Linux driver for Logitech Quickcam Express with HDCS1000 image sensor

Bernhard Kuhn from the Linux-Magazin donated this USB-webcam to us. Since there was no driver for Linux and (AFAIK) Logitech refuses to release the specs, I reverse-engineered the protocoll with an USB-analyzer and a few hours later, I found out how to get pictures out of it.

Most of the important features and registers are now documented, however there are still some mysterious registers...

The software support is far from complete, there exists a simple kernel module that sends the isochronous data to user level. All processing and controlling is done in an user level application. There's no Video4Linux-support nor great adjustment options, as this was just a weekend project...

The quick-hack software allows the resolutions 176*144 and 352*288 (the camera's maximum) and works only on 24Bit Displays.

Chips

The camera (P/N:861073-0000, S/N: LZ93857592) consists of an ASIC (STV0600) for USB control and a CMOS image sensor.

There are apparently two versions, my camera has the Hewlett-Packard/Agilent sensor HDCS1000, there's no datasheet available on their webpage, but I got one from Agilent, Germany. The I2C-address is 0xAA.

The other sensor seems to be the Photobit PB-0100, the datasheet is on Photobit's webpage, the I2C-address is 0xBA. The chip is packaged in a lead-less PLCC case, whereas the HDCS1000 has "gull-wing" pins.

The sensors are controlled via an I2C-bus from the STV0600, which gets the data from the PC.

Both sensors are NOT compatible (hardware and software), so the I2C control stuff in my "driver" works for the HDCS1000-sensor only!

The HDCS1000-sensor is so low-cost, that it even has no exposure control, this has to be done in software. The Photobit sensor has this capability.

STV0600 ASIC

Access to STV0600-Registers via CTRL-transfer:

SETUP:
40 04 LL HH 00 00 SS SS (DATA)

Writes SSSS bytes of data to register HHLL. SSSS is usually 1 or 2

SETUP:
C0 04 LL HH 00 00 SS SS ->(DATA)

Reads SSSS bytes of data of register HHLL.

The (guessed) meanings of the registers:

Address Function

0x0423 ?

0x1410 I2C read value

0x1440 Enable ISO-streaming (1)

0x1443 Sort of scan rate...

0x1500

0x1501 Value seems to be ignored, but set by Windows

0x1502 Value seems to be ignored, but set by Windows

0x1503 ?

0x1504 ?

0x15c1/0x15c2 Max. ISO packet size L/H

0x15c3 Y-Control, 1: 288 lines, 2: 144 lines

0x1680 X-Control, 0xa: 352 columns, 6: 176 columns

HDCS1000 image sensor

If STV0600-address is 0x0400, then the I2C bus is accessed with a special format:

SETUP:
40 04 00 04 00 00 23 00 (35 Bytes of Data)
DATA:
16 Bytes of I2C-Registers
16 Bytes of Values
(I2C-Address) (Number of values-1) (CMD)

CMD: 01 for I2C-write, 03 for I2C Read

For I2C-Read the lowest bit of the I2C-address has to be set and the read value seems to be located in STV0600-register 0x1410.

The write command allows multiple registers to be written with on control transfer. For accessing the gain and shutter controls this feature is necessary, otherwise the stream gets out of sync...

The (guessed) meanings of the HDCS1000-registers:

Address Function

01

06 ? !!!!!!!!

08 ? --------

0a ? m-1-R---

0c ? ------x-

10 ? --------

12 ADC precision mask(1-10Bit) ----bbbb

14 Starty *4, sensor window to be read out

16 Startx *4

18 Height *4

1a Width *4

1c frame rate/integration time?

1e Gain Green1

20 Gain Red

22 Gain Blue

24 Gain Green2

26 Shutter L (larger->longer)

28 Shutter H

2a Exposure L?

2c Exposure H? increasing causes "stripes"

2e ? --mmx-we

30 ? Enable (4) -----x!!

32 contrast/colour? !!!!!!!!

34 ? 0-------

36 ? ---mm!!!

38 ? -----!!!

(-: no change, != unknown behavior (mostly garbled screen/black), x:important, :m= some mode changes, w: switches to white) The values set in the viewer application are derived by the settings from the Windows driver...

The stream format

Both image sensors use the Bayer RGB pattern, i.e. there are only two byte values for each pixel, green and red for even rows, blue and green for odd rows. The camera does no other data compression. Each image starts with the sync values 80 02 00 00 80 01 00 00 ("VSYNC"). After that, the data is transmitted in chunks of more or less random length. Each chunk has the header 02 00 HH LL, where the data size is indicated by HHLL. After the header the HHLL bytes of data follow.

Quick hack application for demonstration

Download the quickcam.tgz-package. With make, two binaries are compiled:

quickcamex.o: The kernel driver, it depends on USB support (>2.2.14 with USB-Backport or >2.3.99). After insmoding, install the device with "mknod /dev/quick c 180 80". The driver just outputs the data stream to /dev/quick and allows control messages to be sent to the device. Control messages that read are not implemented at the moment. They would be needed to discern the both sensors (I2C-address BA vs. AA).

quickcam: The viewer. Without any option, the resolution is 352*288, with option "1" it displays 176*144. Only 24Bit displays are supported (you guessed it: quick hack ;-)

Remarks

If your Quickcam Express uses the Photobit sensor, you will hardly see a picture.
The image quality is really bad (ie. noisy), since the HDCS1000 is a CMOS sensor and the low cost Bayer-RGB-matrix makes this even more visible... But it isn't much better under Windows ;-)

The software exposure control needs much more intelligence and deeper knowledge of the sensor's registers.
White balance is (of low-cost ^H^H^H^H^H^H^H^H^H course) purely a software thing...
Too much control messages disturb the ISO-streaming and causes synchronisation loss. I guess it's a problem in the STV0600 and not in the Linux USB stack.
Some fiddling on the register values can cause permanent black out (no ISO-stream), re-plug helps...

Volunteers needed...

It would be nice, if somebody has the time and knowledge to put the stuff into a V4L-compatible module or adopt the code to the Photobit sensor...

Demo pictures

A picture of the camera itself, shot with a mirror:

Address	Function
0x0423	?
0x1410	I2C read value
0x1440	Enable ISO-streaming (1)
0x1443	Sort of scan rate...
0x1500
0x1501	Value seems to be ignored, but set by Windows
0x1502	Value seems to be ignored, but set by Windows
0x1503	?
0x1504	?
0x15c1/0x15c2	Max. ISO packet size L/H
0x15c3	Y-Control, 1: 288 lines, 2: 144 lines
0x1680	X-Control, 0xa: 352 columns, 6: 176 columns

Address	Function
01
06	? !!!!!!!!
08	? --------
0a	? m-1-R---
0c	? ------x-
10	? --------
12	ADC precision mask(1-10Bit) ----bbbb
14	Starty *4, sensor window to be read out
16	Startx *4
18	Height *4
1a	Width *4
1c	frame rate/integration time?
1e	Gain Green1
20	Gain Red
22	Gain Blue
24	Gain Green2
26	Shutter L (larger->longer)
28	Shutter H
2a	Exposure L?
2c	Exposure H? increasing causes "stripes"
2e	? --mmx-we
30	? Enable (4) -----x!!
32	contrast/colour? !!!!!!!!
34	? 0-------
36	? ---mm!!!
38	? -----!!!