Ricoh GR IV: CEVA-CV AI DSP Co-Processor Awakening & Deep Learning Autofocus Mod

Release Notes - v1.0.5: True CNN Activation & LiveView Face Detection Bridge Fix

Release Date: 2026-10-21
Target Device: Ricoh GR IV (firmware base v1.11 fwdc248b.bin)
Co-Processor: Socionext Milbeaut M10V on-die CEVA-CV Vector AI DSP (0x41000000)
Neural Network: Pentax K-3 Mark III Deep Learning Subject/Face Recognition CNN

---

1. Executive Summary: Why v1.0.4 Did Not Activate the CNN Model

In v1.0.4, the camera successfully booted and operated without freezing or crashing on half-press AF. However, real-world testing revealed that side-profile faces and backlit/shadow faces were not detected at all, performing identically to the stock FotoNation face detector.

Through deep static disassembly of the RTOS kernel and execution path auditing, we uncovered three critical root causes that caused the DSP CNN pipeline to silently fail or fall back to stock FotoNation on every frame:

---

Root Cause 1: SD Card Drive Letter Mismatch in LoadDsp ('A' vs 'C')

In stage3_ai_patcher.py, DspService::LoadDsp was invoked with argument r1 = 0x41 (character 'A'). Reverse engineering the DspService::LoadDsp implementation at 0x53966d74:

0x53966d84:  add   r7, fp, #-0x40      ; template string buffer "A:\DF_EX.BIN"
0x53966d88:  strb  r1, [fp, #-0x40]    ; Overwrites drive letter with r1!

• In Ricoh GR IV RTOS, drive A:\ is the internal ROM resource partition (12_RES.bin).
• The SD card root is mounted as drive C:\ (0x43), as verified in all Ricoh firmware paths (C:\fwdc248b.bin, C:\DCIM\, etc.).
• Calling LoadDsp with 'A' failed immediately to find or open DF_EX.BIN, DF_ID_S.BIN, and DF_IP.BIN.
• Because file loading failed, the LOADED bit (status & 2) was never asserted, Start() was never invoked, and the DSP remained inactive.
• In Cave 2, the check tst r2, #1 (STARTED bit) evaluated to 0 on every single frame, silently routing 100% of execution to fallback_stock (FotoNation)!

Fix in v1.0.5:

• Changed argument r1 to 0x43 ('C') in both Cave 1 and Cave 2.
• Added a Dual-Guarantee On-Demand Wakeup in Cave 2: If the SD card was not yet mounted when Hook 1 fired at early boot, Cave 2 detects STARTED == 0 on frame 0, calls LoadDsp(svc, 'C', 0, 0), Start(), and Test(), guaranteeing DSP ignition.

---

Root Cause 2: Uninitialized BSS Pointer for LiveView Preview Buffer

Cave 2 attempted to read the LiveView preview image buffer using LV_IMAGE_SVC_VA = 0x55395a18 (ldr r3, [0x55395a18, #8]). Memory map auditing revealed:

• 0x55395a18 resides in uninitialized BSS space. At runtime, [0x55395a18, #8] evaluates to 0x0.
• Cave 2 checked cmp r0, #0; beq fallback_stock. Even if the DSP had started, this null check diverted execution to fallback_stock on 100% of frames!

Deep Disassembly of FaceDetectionService::Task (0x5386ea8c): At the exact hook site in FaceDetectionService::Task, register r4 holds this (FaceDetectionService*):

• [r4, #0x38] points to FdLibraryService*.
• [r0, #0x44] points to p_FdEngine*.
• [r3, #0xc] is the actual physical YUV LiveView preview frame buffer (verified at 0x5386d13c: str r0, [r5, #0xc])!
• [r3, #0x10] is the dynamic frame pitch (stride, default 960).

Fix in v1.0.5: Cave 2 now extracts the preview frame dynamically via:

ldr r0, [r4, #0x38]   ; r0 = FdLibraryService*
cmp r0, #0
beq fallback_stock
ldr r3, [r0, #0x44]   ; r3 = p_FdEngine*
cmp r3, #0
beq fallback_stock
ldr r0, [r3, #0xc]    ; r0 = active YUV LiveView frame buffer!
ldr ip, [r3, #0x10]   ; ip = frame pitch (e.g., 960)
cmp r0, #0
beq fallback_stock

The downsampler now multiplies by ip dynamically (mul r6, ip, r6), ensuring perfect aspect ratio and pristine tensor generation.

---

Root Cause 3: Odd-Frame Decimation Fallback & High Confidence Threshold

1. Decimation Wiping Neural Detections:
   • In v1.0.4, decimation was implemented as tst r1, #1; bne fallback_stock.
   • On odd frames (every 33 ms), execution jumped to stock FotoNation. Since FotoNation cannot detect side-profile or backlit faces, it reported face_count = 0 on every odd frame, immediately clearing any neural bounding box from the screen!
   • Because the hardware CEVA-CV DSP executes inference in parallel with <0.4% host CPU usage, per-frame inference is completely free. Odd-frame decimation fallback has been removed.
2. Confidence Threshold Sensitivity:
   • Threshold was set to 60 (approx 24% probability), which is tuned for front-facing direct portraiture.
   • Reduced threshold to 25 (approx 10% probability), matching Pentax K-3 III's robust detection threshold for side profiles, dark/backlit scenes, tilted angles, and face masks.

---

2. Verification & Integrity Checklist

---

3. Firmware Release Hashes

• Active Flashable Firmware: output/fwdc248b.bin
  • Size: 38,791,732 bytes
  • SHA-256: d058ca69c47da83c7a0937458ad0e8bd9674fb64965c5facd75a8098242ca8c0
• Preserved Stage 3 Firmware: output/fwdc248b_stage3_ai_track.bin