S100 porting thread - DryOS Development - CHDK Forum  
« previous next »
Pages: [1] 2 3 4 5 6 ... 29   Go Down

S100 porting thread

  • 286 Replies
  • 113567 Views
*

Offline c10ud

  • ***
  • 245
S100 porting thread
« on: 24 / March / 2012, 10:35:34 »
Advertisements
I'll have the camera for a limited amount of time, i'll try to port as much as i can given my free time.

After dumping the firmware and running through the decompilation, philmoz' finsig and ERR99's sx40hs port i found out some interesting things about this new DIGIC V camera.

I'll keep you updated on progress.

Some early infos:
// Camera info:
//   DRYOS R49 (DRYOS version 2.3, release #0049)
//   Firmware Ver GM1.00D
//   Canon PowerShot S100

Led address: 0xC022C30C
seems like it's not enough anymore to write 0x46/0x44 in order to power on/off the led (where did this come from, anyway?), but it's required to do what ERR99 did with sx40hs
e.g.
Code: [Select]
volatile long *p=(void*)0xC022C30C;

*p = (*p & 0xFFFFFFCF) | 0x20; // Turn on LED

*p = (*p & 0xFFFFFFCF); // Turn off LED
Today i was talking with philmoz when i had no clue on where to find LED addresses and after some research i found out there's a pattern (at least it these new cameras? i didn't check other dumps) that could be used by finsig to find these addresses (i'm no expert but..), in fact both sx40hs and s100 show this patterns (reflected in ERR99's code):
Code: [Select]
LDR     R2, =0xC022C000
LDR     R1, [R2,#0x30C]
BIC     R1, R1, #0x30
ORR     R1, R1, #0x20
STR     R1, [R2,#0x30C]
and
Code: [Select]
LDR     R2, =0xC022C000
LDR     R1, [R2,#0x30C]
BIC     R1, R1, #0x30
STR     R1, [R2,#0x30C]
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: S100 porting thread
« Reply #1 on: 24 / March / 2012, 11:05:52 »
Just realized you're talking about firmware code snippets. Sorry.

Just an idea and it may not help much (based on observations on earlier models):
The 0xc022xxxx GPIO area holds two representations of the GPIO "pins". The first one uses a whole word (32bits) to set up (and read/write) a single "pin", the second one collects the states of multiple "pins" into a few words (1 bit / GPIO).
One can use the 32bit/pin representation to set up hardware properties of that pin (e.g. set it as input or output, set pullup/pulldown resistor, set driving mode, etc). That is the reason for using 0x46/0x44.

I think this still applies to the DIGIC 5 (since manipulating bits of a word without affecting all the other bits is not possible on ARM, and this is not a regular memory area). I think what you've found is the grouped version (1bit/pin).

edit:
I was curious and tried modifying the Canon Basic dumper script to dump the 0xc022.... area. It seemed to work ... on the A410 and the Ixus870.

Code: [Select]
' dump 0xC022xxxx to A/C022.BIN
' log to A/CBDUMPER.LOG
 
DIM startaddr=0xC0220000
DIM os="unk"
DIM lcdmsg=0
DIM msgstr=0
 
private sub RegisterProcs()
' Newest cams (Dryos rel 43 and later) only have System.Create()
' on older dryos cams SystemEventInit is an alias for System.Create()
' ExecuteEventProcedure does is not registered by default on vx,
' but calling an unregistered is not fatal
if System.Create() = -1 then
SystemEventInit()
end if
if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
ExecuteEventProcedure("UI.CreatePublic")
end if
end sub
 
private sub InitMsg()
lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
msgstr = AllocateMemory(80)
' truncate log
msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
if msgfile <> 0 then
Fclose_Fut(msgfile)
end if
end sub
 
private sub PutMsg(msg)
if lcdmsg >= 0 then
LCDMsg_SetStr(lcdmsg,msg)
LCDMsg_ChangeColor(lcdmsg ,6)
end if
msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
if msgfile <> 0 then
Fwrite_Fut(msg,strlen(msg),1,msgfile)
Fwrite_Fut("\n",1,1,msgfile)
Fclose_Fut(msgfile)
end if
end sub
 
private sub Initialize()
RegisterProcs()
InitMsg()
PutMsg("Started")
 
if startaddr <> 0 then
sprintf(msgstr,"%0X %s",startaddr,os)
PutMsg(msgstr)
' romsize = 0xFFFFFFFC - startaddr
romsize = 0xFFFC
dumpfile = Fopen_Fut("A/C022.BIN","w")
if dumpfile <> 0 then
Fwrite_Fut(startaddr,romsize,1,dumpfile)
Fclose_Fut(dumpfile)
Wait(500)
PutMsg("done")
else
PutMsg("file error")
end if
else
PutMsg("not found!")
end if
FreeMemory(msgstr)
end sub
« Last Edit: 24 / March / 2012, 13:17:40 by srsa_4c »
Logged
*

Offline c10ud

  • ***
  • 245
Re: S100 porting thread
« Reply #2 on: 26 / March / 2012, 12:17:48 »
Update: CHDK loads correctly. Nothing has been implemented yet, i ran out of battery and i still need to fix the alt button thingie

For those curious, you can take a look at the code here: https://github.com/c10ud/CHDK/tree/s100

@srsa_4c: about LEDs, i tried printing on screen the value of some potential locations (even the correct one) while toying around with LEDDrive but if iirc i got the same value when the LED was on and when it was off, maybe it was just because of cbasic buffering data or something, i don't really know.
Anyway, the firmware snippets look good for finding locations to me.. ofcourse if they're implemented the same in every DryOS but sx40hs was the first one (afaik) to show this new LED handling so.. :)

update 2: kbd now working correctly, chdk menu up and running
note: i've mapped the ALT mode button to the REC button because DISP is also DOWN
« Last Edit: 26 / March / 2012, 16:13:42 by c10ud »
Logged
*

Offline reyalp

  • ******
  • 14003
Re: S100 porting thread
« Reply #3 on: 26 / March / 2012, 17:16:32 »
Excellent progress.

Per this discussion http://chdk.setepontos.com/index.php?topic=6787.0 please make play the default alt button. If you implement adjustable alt (recommended) then movie can be an alternate option.
Logged
Don't forget what the H stands for.
*

Offline c10ud

  • ***
  • 245
Re: S100 porting thread
« Reply #4 on: 27 / March / 2012, 07:14:34 »
Thank you reyalp.

Today i finished porting all chdk tasks, tested the build a bit and updated TODO/known issues (see here)
The default alt mode button is now playback, and it's adjustable with the same options as sx150 (they looked fair to me)

edit:
i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?
« Last Edit: 27 / March / 2012, 10:50:11 by c10ud »
Logged
*

Offline reyalp

  • ******
  • 14003
Re: S100 porting thread
« Reply #5 on: 27 / March / 2012, 17:15:50 »
Quote from: c10ud on 27 / March / 2012, 07:14:34
i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?
Is your capt_seq task starting ?
Logged
Don't forget what the H stands for.
*

Offline c10ud

  • ***
  • 245
Re: S100 porting thread
« Reply #6 on: 28 / March / 2012, 06:40:23 »
shooting manually with ISO overriding seems to work, hence i think the answer is yes (?)
also, sending button presses works (e.g. press("shoot_full"))

i still need to check a few values, though

edit: tried blinking in captseq jumptable entry 1 but it didn't work when calling shoot(), on the contrary it did work when pressing the button manually

edit2: manually pressing shoot_half when shoot() script hangs makes it complete successfully

edit3: thank you c10ud from 2010, problem solved: http://chdk.setepontos.com/index.php?topic=5720.msg56168#msg56168
« Last Edit: 28 / March / 2012, 09:41:00 by c10ud »
Logged
*

Offline waterwingz

  • ******
  • 12138
    • Waterwingz
Re: S100 porting thread
« Reply #7 on: 28 / March / 2012, 10:47:21 »
Quote from: c10ud on 28 / March / 2012, 06:40:23
also, sending button presses works (e.g. press("shoot_full"))
That's handled in the keyboard task.

Quote
edit3: thank you c10ud from 2010, problem solved: http://chdk.setepontos.com/index.php?topic=5720.msg56168#msg56168
So the half-press key mask was wrong or missing ?
Logged
Ported :   A1200    SD940   G10    Powershot N    G16
*

Offline c10ud

  • ***
  • 245
Re: S100 porting thread
« Reply #8 on: 28 / March / 2012, 13:32:28 »
turns out i forgot *again* that i mustn't include shoot_half (and shoot_full_only) in the keymask ;)

btw, now the issue is fixed
Logged
*

Offline c10ud

  • ***
  • 245
Re: S100 porting thread
« Reply #9 on: 30 / March / 2012, 06:24:13 »
update: corrected a few things in shooting.c, platform_camera.h, etc. (thanks philmoz), code is at the usual place.

i've seen there's an official canon update for this camera, i'll ask if i can upgrade mine so i can port to the new firmware too :)

edit: upgrading with the official updater http://www.canon.com.au/Support-Services/Support-News/Firmware-Updates/PowerShot-s100-Firmware-Update now i have firmware 101a
« Last Edit: 30 / March / 2012, 08:34:47 by c10ud »
Logged
Pages: [1] 2 3 4 5 6 ... 29   Go Up
« previous next »
 

Related Topics