D5100 video mode sensor readout

[leegong]

Side decoding from LV RAW hacking :
0x8F80AA78 ring buffer records major actions of IMX071 and EI-155 , just dump ring buffer
which shows the whole progress of starting Liveview :
the action code sequence 0x14, 0x15, 0x16, 1, 0xB, 0x17
is set by sub_001E726C "SensorEI155PP_Power_ON_init" , sequence 0x8, 0x23, 0x1B is set by sub_001E763A "Start_LiveView" ,
sequence 0x24, 0x25, 0x63 is set by sub_001E7918 CSIO_ch01_action0x11 triggered by INT24 external interrupt falling_edge,
single 0x63 might be set by sub_001E76DE Sensor_EI155_switch_to_multi_status and sub_001E7846 IMX071_setup_SSBRK

[leegong]

Just found two direct evidences show that normal LV stream works in 3x3 addition mode instead of 1/3 eliminate mode .
1）chip register 0x4000D106 :
2496 for still normal RAW (NEF) shooting
2528 for still overscan RAW (NEF) shooting
836 for still MV defect RAW shooting
2496 for super zoom LV stream
836 for normal LV stream
2) For both of Liveview stream and MV defect RAW , IMX071 register0x0 setting is the same 0x54 , i believe that MVdefect RAW
has same numbers of pixels as that of Liveview stream frame .

EDIT : Could anybody manage to shoot MV defect RAW with D5100 or D7000 ?

[leegong]

Time value ( unit ms ) in ring buffer can indicate LiveView FPS , for example interval of adjacent
action code 0x63 means time interval of Liveview frame , approximately decimal 41ms in my screenshot above .
EDIT :
ring buffer is inside EXIF Tags0x91 Nikon ShotInfoD5100 :
offset 2210(decimal) : uint32 - value of 32bits timer counter when IMX071 exposure is started
offset 2214(decimal) : uint32 - value of 32bits timer counter when image data from IMX071 is captured and stored in DDR memory .
offset 2222(decimal) : uint16 - temperature
offset 2286(decimal) : uint32 - index of the latest action descripted in ring buffer followed
offset 2290(decimal) - 320 bytes ring buffer : 64 bytes ACTION CODE array + 64 uint32 timing value array .