The 70 sensor modes70 個感光元件模式

Eight tables, one mode八張表,一個模式

How many parameters does a sensor mode have? 252 words, of which 203 actually differ between modes — 195 once you drop the eight copies of the mode id, which are an index rather than a setting. Three tables are understood and five are not:

一個感測器模式有多少參數?252 個字,其中203 個真的會隨模式改變 —— 扣掉八份 mode id 副本(那是索引不是設定),真正的設定是 195 個。 八張表裡三張懂、五張不懂:

Every stride here was derived the same way: the tables sit back to back, so the gap to the next one divided by 70 gives the record size. Nothing was guessed, and the timing table is the proof — it was called unsolvable while being walked at twice its real stride.

這裡每個 stride 都是同一個方法算出來的:這些表是背靠背排在一起的, 所以「到下一張表的間距 ÷ 70」就是每筆的大小。沒有一個是猜的 —— 而時序表就是證據:它之前被判定「解不開」,只因為當時用了兩倍的 stride 在走。

All 161 sensor settings感光元件上的 161 個設定

This is the main table of this page: every value the fp writes to the IMX410, one row each. The camera issues these as 161 straight-line I²C writes with no branches, so every mode writes all 161 — only the values change. 150 of them are now decoded. Click a row to see what that register holds across all 70 modes.

這是這一頁的主表:fp 會寫進 IMX410 的每一個值,一個暫存器一列。 相機是用 161 筆沒有任何分支的直線 I²C 寫入送出去的,所以每個模式都會寫滿這 161 個, 只有值不一樣。其中 150 個已經解出用途。點任一列可以看這個暫存器在 70 個模式上分別是什麼值。

Nothing matches that.沒有符合的項目。

Every field in the metadata recordmetadata 記錄的每一個欄位

25 words. Confidence is marked per field: read means the meaning is visible in the data or in code, inferred means it comes from one mode's investigation and has not been checked across the table, and unknown is unknown.

25 個字。每個欄位都標了信心等級:read 表示意義在資料或程式碼裡看得見;inferred 表示來自單一模式的調查、沒在整張表上驗證過; unknown 就是不知道。

All 70 modes全部 70 個模式

Sort by any column. Search matches the mode id and the raster. “Rel.” is the raster width against the full 6064, so ×2 means half-width readout. fps and roll ms are computed from the timing table; nom is the metadata field that lies, kept alongside for comparison.

These thirteen columns are metadata — what the mode produces. They are not what gets written to the sensor. Click any row to open the 161 sensor registers that mode actually programs, plus its raw words from the other seven tables. Modes 98 and 117 look almost identical here and differ in 78 of those registers — though not, it turns out, in any of their merge registers. To diff two modes side by side, use Compare two modes below.

點任一欄的標題可以排序。搜尋可以打 mode id 或光柵尺寸。 「Rel.」是光柵寬度相對於全寬 6064 的倍率,所以 ×2 就是半寬讀出。
格率和捲簾是從時序表算出來的真實值;標稱是 metadata 裡那個會騙人的欄位,擺旁邊對照。

這十三欄是 metadata,講的是這個模式「產出什麼」,不是「寫了什麼到感光元件上」。 點任何一列就會展開,裡面是這個模式實際寫進感光元件的 161 個暫存器, 以及它在另外七張表裡的原始字。
mode 98 跟 117 在這張表上幾乎一模一樣,但它們有 78 個暫存器不同 —— 不過那 78 個沒有一個是合併暫存器。要並排比較兩個模式,用下面的比較兩個模式。

Nothing matches that.沒有符合的項目。

Compare two modes比較兩個模式

The table above shows what a mode produces. It says almost nothing about what gets written to the sensor — that is the other six tables, and the table above shows none of them. Modes 98 and 117 make the point: same raster, same merge tuple, same aspect, same bit depth, and 110 of the 195 varying parameters differ. (203 words vary, but eight of those are just the mode id repeated once per table — an index, not a setting, so they are excluded here.)

上面那張表講的是一個模式產出什麼。至於寫進感光元件的是什麼, 它幾乎沒講 —— 那在另外六張表裡,而上面那張一個都沒顯示。
mode 98 跟 117 就是最好的例子:同光柵、同合併倍率、同比例、同位深, 但 195 個會變的參數裡有 110 個不同。
(會變的字其實有 203 個,但其中 8 個只是八張表各自重複一次的 mode id —— 那是索引不是設定值,所以扣掉。)

Only the 203 words that vary somewhere across the 70 modes are listed; the 29 always-zero and 20 constant ones cannot differ and are left out.

只列那 203 個「在 70 個模式之間會變」的字; 另外 29 個恆為 0、20 個是常數,不可能有差,所以不列。

The register record is 161 sensor registersregister record 是 161 個感光元件暫存器

The biggest of the eight, and it is not a list of parameters — it is one 8-bit value per sensor register. FUN_c03258c8 walks a record and makes 161 calls to a write helper, and the register addresses are hardcoded in that function, not stored in the table:

八張裡最大的一張,而且它不是一串參數 —— 它是每個感光元件暫存器一個 8-bit 值。FUN_c03258c8 走過一筆記錄, 呼叫 161 次寫入函式,而暫存器位址是寫死在那個函式裡的,不在表裡:

record[mode]   word 0        mode id
               word 1..161   one 8-bit value each

FUN_c03258c8(mode):
    FUN_c0322c70(0x01, record[1])      // register address is a literal
    FUN_c0322c70(0x03, record[2])
    FUN_c0322c70(0x05, record[3])
    ... 161 of them ...
    FUN_c0322c70(0xCE, 0)              // one constant write

FUN_c0322cb0(buf, reg, val):
    buf[0] = reg >> 8 ;  buf[1] = reg ;  buf[2] = val
    // I2C: 16-bit register address, 8-bit valuerecord[mode]   word 0        mode id
               word 1..161   各一個 8-bit 值

FUN_c03258c8(mode):
    FUN_c0322c70(0x01, record[1])      // 暫存器位址是寫死的常數
    FUN_c0322c70(0x03, record[2])
    FUN_c0322c70(0x05, record[3])
    ... 共 161 次 ...
    FUN_c0322c70(0xCE, 0)              // 一次常數寫入

FUN_c0322cb0(buf, reg, val):
    buf[0] = reg >> 8 ;  buf[1] = reg ;  buf[2] = val
    // I2C:16-bit 暫存器位址,8-bit 值

Most of the varying fields take only two or three distinct values across all 70 modes, which is the signature of a mode class selector rather than a tuned number — the same value repeats for every mode in a raster family. A handful have wider ranges and look more like real timing or gain values.

大部分會變的欄位,在 70 個模式裡只有兩三種值 —— 那是「模式類別選擇器」的特徵,不是調校過的數值:同一個光柵家族的模式共用同一個值。 少數幾個值域比較寬,那些看起來才像真的時序或增益。

Frame geometry and timing are not in these registers at all. The search found no encoding of hmax, tail, vmax, width or height, in any byte order, at any width. These 161 are analogue and readout configuration; the geometry is programmed somewhere else.

幀幾何與時序根本不在這 161 個暫存器裡。不管用哪種位元組序、幾個位元組去湊, 都找不到 hmax、tail、vmax、寬、高的編碼。這 161 個是類比與讀出的組態,幾何是別的路徑寫的。

Timing — solved時序 — 解開了

Frame rate and rolling shutter come from hmax, vmax and a tail value, not from the metadata field. The timing table is the descriptor's first pointer: 0xC0B59500, 70 records of 0x20 bytes, indexed by the same row number as metadata — all 70 rows carry a matching mode id.

格率和捲簾時間來自 hmax、vmax 跟一個 tail 值, 不是來自 metadata 那個欄位。時序表是描述子的第一個指標: 0xC0B59500,70 筆,每筆 0x20 bytes, 用跟 metadata 相同的列號索引 —— 70 筆的 mode id 全部對得上。

+0x00   mode id
+0x04   hmax, tail          two u16
+0x08   vmax, ?             two u16

frame period   hmax x (vmax-1) + tail   cycles @ 72 MHz
rolling        hmax x height / 72 MHz+0x00   mode id
+0x04   hmax, tail          兩個 u16
+0x08   vmax, ?             兩個 u16

每幀週期  hmax x (vmax-1) + tail   個時脈 @ 72 MHz
捲簾      hmax x 高度 / 72 MHz

Checked against every rolling-shutter and frame-rate figure the project had recorded independently — nine of them, across six modes:

拿專案裡所有獨立記錄過的捲簾與格率數字來對 —— 九個,橫跨六個模式:

What is still open還沒解的部分

• What the 161 sensor registers actually do. Their addresses are known; their meanings need an IMX410 register map, which is not public.
• 那 161 個感光元件暫存器各自做什麼。位址知道了,意義要有 IMX410 的暫存器表才行,而那份不公開。
• What tables C through G are for. 57 words per mode, 44 of them varying, and not one is identified — table G alone has 25 varying words including a second mode id whose purpose is unknown.
• table C 到 G 是做什麼的。每個模式 57 個字、其中 44 個會變,沒有一個被辨識出來 —— 光是 table G 就有 25 個會變的字,裡面還有另一個 mode id,用途不明。
• The unnamed half of the timing record's second word, and the five words after it. Frame rate and rolling shutter do not need them, so they were never chased.
• 時序記錄第二個字裡沒命名的那半邊,以及它後面那五個字。算格率和捲簾用不到它們,所以一直沒去追。
• Why the metadata record carries its geometry three times, and why mode 100 is the one record where the third copy disagrees.
• metadata 記錄為什麼要把幾何存三次,以及為什麼 mode 100 是唯一第三份不一致的那一筆。
• What +0x0C/+0x10 and +0x1C/+0x20 are for. They are zero in every record, so nothing can be inferred from the data alone.
• +0x0C/+0x10 和 +0x1C/+0x20 是做什麼的。它們在每一筆裡都是 0,所以光看資料推不出任何東西。
• Whether the merge tuple means charge binning or row skipping. The last two factors are confirmed as geometry scale, which does not settle it, and the noise analysis that tried to settle it hit a modelling contradiction.
• 合併倍率到底是電荷合併還是跳列。後兩個因子確認是幾何倍率,但那不足以定案;想定案的雜訊分析撞到了一個模型上的矛盾。
• +0x5C and +0x60 are named from one mode's investigation and have not been verified across the table.
• +0x5C 跟 +0x60 的名字來自單一模式的調查,沒有在整張表上驗證過。

Sources出處

Every number on this page is read directly out of the Ver.5.02 image at the addresses given. The field names for +0x5C and +0x60, and the mode-12 timing decode, come from the HSW investigation; the RAW14 identification that fixes the polarity of +0x3C comes from the sensor-mode work. Where this page says a field is unknown, that is the current state and not a summary of someone else's conclusion.

這頁的每一個數字,都是在上面給的位址直接從 Ver.5.02 映像讀出來的。 +0x5C 與 +0x60 的欄位名稱、以及 mode 12 的時序解讀,來自 HSW 的調查; 把 +0x3C 極性定下來的 RAW14 判定,來自感光元件模式的研究。
這頁說某個欄位「不知道」的地方,就是目前真的不知道,不是在轉述別人的結論。