SD1200 IS Porting Thread

SD1200IS CHDK Wiki
Firmware Dumping Thread
ixus95_sd1200-100c.7z 4MB Firmware from 0xFFC00000 Blinked by syrius (Thanks so much!)
CHDK-SD1200 Git Repo git clone git://github.com/barryk/CHDK-SD1200.git
PS.FI2 CHDK build

Reference Cameras: (To compare firmware)   SD780IS       SD990IS


Well thanks to the work of both hardware investigation and firmware dumping done by syrius in the Firmware Dumping Thread and HarpoMa in the SD780 thread, I have an initial booting CHDK firmware for the SD1200IS.

Source in my git repo CHDK-SD1200 Git Repo. Binary here though it's not very impress. If you try to take a photo it will shut off. But before you take a photo you can watch a nice led show... https://198.109.25.184/kb/CHDK/20091005a/PS.FI2


Current Status:
2009/10/10
GUI Works
Keyboard Works (Play is ALT key, hold down for Play functionality)
RAW works (I developed with dcraw)

2009/10/05
100c  Firmware blink-dumped.(Check Firmware Version)
Boots PS.FI2 files if encoded properly http://chdk.setepontos.com/index.php/topic,3547.msg37877.html#msg37877
Boots CHDK and runs blinker task 2009/10/05
Task can dump firmware from 0xFFC00000 (Mostly matches blinked firmware, looks like I just have an error log). Cannot dump from 0xFF810000 (No 8MB dump. Smaller flash size on this camera?)

Task can dump firmware from 0xFFC00000 (Mostly matches blinked firmware, looks like I just have an error log).

It's possible, it appears some newer non a-series cameras are now starting at 0XFFC00000
edit: the dump confirms this:
ROM:FFC00058                 LDR     R0, =0xFFC0002B
ROM:FFC0005C                 MCR     p15, 0, R0,c6,c5

Have you tried diskboots with dancingbits 2 and 3 ?

edit:
looks like 2 should work.

Hrm I'm having an odd problem... The end of the first chunk of code of the SD1200 firmware is:
FFC0013C loc_FFC0013C                            ; CODE XREF: ROM:FFC00148j
ROM:FFC0013C                 CMP     R1, R3
ROM:FFC00140                 LDRCC   R2, [R0],#4
ROM:FFC00144                 STRCC   R2, [R1],#4
ROM:FFC00148                 BCC     loc_FFC0013C
ROM:FFC0014C                 LDR     R1, =0x12AD3C
ROM:FFC00150                 MOV     R2, #0
ROM:FFC00154
ROM:FFC00154 loc_FFC00154                            ; CODE XREF: ROM:FFC0015Cj
ROM:FFC00154                 CMP     R3, R1
ROM:FFC00158                 STRCC   R2, [R3],#4
ROM:FFC0015C                 BCC     loc_FFC00154
ROM:FFC00160                 B       loc_FFC001A0

From what I've read this suggests that MEMISOSTART should be 0x12AD3C and sure enough the camera boots when it is set to that. I'd been trying to get the gui to work but it always would crash the camera when it got to draw_init or draw_txt_string (if I bypassed draw_init). Even if I replaced the contents of those functions with "return;". (Confirmed as BX LR in main.dump).

So I tried doing a memory dump of 0x12AD3C to the SD card and found 7924 bytes of zeros (7924 is 0x1ef4). (And normal memory following). I tried changing my MEMISOSTART to 0x12AD3C + 0x1ef4) = 0x12CC30, but the camera would not boot this way. So I changed my core/entry.S to add an offset:

    .section .entry
    .org 0x1ef4
    MOV R0, #2
    TEQ     R0, #2
    LDR     SP, =0x1900
    MOV     R11, #0
    B   startup

Now the camera boots and draw_init() can be called successfully (I get 4 logos rather than one, but I think that's a different issue).

Thoughts? This doesn't seem like the proper fix...

BTW no luck with dancing bits yet. I wonder if that's related to this memory thing.

Hard to say without knowing what all you've done and how far you've gotten.
1) maybe you have a function identified incorrectly, that is clobbering this ?
2) do you have new_sa passed into the canon firmware to inform it of the size reserved for CHDK ?
3) Try checking at various points in the startup process to see where this gets clobbered ?

You need to make a function that blinks a LED, and then put it at various places in the code to see if the execution got there. The find out the last function where it stopped, and investigate.

I get 4 logos rather than one, but I think that's a different issue.

I presume that you have wrong values for vid_get_bitmap_buffer_width() or vid_get_bitmap_screen_width() in platform/*/sub/*/lib.c file. I had similar problem and substituting 720 for 360 fixed it for me.

Quote

I get 4 logos rather than one, but I think that's a different issue.

I presume that you have wrong values for vid_get_bitmap_buffer_width() or vid_get_bitmap_screen_width() in platform/*/sub/*/lib.c file. I had similar problem and substituting 720 for 360 fixed it for me.

Yes, this is how the sd990 looked at first: http://chdk.setepontos.com/index.php/topic,2972.msg29795.html#msg29795

Thanks guys.

I followed reyalp's suggestion on checking at various points to figure out where the data got clobbered. Not too surprising actually, the canon_bss_len was wrong, so some extra data was copied, right onto MEMISOSTART and then some.

The video stuff was partially those settings, but once that was resolved the aspect ratio was also off. I found the SX200IS did some hacks to adjust the aspect ratio and incorporated them into the SD1200IS. I also got the keyboard working. Things seem to be in pretty good shape now. Oh and raw shooting works in CRW mode.

Some things that still need work:
badpixel script always says "Try again"
Zebra/Edge Overlay don't seem to be using the right data (probably a wrong vid buffers?)
Screen refresh is kind of weird. Like if I exit a menu but the previous menu was smaller then i still can see the exited menu.
Sometimes menus exit by themselves
No way to exit main menu (?) Is this normal? Or because I'm using my PLAY key as PRINT/ALT?

The video stuff was partially those settings, but once that was resolved the aspect ratio was also off. I found the SX200IS did some hacks to adjust the aspect ratio and incorporated them into the SD1200IS. I also got the keyboard working. Things seem to be in pretty good shape now. Oh and raw shooting works in CRW mode.

Have you verified that the raws have correct image data ? On some cameras, there are multiple buffers. If you only have one right, this could cause the badpixel problem.

Zebra/Edge Overlay don't seem to be using the right data (probably a wrong vid buffers?)

Could be. Note that the sx200 zebra fix is #ifdef'd for sx200 only right now.

Screen refresh is kind of weird. Like if I exit a menu but the previous menu was smaller then i still can see the exited menu.
Sometimes menus exit by themselves

Are you sure they exit themselves, or is the canon firmware just erasing them ? The latter is normal.

No way to exit main menu (?) Is this normal? Or because I'm using my PLAY key as PRINT/ALT?

Pressing menu in alt mode should toggle the CHDK menu.

Have you verified that the raws have correct image data ? On some cameras, there are multiple buffers. If you only have one right, this could cause the badpixel problem.

I've developed multiple images and they correspond with the associated JPEG.

Are you sure they exit themselves, or is the canon firmware just erasing them ? The latter is normal.

Okay just verified and indeed the menus are still active, just that they are overwritten. Using the down arrow selects the next item and does a redraw.

The main menu issue is similar, pressing menu does indeed toggle the menu, however it stays visible until canon overwrites it.