shooting state / shooting in progress

cyril42e

111
SD1000/Ixus70 1.02a

« on: 24 / June / 2008, 17:27:52 »

Advertisements

Propcases 115 and 206 are supposed to be ready-to-shot and shooting-in-progress for DIGIC III cameras. However on the SD1000/Ixus70 at least, both propcases always have the same value (which is actually ready-to-shot || shooting-in-progress). As a result, if we use them with AElock and AFlock, or don't release shoot_half, the camera is always ready-to-shot so it is impossible to use these propcases to wait that shooting has finished.

So I looked for something else to know whether shooting is in progress or not, and I found memory address 0x2568 on the SD1000 (used in some file ShootState.c). Its behavior seems to be:

shutter	shoot state	0x2568
released	nothing	0
right after half, shortly	going to focus?	1
half	focusing	2
half	ready to shot	7
-	shooting/processing/saving	9
-	review	12
-	right after review, shortly	11

So comparing this variable to 9 gives the solution.

It could also allow fixing:

Code: [Select]

core/kbd.c:165, kbd_sched_shoot
 kbd_sched_delay(conf.script_shoot_delay*100);// XXX FIXME find out how to wait to jpeg save finished

and possibly other things...

Now... what should I do? Find the address for all cameras and provide a patch? Provide the patch only for SD1000 for now? Provide a command that returns complete shoot_state, or only is_shooting (shoot_state == 9) ? Further investigation needed?

Logged

fudgey

1705
a570is

Re: shooting state / shooting in progress

« Reply #1 on: 25 / June / 2008, 14:47:05 »

Great find!

First, a better shooting-in-progress indicator is really needed for ubasic for two reasons:
1) For it to work with AE lock as you described
2) Script portability (for the same script to work on all camera models without modifications). The JuciPhoX builds already have 205/206 mapped to a separate get_ready script command I think, to remove the difference between Digic II and III but afaik hasn't yet found it's way to allbest releases.

Now, in my opinion all the information you found should be made accessible from scripts, not just the (improved) equivalent of propcase 205/206. For example a script may want to just focus and check when it's done and then do something else.

Just a single command returning the value you found may be fine and very useful, but it might not be optimal for usability. Most importantly I very fear that this value (if even found in all firmwares) may not behave identically in all cameras (especially between the different digic platforms). This needs to be investigated and if there are differences, some sort of a compromise or mapping should be thought of.

Maybe we can replace the get_ready command with a more robust one using this? But note that currently some scripts use propcase 205/206 for more than just one thing, e.g. my MD script uses it for
1) to find out when focus&exposure is done with
2) to find out when shooting has finished and we start doing other stuff

Your table lists "shutter -" for the three last ones. But one can hold the shutter half or full pressed during shooting/processing/saving/review. Do the values differ in those cases? Also, one can full-press the shutter but still have the camera autofocus&exposure during full press or when shutter has already been released. Does this make a difference?

Logged

cyril42e

111
SD1000/Ixus70 1.02a

Re: shooting state / shooting in progress

« Reply #2 on: 25 / June / 2008, 19:33:30 »

Quote from: fudgey on 25 / June / 2008, 14:47:05

Now, in my opinion all the information you found should be made accessible from scripts, not just the (improved) equivalent of propcase 205/206.
[...]
Most importantly I very fear that this value (if even found in all firmwares) may not behave identically in all cameras (especially between the different digic platforms).
This needs to be investigated and if there are differences, some sort of a compromise or mapping should be thought of.

Yes, even if the value behave identically in all cameras, it could be wise to simplify it, eg with 5 states:
- inactive = 0 <-> 0
- focusing = 1 <-> 1 or 2
- ready to shot = 2 <-> 7 (btw, this "ready to shot" is not enabled when AE and AF are locked and shoot_half not pressed)
- shooting/processing/saving = 3 <-> 9
- review = 4 <-> 11 or 12

Quote

Your table lists "shutter -" for the three last ones. But one can hold the shutter half or full pressed during shooting/processing/saving/review. Do the values differ in those cases?

No, they don't.

Quote

Also, one can full-press the shutter but still have the camera autofocus&exposure during full press or when shutter has already been released. Does this make a difference?

Ooops, didn't check that. Testing... nope, no difference. Actually it never seem to depend on the shutter, I shouldn't have talked about the shutter state in my table...

So, if people want to try with other cameras than SD1000/Ixus70 (there is no risk to read a mem value, even if wrong), here is how to add the get_shoot_state ubasic command:

Code: (diff) [Select]

platform/xxx/sub/xxx/stubs_min.S:14
+DEF(shoot_state,0x2568)
include/platorm.h:457
+extern int shoot_state;

lib/ubasic/tokenizer.c:132
+  {"get_shoot_state",         TOKENIZER_GET_SHOOT_STATE},
lib/ubasic/tokenizer.h:174
+  TOKENIZER_GET_SHOOT_STATE,
lib/ubasic/ubasic.c:244,factor
+case TOKENIZER_GET_SHOOT_STATE:
+    accept(TOKENIZER_GET_SHOOT_STATE);
+    r = shooting_get_shoot_state();
+    break;
include/platorm.h:354
+short shooting_get_shoot_state();
platform/generic/shooting.c:659
+short shooting_get_shoot_state()
+{
+	return shoot_state; // to change to switch to simplify, and move to platform/xxx/lib.c if platform dependant
+}

And then a short script:

Code: (sdlbasic) [Select]

@title Test get_shoot_state

gosub "get_values"
print "rel",a,b,c,d,e,f,g,h
rem should be 0...0

press "shoot_half"

gosub "get_values"
print "half",a,b,c,d,e,f,g,h
rem should be [1] 2...2 7...7

press "shoot_full"
gosub "get_values"
print "full",a,b,c,d,e,f,g,h
release "shoot_full"
release "shoot_half"
rem should be 9...9 12...12

gosub "get_values"
print "rel",a,b,c,d,e,f,g,h
rem should be [11] 0...0

end

:get_values
	a=get_shoot_state
	sleep 240
	b=get_shoot_state
	sleep 240
	c=get_shoot_state
	sleep 240
	d=get_shoot_state
	sleep 240
	e=get_shoot_state
	sleep 240
	f=get_shoot_state
	sleep 240
	g=get_shoot_state
	sleep 240
	h=get_shoot_state
	sleep 210
	return

If it doesn't work, disassemble the camera's firmware, and try with values found in ShootState.c file...

« Last Edit: 26 / June / 2008, 05:10:47 by cyril42e »

Logged

cyril42e

111
SD1000/Ixus70 1.02a

Re: shooting state / shooting in progress

« Reply #3 on: 03 / July / 2008, 23:34:09 »

Some additional info to port it to other platforms:
found in subroutine _ShootState.c__225 (there is always some "ShootState.c" around), at the beginning (not always the first instruction), the one which is not 0x02 before the address at the end, 0x2574 and 0x2576 :

Code: (asm) [Select]

ROM:FF82D5B0                 EXPORT _sub_FF82D5B0__ShootState.c__225
ROM:FF82D5B0 _sub_FF82D5B0__ShootState.c__225        ; CODE XREF: sub_FF82DA04+30p
ROM:FF82D5B0                                         ; sub_FF82E078+84p ...
ROM:FF82D5B0                 LDR     R3, =0x2568
ROM:FF82D5B4                 STMFD   SP!, {R4,R5,LR}
ROM:FF82D5B8                 MOV     R4, R0
ROM:FF82D5BC                 LDR     R5, =0x2574
ROM:FF82D5C0                 LDR     R1, =aShootstate0xX
ROM:FF82D5C4                 STR     R4, [R3]
ROM:FF82D5C8                 MOV     R0, #0x20
ROM:FF82D5CC                 MOV     R2, R4
ROM:FF82D5D0                 BL      _sub_FF8158A4__CameraLog.c__130 ; LOCATION: CameraLog.c:130
ROM:FF82D5D4                 LDRH    R12, [R5]
ROM:FF82D5D8                 CMP     R12, #0xA
ROM:FF82D5DC                 MOV     R3, #0
ROM:FF82D5E0                 LDR     R0, =aShootstate_c
ROM:FF82D5E4                 MOV     R1, #0xE1
ROM:FF82D5E8                 STREQH  R3, [R5]
ROM:FF82D5EC                 MOVEQ   R12, R3
ROM:FF82D5F0                 CMP     R12, #9
ROM:FF82D5F4                 BLS     loc_FF82D600
ROM:FF82D5F8                 BL      DebugAssert
ROM:FF82D5FC                 LDRH    R12, [R5]
ROM:FF82D600
ROM:FF82D600 loc_FF82D600                            ; CODE XREF: _sub_FF82D5B0__ShootState.c__225+44j
ROM:FF82D600                 LDRH    R3, [R5]
ROM:FF82D604                 LDR     R2, =0x2576
ROM:FF82D608                 ADD     R1, R12, #1
ROM:FF82D60C                 STRB    R4, [R2,R3]
ROM:FF82D610                 STRH    R1, [R5]
ROM:FF82D614                 LDMFD   SP!, {R4,R5,PC}
ROM:FF82D614 ; End of function _sub_FF82D5B0__ShootState.c__225

For SD700 101b: 0x72EC (_ShootState.c__201) (or maybe 0x72F8)
For SD800 100e: 0x7CD8 (or maybe 0x7CE4)
For A720IS 100c: 0xAB38 (or maybe 0xABB0)

If someone wants to try, and cannot find the address for his camera, or cannot compile the build to test, ask me, I will do my best to help...

Logged

fudgey

1705
a570is

Re: shooting state / shooting in progress

« Reply #4 on: 14 / July / 2008, 14:57:50 »

Address seems to be 0x253c for a570is 1.00e.

And if anyone's wondering how I found that without IDA, I followed chr's instructions on http://chdk.wikia.com/wiki/Gpl_Disassembling but used 0xffc00000 instead of 0xff810000, i.e. ROMBASEADDR from trunk/platform/a570/sub/100e/makefile.inc.

Then I searched the strings for ShootState

grep -i shootstate dump.strings
ffc1b9b0 ShootState:0x%x
ffc1b9c0 ShootState.c
ffc1d5a0 ShootState:Err03
ffc1d60c ShootState:Err01
ffffe36c 00135950: ShootState:0xb
ffffe5ef 00136990: ShootState:0x0
ffffe747 00137220: ShootState:0x0
ffffe79f 00137230: ShootState:0x1
ffffe8f7 00137310: ShootState:0x2
ffffe97f 00138720: ShootState:0x4
ffffeb67 00138950: ShootState:0x5
ffffebd4 00140370: ShootState:0x7
ffffebee 00140370: ShootState:0x8
ffffec08 00140370: ShootState:0x9

SD1000 1.02a only has equivalents of the 4 first ones, and what cyril4e found seemed like it could be found in ffc1b9c0, so I looked at the dissassembly there.

Those gnu tools give a bit more cryptic output, so I disassembled the sd1000 dump as well, compared and things got clearer for the a570is as well:

Code: [Select]

ffc1b9c0:       6f6f6853        svcvs   0x006f6853
ffc1b9c4:       61745374        cmnvs   r4, r4, ror r3
ffc1b9c8:       632e6574        teqvs   lr, #486539264  ; 0x1d000000
ffc1b9cc:       00000000        andeq   r0, r0, r0
ffc1b9d0:       e59f3060        ldr     r3, [pc, #96]   ; ffc1ba38 <_binary_dump_bin_start+0x1ba38>
ffc1b9d4:       e92d4030        push    {r4, r5, lr}
ffc1b9d8:       e1a04000        mov     r4, r0

The ldr, push and mov are very similar to cyril4e's IDA disassembly (stmfd is a stack operation). IDA goes into the trouble to dig the actual address from pc+96 and my tools don't, but thankfully it does tell that [pc, #96] points to ffc1ba38, whose value is right there further in the file (0x253c):

Code: [Select]

ffc1ba38: 0000253c andeq r2, r0, ip, lsr r5
And to quickly verify this in CHDK, I just modified gui.c to show it in debug misc values:

Code: [Select]

if (debug_vals_show) {
-sprintf(osd_buf, "1:%8x  ", physw_status[0]);
+sprintf(osd_buf, "1:%8x  ", *((unsigned int*)0x253c));

Logged

fudgey

1705
a570is

Re: shooting state / shooting in progress

« Reply #5 on: 15 / July / 2008, 13:54:55 »

I modified code from trunk according to your diffs and tried the script, and it works just like in your comments, except the last one is 12 12 12 11 0 0 0 0, i.e. it still has those 12's there for a little while after releasing shutter. But that's only because I had a 2 second review.

Logged

fudgey

1705
a570is

Re: shooting state / shooting in progress

« Reply #6 on: 15 / July / 2008, 15:57:44 »

I get 5's on the half test line (for example 1 2 2 5 5 5 5 5) in P mode with forced and auto flash, shooting in dark.
And at P mode full flashlight power I get 25's on the last post-release line (for example 12 12 12 25 25 25 0 0).

Will have to find some time to experiment on this further, since we have grave unresolved problems with flashlight causing camera freeze + watchdog reset in some scripts and this might help find a solution.

Logged

LjL

266
A720IS

Re: shooting state / shooting in progress

« Reply #7 on: 20 / July / 2008, 19:15:20 »

So you confirm that there's no separate indications found for "shooting" and "processing", such "shooting + processing"?

Logged

fudgey

1705
a570is

Re: shooting state / shooting in progress

« Reply #8 on: 24 / July / 2008, 16:10:37 »

Quote from: LjL on 20 / July / 2008, 19:15:20

So you confirm that there's no separate indications found for "shooting" and "processing", such "shooting + processing"?

Hm don't know about that. Anyway, I wrote a script to log this thing a bit easier but haven't done systematic tests yet (someone should really fix print_screen so that it would actually work like described in http://chdk.wikia.com/wiki/UBASIC/TutorialScratchpad#The_.22print_screen.22_Command, now it just overwrites a single file in the scripts directory which makes tests like this one tedious).

Unfortunately this script is kind of slow at sampling (40 ms), I guess this should be just brute forced with a few hundred print statements or be rewritten in Lua, maybe with it I could achieve <10 ms resolution (I don't mind the jitter).

Does the juciphox build have the get_shoot_state command?

Code: [Select]

rem Script for ShootState behavior testing. Samples get_shoot_state
rem output to the ubasic log file for different states of the shooting
rem process.

rem Should be tried in various camera modes, such as:
rem flash on/off
rem Ae lock on/off
rem review disabled/enabled
rem RAW on/off
rem burst mode / single shot mode / timer mode
rem dark frame subtraction ("noise reduction") on/off, using large meas time and >1s exposure time
rem M mode, P mode
rem Focus auto/manual with safety MF disabled
rem M mode + manual focus + safety MF disabled + ISO100 + user white balance
@title Test get_shoot_state
 
@param a meas time (*0.4s)
@default a 10

a=a*10
if a<0 then a=1

print_screen 1
print "ShootState log"
print "=============="

print " "
print "P1: Camera idle:"
T=get_tick_count
for A=1 to a step 1
  print get_shoot_state
next A
print get_tick_count-T " ms for " a " steps"


print " "
print "P2: press shoot_half:"
press "shoot_half"
for A=1 to a step 1
  print get_shoot_state
next A

print " "
print "P3: press shoot_full:"
press "shoot_full"
for A=1 to a step 1
  print get_shoot_state
next A

print " "
print "P4: release shoot_full:"
release "shoot_full"
for A=1 to a step 1
  print get_shoot_state
next A

rem give camera time to settle to an idle state
print " "
print "10 second delay..."
sleep 10000

print " "
print "P6: click shoot_full"
click "shoot_full"
for A=1 to a step 1
  print get_shoot_state
next A

rem give camera time to settle to an idle state
print " "
print "10 second delay..."
sleep 10000

print " "
print "P5: shoot"
shoot
for A=1 to a step 1
  print get_shoot_state
next A

print " "
print "End."

end