← fpSup

Firmware research韌體研究

The products are the part of this that fits on an SD card. Most of the work is reading disassembly, and every project page keeps three things apart: what has been proven on a camera, what is being worked on, and what is still open.

做出來的產品,只是這裡面塞得進一張 SD 卡的那一部分。 大部分的工作是在讀反組譯,而每一頁專案都把三件事分開講: 哪些已經在相機上證實、哪些正在做、哪些還沒解。

Explainers解說

IMX410 ISO and gainIMX410 的 ISO 與增益 Where the sensor's gain is actually applied, what that does to dynamic range at each ISO, and which parts are confirmed in the firmware versus which OTP values still need measuring. Interactive.感光元件的增益實際上是在哪裡施加的、那對每一個 ISO 的動態範圍做了什麼,以及哪些部分已經在韌體裡確認、哪些 OTP 值還要量。可互動。 read this one first · the most finished piece of research here先讀這一篇 · 這裡最完整的一份研究 The fpSup load chainfpSup 的載入流程 How a card loads, in four layers — and what the camera's own clock says about them: the whole load takes 3.5 ms out of an 11.7 second boot, so what goes in fpSup.BIN is effectively free and only the AutoRun's length costs anything. With the price of every command, whether fast start pays for itself, and two freezes that turned into build errors.一張卡是怎麼載入的,分成四層 —— 以及相機自己的時鐘怎麼說:整個載入在 11.7 秒的開機裡只佔 3.5 毫秒,所以放進 fpSup.BIN 的東西等於免費,真正有成本的只有 AutoRun 的長度。附每一個指令的代價、fast start 划不划算,以及兩個後來變成編譯錯誤的當機。 measured on the camera · EN / 中文在相機上實測 · EN / 中文 From sensor to CinemaDNG從感光元件到 CinemaDNG The whole recording chain in eleven stages — menu, picker, the 70 sensor modes, the 306 profiles, the reduction stages, the canvas and the DNG writer — each one expandable, with what OG3K, OG2K and HSW each change and an honest mark on which parts are solved, partial or still dark.整條錄影鏈拆成十一段 —— 選單、挑選器、70 個感光元件模式、306 組設定檔、縮減階段、畫布、DNG 寫入器 —— 每一段都可以展開,附 OG3K、OG2K、HSW 各改了什麼,以及哪些部分已解、哪些只解一半、哪些還是黑的。 the map · read this before the reduction pages全局圖 · 讀縮減那幾頁之前先看這個 Every setting on the sensor感光元件上的每一個設定 The 161 values the fp writes to the IMX410, one row each — 150 of them now decoded, without a datasheet, by grouping registers on which modes share a value. Merge select, bit depth and the readout-speed block are identified; 11 are still open. Plus the eight ROM tables the values live in and all 70 modes they combine into.fp 寫給 IMX410 的 161 個值,一個一列 —— 在沒有 datasheet 的情況下,靠「哪些模式共用同一個值」分組,已經解出 150 個。Merge select、位元深度、讀出速度那一區都認出來了,還有 11 個沒解。另附這些值所在的八張 ROM 表,以及它們組合出來的全部 70 個模式。 reference · sortable, filterable, read from Ver.5.02參考 · 可排序、可篩選,從 Ver.5.02 讀出 What the IMX410’s binning actually doesIMX410 的像素合併到底做了什麼 The menu calls the two open-gate modes 2×2 and 3×3. Seven frames say otherwise: up and down the sensor really does combine rows, left and right it combines nothing at all, the ÷3 mode throws one row in three away, and the whole thing averages rather than sums — so none of it buys you light. Written for someone holding a camera, not a textbook.選單把兩個 open gate 模式寫成 2×2 和 3×3,七張照片說不是:上下方向感光元件確實在合併列,左右方向它根本沒有合併,÷3 模式每三列丟掉一列,而且整件事是平均不是相加 —— 所以換不到光。寫給拿著相機的人看,不是寫給教科書。 plain language · M98 and M139 only · EN / 中 / 繁白話版 · 只談 M98 和 M139 · EN / 中 / 繁 What the RWZM resizer doesRWZM 縮圖電路做了什麼 The second machine, the one every mode except OG3K and OG2K goes through — and it matters more than the binning. It shrinks without smoothing first, and it rotates through sixteen slightly different recipes, which is where FHD’s horizontal banding comes from. Every route ranked, the banding graded, and one rule for picking a ratio that will not stripe the picture.第二台機器,除了 OG3K 和 OG2K 以外每個模式都會經過的那一台 ——而它的影響比像素合併還大。它縮圖之前不先平滑,而且輪流使用十六套略有不同的做法,FHD 的橫向條帶就是從那裡來的。附全部路線的排名、橫紋評分,以及一條挑比例不會讓畫面起條紋的規則。 plain language · why FHD looks the way it does · EN / 中 / 繁白話版 · FHD 為什麼長這樣 · EN / 中 / 繁 Hbin, Vbin, Hbin2 and RWZMHbin、Vbin、Hbin2 與 RWZM The same two stages as the pair above, but read out of the firmware instead of measured from frames: six names for where to tap the result, only two of them ever switched on, and the decision that picks between them run over all 306 recording profiles. Interactive.和上面兩頁同樣那兩關,但是從韌體讀出來的,不是從畫面量的:六個可以取結果的地方、其中只有兩個真的會開,以及在 306 組錄影設定檔上跑出來的判斷邏輯。可互動。 from disassembly · corrects three claims in the older notes來自反組譯 · 更正舊筆記裡的三個說法 Reduction kernels — the full working version縮減核 —— 完整技術版 The two plain-language pages above, unabridged and unsimplified: every per-channel table, the sixteen-phase fit, the merge-tuple cross-check, the photon-transfer verification, the two traps, and the corrections in the order they happened. Go here when you want to check the working.上面兩頁白話版的未刪節版本:每一張逐通道表格、十六相位擬合、merge tuple 對照、光子轉移驗證、兩個坑,以及那些更正發生的先後順序。想核對推導過程的時候看這個。 reference · long and technical · EN / 中文參考 · 又長又技術 · EN / 中文 In-camera lossless compression機內無損壓縮 The fp compresses every still it takes and has never compressed a video frame. The engine's measured cost model, where it sits in the pipeline — after every reduction, so you cannot resize afterwards — and a simulator for frame rate, dynamic frame-skip and how much the picture happens to compress.fp 會壓縮它拍的每一張照片,而且從來沒有壓縮過任何一格影片。附這個引擎實測出來的成本模型、它在流程裡的位置 —— 在所有縮減之後,所以事後改不了尺寸 ——以及一個可以算格率、動態抽格、和畫面剛好有多好壓的模擬器。 interactive budget · FHD fits, UHD does not可互動的預算表 · FHD 塞得下,UHD 塞不下 The firmware shell韌體裡的 shell The fp carries a factory debug shell with 77 commands, and a text file on the SD card runs them at boot with no permission gate — which is what everything else here is built on. All 77 with the firmware's own usage text, searchable, and the three tiers of how much damage each one can do.fp 裡有一個原廠除錯用的 shell,共 77 個指令,而且 SD 卡上一個文字檔就能在開機時執行它們,沒有任何權限關卡 —— 這裡其他所有東西都建立在這件事上。77 個全部列出,附韌體自己的用法說明、可搜尋,以及每一個能造成多大破壞的三個等級。 reference · 54 of 77 asked on a live camera參考 · 77 個裡有 54 個在真機上問過 On-screen text colours畫面文字的顏色 The colour of display text is a palette index, not a colour value, and the stock pink is an out-of-range one. All 256 indices, with the thirty that come from ROM kept apart from the ones that had to be photographed.display text 的顏色是一個調色盤索引,不是顏色值,而出廠那個粉紅色是超出範圍的一個。全部 256 個索引都在,其中三十個來自 ROM 的和必須靠拍照才問得出來的分開放。 reference · 0–29 exact, 161–255 measured參考 · 0–29 精確,161–255 是量的 RAW view: fp latitude on a 709 screenRAW 監看:fp 寬容度放上 709 屏幕 How each ISO's latitude lands on a Rec.709 screen with the SA and GA curves of fpsup-raw-view, why the bottom 1.6 stops only show as noise in live view, and which AEL settings touch the CinemaDNG and which only the monitor.fpsup-raw-view 的 SA 與 GA 曲線把每個 ISO 的寬容度放到 Rec.709 屏幕的哪裡、為什麼最底 1.6 檔在預覽裡只會以噪點出現,以及 AEL 哪些設置會動到 CinemaDNG、哪些只影響監看。 interactive · 31 ISOs · EN / 中文可互動 · 31 個 ISO · EN / 中文

Project threads專案進度

project專案what it is是什麼status狀態
usb shell sup USB firmware research and data transportUSB 韌體研究與資料傳輸 released — v3.1.0, built on the camera's own PTP gadget so recording survives it已釋出 —— v3.1.0,建在相機自己的 PTP gadget 上,所以錄影不會被它打斷
sensor lab sup IMX410 modes, ISO, gain, sensor controlIMX410 的模式、ISO、增益、感光元件控制 research complete — the mode-table ambiguity is closed研究完成 —— 模式表的歧義已經解掉
gyro sup Gyro, six-axis logging, Gyroflow workflow陀螺儀、六軸記錄、Gyroflow 流程 released — two editions已釋出 —— 兩個版本
open gate Recording the sensor's full 3:2 area錄下感光元件完整的 3:2 範圍 OG3K v0.2.3a alpha · OG2K v0.1.0testOG3K v0.2.3a alpha · OG2K v0.1.0test
6k to ssd Getting the best 6K the link can carry在傳輸能扛的範圍內拿到最好的 6K designed — 8-bit lands within 94–100% of native 6K設計完成 —— 8-bit 落在原生 6K 的 94–100%
focus sup DFD, focus model, lens control, follow focusDFD、對焦模型、鏡頭控制、跟焦 AF decompiled in depth; no collector builtAF 已深入反編譯;還沒做出收集工具
raw sup Bayer capture, streaming, compression, packaging拜耳擷取、串流、壓縮、封裝 researched; the engine's sustained rate is the one unmeasured number研究完成;引擎的持續速率是唯一還沒量到的數字
ui sup On-screen display, boot animation螢幕顯示、開機動畫 text, colour and a hardware overlay line all work on a camera文字、顏色和一條硬體疊圖線都已經在相機上跑起來
power sup USB-C power delivery and power savingUSB-C 供電與省電 charging mechanism solved; the rest untouched充電機制已解;其餘還沒碰
firmware map Format, subsystems, task ABI, state sources格式、子系統、task ABI、狀態來源 ongoing — not a product, the ground the rest stands on持續進行 —— 不是產品,是其他東西站的地基

Reference參考文件

document文件what is in it裡面有什麼
SHELL_COMMANDS The firmware shell's 77 commands, with the usage text asked from a live camera韌體 shell 的 77 個指令,附從真機上問出來的用法說明
SHELL_CAPABILITIES What those commands reach — memory and I²C writes, menu setters, sensor readout modes那些指令碰得到什麼 —— 記憶體與 I²C 寫入、選單設定、感光元件讀出模式
MENU_MODIFICATION Every menu item carries its own metadata in ROM, right after its name string每一個選單項目在 ROM 裡都帶著自己的 metadata,就接在名稱字串後面
FREEZE_ROOTCAUSE Why the first USB shell froze the camera — six symptoms reduced to one mechanism第一版 USB shell 為什麼會讓相機當機 —— 六個症狀收斂成一個機制

These are the working documents, not tidied write-ups, and several are in Traditional Chinese. They are on GitHub rather than here because GitHub renders Markdown and this site does not.

這些是工作筆記,不是整理過的文章,而且有幾份是繁體中文。 它們放在 GitHub 而不是這裡,因為 GitHub 會算繪 Markdown,這個站不會。

Stopped or paused停掉或暫停的

Kept because what they established still holds.

留著,因為它們確立的東西現在還成立。

bridge The most complete thing built on the fp's PTP surface. Its measurements — why host-side autofocus is hard, and that UHD 12-bit CinemaDNG cannot come over USB — are load-bearing here建在 fp 的 PTP 介面上最完整的東西。它量到的兩件事 —— 為什麼主機端自動對焦很難,以及 UHD 12-bit CinemaDNG 沒辦法走 USB —— 在這裡是承重的
gimbal SIGMA's 0x94xx vendor protocol works during recording, unlike tethered focus. Relative drive only, but absolute position is readableSIGMA 的 0x94xx 廠商協定在錄影中可以用,和連線對焦不一樣。只能相對驅動,但絕對位置讀得到
color sup The colour is reproduced; the tool is awkward and nothing is packaged顏色已經重現;工具很難用,而且什麼都還沒打包
fpRemote Not started. Wireless bridge and low-resolution streaming through AutoRun rather than PTP還沒開始。無線橋接和低解析度串流,走 AutoRun 而不是 PTP

Helping想幫忙的話

The most useful thing anyone can contribute is a measurement: a card's sustained write rate, a frame rate nobody has tested, footage from a body other than the one everything here was developed on. The Discord is where that gets coordinated, the repository has all of it, and there is a YouTube channel.

任何人能提供的東西裡,最有用的是一筆量測:一張卡的持續寫入速度、 一個沒人試過的格率、或是來自另一台機身的素材 —— 這裡的一切都只在同一台機器上開發出來。 協調這些事的地方在 Discord, 全部的東西都在程式庫裡, 另外還有一個 YouTube 頻道。