# NT98566 + SC501AI: Cannot start SDK - syscall_403 ENOSYS / hdal module symbol mismatch #2107

Hardware

• SoC: Novatek NT98566 (NA51089)
• Sensor: SmartSens SC501AI (5MP, confirmed from OEM firmware - vendor advertised as Sony IMX415)
• Flash: XM25QH128C 16MB NOR
• RAM: 128MB
• Board: IVG-N8S (XMeye/ANBIUX branded camera)
• OpenIPC firmware: openipc.nt98566-nor-lite (built 2026-05-10, kernel 4.19.91)

Problem

Majestic fails to start with open fail=-41 / Cannot start SDK. RTSP stream starts but delivers no video (vd_count=0, sps_len=0).

Investigation

1. syscall_403 returning ENOSYS

strace shows syscall_403 (0x193) called repeatedly by libhdal.so / libvendor_isp.so, returning errno 38 (ENOSYS):

syscall_403(0, 0x7eea1530, 0x516000, 0x193, 0, 0x7eea1530) = -1 (errno 38)
syscall_403(0x6, 0x7eea1488, 0x76dd5000, 0x193, 0x6, 0x7eea1488) = -1 (errno 38)

The OpenIPC kernel arch/arm/tools/syscall.tbl only goes up to entry 399. Syscall 403 is a Novatek proprietary syscall present in the OEM XMeye kernel but missing from the OpenIPC kernel.

2. OEM hdal modules incompatible with OpenIPC kernel

Attempting to use OEM kdrv_comm.ko from the original firmware dump fails because the OEM module requires nvttmr_base, nvttmr_lock, nvttmr_in_use symbols which were not exported by the OpenIPC kernel's timer-novatek.c (CONFIG_NOVATEK_TIMER was disabled).

Fix applied: Enabled CONFIG_NOVATEK_TIMER=y in nt98566.generic.config → symbols now exported. But further OEM modules (kdrv_h26x.ko) require symbols like H26XEnc_setUsrQpCfg, SetMemoryAddr, VdoEnc_Builtin_GetEncVar which appear to be built into the OEM kernel (not found in any extractable .ko).

3. Sensor and I2C

• Pinmux must be set manually: echo sensor 0x220 > /proc/nvt_info/nvt_pinmux/pinmux_set
• Fixed in DTB by modifying sensor { pinmux = <0x220> } in boot partition
• nvt_sen_sc501ai.ko loads successfully (lsmod confirms)
• i2cdetect -y 0 shows empty bus (sensor not responding) - MCLK not being enabled
• After pinmux fix, dmesg no longer shows I2C timeouts but _isf_vdocap_do_open() no sen driver persists

4. Kernel version mismatch

Both OEM and OpenIPC kernels report vermagic: 4.19.91 preempt mod_unload ARMv7 but they are different builds with different exported symbols.

What works

• ✅ OpenIPC boots successfully
• ✅ Network (DHCP), SSH (dropbear), HTTP (port 80/443)
• ✅ RTSP server starts on port 554
• ✅ overlay filesystem (jffs2 on mtdblock3)
• ✅ fw_printenv/fw_setenv working
• ✅ All OpenIPC hdal .ko load correctly with CONFIG_NOVATEK_TIMER=y
• ✅ nvt_sen_sc501ai.ko loads
• ✅ Pinmux 0x220 set correctly

What doesn't work

• ❌ Majestic SDK initialization (open fail=-41)
• ❌ Sensor I2C communication (MCLK not enabled)
• ❌ Video capture

Flash layout (working)

mtd0: 0x050000 "boot"     (contains U-Boot + DTB)
mtd1: 0x200000 "kernel"
mtd2: 0x480000 "rootfs"
mtd3: 0x930000 "rootfs_data"

Working bootargs

earlyprintk console=ttyS0,115200 init=/init mem=54M rootwait root=/dev/mtdblock2 rootfstype=squashfs mtdparts=spi_nor.0:0x50000(boot),0x200000(kernel),0x480000(rootfs),-(rootfs_data)

Sensor config (from OEM firmware)

[POWER]
id_0_mclk = 0        # CTL_SEN_CLK_SEL_SIEMCLK
id_0_pwdn_pin = 0xFFFFFFFF
id_0_rst_pin = 0x44  # S_GPIO_4
[I2C]
id_0_i2c_id = 0
id_0_i2c_addr = 0x30 # 0x60 >> 1

Requested help

1. Syscall 403 - What is this Novatek proprietary syscall? Is it possible to add it to the OpenIPC kernel for NT98566/NT98562?

2. MCLK - How to properly enable MCLK (SIEMCLK) for SC501AI on NT98566? The pinmux driver source (na51089_pinmux_host.c) references SEN_MCLK bit in TOP_REG3 but it's unclear how to trigger this from userspace/init.

3. hdal symbols - H26XEnc_setUsrQpCfg, SetMemoryAddr, VdoEnc_Builtin_GetEncVar appear to be built into the OEM kernel. Are there OpenIPC versions of these?

OEM firmware analysis

• OEM uses Load_NT98566 shell script to load hdal modules (identical structure to OpenIPC load_novatek)
• OEM sensor detection via XmGetSensorType binary which sets pinmux echo sensor 0x220 > /proc/nvt_info/nvt_pinmux/pinmux_set
• Original firmware backup (16MB) available for further analysis

Fix already applied to OpenIPC repo (PR suggestion)

Add CONFIG_NOVATEK_TIMER=y to br-ext-chip-novatek/board/nt9856x/nt98566.generic.config to export required timer symbols for OEM hdal modules.