S1IS

Development information

Hardware

Main CPU is (according to some strings in the firmware) ARM7TDMI, ARMv4T architecture. It resides in the large DIGIC chip beside the DSP. The DSP core is JP51 (DIGIC II is JP52). Amount of the RAM is 32M, the flash is 8M. Storage medium is CompactFlash.

This fine camera is unfortunately a victim of the Sony CCD failure epidemic.

CPU

The main CPU is an older architecture than the one used in later DIGICs. According to the manual, it does not support TCM, memory protection. There must be some kind of cache, but according to the manual, ARM7TDMI does not support it. Maybe that's what the 0xdfffxxxx area is for.

Memory map

0x00000000 ... 0x01ffffff: RAM

0x10000000 ... 0x11ffffff: RAM mapped for uncached access

0xc0xxxxxx ... : memory mapped devices (more/less similarity with DIGIC II +)

0xdfffxxxx ... : some kind of config area

0xff000000 ... 0xff7fffff: flash ROM

 0xff000000 ... 0xff00ffff: bootloader

 0xff010000 ... 0xff6fffff: primary firmware and data

 0xff700000 ... 0xff7fffff: secondary firmware (rescue)

LEDs, buttons

Most of the camera's LEDs and buttons are handled by the so called Sub-CPU. Direct access (like on later DIGIC) is not available.

There's an event procedure to control LEDs. Example:

ExecuteEventProcedure("SetLED",0,1) 'lights up LED 0 (whichever it is)

The following lists the physical events on the serial console:

ExecuteEventProcedure("ShowPhysicalEventList")

... which looks like this:

PhysicalEvent LogicalEventName Table
[PhysicalEvent]     [LogicalEventName]
[0x81000024]        [UnpressRightButton]
[0x81000003]        [OpenBatteryCover]
[0x82000085]        [UnpressRemoteUpButton]
[0x81000008]        [UnpressSwOne]
[0x81000109]        [ModeDialToM]
[0x81000011]        [UnpressDriveButton]
[0x81000101]        [ModeDialToP]
[0x81000103]        [ModeDialToStitchAssist]
[0x81000106]        [ModeDialToFastShutter]
[0x82000087]        [UnpressRemoteRightButton]
[0x81000094]        [PressISButton]
[0x810000a5]        [PressSetButton]
[0x81000107]        [ModeDialToSlowShutter]
[0x8100000f]        [OpenPopupStrobe]
[0x82000088]        [UnpressRemoteLeftButton]
[0x81000040]        [UnpressSwTwo]
[0x82000005]        [PressRemoteUpButton]
[0x82000084]        [UnpressRemoteSetButton]
[0x810000bb]        [PressTeleButton]
[0x8100003b]        [UnpressTeleButton]
[0x82000001]        [PressRemoteMultiButton]
[0x81000025]        [UnpressSetButton]
[0x81000021]        [UnpressUpButton]
[0x81000202]        [LCDPosition00]
[0x81000200]        [LCDPosition01]
[0x82000008]        [PressRemoteLeftButton]
[0x810000a3]        [PressLeftButton]
[0x81000023]        [UnpressLeftButton]
[0x81000201]        [LCDPosition02]
[0x81004301]        [CloseLensCover]
[0x82000004]        [PressRemoteSetButton]
[0x81000203]        [LCDPosition03]
[0x810000b5]        [ConnectVideoCable]
[0x81000102]        [ModeDialToMovie]
[0x82000002]        [PressRemoteMagnifyButton]
[0x810000a1]        [PressUpButton]
[0x8100001e]        [UnpressShortcutButton]
[0x8100010c]        [ModeDialToLandscape]
[0x82000082]        [UnpressRemoteMagnifyButton]
[0x82000083]        [UnpressRemoteDispButton]
[0x81004201]        [DetectBatterySafetyLow]
[0x81000801]        [CompletePhysicalSwNotify]
[0x81000087]        [PressOffButton]
[0x8100010d]        [ModeDialToAv]
[0x81000001]        [DisconnectACCable]
[0x81000004]        [RemoveCFCard]
[0x81000090]        [PressFlashButton]
[0x810000a8]        [PressMovieButton]
[0x8100009e]        [PressShortcutButton]
[0x81004202]        [DetectBatterySystemLow]
[0x81000089]        [ConnectUSBCable]
[0x81000005]        [UnpressPBButton]
[0x82000003]        [PressRemoteDispButton]
[0x810000a6]        [PressMenuButton]
[0x81000026]        [UnpressMenuButton]
[0x8100009d]        [PressDispButton]
[0x8100008b]        [TimerSignalOn]
[0x8100001d]        [UnpressDispButton]
[0x810000ba]        [PressWideButton]
[0x8100003a]        [UnpressWideButton]
[0x81000007]        [UnpressOffButton]
[0x82000007]        [PressRemoteRightButton]
[0x81000035]        [DisconnectVideoCable]
[0x81000085]        [PressPBButton]
[0x82000086]        [UnpressRemoteDownButton]
[0x81000086]        [PressRecButton]
[0x8100009b]        [PressSpotButton]
[0x81000108]        [ModeDialToPortrait]
[0x81000100]        [ModeDialToAuto]
[0x8100008f]        [ClosePopupStrobe]
[0x8100001b]        [UnpressSpotButton]
[0x81000009]        [DisconnectUSBCable]
[0x81000010]        [UnpressFlashButton]
[0x81000028]        [UnpressMovieButton]
[0x82000081]        [UnpressRemoteMultiButton]
[0x81000088]        [PressSwOne]
[0x8100000b]        [TimerSignalOff]
[0x8100008a]        [AlarmSignalOn]
[0x82000006]        [PressRemoteDownButton]
[0x810000a2]        [PressDownButton]
[0x81000022]        [UnpressDownButton]
[0x81000006]        [UnpressRecButton]
[0x81004200]        [DetectBatteryWarning]
[0x810000a4]        [PressRightButton]
[0x81000091]        [PressDriveButton]
[0x81000082]        [CloseCFCover]
[0x81000002]        [OpenCFCover]
[0x81000105]        [ModeDialToTv]
[0x81000081]        [ConnectACCable]
[0x81000803]        [CompleteSwHistoryNotify]
[0x810000c0]        [PressSwTwo]
[0x81000084]        [InsertCFCard]
[0x81000013]        [UnpressMFButton]
[0x81000083]        [CloseBatteryCover]
[0x810000a7]        [PressFuncButton]
[0x81000027]        [UnpressFuncButton]
[0x8100010b]        [ModeDialToC]
[0x81000802]        [CompleteBootReasonSwNotify]
[0x0a0d]            [AlarmSignalOff]
[0x81004381]        [OpenLensCover]
[0x81000014]        [UnpressISButton]
[0x81000104]        [ModeDialToNightScene]
[0x81000093]        [PressMFButton]

Despite the camera having no PhySw task, there seems to be a chance to gain control over the buttons.

ExecuteEventProcedure("UnregisterPhysicalEvent","PressLeftButton")
ExecuteEventProcedure("UnregisterPhysicalEvent","UnpressLeftButton")

strips the event procedures generated by the left button. Following that, one could register some other eventproc to the physical event (even a self-made eventproc, I bet), like this:

ExecuteEventProcedure("RegisterPhysicalEvent","PressOffButton",0x810000a3)
ExecuteEventProcedure("RegisterPhysicalEvent","UnpressOffButton",0x81000023)

Which makes the left button behave like the off button :)

Firmware specialities

There's no support for diskboot. The bootloader supports 3 methods: PRIMARY, SECONDARY, downloaded (RAM, source is probably the serial debug connection).

There is support for a version of Canon Basic. No special preparation is necessary for the card. The script must be placed into a file named extend.m in the root of the CF. The script can be started by pressing SET in play mode (must start in playback mode for this, SET has to be the first button pressed). The script's status (and the possible syntax error) can be seen in the serial debug output (which was a big help for me). Scripts with errors can cause various effects ranging from nothing visible to a complete lockup or immediate shutdown.

The implemented Canon Basic differs a little from the later revisions. For example the Initialize method lacks the brackets. Event procedures "just work", haven't found one yet that required some prior initialization.

The firmware contains many debug strings.

Memory dumping script

' dump ROM to /CF0R0V0/ROM.BIN

DIM startaddr=0xFF000000

private sub Initialize
    romsize = 0xFF7FFFFC - startaddr
    dumpfile = creat("/CF0R0V0/ROM.BIN",2)
    write(dumpfile,startaddr,romsize)
    close(dumpfile)
end sub

The script also works for RAM (uncached access doesn't work, write() chokes on a NULL pointer).

Frame buffers

(preliminary information only, based on a play mode RAM dump, using the LCD, PAL mode)

bitmap buffer:

starts at 0x1049a650, 8bit/pixel, buffer dimensions=360x240, used width=320 with LCD, 352 with TV-out

after a recent start in playback mode, only this buffer showed bitmap overlay content

viewports in playback mode:

buffer dimensions: 720x576, Y411, used area 640x218 (LCD mode) or 704x576 (TV-out, PAL)

0x1055cb88, shifts to 0x1055c750 when TV-out is used
0x105F4988 (right after the previous one), same dimensions, also shifted in TV-out mode...

buffer dimensions: 704x480, Y411, completely filled with a 704x480 picture

0x10c8c350