S100 porting thread

c10ud

I'll have the camera for a limited amount of time, i'll try to port as much as i can given my free time.

After dumping the firmware and running through the decompilation, philmoz' finsig and ERR99's sx40hs port i found out some interesting things about this new DIGIC V camera.

I'll keep you updated on progress.

Some early infos:
// Camera info:
// DRYOS R49 (DRYOS version 2.3, release #0049)
// Firmware Ver GM1.00D
// Canon PowerShot S100

Led address: 0xC022C30C
seems like it's not enough anymore to write 0x46/0x44 in order to power on/off the led (where did this come from, anyway?), but it's required to do what ERR99 did with sx40hs
e.g.

volatile long *p=(void*)0xC022C30C;

*p = (*p & 0xFFFFFFCF) | 0x20; // Turn on LED

*p = (*p & 0xFFFFFFCF); // Turn off LED

Today i was talking with philmoz when i had no clue on where to find LED addresses and after some research i found out there's a pattern (at least it these new cameras? i didn't check other dumps) that could be used by finsig to find these addresses (i'm no expert but..), in fact both sx40hs and s100 show this patterns (reflected in ERR99's code):

LDR     R2, =0xC022C000
LDR     R1, [R2,#0x30C]
BIC     R1, R1, #0x30
ORR     R1, R1, #0x20
STR     R1, [R2,#0x30C]

and

LDR     R2, =0xC022C000
LDR     R1, [R2,#0x30C]
BIC     R1, R1, #0x30
STR     R1, [R2,#0x30C]

srsa_4c

Just realized you're talking about firmware code snippets. Sorry.

Just an idea and it may not help much (based on observations on earlier models):
The 0xc022xxxx GPIO area holds two representations of the GPIO "pins". The first one uses a whole word (32bits) to set up (and read/write) a single "pin", the second one collects the states of multiple "pins" into a few words (1 bit / GPIO).
One can use the 32bit/pin representation to set up hardware properties of that pin (e.g. set it as input or output, set pullup/pulldown resistor, set driving mode, etc). That is the reason for using 0x46/0x44.

I think this still applies to the DIGIC 5 (since manipulating bits of a word without affecting all the other bits is not possible on ARM, and this is not a regular memory area). I think what you've found is the grouped version (1bit/pin).

edit:
I was curious and tried modifying the Canon Basic dumper script to dump the 0xc022.... area. It seemed to work ... on the A410 and the Ixus870.

' dump 0xC022xxxx to A/C022.BIN
' log to A/CBDUMPER.LOG
 
DIM startaddr=0xC0220000
DIM os="unk"
DIM lcdmsg=0
DIM msgstr=0
 
private sub RegisterProcs()
	' Newest cams (Dryos rel 43 and later) only have System.Create()
	' on older dryos cams SystemEventInit is an alias for System.Create()
	' ExecuteEventProcedure does is not registered by default on vx, 
	' but calling an unregistered is not fatal
	if System.Create() = -1 then
		SystemEventInit()
	end if
	if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
		ExecuteEventProcedure("UI.CreatePublic")
	end if
end sub
 
private sub InitMsg()
	lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
	msgstr = AllocateMemory(80)
	' truncate log
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
	if msgfile <> 0 then
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub PutMsg(msg)
	if lcdmsg >= 0 then
		LCDMsg_SetStr(lcdmsg,msg)
		LCDMsg_ChangeColor(lcdmsg ,6)
	end if
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
	if msgfile <> 0 then
		Fwrite_Fut(msg,strlen(msg),1,msgfile)
		Fwrite_Fut("\n",1,1,msgfile)
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub Initialize()
	RegisterProcs()
	InitMsg()
	PutMsg("Started")
 
	if startaddr <> 0 then
		sprintf(msgstr,"%0X %s",startaddr,os)
		PutMsg(msgstr)
		' romsize = 0xFFFFFFFC - startaddr
		romsize = 0xFFFC
		dumpfile = Fopen_Fut("A/C022.BIN","w")
		if dumpfile <> 0 then
			Fwrite_Fut(startaddr,romsize,1,dumpfile)
			Fclose_Fut(dumpfile)
			Wait(500)
			PutMsg("done")
		else
			PutMsg("file error")
		end if
	else
		PutMsg("not found!")
	end if
	FreeMemory(msgstr)
end sub

c10ud

Update: CHDK loads correctly. Nothing has been implemented yet, i ran out of battery and i still need to fix the alt button thingie

For those curious, you can take a look at the code here: https://github.com/c10ud/CHDK/tree/s100

@srsa_4c: about LEDs, i tried printing on screen the value of some potential locations (even the correct one) while toying around with LEDDrive but if iirc i got the same value when the LED was on and when it was off, maybe it was just because of cbasic buffering data or something, i don't really know.
Anyway, the firmware snippets look good for finding locations to me.. ofcourse if they're implemented the same in every DryOS but sx40hs was the first one (afaik) to show this new LED handling so.. 😀

update 2: kbd now working correctly, chdk menu up and running
note: i've mapped the ALT mode button to the REC button because DISP is also DOWN

reyalp

Excellent progress.

Per this discussion https://chdk.setepontos.com/d/6787 please make play the default alt button. If you implement adjustable alt (recommended) then movie can be an alternate option.

c10ud

Thank you reyalp.

Today i finished porting all chdk tasks, tested the build a bit and updated TODO/known issues (see here)
The default alt mode button is now playback, and it's adjustable with the same options as sx150 (they looked fair to me)

edit:
i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?

reyalp

c10ud
i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?

Is your capt_seq task starting ?

c10ud

shooting manually with ISO overriding seems to work, hence i think the answer is yes (?)
also, sending button presses works (e.g. press("shoot_full"))

i still need to check a few values, though

edit: tried blinking in captseq jumptable entry 1 but it didn't work when calling shoot(), on the contrary it did work when pressing the button manually

edit2: manually pressing shoot_half when shoot() script hangs makes it complete successfully

edit3: thank you c10ud from 2010, problem solved: https://chdk.setepontos.com/d/5720/34

waterwingz

c10ud
also, sending button presses works (e.g. press("shoot_full"))

That's handled in the keyboard task.

edit3: thank you c10ud from 2010, problem solved: https://chdk.setepontos.com/d/5720/34

So the half-press key mask was wrong or missing ?

c10ud

turns out i forgot *again* that i mustn't include shoot_half (and shoot_full_only) in the keymask 😉

btw, now the issue is fixed

c10ud

update: corrected a few things in shooting.c, platform_camera.h, etc. (thanks philmoz), code is at the usual place.

i've seen there's an official canon update for this camera, i'll ask if i can upgrade mine so i can port to the new firmware too 😀

edit: upgrading with the official updater http://www.canon.com.au/Support-Services/Support-News/Firmware-Updates/PowerShot-s100-Firmware-Update now i have firmware 101a

c10ud

added code for firmware 101a in github. Looks like the same except for a few addresses 😀

also updated todo and fixed some other things

Jim

Super news on the progress with the S100. Been waiting for CHDK/SDM to be available for this camera. Been using the S95 for a year with CHDK/SDM for kite aerial photography - works great! Love to move to the S100 for a number of reasons. Let me know if you need any beta testers.

c10ud

Ok, new update:

i downloaded firmware 100e and ported chdk to it. This is completely untested since i only own a 101a (not for long..as i said in the first post) but i checked briefly the diff against another 100d and it was pretty small so it *shouldn't* cause issues.

Meanwhile i checked out some raw addresses, fixed some defines (i'm not into the raw field so they might be wrong) and updated code a bit.

You can find the source code at the usual address: https://github.com/c10ud/CHDK/tree/s100
I think i will generate a diff and ask for inclusion in the chdk svn trunk soon so a wider audience can be reached and obvious bugs can be better identified and fixed. I wanted to take a look at gps functionalities first but i don't know if i'll have the time.

For those curious/eager to test, here are my local builds for firmware 100d, 100e, 101a.
USE AT YOUR OWN RISK

CHDK-s100-100d-1.1.0.zip

244.18KB

CHDK-s100-100e-1.1.0.zip

244.18KB

c10ud

..and here's the 101a build (2 attachments per post max 😉)

CHDK-s100-101a-1.1.0.zip

244.18KB

waterwingz

c10ud
2 attachments per post max 😉

www.box.com

c10ud

i've received positive feedback from a 100e user, i guess i am ready to ask for inclusion in trunk then 😉

one thing to mention: i didn't implement any multipart support because camera can boot from fat32 (tested)

diff incoming

edit: here it is https://chdk.setepontos.com/d/650/692

ch01ia

Is there a chance, that CHDK can remove the 30 seconds limit for the slowmotion videos?

edit: How do I get the firmware version on the S100? It works for my A720 with the same SD card, so I guess I'm pressing the wrong buttons ...

c10ud

Hello everyone,
i gave the camera back so i don't have physical access to it anymore.
However, if i can help with something, i will.

@ch01ia: i don't have an answer for that but if that's already implemented in some other camera, it is surely possible and could be easy to port to s100.

You can find your firmware version with a simple tool, see here: http://chdk.wikia.com/wiki/CameraVersion

ch01ia

Thanks for the tip. I've got the 1.01a ...

Now I'm trying to get chdk to boot. I tried installing it with licks but nothing happens. The camera just says that the card is write protected.
I'm not sure what I need to put on the SD card apart from what is in the zip from this thread and where to get it.

Digiman1946

Hello ch01ia,

Check out this page and go down to "New in 2012 for recent cameras!". I used EOScard1.2 Utility for Windows and it works fine.

http://chdk.wikia.com/wiki/Bootable_SD_card

Curt