ok, thanks for another build to test. here's the section with your highlights,
@0dan0 :
Code:
a1-3:2564 1444 1244
a1-3:466 84 8
a1-3:1452 1076 8
Full output from Hello World to the kernel crash:
Code:
Hello, World!
> TestProtection begin
EDesEn_Crypt pass
SC CRC PowerOnCheck: OK!
Enter DSC
bind - begin!
bind - end!
event loop - begin!
ERR:ramdsk_setParam() No Implement! uiEvt 1
Init!
System_OnStrgInit_FWS(): ^M LD_BLOCK=16384
System_OnStrgInit_FWS(): ^M FW_MAX_SIZE=003C0000
System_OnStrgInit_FWS(): ^MFW_validate-update:System_OnStrgInit_FWS():
^MFW is just updated.
System_OnStrgInit_FWS(): ^M ok
ERR:PartLoad_Init() ^RLoaded Addr 0x(80E08DAC)!= Verified Addr 0x(80106000)
ERR:xFwSrv_Err() -21
ERR:System_OnStrgInit_FWS() Init failed!
Init!
[LOAD-FW]
Total Sections = 10
Section-01: Range[0x80000000~0x801055F0] Size=0x001055F0 (LOAD)
System_OnStrg_DownloadFW(): ^M P1_LOAD_SIZE=00E08DAC, TIME=27936371
System_OnStrg_DownloadFW(): ^MPL_check_Ld:
System_OnStrg_DownloadFW(): ^M PL_EN=00000000
System_OnStrg_DownloadFW(): ^M LZ_EN=00000000
ERR:IPL_GetCmd() -E- Cmd fail 9
---------------------------------------------------------
LD VERISON: LD658
FW --- Daily Build: Aug 22 2025, 11:52:51
---------------------------------------------------------
dispdev_openIFDsi(): Original SrcClk(297)Mhz
dispdev_openIFDsi(): DEVDSI: Chg PLL2 to(480)Mhz
ERR:DrvLCDState() state=0x06 not support!
[DOUT1]: device = [Display_LCD], state = [STOP], mode = [0x0d, 864x480]
[DOUT2]: device = [N/A], lockdevice = [N/A]
-11-GPIOMap_LCDStatus------
-22-GPIOMap_LCDStatus------
dispdev_closeIFDsi(): DEVDSI: Chg PLL2 from (480)MHz to(297)MHz
dispdev_closeIFDsi(): DEVDSI: Chg PLL2 to(297)Mhz done
dispdev_openIFDsi(): Original SrcClk(297)Mhz
dispdev_openIFDsi(): DEVDSI: Chg PLL2 to(480)Mhz
ERR:Ux_GetRootWindow() wnd not created
ERR:idec_setVideoWinAttrEx() Vertical Scaling down ratio over 2!
ERR:idec_setOsdWinAttrEx() Vertical Scaling down ratio over 2!
ERR:Ux_GetRootWindow() wnd not created
System_OnStrgInsert(): Card inserted
ERR:Ux_GetRootWindow() wnd not created
WRN:sdioHost_setBusClk() SDIO host0 : real clock (396694Hz) is not equal to desired (399000Hz)
Detected A:\NVTDELFW, delete A:\FWDV280.BIN
ERR:fs_remove() Try to delete read only file
ERR:System_OnStrgAttach() delete A:\NVTDELFW failed .
ERR:Ux_GetRootWindow() wnd not created
UINet_SetPASSPHRASE(): 12345678
Parameter error in Get_SceneModeValue()
MULTIREC_OFF!!!!!!!!!!
MULTIREC_OFF!!!!!!!!!!
pathid=0
on=1
pathid=1
on=0
SetupExe_OnWifiSetSSID CarDV_
UINet_SetSSID(): CarDV_
UIInfo: PStore sys param not save before load pstore!!!
ERR:PStore_OpenSection() Section not found, name: SERIAL_NUM, op: 0x3
Read SN:
uhInfoSize: 1652
Parameter error in Get_SceneModeValue()
MULTIREC_OFF!!!!!!!!!!
MULTIREC_OFF!!!!!!!!!!
pathid=0
on=1
pathid=1
on=0
SetupExe_OnWifiSetSSID CarDV_
UINet_SetSSID(): CarDV_
DNUI_FuncADJInit FlimType 0
Mode {MAIN} Open begin
CHK: 50, ModeMain_Open
ERR:xDispSrv_Err() -29
ERR:FileDB_GetInfoByHandle() This Handle is not created(0)
ERR:FileDB_GetInfoByHandle() This Handle is not created(0)
fileid:0
MULTIREC_OFF!!!!!!!!!!
MULTIREC_OFF!!!!!!!!!!
pathid=0
on=1
pathid=1
on=0
ERR:IPL_GetCmd() -E- Cmd fail 9
CHK: 203, UIMenuCommonItem_1x3_OnOpen
Mode {MAIN} Open end
ERR:IPL_GetCmd() -E- Cmd fail 9
Info.IdxSP8OUT=18
CHK: 234, UIMenuCommonItem_1x3_OnCustom1
CHK: 239, UIMenuCommonItem_1x3_OnCustom1
Mode {MAIN} Close begin
Mode {MAIN} Close end
Mode {MAIN} Open begin
CHK: 50, ModeMain_Open
ERR:pll_selectClkSrc() (0x0, 0x4) not supported
1.0-----------------------------true
Id=0
Mode=1
ERR:Init_OS04D10() OS04D10_init...
Init_OS04D10, DATALANE: 0 1 2 3
MULTIREC_OFF!!!!!!!!!!
MULTIREC_OFF!!!!!!!!!!
pathid=0
on=1
pathid=1
on=0
ERR:NH_Custom_SetFolderPath() setFolderPath id error 2!
ERR:NH_Custom_SetFolderPath() setFolderPath id error 3!
ERR:IPL_SetDZoom() IPL_SetDZoom fail (Current Mode = 0)
ERR:ChgMode_OS04D10() ChgMode_OS04D10 to 1...
csi_setEnable(TRUE)=0
CHK: 560, ChgMode_OS04D10
csi_waitInterrupt(CSI_INTERRUPT_FRAME_END)=65536
CHK: 562, ChgMode_OS04D10
pll_setPLLEn(PLL_ID_6, TRUE)=0
ERR:AF_Open() #Register AF event table.
Id=0
Mode=1
Id=0
Mode=1
Id=0
Mode=1
a1-3:2564 1444 1244
a1-3:466 84 8
a1-3:1452 1076 8
*** CPU Exception!!! cause 0x04: Address error exception (load or instruction fetch)
epc - 0x80339000
$ra - 0x80338fe4
$sp - 0x81309c80
$fp - 0x81309c48
general registers:
$zero : 0x00000000 $at : 0x80e10da0 $v0 : 0x00000012 $v1 : 0x0000000e
$a0 : 0x80dfc5c8 $a1 : 0x00000fc0 $a2 : 0x00000bd0 $a3 : 0x000017a0
$t0 : 0x0000c54c $t1 : 0x01010101 $t2 : 0x81308640 $t3 : 0x00000012
$t4 : 0x00000000 $t5 : 0x80f9beec $t6 : 0x0000000a $t7 : 0x81309b90
$s0 : 0x00000000 $s1 : 0x00000002 $s2 : 0x00000a08 $s3 : 0x80e07b50
$s4 : 0x00000000 $s5 : 0x81309d30 $s6 : 0x00b009c0 $s7 : 0x81309dec
$t8 : 0x00000002 $t9 : 0x00000002 null : 0x00000434 null : 0x00000008
gp : 0x80e10da0 sp : 0x81309c80 fp : 0x81309c48 ra : 0x80338fe4
co-processor registers:
entrylo : 0x00000001 status : 0x00000010 vector : 0x0100c403 epc : 0x80339000
cause : 0x00000000 badvaddr : 0x00800010 hwrena : 0x00000042 prid : 0x00019655
entrylo : 0x014f82a5
Task(id) :
IPL_Tsk(26)
stack :
range(0x81308620 - 0x8130a37c)
call stack :
:
abort (failed to backtrace $pc!)
*** CPU Exception in Task[]! cause=0x00000004, addr=0x80339000
I'm continuing image sensor research with Claude.ai python scripts in Ghidra. I just had my right hand injected with Xiaflex and I can't work as fast now until Wednesday or so. Here's some initial findings from the python scripts (attached) and Claude's analysis, which helps but is no smoking gun.
Key Findings
Sensor Confirmed: OS04D10
Multiple string hits at 0x80105de9 and throughout 0x80d97xxx confirm OmniVision OS04D10 sensor.
OmniVision Exposure Registers ARE Being Used
| Register | Purpose | Occurrences |
|---|
| 0x3500 | Exposure bits 19:16 | 281 |
| 0x3501 | Exposure bits 15:8 | 22 |
| 0x3502 | Exposure bits 7:0 | 58 |
| 0x3503 | AEC Manual Control | 20 |
| 0x350A | Gain high | 3 |
| 0x350B | Gain low | 6 |
Interesting: AR0330 Code Still Present
The firmware has
both AR0330 and OmniVision register patterns. This likely means:
- Shared codebase with Types A/B/C
- Sensor abstraction layer that handles both
- Or conditional code paths based on detected sensor
I2C Functions Located
Low-level sensor communication at:
- FUN_80002384
- FUN_800023dc
- FUN_80002474
Key Discovery: Different Memory Region!
Type C expo_iso was around 0x80E55xxx Type D candidates are at 0x80F82xxx
This is NOT just a +0x160 offset - it's a completely different memory region. This explains why your Type C addresses caused TLB crashes.
Top expo_iso Candidates
| Address | Register | Notes |
|---|
| 0x80F823A4 | s2, s7, a1 | Loaded 3+ times - HIGHEST PRIORITY |
| 0x80F82580 | s7, a1 | Secondary candidate |
| 0x80F82570 | a1 | Secondary candidate |
The 0xAAAAxxxx values are division magic constants (for the modulo-3 frame check), not pointers. The 0x43210007 is the familiar debug/magic constant.
Confirmed: frameno is nearby!
Look at this from the disassembly:
[CODE}
lui v1, 0x80f8
lw v0, 0x2464(v1) ; Load from 0x80F82464
[/CODE}
0x80F82464 is frameno - we already knew this worked! This strongly suggests the AE-related structures are all in the 0x80F82xxx region.
