177 lines
11 KiB
Markdown
177 lines
11 KiB
Markdown
# PT2 Shutter Display Trace
|
|
|
|
This note collects the current ROM evidence for the shutter seven-segment display and related selector traffic.
|
|
|
|
## Confirmed Bench Mapping
|
|
|
|
The real panel responds to primary selector `0x008F`:
|
|
|
|
| Command 0 write | Meaning candidate | Observed panel result |
|
|
| --- | --- | --- |
|
|
| `00 01 0F 08 00 5C` | `E000[0x008F].11` | SHUTTER shows observed `EUS`, likely manual `EVS`; iris AUTO lamp on |
|
|
| `00 01 0F 10 00 44` | `E000[0x008F].12` | SHUTTER shows literal `OFF`; iris AUTO lamp on |
|
|
| `00 01 0F 18 00 4C` | bits 11 and 12 | likely `EVS` wins over `OFF`; iris AUTO lamp on |
|
|
| `00 01 0F 00 00 54` | live default/clear | in the short clear-control run, SHUTTER swapped to `OFF`, then back to `EVS` when bit 11 was restored |
|
|
|
|
Manual correlation:
|
|
|
|
- The RCP-TX7 manual has `OTHERS (1/6: SHUTTER)` with an `EVS` button.
|
|
- The RCP-TX7 menu table lists `EVS/ECS` under OTHERS for DXC-D30/D30P.
|
|
- A later CCU/RCP manual says the shutter display shows `EVS` when EVS is on and `OFF` when the shutter switch is off.
|
|
|
|
So `0x008F.11` is currently best labeled `shutter_evs_display_or_mode`. `0x008F.12` and `0x008F=0` both have `OFF` display evidence, so treat `OFF` as the live default/fallback shutter display unless a later bit-isolation run splits forced OFF from default OFF.
|
|
|
|
## Selector 0x008F ROM Path
|
|
|
|
Primary table address:
|
|
|
|
```text
|
|
selector 0x008F -> E000 + 2 * 0x008F = H'E11E
|
|
```
|
|
|
|
The OTHERS/SHUTTER menu handler is `H'6EE4`.
|
|
|
|
Important instructions:
|
|
|
|
```text
|
|
6F6E: BTST.W #11, @H'E11E
|
|
6F74: BSET.B #6, R0
|
|
6F76: BTST.W #12, @H'E11E
|
|
6F7C: BSET.B #4, R0
|
|
6F7E: MOV:G.B R0, @H'F711
|
|
```
|
|
|
|
This is the direct consumer seen so far. The current decompile does not show another static read of `H'E11E` outside this handler.
|
|
|
|
`H'6EE4` also programs local descriptor RAM before this:
|
|
|
|
```text
|
|
6EFD: F73E = H'088F
|
|
6F09: F74E = H'0800
|
|
6F0F: F742 = H'088F
|
|
6F1B: F752 = H'1000
|
|
```
|
|
|
|
Those descriptors match selector `0x008F` plus the two observed masks `0x0800` and `0x1000`, so the generic panel-output updater also appears to know about the same selector.
|
|
|
|
## Local Panel Trigger Path
|
|
|
|
`H'6EE4` can also generate a selector `0x008F` report/update from local OTHERS/SHUTTER controls:
|
|
|
|
```text
|
|
6F26: read F770 local action byte
|
|
6F2E: keep low two action bits
|
|
6F37: if action bit path and E400[0x008F].11 is enabled, set E800[0x008F] = 0x0800
|
|
6F45: if alternate action path and E400[0x008F].12 is enabled, set E800[0x008F] = 0x1000
|
|
6F53: R3 = 0x008F
|
|
6F64: call 3E54 report/target-frame builder
|
|
```
|
|
|
|
Practical meaning:
|
|
|
|
- The CCU can force the display state by writing `E000[0x008F]`.
|
|
- The RCP can also try to report local EVS/OFF changes through selector `0x008F`, but only when the secondary-table feature bits `E400[0x008F].11/.12` allow it.
|
|
|
|
## Adjacent Shutter Value Family
|
|
|
|
The periodic/control-change scanner at `H'15E0` processes changed input words collected by IRQ3 from the external panel chips. Around the shutter path it calls `H'19A2`, which compares a local delta against the current primary table value and, if changed, writes the `E800` current table and calls `H'3E54`.
|
|
|
|
Candidate selectors:
|
|
|
|
| Handler | Source RAM | Gate | Selector sent | Meaning candidate |
|
|
| --- | --- | --- | --- | --- |
|
|
| `H'17C9` | `F6AE/F6CE` | `E000[0x0093].12` | `0x00A3` | clear-scan/shutter value lane |
|
|
| `H'17FB` | `F6AC/F6CC` | `E000[0x0093].12` | `0x00A4` | clear-scan/shutter value lane |
|
|
| `H'182D` | `F6AA/F6CA` | `E000[0x0093].5`, `F717.2` clear | `0x00A5` | shutter value lane |
|
|
| `H'182D` | `F6AA/F6CA` | `F717.2` set | `0x00D8` | alternate/DXC-637 shutter lane |
|
|
| `H'1891` | `F6A8/F6C8` | `E000[0x0093].5`, `F717.2` clear | `0x0080` | shutter value lane |
|
|
| `H'1891` | `F6A8/F6C8` | `F717.2` set | `0x00D9` | alternate/DXC-637 shutter lane |
|
|
| `H'18E7` | `F6A6/F6C6` | `E000[0x0093].5`, `F717.2` clear | `0x00A6` | shutter value lane |
|
|
| `H'18E7` | `F6A6/F6C6` | `F717.2` set | `0x00DA` | alternate/DXC-637 shutter lane |
|
|
| `H'194A` | `F6A4/F6C4` | `F731 <= 3` | `0x0080` | shared value lane |
|
|
| `H'1979` | `F6A2/F6C2` plus `F68C` scale | `F731 <= 3` | `0x0081` | scaled analog value lane |
|
|
|
|
This cluster is a strong candidate for the numeric shutter speed / clear-scan frequency side of the display. It is not yet bench-confirmed.
|
|
|
|
ROM refinement:
|
|
|
|
- `F6AE/F6AC` are sampled from the external panel bus in the IRQ3 `A8` branch (`H'3CCB`), from `F00C/F00A`.
|
|
- `F6AA/F6A8/F6A6/F6A4/F6A2` are sampled from the IRQ3 `A9` branch (`H'3C49`), from `F00C/F00A/F008/F006/F004`.
|
|
- Those IRQ3 branches set dirty bits in `F6F1`, then the `H'15E0` scanner fans changes into the selector reports above.
|
|
- Several lanes can OR bit 14 into the report selector when `F791` and `F404` feature bits are live. So emitted report traffic may carry a tagged variant of the base selector even though the table readback probes below use the base selector.
|
|
- This makes the adjacent selector family more likely to be live local-panel state than a simple CCU-write display latch.
|
|
|
|
## Candidate Probe Frames
|
|
|
|
Readback:
|
|
|
|
```text
|
|
01 01 0F 00 00 55 ; read 0x008F
|
|
01 01 13 00 00 49 ; read 0x0093 gate/status
|
|
01 01 23 00 00 79 ; read 0x00A3
|
|
01 01 24 00 00 7E ; read 0x00A4
|
|
01 01 25 00 00 7F ; read 0x00A5
|
|
01 01 58 00 00 02 ; read 0x00D8
|
|
01 01 00 00 00 5A ; read 0x0080
|
|
01 01 59 00 00 03 ; read 0x00D9
|
|
01 01 26 00 00 7C ; read 0x00A6
|
|
01 01 5A 00 00 00 ; read 0x00DA
|
|
01 01 01 00 00 5B ; read 0x0081
|
|
```
|
|
|
|
Potential display probes after `CONNECT: OK`:
|
|
|
|
```text
|
|
00 01 0F 00 00 54 ; clear selector 0x008F
|
|
00 01 13 80 00 C8 ; set 0x0093 high bit candidate
|
|
00 01 13 FF FF 48 ; enable all 0x0093 gates candidate
|
|
```
|
|
|
|
Use the value-lane selectors cautiously. They may represent shutter/clear-scan numeric values, but they are also part of the local control-report path, so bench probing should change one selector at a time and record LCD, shutter display, iris AUTO, and emitted report frames.
|
|
|
|
Important methodology caveat:
|
|
|
|
- `CONNECT:NOT ACT` globally clears volatile panel presentation. A blank LCD/segment result after a long wait is not evidence that a tested selector cleared the panel.
|
|
- For selector-display tests, record the visible state inside the short post-write window, before the session can fall back to `NOT ACT`.
|
|
- Use the timeout-control scenario below to measure the current bench's natural EVS-to-NOT-ACT cleanup time. Treat results after that point as timeout-contaminated.
|
|
- Re-seed `CONNECT: OK` immediately before gate writes when a prior readback sweep may have consumed enough time for the visible state to expire.
|
|
|
|
## Adjacent Selector Bench Scenarios
|
|
|
|
These JSON scenarios are set up for the current bench runner and default to `38400 8E1`:
|
|
|
|
```text
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-adjacent-readback.json --parity E --log captures\shutter-adjacent-readback.txt --result-json captures\shutter-adjacent-readback-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-008f-evs-timeout-control.json --parity E --log captures\shutter-008f-evs-timeout-control.txt --result-json captures\shutter-008f-evs-timeout-control-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-008f-evs-clear-control.json --parity E --log captures\shutter-008f-evs-clear-control.txt --result-json captures\shutter-008f-evs-clear-control-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-gate-8000.json --parity E --log captures\shutter-0093-gate-8000.txt --result-json captures\shutter-0093-gate-8000-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-gate-ffff.json --parity E --log captures\shutter-0093-gate-ffff.txt --result-json captures\shutter-0093-gate-ffff-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-bit-isolation.json --parity E --log captures\shutter-0093-bit-isolation.txt --result-json captures\shutter-0093-bit-isolation-result.json
|
|
.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\shutter-0093-blackflare-auto-candidates.json --parity E --log captures\shutter-0093-blackflare-auto-candidates.txt --result-json captures\shutter-0093-blackflare-auto-candidates-result.json
|
|
```
|
|
|
|
Run order:
|
|
|
|
1. `shutter-adjacent-readback.json`: read-only baseline for the adjacent shutter cluster after the selector-zero `CONNECT: OK` seed.
|
|
2. `shutter-008f-evs-timeout-control.json`: measures how long EVS survives before `CONNECT:NOT ACT` clears it with no explicit clear command.
|
|
3. `shutter-008f-evs-clear-control.json`: checks whether the EVS/OFF display selector can be cleared live inside the safe pre-timeout window.
|
|
4. `shutter-0093-gate-8000.json`: tests the ROM-observed `0x0093` high-bit gate without enabling every unknown bit.
|
|
5. `shutter-0093-gate-ffff.json`: broader gate test if the targeted high-bit run is uneventful.
|
|
6. `shutter-0093-bit-isolation.json`: isolates the `0x0093` bits after bench evidence showed this selector also controls white-balance and black/flare lamps.
|
|
7. `shutter-0093-blackflare-auto-candidates.json`: uses the known `0x9020` black/flare-manual context and adds each remaining bit to hunt for the `0xFFFF` black/flare-AUTO effect.
|
|
|
|
## Bench Observations 2026-05-26
|
|
|
|
Observed visible effects from the first adjacent-selector run set:
|
|
|
|
| Scenario | Serial evidence | Observed panel result | Current interpretation |
|
|
| --- | --- | --- | --- |
|
|
| `shutter-adjacent-readback` | all read selectors returned value `0x0000` | no specific visible note | baseline cluster was clear |
|
|
| `shutter-0093-gate-8000` | `E000[0x0093]` read back as `0x8000` | white-balance PRESET lamp on, black/flare MANUAL lamp on | `0x0093.15` is a live panel-status/lamp bit, not just a shutter gate |
|
|
| `shutter-0093-gate-ffff` | `E000[0x0093]` read back as `0xFFFF` | white-balance PRESET lamp on, black/flare AUTO lamp on | another `0x0093` bit overrides/selects black/flare AUTO when all bits are set |
|
|
| `shutter-0093-bit-isolation` | stepped through `0x1000`, `0x0020`, `0x1020`, `0x8000`, `0x8020`, `0x9000`, `0x9020` | white-balance lamps swapped between MANUAL and PRESET; black/flare stayed MANUAL | bit 15 remains the prime white-balance PRESET candidate; black/flare AUTO is likely outside bits 15/12/5 |
|
|
| `shutter-008f-evs-clear-control` | `0x008F` writes acknowledged as `0x0800`, `0x0000`, `0x0800` | SHUTTER swapped between EVS and OFF while iris AUTO lamp stayed on | `0x008F` is a packed shutter/display status word; clearing it does not simply mean "blank" |
|
|
| `shutter-008f-evs-timeout-control` | only `0x008F=0x0800` was sent after OK seed | EVS/iris AUTO, then `CONNECT:NOT ACT` | later blanking is timeout cleanup, not selector-clear evidence |
|
|
|
|
This changes the local naming: the "adjacent shutter" group should be treated as a broader camera-status and panel-output word cluster. `0x008F` currently covers shutter EVS/OFF plus iris AUTO side effects; `0x0093` covers at least white-balance manual/preset and black/flare manual/auto side effects, and still gates some ROM-observed shutter/clear-scan report lanes.
|