :)

On Aug 17, 1:50 pm, "K." <justynadric...@gmail.com> wrote:
> OK I got if off youtube :) its real 30fps ! Wow this is amazing i must say
> haha, so can you make 24fps as well ? I see rolling shutter is as bad as it
> was with 20fps :) But it doesnt matter, congrats for your work and courage
> to dig in the firmware.
> I had 500D but sold it because of not acceptable 20fps.
> 2011/8/17 K. <justynadric...@gmail.com>
>
>
>
>
>
>
>
> > So is it real 30fps? can you upload the video somewhere to download it and
> > check smoothness and fps ?
>
> > 2011/8/17 Andrew Coutts <andrewjohncou...@gmail.com>
> ...
>
> read more »

Brian

unread,
Aug 17, 2011, 1:14:06 PM8/17/11
to ml-d...@googlegroups.com

Great work!

"Sztupák Sz. Zsolt"

unread,
Aug 17, 2011, 3:48:06 PM8/17/11
to ml-d...@googlegroups.com
Good work! I'll hopefully get a 500D soon for a few days, I'll defintely
test it.

SztupY

2011.08.17. 19:56 keltez�ssel, Andrew Coutts �rta:

>> read more �

Adityo Jiwandono

unread,
Aug 18, 2011, 5:09:22 AM8/18/11
to ml-d...@googlegroups.com
On Thu, Aug 18, 2011 at 12:10 AM, Andrew Coutts
<andrewjo...@gmail.com> wrote:
> it works on 1080p!!
>
> http://www.youtube.com/watch?v=TkaRmCTz7cQ
>
>
> I can't shoot more than a few seconds of video though before it
> buffers out. Even shooting at 0.1x CBR only let me record for ~15
> seconds or so. I think the buffers aren't made to support 30fps, so
> that's the next thing to look into!!

I did some tests, too.
1080p 30fps mode only records for 16 seconds, even with lowest bitrate setting.

But there is an issue:
Although ML is able to produce 1080p 30fps video file, the video
stream from sensor itself is still 20fps. I recorded the Windows clock
application. The clock ticks faster. See my video for details.

http://arc.itb.ac.id/~jiwandono/magiclantern/MVI_2212.MOV (~20 MB)

Great work, Coutts!


--
Adityo Jiwandono

Roald Frederickx

unread,
Aug 18, 2011, 11:11:47 AM8/18/11
to ml-d...@googlegroups.com
Yup, viewing that file at 66% its speed (20 fps) makes the clock run
normally. We thus achieved, well, nothing really >_<.

2011/8/18 Adityo Jiwandono <jiwa...@gmail.com>:

Adityo Jiwandono

unread,
Aug 18, 2011, 11:38:33 AM8/18/11
to ml-d...@googlegroups.com
On Thu, Aug 18, 2011 at 10:11 PM, Roald Frederickx
<roald.fr...@gmail.com> wrote:
> Yup, viewing that file at 66% its speed (20 fps) makes the clock run
> normally. We thus achieved, well, nothing really >_<.

Being able to produce 1080p 30fps file is actually one step closer to
true 1080p 30fps recording :)


--
Adityo Jiwandono

Reply all
Reply to author
Forward
0 new messages