E-mount electronic protocol reverse engineering

Leegong wrote: @Entropy512, Yes , debug UART is a separate interface , however it isn't connected to anything , you may connect it with your own UART terminal . I'm not able to readback the previous firmware from an adapter(MC-11 or LAEA), i just analyzed updates of firmware . I have not looked at the recent update of Sony issued .

Oh, I thought that the LA-EA3 hadn't received an update prior to last week's - Nice to know. It would be very interesting to look at the differences between the old and new firmware.

What CPU is in the MC-11?

A few other things:
Command 0x1D has at least three different modes. The mode is set by the third/fourth bytes of the command payload, the actual motor position (relative or absolute) is in the first two bytes.

Mode 0x0000 - First two bytes are absolute position - probably unsigned but I've never seen a value greater than 32767 so I'm not sure - Pretty much the sole AF command for EA3 with a newer legacy-adapter PDAF body (like A6300), also rare to see anything else when a native lens is in AF-C

Mode 0x3cff (note: I did byteswapping here since everything is little-endian) - First two bytes are a signed twos-complement relative motion command. Only seen so far when a legacy adapter (such as EA3) is in CDAF mode during the microstepping phase of CDAF - this is almost always negative motion
Mode 0x0400 - First two bytes are a signed twos-complement relative motion command - may have a scaling factor not seen with 0x3cff, hard to tell. Appears to be sent as the final relative command in a microstepping sequence. Usually is positive motion but on occasion is negative. I see evidence of partial motor travel (maybe there's a 0.5x scaling factor?) whenever this is sent to an EA3. That said - I've sometimes seen an EA3 not fully move to a commanded absolute position...

Seems to me that the number one real-world problem with the e-mount system is that the lenses are left with closed apertures when they are disconnected. It makes using those lenses elsewhere a real pain.

It also looks like your investigation has almost reached the stage where you could write a script for a common micro-controller that could force the aperture open all the way.

As an intermediate goal: It would validate your work and have real-world utility.

Another 'discovery' is that Sony has different OSPDAF sensors for different exit pupil distances.

This could be a built-in table or it could be communicated by the lens to the body. The boundaries are at 60 and 110 mm pupil distance.

Can you read patents on this kind of thing? If so I'll dig up where I found that.

As far as the firmware update: it is clear Commlite licensed it from Sony, as the firmware utility has the same file structure (though different binaries, names and parts are similar. Finding that is more of a statement that things can be licensed and do not have to be RE-ed.

I hope this will be considered as within the topic of this thread:

I'm looking for information on which pins might be responsible for transmitting "Focus Hold Button-depressed" information to the camera. This button appears on many of the recent Sony brand lenses, particularly the longer telephotos, zooms, and lenses with larger apertures, and it allows the user to maintain focus hold with the hand that is holding the lens - leaving the right hand to control the camera and shutter release.
Does anyone know which (likely two?) pins might transmit this data?
Or perhaps that button press is "a state that is scanned by the cpu" and transmitted within the data stream?

Both the lens and the camera contain microprocessors, and data is transmitted serially. There isn't a dedicated pin for each type of data (hasn't been since at least 1985) I don't know which bytes are changed.

It doesn't work that way. How it likely works is that the lens inserts a data packet with the function 'hold focus' (or maybe it is a "switch to MF") into the data stream from the lens to the camera - and the camera follows that command by stopping focusing.

A DIY method might be to disconnect the focus motor, but this will likely just give an error on the side of the camera.

But it doesn't matter whether the switch is NO or NC.