supplierdeeply

S100 porting thread

  • 281 Replies
  • 35356 Views
*

Offline c10ud

  • ***
  • 244
  • Publish
    S100 porting thread
    « on: 24 / March / 2012, 10:35:34 »
    Advertisements
    I'll have the camera for a limited amount of time, i'll try to port as much as i can given my free time.

    After dumping the firmware and running through the decompilation, philmoz' finsig and ERR99's sx40hs port i found out some interesting things about this new DIGIC V camera.

    I'll keep you updated on progress.

    Some early infos:
    // Camera info:
    //   DRYOS R49 (DRYOS version 2.3, release #0049)
    //   Firmware Ver GM1.00D
    //   Canon PowerShot S100

    Led address: 0xC022C30C
    seems like it's not enough anymore to write 0x46/0x44 in order to power on/off the led (where did this come from, anyway?), but it's required to do what ERR99 did with sx40hs
    e.g.
    Code: [Select]
    volatile long *p=(void*)0xC022C30C;

    *p = (*p & 0xFFFFFFCF) | 0x20; // Turn on LED

    *p = (*p & 0xFFFFFFCF); // Turn off LED
    Today i was talking with philmoz when i had no clue on where to find LED addresses and after some research i found out there's a pattern (at least it these new cameras? i didn't check other dumps) that could be used by finsig to find these addresses (i'm no expert but..), in fact both sx40hs and s100 show this patterns (reflected in ERR99's code):
    Code: [Select]
    LDR     R2, =0xC022C000
    LDR     R1, [R2,#0x30C]
    BIC     R1, R1, #0x30
    ORR     R1, R1, #0x20
    STR     R1, [R2,#0x30C]
    and
    Code: [Select]
    LDR     R2, =0xC022C000
    LDR     R1, [R2,#0x30C]
    BIC     R1, R1, #0x30
    STR     R1, [R2,#0x30C]

    *

    Offline srsa_4c

    • ******
    • 3103
  • Publish
    Re: S100 porting thread
    « Reply #1 on: 24 / March / 2012, 11:05:52 »
    Just realized you're talking about firmware code snippets. Sorry.

    Just an idea and it may not help much (based on observations on earlier models):
    The 0xc022xxxx GPIO area holds two representations of the GPIO "pins". The first one uses a whole word (32bits) to set up (and read/write) a single "pin", the second one collects the states of multiple "pins" into a few words (1 bit / GPIO).
    One can use the 32bit/pin representation to set up hardware properties of that pin (e.g. set it as input or output, set pullup/pulldown resistor, set driving mode, etc). That is the reason for using 0x46/0x44.

    I think this still applies to the DIGIC 5 (since manipulating bits of a word without affecting all the other bits is not possible on ARM, and this is not a regular memory area). I think what you've found is the grouped version (1bit/pin).

    edit:
    I was curious and tried modifying the Canon Basic dumper script to dump the 0xc022.... area. It seemed to work ... on the A410 and the Ixus870.


    Code: [Select]
    ' dump 0xC022xxxx to A/C022.BIN
    ' log to A/CBDUMPER.LOG
     
    DIM startaddr=0xC0220000
    DIM os="unk"
    DIM lcdmsg=0
    DIM msgstr=0
     
    private sub RegisterProcs()
    ' Newest cams (Dryos rel 43 and later) only have System.Create()
    ' on older dryos cams SystemEventInit is an alias for System.Create()
    ' ExecuteEventProcedure does is not registered by default on vx,
    ' but calling an unregistered is not fatal
    if System.Create() = -1 then
    SystemEventInit()
    end if
    if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
    ExecuteEventProcedure("UI.CreatePublic")
    end if
    end sub
     
    private sub InitMsg()
    lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
    msgstr = AllocateMemory(80)
    ' truncate log
    msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
    if msgfile <> 0 then
    Fclose_Fut(msgfile)
    end if
    end sub
     
    private sub PutMsg(msg)
    if lcdmsg >= 0 then
    LCDMsg_SetStr(lcdmsg,msg)
    LCDMsg_ChangeColor(lcdmsg ,6)
    end if
    msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
    if msgfile <> 0 then
    Fwrite_Fut(msg,strlen(msg),1,msgfile)
    Fwrite_Fut("\n",1,1,msgfile)
    Fclose_Fut(msgfile)
    end if
    end sub
     
    private sub Initialize()
    RegisterProcs()
    InitMsg()
    PutMsg("Started")
     
    if startaddr <> 0 then
    sprintf(msgstr,"%0X %s",startaddr,os)
    PutMsg(msgstr)
    ' romsize = 0xFFFFFFFC - startaddr
    romsize = 0xFFFC
    dumpfile = Fopen_Fut("A/C022.BIN","w")
    if dumpfile <> 0 then
    Fwrite_Fut(startaddr,romsize,1,dumpfile)
    Fclose_Fut(dumpfile)
    Wait(500)
    PutMsg("done")
    else
    PutMsg("file error")
    end if
    else
    PutMsg("not found!")
    end if
    FreeMemory(msgstr)
    end sub
    « Last Edit: 24 / March / 2012, 13:17:40 by srsa_4c »

    *

    Offline c10ud

    • ***
    • 244
  • Publish
    Re: S100 porting thread
    « Reply #2 on: 26 / March / 2012, 12:17:48 »
    Update: CHDK loads correctly. Nothing has been implemented yet, i ran out of battery and i still need to fix the alt button thingie

    For those curious, you can take a look at the code here: https://github.com/c10ud/CHDK/tree/s100

    @srsa_4c: about LEDs, i tried printing on screen the value of some potential locations (even the correct one) while toying around with LEDDrive but if iirc i got the same value when the LED was on and when it was off, maybe it was just because of cbasic buffering data or something, i don't really know.
    Anyway, the firmware snippets look good for finding locations to me.. ofcourse if they're implemented the same in every DryOS but sx40hs was the first one (afaik) to show this new LED handling so.. :)

    update 2: kbd now working correctly, chdk menu up and running
    note: i've mapped the ALT mode button to the REC button because DISP is also DOWN
    « Last Edit: 26 / March / 2012, 16:13:42 by c10ud »

    *

    Offline reyalp

    • ******
    • 9809
  • Publish
    Re: S100 porting thread
    « Reply #3 on: 26 / March / 2012, 17:16:32 »
    Excellent progress.

    Per this discussion http://chdk.setepontos.com/index.php?topic=6787.0 please make play the default alt button. If you implement adjustable alt (recommended) then movie can be an alternate option.
    Don't forget what the H stands for.


    *

    Offline c10ud

    • ***
    • 244
  • Publish
    Re: S100 porting thread
    « Reply #4 on: 27 / March / 2012, 07:14:34 »
    Thank you reyalp.

    Today i finished porting all chdk tasks, tested the build a bit and updated TODO/known issues (see here)
    The default alt mode button is now playback, and it's adjustable with the same options as sx150 (they looked fair to me)

    edit:
    i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?
    « Last Edit: 27 / March / 2012, 10:50:11 by c10ud »

    *

    Offline reyalp

    • ******
    • 9809
  • Publish
    Re: S100 porting thread
    « Reply #5 on: 27 / March / 2012, 17:15:50 »
    i'm trying to make the shoot() script work but i see an issue: it gets stuck at AS_WAIT_SHOOTING_IN_PROGRESS because shooting_in_progress() is never returning true, even if PROPCASE_SHOOTING is correct, at least when you shoot_half manually.. did anyone see anything similar in other cameras?
    Is your capt_seq task starting ?
    Don't forget what the H stands for.

    *

    Offline c10ud

    • ***
    • 244
  • Publish
    Re: S100 porting thread
    « Reply #6 on: 28 / March / 2012, 06:40:23 »
    shooting manually with ISO overriding seems to work, hence i think the answer is yes (?)
    also, sending button presses works (e.g. press("shoot_full"))

    i still need to check a few values, though

    edit: tried blinking in captseq jumptable entry 1 but it didn't work when calling shoot(), on the contrary it did work when pressing the button manually

    edit2: manually pressing shoot_half when shoot() script hangs makes it complete successfully

    edit3: thank you c10ud from 2010, problem solved: http://chdk.setepontos.com/index.php?topic=5720.msg56168#msg56168
    « Last Edit: 28 / March / 2012, 09:41:00 by c10ud »

  • Publish
    Re: S100 porting thread
    « Reply #7 on: 28 / March / 2012, 10:47:21 »
    also, sending button presses works (e.g. press("shoot_full"))
    That's handled in the keyboard task.

    Quote
    edit3: thank you c10ud from 2010, problem solved: http://chdk.setepontos.com/index.php?topic=5720.msg56168#msg56168
    So the half-press key mask was wrong or missing ?


    *

    Offline c10ud

    • ***
    • 244
  • Publish
    Re: S100 porting thread
    « Reply #8 on: 28 / March / 2012, 13:32:28 »
    turns out i forgot *again* that i mustn't include shoot_half (and shoot_full_only) in the keymask ;)

    btw, now the issue is fixed

    *

    Offline c10ud

    • ***
    • 244
  • Publish
    Re: S100 porting thread
    « Reply #9 on: 30 / March / 2012, 06:24:13 »
    update: corrected a few things in shooting.c, platform_camera.h, etc. (thanks philmoz), code is at the usual place.

    i've seen there's an official canon update for this camera, i'll ask if i can upgrade mine so i can port to the new firmware too :)

    edit: upgrading with the official updater http://www.canon.com.au/Support-Services/Support-News/Firmware-Updates/PowerShot-s100-Firmware-Update now i have firmware 101a
    « Last Edit: 30 / March / 2012, 08:34:47 by c10ud »

     

    Related Topics