Beta Testers needed. I have successfully created a CFW for such a device. Please report here if you are interessted in testing. I will provide instructions as soon as i have someone to test.

PS: According to https://4pda.ru/forum/index.php?showtopic=807259&st=2100, it should also work on MixSight HX-I2110T2; WanScam HW0036; Escam G02 because they are identical.

I have escam g02 and can test.

@codedmind : Do you have a serial connection to the camera?

I can have it connected via USB if is that you asking

On Wed, Aug 8, 2018, 21:51 Elias Kotlyar notifications@github.com wrote:

@codedmind https://github.com/codedmind : Do you have a serial connection to the camera?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/issues/625#issuecomment-411547841, or mute the thread https://github.com/notifications/unsubscribe-auth/ACxnX7h4tU0eXb-Ijm-WcNOExLN5gsmXks5uO08zgaJpZM4Vw8KI .

Okey. I assume that it still should work out. Can you please do the following:

Connect via Telnet to the camera. 1.1 Download the APP "Digma" from Google Play Store. 1.2 Connect to Camera using Digma. Go to Settings -> Advanced Settings -> Telnet-Access -> Enable it 1.3. Connect via Telnet to Camera using following credentials: root:hslwificam

Dump the content of the following partitions to microsd: 2.1 cd /mnt/sdcard 2.2

dd if=/dev/mtdblock2 of=rootfs.bin 
dd if=/dev/mtdblock3 of=system.bin 
dd if=/dev/mtdblock4 of=factory.bin 
dd if=/dev/mtdblock5 of=param.bin

2.3 Provide this files in a Zip-File for recovery purposes

Check the cmdline and dump the output here cat /proc/cmdline

Hello, I'm not able to connect using digma smarcam, always get invalid uid.

Using camhi is online....

On Thu, Aug 9, 2018, 09:31 Elias Kotlyar notifications@github.com wrote:

Okey. I assume that it still should work out. Can you please do the following:

Connect via Telnet to the camera. 1.1 Download the APP "Digma" from Google Play Store. 1.2 Connect to Camera using Digma. Go to Settings -> Advanced Settings -> Telnet-Access -> Enable it 1.3. Connect via Telnet to Camera using following credentials: root:hslwificam 2.1 cd /mnt/sdcard 2.2 Dump the content of the following partitions to microsd: dd if=/dev/mtdblock2 of=rootfs.bin dd if=/dev/mtdblock3 of=system.bin dd if=/dev/mtdblock4 of=factory.bin dd if=/dev/mtdblock5 of=param.bin 2.3 Provide this files in a Zip-File for recovery purposes

Check the cmdline and dump the output here cat /proc/cmdline

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/issues/625#issuecomment-411680207, or mute the thread https://github.com/notifications/unsubscribe-auth/ACxnX2cNCZzI1PxnqY0t4wlIxZz75bl8ks5uO_NWgaJpZM4Vw8KI .

Ok i found this site : https://blog.sengotta.net/short-security-overview-of-the-escam-g02/ And i'm able to login via telnet with user default, but i cannot access sdcard via telnet, i can view the sdcad via webgui.

In the meantime i think i brik de camera, i can't reset it and it won't boot

Ok, after i restore the camera. 1 - login to webgui 2 - open url http://ipcamera/cgi-bin/ht3510/printscreenrequest.cgi (ativate telnet) 3 - open telnet session login root:hichiphx 4 - cd into /mnt/mtd/ipc/tmpfs/sd

But then dd is missing... Any sugestion?

Can you try:

busybox dd

dd: Applet not found

busybox

BusyBox v1.18.1 (2017-08-11 16:47:04 CST) multi-call binary. Copyright (C) 1998-2009 Erik Andersen, Rob Landley, Denys Vlasenko and others. Licensed under GPLv2. See source distribution for full notice.

Usage: busybox [function] [arguments]... or: busybox --list[-full] or: function [arguments]...

    BusyBox is a multi-call binary that combines many common Unix
    utilities into a single executable.  Most people will create a
    link to busybox for each function they wish to use and BusyBox
    will act like whatever it was invoked as.

Currently defined functions: arping, ash, awk, basename, bash, cat, chmod, cp, cttyhack, date, df, dhcprelay, dmesg, dnsdomainname, du, dumpleases, echo, egrep, false, fdisk, fgrep, free, getty, grep, gunzip, gzip, halt, hostname, id, ifconfig, init, insmod, kill, killall, linuxrc, ln, login, ls, lsmod, lsusb, mdev, mesg, mkdir, mknod, mount, mv, netstat, ping, poweroff, printenv, printf, ps, pwd, reboot, rm, rmmod, route, sed, seq, sh, sleep, stat, su, sulogin, sync, tar, telnetd, tftp, top, touch, true, udhcpc, udhcpd, umount, unzip, usleep, vi, wc, zcat

On Sun, Aug 19, 2018, 22:11 Elias Kotlyar notifications@github.com wrote:

Can you try:

busybox dd

?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/issues/625#issuecomment-414156228, or mute the thread https://github.com/notifications/unsubscribe-auth/ACxnX-i_8C-ujL6a6ZUxXe-FvjE_Re1Sks5uSdSdgaJpZM4Vw8KI .

Hello Elias I have an i21g, and here is the result.

apk-link login: root
Password:

Processing /etc/profile... Done

~ # cd /mnt/DCIM/
/mnt/DCIM # dd if=/dev/mtdblock2 of=rootfs.bin
6656+0 records in
6656+0 records out
3407872 bytes (3.3MB) copied, 3.201716 seconds, 1.0MB/s
/mnt/DCIM # dd if=/dev/mtdblock3 of=system.bin
4608+0 records in
4608+0 records out
2359296 bytes (2.3MB) copied, 2.304760 seconds, 999.7KB/s
/mnt/DCIM # dd if=/dev/mtdblock4 of=factory.bin
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.052567 seconds, 1.2MB/s
/mnt/DCIM # dd if=/dev/mtdblock5 of=param.bin
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.054542 seconds, 1.1MB/s
/mnt/DCIM # cat /proc/cmdline
console=ttyS1,115200n8 mem=39M@0x0 ispmem=5M@0x2700000 rmem=20M@0x2c00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2176k(kernel),3328k(root),2304k(system),64k(factory),64k(param) quiet
/mnt/DCIM #

saved bin files

@codedmind I have the same escam g02. However the default username is not working for me. Is there anything I'm missing?

root:hichiphx

On Thu, Aug 30, 2018, 12:21 Ashwin Prasad notifications@github.com wrote:

@codedmind https://github.com/codedmind I have the same escam g02. However the default username is not working for me. Is there anything I'm missing?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/issues/625#issuecomment-417284490, or mute the thread https://github.com/notifications/unsubscribe-auth/ACxnXy6rx-V5oN-XikZXLXtptJsawl_kks5uV8qhgaJpZM4Vw8KI .

@codedmind thanks, i followed the link you posted and i'm able to access it now

@EliasKotlyar i think ESCAM G02 doesn't use Ingenic processor, take a look at the dmesg outout

[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.4.43-gk (root@localhost.localdomain) (gcc version 4.6.1 (crosstool-NG 1.18.0) ) #6 PREEMPT Sat Sep 30 10:14:30 CST 2017
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d
[    0.000000] CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Goke IPC Board

dmesg.log

@EliasKotlyar any update about this camera?

@EliasKotlyar

Here ya go Sannce i21ag cam. DCIM.zip Only got system.bin and rootfs.bin. No /dev/mtdblock4 and /dev/mtdblock5 avaible. /dev/mtdblock0+/dev/mtdblock1 are avaible if needed.

~ # cat /proc/cmdline console=ttyS1,115200n8 mem=39M@0x0 ispmem=5M@0x2700000 rmem=20M@0x2C00000 init/linuxrc rootfstype=squashfs init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2176k(kernel),3584k(rootfs),2176k(system) quiet ~ #

@thgab Did you come any further?

@DoeEensGek No. I have dumped mtblocks, and thats all. I'm interested about i21ag cfw firmware, but i dont have more information.

I have 2 G02 here aswell, one with december 2017 firmware and one with july 2018 firmware. Received a firmware update by mail from Escam "GK7102CHX_V13.1.6.1.30-20180329". Updated the one with newer firmware, but unfortunatly the CamHi app no longer works now. Always wrong password error. Does anyone have an older or newer firmware version you would like to share?

Both cams look identical and are telnet enabled. Have tried binwalking the received firmware and editing the files I thought were wrong and then recreating the firmware. Cam says firmware update successfull but never updates anything.

Can't change anything as the whole filesystem is read-only and unchangable. Some mounts are writeable.

Been able to dump mtdblocks of the one with the older firmware. My versions do not have a /system so it is different from the G02 as named on 4pda.ru. There is another thread about G02 with firmware updates and a tool. Am looking for those as the links do not work.

rootfs on / type rootfs (rw) /dev/root on / type squashfs (ro,relatime) proc on /proc type proc (rw,relatime) tmpfs on /dev type tmpfs (rw,relatime) tmpfs on /tmp type tmpfs (rw,relatime) sysfs on /sys type sysfs (rw,relatime) devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000) /dev/mtdblock4 on /mnt/mtd/ipc type squashfs (ro,relatime) /dev/mtdblock5 on /mnt/mtd/ipc/conf type jffs2 (rw,relatime) /proc/bus/usb on /proc/bus/usb type usbfs (rw,relatime) tmpfs on /mnt/mtd/ipc/tmpfs type tmpfs (rw,relatime,size=16384k) /dev/mmcblk0p1 on /mnt/mtd/ipc/tmpfs/sd type vfat (rw,noexec,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=continue)

mtdblocks available if needed. Dumped with 'cat'.

working logins: root / hichiphx admin / 2601hx default / (null)

dev: size erasesize name mtd0: 00030000 00010000 "boot" mtd1: 00010000 00010000 "bootenv" mtd2: 00150000 00010000 "kernel" mtd3: 001d0000 00010000 "rootfs" mtd4: 00300000 00010000 "mtd" mtd5: 001a0000 00010000 "conf" mtd6: 00800000 00010000 "all"

SANNCE I21AG; MixSight HX-I2110T2; WanScam HW0036; icam608 and other, have two revisions 1) Old - device firmware A- and E-

console=ttyS1,115200n8 mem=39M@0x0 ispmem=5M@0x2700000 rmem=20M@0x2C00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2176k(kernel),3584k(rootfs),2176k(system)

2) Last - device firmware T-* have new uboot, kernel, rootfs

console=ttyS1,115200n8 mem=39M@0x0 ispmem=5M@0x2700000 rmem=20M@0x2C00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2176k(kernel),3328k(rootfs),2304k(system),64k(factory),64k(param)

mtd4_factory - only config with device_id ipcam mtd5_param - not used/ sannce_dumps.zip

I have a Sannce I21AG and i'm interested in getting this FW going. What is the current state?

I have so far been able to access the camera through telnet using the info provided in this thread but I need to get an sd-card as I had no spare available.

Maybe someone can use it:

~ # ls -a . .. ~ # cd /. / # ls bin dev etc lib linuxrc mnt opt proc root run sbin sys system tmp usr var / # ls -la total 0 drwxr-xr-x 16 root 0 225 May 31 2016 . drwxr-xr-x 16 root 0 225 May 31 2016 .. drwxr-xr-x 2 root 0 1352 May 31 2016 bin drwxrwxrwt 5 root 0 11920 Jan 1 1970 dev drwxr-xr-x 6 root 0 399 May 31 2016 etc drwxr-xr-x 3 root 0 513 May 31 2016 lib lrwxrwxrwx 1 root 0 11 May 31 2016 linuxrc -> bin/busybox drwxr-xr-x 4 root 0 39 May 31 2016 mnt drwxr-xr-x 2 root 0 3 May 31 2016 opt dr-xr-xr-x 53 root 0 0 Jan 1 1970 proc drwxr-xr-x 2 root 0 3 May 31 2016 root drwxr-xr-x 2 root 0 3 May 31 2016 run drwxr-xr-x 2 root 0 1041 May 31 2016 sbin dr-xr-xr-x 11 root 0 0 Jan 1 1970 sys drwxr-xr-x 8 root 0 0 Oct 24 17:10 system drwxrwxrwt 4 root 0 460 Oct 26 17:21 tmp drwxr-xr-x 5 root 0 63 May 31 2016 usr lrwxrwxrwx 1 root 0 4 May 31 2016 var -> /tmp / # cd ~ # ls -la total 0 drwxr-xr-x 2 root 0 3 May 31 2016 . drwxr-xr-x 16 root 0 225 May 31 2016 .. ~ # cd /. / # ls -la total 0 drwxr-xr-x 16 root 0 225 May 31 2016 . drwxr-xr-x 16 root 0 225 May 31 2016 .. drwxr-xr-x 2 root 0 1352 May 31 2016 bin drwxrwxrwt 5 root 0 11920 Jan 1 1970 dev drwxr-xr-x 6 root 0 399 May 31 2016 etc drwxr-xr-x 3 root 0 513 May 31 2016 lib lrwxrwxrwx 1 root 0 11 May 31 2016 linuxrc -> bin/busybox drwxr-xr-x 4 root 0 39 May 31 2016 mnt drwxr-xr-x 2 root 0 3 May 31 2016 opt dr-xr-xr-x 53 root 0 0 Jan 1 1970 proc drwxr-xr-x 2 root 0 3 May 31 2016 root drwxr-xr-x 2 root 0 3 May 31 2016 run drwxr-xr-x 2 root 0 1041 May 31 2016 sbin dr-xr-xr-x 11 root 0 0 Jan 1 1970 sys drwxr-xr-x 8 root 0 0 Oct 24 17:10 system drwxrwxrwt 4 root 0 480 Oct 26 17:22 tmp drwxr-xr-x 5 root 0 63 May 31 2016 usr lrwxrwxrwx 1 root 0 4 May 31 2016 var -> /tmp / # cd /dev /dev # ls -la total 0 drwxrwxrwt 5 root 0 11920 Jan 1 1970 . drwxr-xr-x 16 root 0 225 May 31 2016 .. crw-r--r-- 1 root 0 14, 4 Jan 1 1970 audio crw-rw---- 1 root 0 5, 1 Oct 26 17:12 console crw-rw---- 1 root 0 10, 52 Jan 1 1970 cpu_dma_latency crw-rw---- 1 root 0 14, 3 Jan 1 1970 dsp crw-rw---- 1 root 0 1, 7 Jan 1 1970 full crw-rw---- 1 root 0 10, 48 Jan 1 1970 gpioapp drwxr-xr-x 2 root 0 60 Jan 1 1970 input crw-rw---- 1 root 0 10, 63 Jan 1 1970 ipu crw-rw---- 1 root 0 10, 60 Jan 1 1970 jz_adc_aux_0 crw-rw---- 1 root 0 10, 59 Jan 1 1970 jz_adc_aux_1 crw-rw---- 1 root 0 10, 58 Jan 1 1970 jz_adc_aux_2 crw-rw---- 1 root 0 10, 57 Jan 1 1970 jz_adc_aux_3 crw-rw---- 1 root 0 10, 56 Jan 1 1970 jz_adc_aux_4 crw-rw---- 1 root 0 10, 55 Jan 1 1970 jz_adc_aux_5 crw-rw---- 1 root 0 10, 54 Jan 1 1970 jz_adc_aux_6 crw-rw---- 1 root 0 10, 53 Jan 1 1970 jz_adc_aux_7 crw-rw---- 1 root 0 1, 2 Jan 1 1970 kmem crw-rw---- 1 root 0 1, 11 Jan 1 1970 kmsg crw-rw---- 1 root 0 10, 62 Jan 1 1970 log_main crw-rw---- 1 root 0 10, 237 Jan 1 1970 loop-control brw-rw---- 1 root 0 7, 0 Jan 1 1970 loop0 brw-rw---- 1 root 0 7, 1 Jan 1 1970 loop1 brw-rw---- 1 root 0 7, 2 Jan 1 1970 loop2 brw-rw---- 1 root 0 7, 3 Jan 1 1970 loop3 brw-rw---- 1 root 0 7, 4 Jan 1 1970 loop4 brw-rw---- 1 root 0 7, 5 Jan 1 1970 loop5 brw-rw---- 1 root 0 7, 6 Jan 1 1970 loop6 brw-rw---- 1 root 0 7, 7 Jan 1 1970 loop7 crw-rw---- 1 root 0 253, 0 Jan 1 1970 media0 crw-rw---- 1 root 0 1, 1 Jan 1 1970 mem crw-rw---- 1 root 0 14, 0 Jan 1 1970 mixer crw-rw---- 1 root 0 10, 47 Jan 1 1970 motor crw-rw---- 1 root 0 90, 0 Jan 1 1970 mtd0 crw-rw---- 1 root 0 90, 1 Jan 1 1970 mtd0ro crw-rw---- 1 root 0 90, 2 Jan 1 1970 mtd1 crw-rw---- 1 root 0 90, 3 Jan 1 1970 mtd1ro crw-rw---- 1 root 0 90, 4 Jan 1 1970 mtd2 crw-rw---- 1 root 0 90, 5 Jan 1 1970 mtd2ro crw-rw---- 1 root 0 90, 6 Jan 1 1970 mtd3 crw-rw---- 1 root 0 90, 7 Jan 1 1970 mtd3ro brw-rw---- 1 root 0 31, 0 Jan 1 1970 mtdblock0 brw-rw---- 1 root 0 31, 1 Jan 1 1970 mtdblock1 brw-rw---- 1 root 0 31, 2 Jan 1 1970 mtdblock2 brw-rw---- 1 root 0 31, 3 Jan 1 1970 mtdblock3 drwxr-xr-x 2 root 0 60 Jan 1 1970 net crw-rw---- 1 root 0 10, 51 Jan 1 1970 network_latency crw-rw---- 1 root 0 10, 50 Jan 1 1970 network_throughput crw-rw---- 1 root 0 1, 3 Jan 1 1970 null crw-rw---- 1 root 0 5, 2 Oct 26 17:23 ptmx drwxr-xr-x 2 root 0 0 Jan 1 1970 pts crw-rw---- 1 root 0 2, 176 Jan 1 1970 ptya0 .... crw-rw---- 1 root 0 2, 175 Jan 1 1970 ptyzf brw-rw---- 1 root 0 1, 0 Jan 1 1970 ram0 brw-rw---- 1 root 0 1, 1 Jan 1 1970 ram1 brw-rw---- 1 root 0 1, 10 Jan 1 1970 ram10 brw-rw---- 1 root 0 1, 11 Jan 1 1970 ram11 brw-rw---- 1 root 0 1, 12 Jan 1 1970 ram12 brw-rw---- 1 root 0 1, 13 Jan 1 1970 ram13 brw-rw---- 1 root 0 1, 14 Jan 1 1970 ram14 brw-rw---- 1 root 0 1, 15 Jan 1 1970 ram15 brw-rw---- 1 root 0 1, 2 Jan 1 1970 ram2 brw-rw---- 1 root 0 1, 3 Jan 1 1970 ram3 brw-rw---- 1 root 0 1, 4 Jan 1 1970 ram4 brw-rw---- 1 root 0 1, 5 Jan 1 1970 ram5 brw-rw---- 1 root 0 1, 6 Jan 1 1970 ram6 brw-rw---- 1 root 0 1, 7 Jan 1 1970 ram7 brw-rw---- 1 root 0 1, 8 Jan 1 1970 ram8 brw-rw---- 1 root 0 1, 9 Jan 1 1970 ram9 crw-rw---- 1 root 0 1, 8 Jan 1 1970 random crw-rw---- 1 root 0 10, 61 Jan 1 1970 rmem lrwxrwxrwx 1 root 0 9 Jan 1 1970 root -> mtdblock2 crw-r--r-- 1 root 0 10, 135 Jan 1 1970 rtc crw-rw---- 1 root 0 10, 46 Jan 1 1970 sinfo crw-rw---- 1 root 0 10, 49 Jan 1 1970 soc_vpu crw-rw---- 1 root 0 5, 0 Jan 1 1970 tty crw--w---- 1 root 0 4, 65 Jan 1 1970 ttyS1 crw-rw---- 1 root 0 3, 176 Jan 1 1970 ttya0 ... crw-rw---- 1 root 0 3, 175 Jan 1 1970 ttyzf crw-rw---- 1 root 0 1, 9 Jan 1 1970 urandom crw-rw---- 1 root 0 81, 3 Jan 1 1970 v4l-subdev0 crw-rw---- 1 root 0 81, 0 Jan 1 1970 video0 crw-rw---- 1 root 0 81, 1 Jan 1 1970 video1 crw-rw---- 1 root 0 81, 2 Jan 1 1970 video2 crw-rw---- 1 root 0 10, 130 Jan 1 1970 watchdog crw-rw---- 1 root 0 252, 0 Jan 1 1970 watchdog0 crw-rw---- 1 root 0 1, 5 Jan 1 1970 zero /dev #

I bought a camera before digging into the instructions for this, but yep, im interested as well. I grabbed a cheapo Wanscam

Hello everyone,

I have created a tutorial for the installation of the bootloader on a Sannce. Can someone test if its working on a Sannce? Attention: It may break your camera. Also we can start collecting images for other devices.

Here is the tutorial: https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/information/sannce.md

next steps: i have already compiled a kernel and the rootfs from the dafang can still be used. I hope i have time to release soon.

There is new version (cams sold in 2018) with closed ports and communication tied only to JoyLite application (can not be accessed by Digma - invalid device id,without possibility to manage ports, users, login data (basically they made botnet camera). Any idea 💡 how to aproach

sannce_v1.bin - not work/ I got a brick/

Hey. I have made a full tutorial for hacking a Sannce Camera. It should basically work on any T10 based Device, so if someone have some spare time, give it a try.

Any feedback on the esgam g02?

@codedmind : Do you have a serial connection attached? If so, please provide a bootlog and dump the firmware and i can tell you if you can install the bootloader of the sannce safely.

@EliasKotlyar i don't have serial... but i can access via telnet/ssh the problem is that in that model don't have dd commands so i can not provide you the bootlog and dump follow the tutorial to do so...

Any alternative methods?

@codedmind : please use the following issue. I provided you a small tutorial, how you can install the dd commands back. https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/issues/795

@EliasKotlyar Here are the files https://uploadfiles.io/ksxid

cat /proc/mtd

dev: size erasesize name mtd0: 00030000 00010000 "boot" mtd1: 00010000 00010000 "bootenv" mtd2: 00150000 00010000 "kernel" mtd3: 001d0000 00010000 "rootfs" mtd4: 00300000 00010000 "mtd" mtd5: 001a0000 00010000 "conf" mtd6: 00800000 00010000 "all"

@EliasKotlyar try this one https://we.tl/t-Rrgd00Cv3J

There is new version (cams sold in 2018) with closed ports and communication tied only to JoyLite application (can not be accessed by Digma - invalid device id,without possibility to manage ports, users, login data (basically they made botnet camera). Any idea 💡 how to aproach

I have the same device as @elkapetano , both Digma and other Sannce apps dont recognize the ID. Its an Sannce I141CB. My goal is to be able to view the video feed outside of the JoyLite-app.

It seams really closed: Nmap doesn't show any open ports. I've used tcpdump in different setups. Almost everything is encrypted. I see some HTTPS traffic to china (jpush and kalay API's). After MITMing this doesnt look that interesting (other then an use privacy issue..). The audio and video are on some weird UDP-stream that wireshark cant decode. I suspect some kind of encrypted RTP (?). In normal operation it is sent to 4 different IP's on port 10001. Joylight app connects to that cloud as well. If i disable the WAN-connection, my JoyLite app still works by broadcasting to port 32761, in order to find the webcam. Those are encrypted UDP as well, so this doesnt help me any further.

Now i have found this project. I would like to help test firmware, and opened the the device. It seems to be different then other models mentioned here. See images: https://ibb.co/8XYjkKX https://ibb.co/2cDCQ70 https://ibb.co/gt62gSs https://ibb.co/30jJYpL https://ibb.co/rk0C124

Will the firmware work on my device at all? I can visibly verify its an T20-chip.

@EliasKotlyar I have found the serial connection on my Sannce I141CB: https://ibb.co/PcVtWKz

Here are the bootlogs:

bootlog_sannce.txt

bootlog_sannce_uboot.txt

I can get root with: setenv bootargs console=ttyS1,115200n8 mem=42012K@0x0 ispmem=8100K@0x2907000 rmem=15424K@0x30F0000 init=/bin/sh rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),1792k(rootfs),3584k(user),2048k(kernel2),1792k(rootfs2),3584k(user2),1024k(mtd),-(flag)

But directories like /proc, /system_rw arent mounted if i boot this way. I don't know how to get the necessary files. I am currently trying the normal login. Passwords hslwificam, ismart12, hichiphx don't work. Currently trying to crack the /etc/shadow: root:$1$2368HyeJ$NhlfFNmvbW32jNZWwcIdP0:0:0:99999:7:::

Hello xatr0z,

Can you please dump the whole firmware and provide it here? It would help investigation a lot.

I have compiled a bootloader for your camera. It can be found here(sannce_i141cb_v2.bin): https://github.com/Dafang-Hacks/uboot/tree/master/compiled_bootloader

Attention: I cannot guarantee that it will work out of the box. I hope it does, but create a dump of the whole firmware first and consider that you might need to recover(using a Raspi or a CH341).

Greatings, Elias

Can you please dump the whole firmware and provide it here? It would help investigation a lot.

Hi Elias,

Thank you very much for you effort!

Unfortunatly I don't know how to dump the firmware. Like i said, I currently only have access via serial (/bin/sh), and /proc/, /dev/, /system_rw/ etc are all empty. It seems that mdev doesnt run. When i try it manually i get ~ # /sbin/mdev -s mdev: /sys/class: No such file or directory

Does anyone know another way to dump the firmware? Maybe from uboot prompt? Or is it possible to create the /dev/ entries so i can mount them and use dd?

Hello xatr0z,

You can try to boot into a custom kernel(just take the one from the rootfs repository) with the following tutorial(Loading and booting a kernel without flashing (for advanced users): https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/hacks/unbrick.md

I suppose that it may be ok for getting the /dev/ working, and then dumping the system.

Hi Elias,

In the end i got an dump from the Sannce i141cb :) See dump.zip. Only mtdblock9 and mtdblock10 (para and flag) wouldnt copy: No such device or address

I'll try flashing the bootloader later.

For future readers in same situation:

I tried some different kernels, bootargs, bootcmd. The kernel that worked for me was https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/tree/master/firmware_original/sannce with normal way to get root (/bin/sh instead of /linuxrc).
After booting i still got empty directories like /dev and /system_rw. So I couldnt perform the dd command, as it needed the devices to exist.
But /proc/ did contain files! mdev -s could now try to create the devices, but wasnt able to: mdev: can't create 'mem': Read-only file system.
I had to create all devices manually. First i did cat /proc/devices which recognized mtdblock and mmc:
```
Block devices:
1 ramdisk
259 blkext
7 loop
31 mtdblock
179 mmc
```

Creating devices with 31 for mtdblock:

mknod /tmp/mtdblock1 b 31 1
mknod /tmp/mtdblock2 b 31 2
mknod /tmp/mtdblock3 b 31 3
mknod /tmp/mtdblock4 b 31 4
mknod /tmp/mtdblock5 b 31 5
mknod /tmp/mtdblock6 b 31 6
mknod /tmp/mtdblock7 b 31 7
mknod /tmp/mtdblock8 b 31 8
mknod /tmp/mtdblock9 b 31 9
mknod /tmp/mtdblock10 b 31 10

Creating device with id 179 for mmc, and mounting it. As i only had one partition i used 179 1:
```
mount -t vfat /tmp/mmc1 /tmp/mounts/mmc
```

Finally, dump the files:

dd if=/tmp/mtdblock0 of=/tmp/mounts/mmc/dump/uboot.bin 
dd if=/tmp/mtdblock1 of=/tmp/mounts/mmc/dump/kernel.bin 
dd if=/tmp/mtdblock2 of=/tmp/mounts/mmc/dump/rootfs.bin 
dd if=/tmp/mtdblock3 of=/tmp/mounts/mmc/dump/driver.bin 
dd if=/tmp/mtdblock4 of=/tmp/mounts/mmc/dump/appfs.bin 
dd if=/tmp/mtdblock5 of=/tmp/mounts/mmc/dump/backupk.bin 
dd if=/tmp/mtdblock6 of=/tmp/mounts/mmc/dump/backupd.bin 
dd if=/tmp/mtdblock7 of=/tmp/mounts/mmc/dump/backupa.bin 
dd if=/tmp/mtdblock8 of=/tmp/mounts/mmc/dump/config.bin 
dd if=/tmp/mtdblock9 of=/tmp/mounts/mmc/dump/para.bin 
dd if=/tmp/mtdblock10 of=/tmp/mounts/mmc/dump/flag.bin 
umount /tmp/mounts/mmc/

I just tried flashing sannce_i141cb_v2.bin (renamed to demo.bin), but it didnt work. Device still working though :)

Its a large SD-card (64GB), but its always been recognized by uboot. After lots of tries with different timings for holding the reset button, FAT32, FAT 32 LB, i finally got a step closer to flashing. This was after changing the partition to 64 MB.

Then this Auto upgrade start appeared:

User check OK! 
Hit any key to stop autoboot:  0 
>>>>Auto upgrade start!
Interface:  MMC
  Device 0: Vendor: Man 000003 Snr 700a2401 Rev: 15.9 Prod: SC16G�
            Type: Removable Hard Disk
            Capacity: 15193.5 MB = 14.8 GB (31116288 x 512)
Filesystem: FAT16 "           "
the manufacturer c2
SF: Detected MX25L128**E

reading uImage.uvc
** Unable to read file uImage.uvc **
read uImage.uvc sz -1 hdr 64
reading FIRMWARE_DS202.bin
** Unable to read file FIRMWARE_DS202.bin **
read FIRMWARE_DS202.bin sz -1 hdr 64
reading FIRMWARE_DS202_F.Bin
** Unable to read file FIRMWARE_DS202_F.Bin **
read FIRMWARE_DS202_F.Bin sz -1 hdr 64
>>>>Auto upgrade Fail!
the manufacturer c2
SF: Detected MX25L128**E

--->probe spend 4 ms
SF: 2097152 bytes @ 0x40000 Read: OK
--->read spend 272 ms
## Booting kernel from Legacy Image at 80600000 ...

I even tried renaming demo.bin to FIRMWARE_DS202.bin, but that didn't work either:

reading uImage.uvc
** Unable to read file uImage.uvc **
read uImage.uvc sz -1 hdr 64
reading FIRMWARE_DS202.bin
read FIRMWARE_DS202.bin sz 64 hdr 64
------------- hdr -------------
(Image Header Magic Number) ih_magic 0x3040506
(Image Header CRC Checksum) ih_hcrc 0x55aa5502
(Image Creation Timestamp ) ih_time 0x59aa
(Image Data Size          ) ih_size 0x306c
(Data Load Address        ) ih_load 0x0
(Entry Point Address      ) ih_ep 0x0
(Image Data CRC Checksum  ) ih_dcrc 0x0
(Operating System         ) ih_os 0x0
(CPU architecture         ) ih_arch 0x0
(Image Type               ) ih_type 0x0
(Compression Type         ) ih_comp 0x0
(Image Name               ) ih_name 
-------------------------------
Image FIRMWARE_DS202.bin bad MAGIC or ARCH
reading FIRMWARE_DS202_F.Bin
** Unable to read file FIRMWARE_DS202_F.Bin **
read FIRMWARE_DS202_F.Bin sz -1 hdr 64
>>>>Auto upgrade Fail!

This looks different from the normal flashlog, does anyone understand it and why it fails?

Is it also possible to update sannce_i141cb_v2.bin via uboot? Im not sure about the right command...

Is it also possible to update sannce_i141cb_v2.bin via uboot? Im not sure about the right command...

Does anyone have an idea how I can flash with uboot/console access? Maybe @EliasKotlyar?

I have added some tutorial on this: https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/hacks/newdevices.md Basically:

fatls mmc 0:1
fatload mmc 0:1 0x80600000 bootloader.bin
sf probe
sf update 0x80600000 0x0 0x40000

How do I add a sannce clone to the Digma app?

Hi @EliasKotlyar, I have i141cb and I did reflashing uboot sannce_i141cb_v2.bin, put in ext3 sdcard rootfs as described in sannce.md. I can boot and reach camera site but I can't see any picture and can't move PT. I saw in original rootfs that it use different image sensor BG0806

I have also another T20 base camera from floureon with Wifi Realtek 8188fu, image sensor SC2145 and SPI flash W25Q64

Could you make a mod that include these image sensors, wifi and spi flash?

There is new version (cams sold in 2018) with closed ports and communication tied only to JoyLite application (can not be accessed by Digma - invalid device id,without possibility to manage ports, users, login data (basically they made botnet camera). Any idea 💡 how to aproach

I have one of these cameras I21AG with firmware version 10.7.1.17.7 The way in is to set up a smtp server, I picked google, and set the username to $(telnetd -p23 -l/bin/sh), set the motion alert action to send email, turn on motion alert, and trigger an alert - the camera happily launches a telnet :D

@xatr0z could you bring your i141cb with hacked firmware to run?

Hello @xcometz ,

Can you please provide a log of your camera when booting into rootfs? I suppose that it cannot find the right sensor....

I used kernel-t20.bin on uEnv.txt. on rcS I used mt7601Usta.ko , disable dafang sensor and added sensor_bg0806.ko that I extracted from original flash dump.

Here the log:

U-Boot SPL 2013.07-g35cedcb-dirty (Jan 01 2019 - 21:43:42)
pll_init:365
l2cache_clk = 375000000
pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 3
nf=36 nr = 1 od0 = 1 od1 = 1
cppcr is 02404900
CPM_CPAPCR 0470890d
nf=42 nr = 1 od0 = 1 od1 = 1
cppcr is 02a04900
CPM_CPMPCR 07d0c90d
nf=50 nr = 1 od0 = 1 od1 = 1
cppcr is 03204900
CPM_CPVPCR 0320490d
cppcr 0x9a794410
apll_freq 860160000
mpll_freq 1000000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 500000000
cclk  860160000
l2clk 286720000
h0clk 250000000
h2clk 250000000
pclk  125000000
DDRC_DLP:0000f003

U-Boot 2013.07-g35cedcb-dirty (Jan 01 2019 - 21:43:42)

Bootloader-Version: Dafanghacks v2
Board: Sannce I141CB 64MB (Ingenic XBurst T20 SoC)
DRAM:  64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 419k for U-Boot at: 83f94000
Reserving 32784k for malloc() at: 81f90000
Reserving 32 Bytes for Board Info at: 81f8ffe0
Reserving 124 Bytes for Global Data at: 81f8ff64
Reserving 128k for boot params() at: 81f6ff64
Stack Pointer at: 81f6ff48
Now running in RAM - U-Boot at: 83f94000
MMC:   msc: 0
the manufacturer ef
SF: Detected W25Q128

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting yellow_gpio to off:
gpio_request lable = cmd_gpio gpio = 38
gpio: pin 38 (gpio 38) value is 1
Setting blue_gpio to off:
gpio_request lable = cmd_gpio gpio = 39
gpio: pin 39 (gpio 39) value is 1
Setting night_gpios:
gpio_request lable = cmd_gpio gpio = 81
gpio: pin 81 (gpio 81) value is 0
gpio_request lable = cmd_gpio gpio = 49
gpio: pin 49 (gpio 49) value is 0
gpio_request lable = cmd_gpio gpio = 25
gpio: pin 25 (gpio 25) value is 0
Setting USB enable:
gpio_request lable = cmd_gpio gpio = 47
gpio: pin 47 (gpio 47) value is 1
Setting Speaker enable:
gpio_request lable = cmd_gpio gpio = 63
gpio: pin 63 (gpio 63) value is 1
Setting Enable SDCARD:
gpio_request lable = cmd_gpio gpio = 43
gpio: pin 43 (gpio 43) value is 1
gpio_request lable = cmd_gpio gpio = 48
gpio: pin 48 (gpio 48) value is 0
Running SDupdate....
sdupdate - auto upgrade file from mmc to flash

Usage:
sdupdate LOAD_ID ADDR_START ADDR_END
LOAD_ID: 0-->u-boot
         1-->kernel
         2-->rootfs
         3-->demo.bin
ex:
        sdupdate   (update all)
or
        sdupdate 0 0x0 0x40000
Hit any key to stop autoboot:  0
MMC Found
Trying to find FAT uEnv.txt
** Unrecognized filesystem type **
Trying to find EXT3 uEnv.txt
557 bytes read in 11 ms (48.8 KiB/s)
uEnv found - Booting from microsd ...
gpio_request lable = cmd_gpio gpio = 39
gpio: pin 39 (gpio 39) value is 0
1709592 bytes read in 116 ms (14.1 MiB/s)
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1709528 Bytes = 1.6 MiB
   Load Address: 80010000
   Entry Point:  803b3f00
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14 (eko@eko-GE62VR-6RF) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #77 PREEMPT Wed Jul 18 22:58:48 CEST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:AF7B8F46
[    0.000000] CPU0 revision is: 00d00101 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] CCLK:860MHz L2CLK:430Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 004cd000 @ 00010000 (usable)
[    0.000000]  memory: 00033000 @ 004dd000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00101],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=32M@0x0 ispmem=8M@0x2000000 rmem=24M@0x2800000 init=/linuxrc root=/dev/mmcblk0p1 rootwait rootfstype=ext3 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),1792k(rootfs),3584k(user),2048k(kernel2),1792k(rootfs2),3584k(user2),1024k(mtd),-(factory)
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Memory: 26616k/32768k available (3764k kernel code, 6152k reserved, 1150k data, 204k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:418
[    0.000000] clockevents_config_and_register success.
[    0.000024] Calibrating delay loop... 858.52 BogoMIPS (lpj=4292608)
[    0.087752] pid_max: default: 32768 minimum: 301
[    0.092739] Mount-cache hash table entries: 512
[    0.097858] Initializing cgroup subsys debug
[    0.102120] Initializing cgroup subsys freezer
[    0.109120] regulator-dummy: no parameters
[    0.113370] NET: Registered protocol family 16
[    0.132836] bio: create slab <bio-0> at 0
[    0.139250] jz-dma jz-dma: JZ SoC DMA initialized
[    0.144300] usbcore: registered new interface driver usbfs
[    0.149932] usbcore: registered new interface driver hub
[    0.155377] usbcore: registered new device driver usb
[    0.160598] i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)
[    0.166864]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.172978] media: Linux media interface: v0.10
[    0.177562] Linux video capture interface: v2.00
[    0.184270] Switching to clocksource jz_clocksource
[    0.189226] cfg80211: Calling CRDA to update world regulatory domain
[    0.196342] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.201226] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.206404] DWC IN OTG MODE
[    0.359619] sft id =========================off
[    0.364224] dwc2 dwc2: Keep PHY ON
[    0.367614] dwc2 dwc2: Using Buffer DMA mode
[    0.571761] dwc2 dwc2: Core Release: 3.00a
[    0.575884] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.582213] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.589591] hub 1-0:1.0: USB hub found
[    0.593331] hub 1-0:1.0: 1 port detected
[    0.597504] dwc2 dwc2: DWC2 Host Initialized
[    0.602016] NET: Registered protocol family 2
[    0.607012] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.613934] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.620420] TCP: Hash tables configured (established 512 bind 512)
[    0.626706] TCP: reno registered
[    0.629905] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.635863] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.642468] NET: Registered protocol family 1
[    0.647299] freq_udelay_jiffys[0].max_num = 10
[    0.651728] cpufreq  udelay  loops_per_jiffy
[    0.656189] 12000     59885   59885
[    0.659410] 24000     119771  119771
[    0.662853] 60000     299428  299428
[    0.666310] 120000    598857  598857
[    0.669828] 200000    998095  998095
[    0.673360] 300000    1497142         1497142
[    0.677090] dwc2 dwc2: ID PIN CHANGED!
[    0.680896] init DWC as A_HOST
[    0.683982] 600000    2994285         2994285
[    0.687682] 792000    3952457         3952457
[    0.691372] 1008000   5030400         5030400
[    0.695168] 1200000   5988571         5988571
[    0.705651] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[    0.711643] msgmni has been set to 51
[    0.716801] io scheduler noop registered
[    0.720739] io scheduler cfq registered (default)
[    0.727442] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.735633] console [ttyS1] enabled, bootconsole disabled
[    0.735633] console [ttyS1] enabled, bootconsole disabled
[    0.750959] brd: module loaded
[    0.756521] loop: module loaded
[    0.760404] zram: Created 2 device(s) ...
[    0.764630] wifi regulator missing
[    0.768380] logger: created 256K log 'log_main'
[    0.773687] jz SADC driver registeres over!
[    0.779127] jz TCU driver register completed
[    0.783981] the id code = ef4018, the flash name is WIN25Q128
[    0.790181] JZ SFC Controller for SFC channel 0 driver register
[    0.796383] 9 cmdlinepart partitions found on MTD device jz_sfc
[    0.802519] Creating 9 MTD partitions on "jz_sfc":
[    0.807507] 0x000000000000-0x000000040000 : "boot"
[    0.813072] 0x000000040000-0x000000240000 : "kernel"
[    0.818811] 0x000000240000-0x000000400000 : "rootfs"
[    0.824482] 0x000000400000-0x000000780000 : "user"
[    0.830116] 0x000000780000-0x000000980000 : "kernel2"
[    0.835965] 0x000000980000-0x000000b40000 : "rootfs2"
[    0.841765] 0x000000b40000-0x000000ec0000 : "user2"
[    0.847444] 0x000000ec0000-0x000000fc0000 : "mtd"
[    0.852857] 0x000000fc0000-0x000001000000 : "factory"
[    0.858733] SPI NOR MTD LOAD OK
[    0.862061] tun: Universal TUN/TAP device driver, 1.6
[    0.867386] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.873949] usbcore: registered new interface driver zd1201
[    0.880128] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    0.895719] jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
[    0.925731] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    0.931114] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[    0.975823] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[    0.981242] ------------ init codec driver start!
[    0.987288] jz_codec_probe: probe() start
[    0.991466] jz_codec_probe, codec iomem is :0xb0021000
[    0.996843] jz_codec_probe: probe() done
[    1.000983] i2s global init
[    1.003894] current codec is :819fdb80
[    1.008060] i2s init success.
[    1.135719] usb 1-1: new high-speed USB device number 2 using dwc2
[    1.406340] TCP: cubic registered
[    1.409788] NET: Registered protocol family 17
[    1.415402] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.422620] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    1.431214] Waiting for root device /dev/mmcblk0p1...
[    1.979684] mmc0: new high speed SDHC card at address aaaa
[    1.985750] mmcblk0: mmc0:aaaa SL32G 29.7 GiB
[    1.995767]  mmcblk0: p1 p2
[    2.099674] EXT4-fs (mmcblk0p1): mounting ext3 file system using the ext4 subsystem
[    2.125211] EXT4-fs (mmcblk0p1): mounted filesystem with ordered data mode. Opts: (null)
[    2.133737] VFS: Mounted root (ext3 filesystem) on device 179:1.
[    2.140352] Freeing unused kernel memory: 204K (804dd000 - 80510000)
mdev is ok......
[    2.704503] rtusb init rt2870 --->
[    2.713289]
[    2.713289]
[    2.713289] === pAd = c04af000, size = 1582008 ===
[    2.713289]
[    2.722983] allocate tx ringidx 0
[    2.726603] allocate tx ringidx 1
[    2.730161] allocate tx ringidx 2
[    2.733719] allocate tx ringidx 3
[    2.737331] allocate tx ringidx 4
[    2.740893] allocate tx ringidx 5
[    2.744452] allocate tx ringidx 6
[    2.748030] allocate tx ringidx 7
[    2.751591] allocate tx ringidx 8
[    2.755148] allocate tx ringidx 9
[    2.758742] allocate tx ringidx 10
[    2.762390] allocate tx ringidx 11
[    2.766072] allocate tx ringidx 12
[    2.769719] allocate tx ringidx 13
[    2.773366] allocate tx ringidx 0
[    2.776946] allocate tx ringidx 1
[    2.780502] allocate tx ringidx 2
[    2.784058] allocate tx ringidx 3
[    2.787638] allocate tx ringidx 4
[    2.791196] allocate tx ringidx 5
[    2.794753] allocate tx ringidx 6
[    2.798324] allocate tx ringidx 7
[    2.801880] allocate tx ringidx 8
[    2.805438] allocate tx ringidx 9
[    2.809008] allocate tx ringidx 10
[    2.812657] allocate tx ringidx 11
[    2.816316] allocate tx ringidx 12
[    2.819964] allocate tx ringidx 13
[    2.823612] allocate tx ringidx 0
[    2.827183] allocate tx ringidx 1
[    2.830740] allocate tx ringidx 2
[    2.834296] allocate tx ringidx 3
[    2.837868] allocate tx ringidx 4
[    2.841426] allocate tx ringidx 5
[    2.844982] allocate tx ringidx 6
[    2.848552] allocate tx ringidx 7
[    2.852108] allocate tx ringidx 8
[    2.855666] allocate tx ringidx 9
[    2.859236] allocate tx ringidx 10
[    2.862890] allocate tx ringidx 11
[    2.866554] allocate tx ringidx 12
[    2.870202] allocate tx ringidx 13
[    2.873849] allocate tx ringidx 0
[    2.877421] allocate tx ringidx 1
[    2.880980] allocate tx ringidx 2
[    2.884537] allocate tx ringidx 3
[    2.888108] allocate tx ringidx 4
[    2.891664] allocate tx ringidx 5
[    2.895221] allocate tx ringidx 6
[    2.898792] allocate tx ringidx 7
[    2.902348] allocate tx ringidx 8
[    2.905916] allocate tx ringidx 9
[    2.909476] allocate tx ringidx 10
[    2.913122] allocate tx ringidx 11
[    2.916780] allocate tx ringidx 12
[    2.920428] allocate tx ringidx 13
[    2.924589] <-- RTMPAllocTxRxRingMemory, Status=0
[    2.930401] <-- RTMPAllocAdapterBlock, Status=0
[    2.935114] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
[    2.940752] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
[    2.946363] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
[    2.951959] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
[    2.957564] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
[    2.963156] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
[    2.968764] STA Driver version-JEDI.MP1.mt7601u.v1.5
[    2.973906] Compile time-Jun  2 2017,18:29:20
[    2.978530] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    2.983796] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    2.988949] NVM is EFUSE
[    2.991574] Endpoint(8) is for In-band Command
[    2.996194] Endpoint(4) is for WMM0 AC0
[    3.000167] Endpoint(5) is for WMM0 AC1
[    3.004141] Endpoint(6) is for WMM0 AC2
[    3.008125] Endpoint(7) is for WMM0 AC3
[    3.012095] Endpoint(9) is for WMM1 AC0
[    3.016077] Endpoint(84) is for Data-In
[    3.020050] Endpoint(85) is for Command Rsp
[    3.024558] 80211> RFICType = 3
[    3.027838] NumOfChan ===> 58
[    3.030918] 80211> Number of channel = 0x44
[    3.035249] 80211> Number of rate = 12
[    3.039150] 80211> CurTxPower = 0 dBm
[    3.042947] 80211> TxStream = 0
[    3.046712] crda> requlation requestion by core: 00
[    3.051806] 80211> CFG80211_Register
[    3.060886] MSC msc_proc_create: c04af000
[    3.067687] usbcore: registered new interface driver rt2870
[    3.792938] ================> UP : RTMP_SEM_EVENT_WAIT(STA)
[    3.799353] 1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c
[    3.804490] 2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
[    3.809702] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    3.820017] FW Version:0.1.00 Build:7640
[    3.824085] Build Time:201301040941____
[    3.828136] ILM Length = 44276(bytes)
[    3.831926] DLM Length = 0(bytes)
[    3.836704] Loading FW....
[    3.883942] RTMP_TimerListAdd: add timer obj c05d7aac!
[    3.891374] RTMP_TimerListAdd: add timer obj c05d7adc!
[    3.896718] RTMP_TimerListAdd: add timer obj c05d7b0c!
[    3.902044] RTMP_TimerListAdd: add timer obj c05d7a7c!
[    3.907385] RTMP_TimerListAdd: add timer obj c05d79ec!
[    3.912709] RTMP_TimerListAdd: add timer obj c05d7a1c!
[    3.918049] RTMP_TimerListAdd: add timer obj c056c024!
[    3.923374] RTMP_TimerListAdd: add timer obj c0558918!
[    3.928715] RTMP_TimerListAdd: add timer obj c055894c!
[    3.934041] RTMP_TimerListAdd: add timer obj c056c0c4!
[    3.939379] RTMP_TimerListAdd: add timer obj c055b2c8!
[    3.944706] RTMP_TimerListAdd: add timer obj c055ab08!
[    3.950044] RTMP_TimerListAdd: add timer obj c055b294!
[    3.955385] RTMP_TimerListAdd: add timer obj c055b5e4!
[    3.960725] RTMP_TimerListAdd: add timer obj c055b2fc!
[    3.966063] RTMP_TimerListAdd: add timer obj c055b330!
[    3.971391] RTMP_TimerListAdd: add timer obj c055b364!
[    3.976729] RTMP_TimerListAdd: add timer obj c04b3754!
[    3.982053] RTMP_TimerListAdd: add timer obj c04b2f94!
[    3.987389] RTMP_TimerListAdd: add timer obj c04b3720!
[    3.992716] RTMP_TimerListAdd: add timer obj c04b3a70!
[    3.998052] RTMP_TimerListAdd: add timer obj c04b39a4!
[    4.003377] RTMP_TimerListAdd: add timer obj c04ea9cc!
[    4.008713] RTMP_TimerListAdd: add timer obj c04ea20c!
[    4.014039] RTMP_TimerListAdd: add timer obj c04ea998!
[    4.019376] RTMP_TimerListAdd: add timer obj c04eace8!
[    4.024700] RTMP_TimerListAdd: add timer obj c04eaa00!
[    4.030043] RTMP_TimerListAdd: add timer obj c04eaa34!
[    4.035369] RTMP_TimerListAdd: add timer obj c04eaa68!
[    4.040716] RTMP_TimerListAdd: add timer obj c056bfc4!
[    4.046058] RTMP_TimerListAdd: add timer obj c056c094!
[    4.051393] RTMP_TimerListAdd: add timer obj c062f068!
[    4.056734] RTMP_TimerListAdd: add timer obj c062f098!
[    4.062058] RTMP_TimerListAdd: add timer obj c062f0c8!
[    4.067394] RTMP_TimerListAdd: add timer obj c062f0f8!
[    4.072720] RTMP_TimerListAdd: add timer obj c062f128!
[    4.078057] RTMP_TimerListAdd: add timer obj c062f15c!
[    4.083385] RTMP_TimerListAdd: add timer obj c05d7a4c!
[    4.088729] RTMP_TimerListAdd: add timer obj c0557934!
[    4.094056] RTMP_TimerListAdd: add timer obj c0557904!
[    4.099394] RTMP_TimerListAdd: add timer obj c05578d4!
[    4.104722] RTMP_TimerListAdd: add timer obj c056bff4!
[    4.110852] P2pGroupTabInit .
[    4.114153] P2pScanChannelDefault <=== count = 3, Channels are 1, 6,11 separately
[    4.122239] P2pCfgInit::
[    4.125158] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    4.477936] cfg_mode=9
[    4.480388] cfg_mode=9
[    4.482837] wmode_band_equal(): Band Equal!
[    4.488741] Key1Str is Invalid key length(0) or Type(0)
[    4.494272] Key2Str is Invalid key length(0) or Type(0)
[    4.499820] Key3Str is Invalid key length(0) or Type(0)
[    4.505351] Key4Str is Invalid key length(0) or Type(0)
[    4.511684] ###### Force at HT20 (BW_20) mode !!! ########
[    4.524882] 1. Phy Mode = 14
[    4.527886] 2. Phy Mode = 14
[    4.530870] NVM is Efuse and its size =1d[1e0-1fc]
[    4.541992] ERROR!!! MT7601 E2PROM: WRONG VERSION 0xd, should be 9
[    4.563880] 3. Phy Mode = 14
[    4.566889] AntCfgInit: primary/secondary ant 0/1
[    4.749324] ---> InitFrequencyCalibration
[    4.753487] InitFrequencyCalibrationMode:Unknow mode = 3
[    4.759018] InitFrequencyCalibration: frequency offset in the EEPROM = 95(0x5f)
[    4.766606] <--- InitFrequencyCalibration
[    4.770778] RTMPSetPhyMode: channel is out of range, use first channel=1
[    4.781921] MCS Set = ff 00 00 00 01
[    4.795653] <==== STA : rt28xx_init, Status=0
[    4.803603] 80211> re-init bands...
[    4.809364] 80211> RFICType = 1
[    4.812625] NumOfChan ===> 14
[    4.815775] 80211> Number of channel = 0x44
[    4.820111] 80211> Number of rate = 12
[    4.823992] 80211> CurTxPower = 0 dBm
[    4.827836] 80211> TxStream = 1
[    4.832724] 0x1300 = 00064300
[    4.835871] RTMPDrvOpen(1):Check if PDMA is idle!
[    4.841219] RTMPDrvOpen(2):Check if PDMA is idle!
[    4.846491] <================ UP : RTMP_SEM_EVENT_UP(STA)
[    5.447939] 80211> CFG80211_OpsPmksaFlush ==>
udhcpc: started, v1.29.0.git
udhcpc: sending discover
[    5.832806] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[    5.975738] MT7601_ChipSwitchChannel: SwitchChannel#2(RF=15, 1T)
[    6.125724] MT7601_ChipSwitchChannel: SwitchChannel#3(RF=15, 1T)
[    6.275729] MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
[    6.425717] MT7601_ChipSwitchChannel: SwitchChannel#5(RF=15, 1T)
[    6.575766] MT7601_ChipSwitchChannel: SwitchChannel#6(RF=15, 1T)
[    6.725726] MT7601_ChipSwitchChannel: SwitchChannel#7(RF=15, 1T)
[    6.875728] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
[    7.025733] MT7601_ChipSwitchChannel: SwitchChannel#9(RF=15, 1T)
[    7.175804] MT7601_ChipSwitchChannel: SwitchChannel#10(RF=15, 1T)
[    7.325719] MT7601_ChipSwitchChannel: SwitchChannel#11(RF=15, 1T)
[    7.475726] MT7601_ChipSwitchChannel: SwitchChannel#12(RF=15, 1T)
[    7.625717] MT7601_ChipSwitchChannel: SwitchChannel#13(RF=15, 1T)
[    7.775729] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[    7.786759] 80211> cfg80211_scan_done
[    7.795596] #####check WPS IE
[    7.798825] ConnInfo.bWpsConnection ===> Not WPS IE
[    7.803882] 80211> Connect bssid e4:95:6e:44:83:21
[    7.809702] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
[    7.919973] PeerBeaconAtJoinAction(): Set CentralChannel=8
[    7.937611] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending select for 192.168.13.196
udhcpc: lease of 192.168.13.196 obtained, lease time 43200
route: SIOCDELRT: No such process
[   11.980615] motor speed = 1000
[   11.983799] gpio:jz->reg = 0xb0010200
[   11.990081] gpio pin: 0x4
[   11.992803] jz->dev_map[0]: 0x420fd
[   11.996623] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.003839] Stack : 00000006 8003b9a0 00000000 00000001 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d42c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000400 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.041138] Call Trace:
[   12.043686] [<80020f84>] show_stack+0x48/0x70
[   12.048233] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.052755] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.057829] [<8020078c>] gpiod_request+0x120/0x220
[   12.062810] [<c063cdc8>] motor_probe+0x348/0x780 [sample_motor]
[   12.068973] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.074393] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.079378] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.084437] [<8022aef8>] driver_attach+0x20/0x2c
[   12.089281] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.094266] [<8022b9b8>] driver_register+0xbc/0x178
[   12.099359] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.105177] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.110287] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.115261] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.120387] [<80023bdc>] stack_done+0x20/0x44
[   12.124905]
[   12.126478] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinitiongpio:jz->reg = 0xb0010200
[   12.136599] gpio pin: 0x8
[   12.139311] jz->dev_map[0]: 0x420fd
[   12.142931] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.150178] Stack : 00000006 8003b9a0 00000000 80520000 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d43c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000001 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.187177] Call Trace:
[   12.189717] [<80020f84>] show_stack+0x48/0x70
[   12.194241] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.198812] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.203887] [<8020078c>] gpiod_request+0x120/0x220
[   12.208893] [<c063cdec>] motor_probe+0x36c/0x780 [sample_motor]
[   12.215077] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.220517] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.225586] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.230678] [<8022aef8>] driver_attach+0x20/0x2c
[   12.235466] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.240449] [<8022b9b8>] driver_register+0xbc/0x178
[   12.245509] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.251302] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.256394] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.261364] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.266352] [<80023bdc>] stack_done+0x20/0x44
[   12.270865]
[   12.272409] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinitiongpio:jz->reg = 0xb0010200
[   12.282525] gpio pin: 0x10
[   12.285327] jz->dev_map[0]: 0x420fd
[   12.288961] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.296187] Stack : 00000006 8003b9a0 00000000 804c0000 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d40c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000001 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.333368] Call Trace:
[   12.335925] [<80020f84>] show_stack+0x48/0x70
[   12.340450] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.344969] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.350041] [<8020078c>] gpiod_request+0x120/0x220
[   12.355020] [<c063cd80>] motor_probe+0x300/0x780 [sample_motor]
[   12.361206] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.366643] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.371615] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.376687] [<8022aef8>] driver_attach+0x20/0x2c
[   12.381478] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.386459] [<8022b9b8>] driver_register+0xbc/0x178
[   12.391521] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.397312] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.402373] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.407390] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.412375] [<80023bdc>] stack_done+0x20/0x44
[   12.416914]
[   12.418500] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinitiongpio:jz->reg = 0xb0010200
[   12.428768] gpio pin: 0x20
[   12.431580] jz->dev_map[0]: 0x420fd
[   12.435251] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.442496] Stack : 00000006 8003b9a0 00000000 00000001 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d41c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000001 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.479519] Call Trace:
[   12.482060] [<80020f84>] show_stack+0x48/0x70
[   12.486601] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.491121] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.496199] [<8020078c>] gpiod_request+0x120/0x220
[   12.501180] [<c063cda4>] motor_probe+0x324/0x780 [sample_motor]
[   12.507340] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.512758] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.517745] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.522802] [<8022aef8>] driver_attach+0x20/0x2c
[   12.527644] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.532752] [<8022b9b8>] driver_register+0xbc/0x178
[   12.537851] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.543633] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.548710] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.553679] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.558663] [<80023bdc>] stack_done+0x20/0x44
[   12.563178]
[   12.564722] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinitiongpio:jz->reg = 0xb0010200
[   12.574838] gpio pin: 0x40
[   12.577670] jz->dev_map[0]: 0x420fd
[   12.581290] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.588518] Stack : 00000006 8003b9a0 00000000 80520000 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d42c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000001 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.625506] Call Trace:
[   12.628088] [<80020f84>] show_stack+0x48/0x70
[   12.632738] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.637292] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.642353] [<8020078c>] gpiod_request+0x120/0x220
[   12.647404] [<c063cdc8>] motor_probe+0x348/0x780 [sample_motor]
[   12.653554] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.658997] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.663969] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.669042] [<8022aef8>] driver_attach+0x20/0x2c
[   12.673834] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.678837] [<8022b9b8>] driver_register+0xbc/0x178
[   12.683899] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.689694] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.694756] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.699739] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.704712] [<80023bdc>] stack_done+0x20/0x44
[   12.709238]
[   12.710779] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinitiongpio:jz->reg = 0xb0010200
[   12.720899] gpio pin: 0x80
[   12.723699] jz->dev_map[0]: 0x420fd
[   12.727368] CPU: 0 PID: 130 Comm: insmod Tainted: G           O 3.10.14 #77
[   12.734717] Stack : 00000006 8003b9a0 00000000 00000001 00000000 00000000 00000000 00000000
          00000000 00000000 80522eaa 0000003f 81de81d8 c063d43c 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 8063fb00 8063fbc4 80459f70
          804b61a7 8003ce04 00000001 80459f70 00000000 00000082 81de81d8 8063fb38
          ...
[   12.771744] Call Trace:
[   12.774285] [<80020f84>] show_stack+0x48/0x70
[   12.778844] [<803b7d5c>] dump_stack+0x20/0x2c
[   12.783368] [<80018e1c>] jz_gpio_request+0xac/0x128
[   12.788445] [<8020078c>] gpiod_request+0x120/0x220
[   12.793423] [<c063cdec>] motor_probe+0x36c/0x780 [sample_motor]
[   12.799585] [<8022b3e4>] driver_probe_device+0xbc/0x1fc
[   12.805004] [<8022b5a0>] __driver_attach+0x7c/0xb4
[   12.809989] [<802295f4>] bus_for_each_dev+0x60/0xb8
[   12.815048] [<8022aef8>] driver_attach+0x20/0x2c
[   12.819850] [<8022aa24>] bus_add_driver+0xf8/0x25c
[   12.824820] [<8022b9b8>] driver_register+0xbc/0x178
[   12.829970] [<8022c9b0>] platform_driver_register+0x58/0x64
[   12.835922] [<8001051c>] do_one_initcall+0xf0/0x1b4
[   12.840986] [<80083b9c>] load_module+0x1a8c/0x1da4
[   12.845985] [<80083f94>] SyS_init_module+0xe0/0xfc
[   12.850960] [<80023bdc>] stack_done+0x20/0x44
[   12.855472]
[   12.857030] arch/mips/xburst/soc-t20/common/gpio.c:gpio functions has redefinition[   12.920970] register all isp device successfully!
[   12.928865] @@@@ tx-isp-probe ok @@@@@
Generating a 1024 bit RSA private key
....................................................................++++++
.................++++++
writing new private key to '/etc/lighttpd.pem'
-----
[   15.131858] do_page_fault() #2: sending SIGSEGV to motor for invalid read access from
[   15.131858] 000003e8 (epc == 000003e8, ra == 000003e8)
Starting Auto Night Detection
Starting v4l2rtspserver-master
do_page_fault() #2: sending SIGSEGV to motor for invalid read access from
000003e8 (epc == 000003e8, ra == 000003e8)

DafangHacks login: [   16.130137] set sensor gpio as PA-low-10bit
[   16.287411] i2c i2c-0: i2c_jz_irq 441, I2C transfer error, ABORT interrupt
[   16.294551] i2c i2c-0: --I2C txabrt:
[   16.298301] i2c i2c-0: --I2C TXABRT[0]=I2C_TXABRT_ABRT_7B_ADDR_NOACK
[   16.304915] jxf23 0-0040: chip found @ 0x40 (i2c0) is not an jxf23 chip.

DafangHacks login:

Is it also possible to enable MII in kernel since this i141cb has phy IP101GR from IC+?

@EliasKotlyar For comparison here the log original firmware with your custom bootloader:

U-Boot SPL 2013.07-g35cedcb-dirty (Jan 01 2019 - 21:43:42)
pll_init:365
l2cache_clk = 375000000
pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 3
nf=36 nr = 1 od0 = 1 od1 = 1
cppcr is 02404900
CPM_CPAPCR 0470890d
nf=42 nr = 1 od0 = 1 od1 = 1
cppcr is 02a04900
CPM_CPMPCR 07d0c90d
nf=50 nr = 1 od0 = 1 od1 = 1
cppcr is 03204900
CPM_CPVPCR 0320490d
cppcr 0x9a794410
apll_freq 860160000
mpll_freq 1000000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 500000000
cclk  860160000
l2clk 286720000
h0clk 250000000
h2clk 250000000
pclk  125000000
DDRC_DLP:0000f003

U-Boot 2013.07-g35cedcb-dirty (Jan 01 2019 - 21:43:42)

Bootloader-Version: Dafanghacks v2
Board: Sannce I141CB 64MB (Ingenic XBurst T20 SoC)
DRAM:  64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 419k for U-Boot at: 83f94000
Reserving 32784k for malloc() at: 81f90000
Reserving 32 Bytes for Board Info at: 81f8ffe0
Reserving 124 Bytes for Global Data at: 81f8ff64
Reserving 128k for boot params() at: 81f6ff64
Stack Pointer at: 81f6ff48
Now running in RAM - U-Boot at: 83f94000
MMC:   msc: 0
the manufacturer ef
SF: Detected W25Q128

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting yellow_gpio to off:
gpio_request lable = cmd_gpio gpio = 38
gpio: pin 38 (gpio 38) value is 1
Setting blue_gpio to off:
gpio_request lable = cmd_gpio gpio = 39
gpio: pin 39 (gpio 39) value is 1
Setting night_gpios:
gpio_request lable = cmd_gpio gpio = 81
gpio: pin 81 (gpio 81) value is 0
gpio_request lable = cmd_gpio gpio = 49
gpio: pin 49 (gpio 49) value is 0
gpio_request lable = cmd_gpio gpio = 25
gpio: pin 25 (gpio 25) value is 0
Setting USB enable:
gpio_request lable = cmd_gpio gpio = 47
gpio: pin 47 (gpio 47) value is 1
Setting Speaker enable:
gpio_request lable = cmd_gpio gpio = 63
gpio: pin 63 (gpio 63) value is 1
Setting Enable SDCARD:
gpio_request lable = cmd_gpio gpio = 43
gpio: pin 43 (gpio 43) value is 1
gpio_request lable = cmd_gpio gpio = 48
gpio: pin 48 (gpio 48) value is 0
Running SDupdate....
Card did not respond to voltage select!
sdupdate - auto upgrade file from mmc to flash

Usage:
sdupdate LOAD_ID ADDR_START ADDR_END
LOAD_ID: 0-->u-boot
         1-->kernel
         2-->rootfs
         3-->demo.bin
ex:
        sdupdate   (update all)
or
        sdupdate 0 0x0 0x40000
Hit any key to stop autoboot:  0
Card did not respond to voltage select!
MMC not found....
Booting from NAND....
gpio_request lable = cmd_gpio gpio = 38
gpio: pin 38 (gpio 38) value is 0
the manufacturer ef
SF: Detected W25Q128

--->probe spend 4 ms
SF: 2621440 bytes @ 0x40000 Read: OK
--->read spend 381 ms
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1711652 Bytes = 1.6 MiB
   Load Address: 80010000
   Entry Point:  803b6000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14 (yds@serverforbuild) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #5 PREEMPT Fri Sep 7 15:03:35 CST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:AF7BCF62
[    0.000000] CPU0 revision is: 00d00101 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] CCLK:860MHz L2CLK:430Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 004d4000 @ 00010000 (usable)
[    0.000000]  memory: 0003c000 @ 004e4000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00101],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=32M@0x0 ispmem=8M@0x2000000 rmem=24M@0x2800000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),1792k(rootfs),3584k(user),2048k(kernel2),1792k(rootfs2),3584k(user2),1024k(mtd),-(factory)
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Memory: 26524k/32768k available (3770k kernel code, 6244k reserved, 1172k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:418
[    0.000000] clockevents_config_and_register success.
[    0.000024] Calibrating delay loop... 858.52 BogoMIPS (lpj=4292608)
[    0.087752] pid_max: default: 32768 minimum: 301
[    0.092739] Mount-cache hash table entries: 512
[    0.097850] Initializing cgroup subsys debug
[    0.102113] Initializing cgroup subsys freezer
[    0.109131] regulator-dummy: no parameters
[    0.113380] NET: Registered protocol family 16
[    0.134105] bio: create slab <bio-0> at 0
[    0.140533] jz-dma jz-dma: JZ SoC DMA initialized
[    0.145676] usbcore: registered new interface driver usbfs
[    0.151208] usbcore: registered new interface driver hub
[    0.156704] usbcore: registered new device driver usb
[    0.161943] i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)
[    0.168204]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.174304] media: Linux media interface: v0.10
[    0.178880] Linux video capture interface: v2.00
[    0.185648] Switching to clocksource jz_clocksource
[    0.191204] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.196192] cfg80211: Calling CRDA to update world regulatory domain
[    0.202642] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.207697] DWC IN OTG MODE
[    0.360987] sft id =========================off
[    0.365596] dwc2 dwc2: Keep PHY ON
[    0.368966] dwc2 dwc2: Using Buffer DMA mode
[    0.573155] dwc2 dwc2: Core Release: 3.00a
[    0.577267] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.583622] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.591026] hub 1-0:1.0: USB hub found
[    0.594766] hub 1-0:1.0: 1 port detected
[    0.598871] dwc2 dwc2: DWC2 Host Initialized
[    0.603418] NET: Registered protocol family 2
[    0.608362] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.615336] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.621736] TCP: Hash tables configured (established 512 bind 512)
[    0.628040] TCP: reno registered
[    0.631282] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.637180] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.643840] NET: Registered protocol family 1
[    0.648524] RPC: Registered named UNIX socket transport module.
[    0.654529] RPC: Registered udp transport module.
[    0.659225] RPC: Registered tcp transport module.
[    0.664008] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.670990] freq_udelay_jiffys[0].max_num = 10
[    0.675418] cpufreq  udelay  loops_per_jiffy
[    0.679847] dwc2 dwc2: ID PIN CHANGED!
[    0.683701] init DWC as A_HOST
[    0.686748] 12000     59885   59885
[    0.689988] 24000     119771  119771
[    0.693552] 60000     299428  299428
[    0.696920] 120000    598857  598857
[    0.700451] 200000    998095  998095
[    0.704091] 300000    1497142         1497142
[    0.707723] 600000    2994285         2994285
[    0.711456] 792000    3952457         3952457
[    0.715139] 1008000   5030400         5030400
[    0.718935] 1200000   5988571         5988571
[    0.728307] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.734444] exFAT: Version 1.2.9
[    0.738537] jffs2: version 2.2. \A9 2001-2006 Red Hat, Inc.
[    0.744529] msgmni has been set to 51
[    0.749595] io scheduler noop registered
[    0.753645] io scheduler cfq registered (default)
[    0.760104] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.768395] console [ttyS1] enabled, bootconsole disabled
[    0.768395] console [ttyS1] enabled, bootconsole disabled
[    0.783791] brd: module loaded
[    0.789063] loop: module loaded
[    0.793307] zram: Created 2 device(s) ...
[    0.797554] logger: created 256K log 'log_main'
[    0.802996] jz SADC driver registeres over!
[    0.808325] jz TCU driver register completed
[    0.813272] the id code = ef4018, the flash name is WIN25Q128
[    0.819235] JZ SFC Controller for SFC channel 0 driver register
[    0.825456] 9 cmdlinepart partitions found on MTD device jz_sfc
[    0.831649] Creating 9 MTD partitions on "jz_sfc":
[    0.836620] 0x000000000000-0x000000040000 : "boot"
[    0.842194] 0x000000040000-0x000000240000 : "kernel"
[    0.847851] 0x000000240000-0x000000400000 : "rootfs"
[    0.853617] 0x000000400000-0x000000780000 : "user"
[    0.859132] 0x000000780000-0x000000980000 : "kernel2"
[    0.864982] 0x000000980000-0x000000b40000 : "rootfs2"
[    0.870879] 0x000000b40000-0x000000ec0000 : "user2"
[    0.876503] 0x000000ec0000-0x000000fc0000 : "mtd"
[    0.881990] 0x000000fc0000-0x000001000000 : "factory"
[    0.887805] SPI NOR MTD LOAD OK
[    0.891189] tun: Universal TUN/TAP device driver, 1.6
[    0.896433] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.902993] wait stable.[246][cgu_macphy]
[    0.907150] Bus Mode Reg after reset: 0x00020101, cnt=0
[    0.916311] libphy: jz_mii_bus: probed
[    0.920290] =======>gmacdev = 0x81a0a100<================
[    0.925960] =========>gmacdev->MacBase = 0xb34b0000 DmaBase = 0xb34b1000
[    0.932951] Bus Mode Reg after reset: 0x00020101, cnt=0
[    0.939981] jz_mac jz_mac.0: JZ on-chip Ethernet MAC driver, Version 1.0
[    0.947178] usbcore: registered new interface driver zd1201
[    0.953430] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    0.991606] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    0.997283] TCP: cubic registered
[    1.000772] NET: Registered protocol family 17
[    1.006363] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.013590] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    1.023071] SQUASHFS error: Xattrs in filesystem, these will be ignored
[    1.029931] SQUASHFS error: unable to read xattr id index table
[    1.038011] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.045883] Freeing unused kernel memory: 240K (804e4000 - 80520000)
[    1.140632] usb 1-1: new high-speed USB device number 2 using dwc2
mdev is ok......
[    1.682252] SQUASHFS error: Xattrs in filesystem, these will be ignored
[    1.689114] SQUASHFS error: unable to read xattr id index table
## No Need to do Update ##
[    1.938508] register all isp device successfully!
[    1.946951] @@@@ tx-isp-probe ok @@@@@
[    2.013146] jz_codec_register: probe() successful!
[    2.371003] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a1e63000)
[    2.380289] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a1e61000)
[    2.400961] motor speed = 200
[    2.410719] zram0: detected capacity change from 0 to 8388608
Setting up swapspace version 1, size = 8384512 bytes
UUID=6819a9a7-47f9-492a-a0b2-d[    2.425462] Adding 8188k swap on /dev/zram0.  Priority:-1 extents:1 across:8188k SS
347680f1b9e
[    3.201143] rtusb init rt2870 --->
[    3.207700]
[    3.207700]
[    3.207700] === pAd = c05e3000, size = 1581168 ===
[    3.207700]
[    3.221744] <-- RTMPAllocTxRxRingMemory, Status=0
[    3.227540] <-- RTMPAllocAdapterBlock, Status=0
[    3.232757] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
[    3.238358] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
[    3.244404] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
[    3.250003] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
[    3.255961] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
[    3.261810] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
[    3.267411] STA Driver version-JEDI.MP1.mt7601u.v1.5
[    3.272976] Compile time-Sep  6 2018,17:46:17
[    3.277621] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    3.283394] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    3.288522] NVM is EFUSE
[    3.291566] Endpoint(8) is for In-band Command
[    3.296176] Endpoint(4) is for WMM0 AC0
[    3.300148] Endpoint(5) is for WMM0 AC1
[    3.304562] Endpoint(6) is for WMM0 AC2
[    3.308541] Endpoint(7) is for WMM0 AC3
[    3.312858] Endpoint(9) is for WMM1 AC0
[    3.316835] Endpoint(84) is for Data-In
[    3.321138] Endpoint(85) is for Command Rsp
[    3.325642] 80211> RFICType = 3
[    3.328898] NumOfChan ===> 58
[    3.332470] 80211> Number of channel = 0x44
[    3.336809] 80211> Number of rate = 12
[    3.341066] 80211> CurTxPower = 0 dBm
[    3.344869] 80211> TxStream = 0
[    3.348568] crda> requlation requestion by core: 00
[    3.356478] 80211> CFG80211_Register
[    3.366802] usbcore: registered new interface driver rt2870
[    4.881669] ================> UP : RTMP_SEM_EVENT_WAIT(STA)
[    4.887900] 1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c
[    4.893523] 2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
[    4.898707] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    4.909372] FW Version:0.1.00 Build:7640
[    4.913525] Build Time:201301040941____
[    4.917546] ILM Length = 44276(bytes)
[    4.921793] DLM Length = 0(bytes)
[    4.926405] Loading FW....
[    4.968776] RTMP_TimerListAdd: add timer obj c070b764!
[    4.976515] RTMP_TimerListAdd: add timer obj c070b794!
[    4.982107] RTMP_TimerListAdd: add timer obj c070b7c4!
[    4.987440] RTMP_TimerListAdd: add timer obj c070b734!
[    4.993119] RTMP_TimerListAdd: add timer obj c070b6a4!
[    4.998451] RTMP_TimerListAdd: add timer obj c070b6d4!
[    5.004204] RTMP_TimerListAdd: add timer obj c069fcdc!
[    5.009535] RTMP_TimerListAdd: add timer obj c068c5d0!
[    5.015257] RTMP_TimerListAdd: add timer obj c068c604!
[    5.020911] RTMP_TimerListAdd: add timer obj c069fd7c!
[    5.026246] RTMP_TimerListAdd: add timer obj c068ef80!
[    5.031956] RTMP_TimerListAdd: add timer obj c068e7c0!
[    5.037287] RTMP_TimerListAdd: add timer obj c068ef4c!
[    5.042979] RTMP_TimerListAdd: add timer obj c068f29c!
[    5.048311] RTMP_TimerListAdd: add timer obj c068efb4!
[    5.053991] RTMP_TimerListAdd: add timer obj c068efe8!
[    5.059323] RTMP_TimerListAdd: add timer obj c068f01c!
[    5.065012] RTMP_TimerListAdd: add timer obj c05e740c!
[    5.070345] RTMP_TimerListAdd: add timer obj c05e6c4c!
[    5.076041] RTMP_TimerListAdd: add timer obj c05e73d8!
[    5.081637] RTMP_TimerListAdd: add timer obj c05e7728!
[    5.086969] RTMP_TimerListAdd: add timer obj c05e765c!
[    5.092647] RTMP_TimerListAdd: add timer obj c061e684!
[    5.097979] RTMP_TimerListAdd: add timer obj c061dec4!
[    5.103653] RTMP_TimerListAdd: add timer obj c061e650!
[    5.108987] RTMP_TimerListAdd: add timer obj c061e9a0!
[    5.114666] RTMP_TimerListAdd: add timer obj c061e6b8!
[    5.119997] RTMP_TimerListAdd: add timer obj c061e6ec!
[    5.125671] RTMP_TimerListAdd: add timer obj c061e720!
[    5.131264] RTMP_TimerListAdd: add timer obj c069fc7c!
[    5.136596] RTMP_TimerListAdd: add timer obj c069fd4c!
[    5.142291] RTMP_TimerListAdd: add timer obj c0762d20!
[    5.147622] RTMP_TimerListAdd: add timer obj c0762d50!
[    5.153317] RTMP_TimerListAdd: add timer obj c0762d80!
[    5.158651] RTMP_TimerListAdd: add timer obj c0762db0!
[    5.164334] RTMP_TimerListAdd: add timer obj c0762de0!
[    5.169667] RTMP_TimerListAdd: add timer obj c0762e14!
[    5.175350] RTMP_TimerListAdd: add timer obj c070b704!
[    5.180947] RTMP_TimerListAdd: add timer obj c068b5ec!
[    5.186282] RTMP_TimerListAdd: add timer obj c068b5bc!
[    5.191965] RTMP_TimerListAdd: add timer obj c068b58c!
[    5.197300] RTMP_TimerListAdd: add timer obj c069fcac!
[    5.203718] P2pGroupTabInit .
[    5.207024] P2pScanChannelDefault <=== count = 3, Channels are 1, 6,11 separately
[    5.215557] P2pCfgInit::
[    5.218455] ==>WaitForAsicReady MAC_CSR0=0x76010500
[    5.565317] cfg_mode=9
[    5.567772] cfg_mode=9
[    5.570220] wmode_band_equal(): Band Equal!
[    5.576828] Key1Str is Invalid key length(0) or Type(0)
[    5.582688] Key2Str is Invalid key length(0) or Type(0)
[    5.588238] Key3Str is Invalid key length(0) or Type(0)
[    5.594158] Key4Str is Invalid key length(0) or Type(0)
[    5.600870] ###### Force at HT20 (BW_20) mode !!! ########
[    5.615234] 1. Phy Mode = 14
[    5.618224] 2. Phy Mode = 14
[    5.621648] NVM is Efuse and its size =1d[1e0-1fc]
[    5.633236] ERROR!!! MT7601 E2PROM: WRONG VERSION 0xd, should be 9
[    5.652995] 3. Phy Mode = 14
[    5.655992] AntCfgInit: primary/secondary ant 0/1
[    5.840551] ---> InitFrequencyCalibration
[    5.844716] InitFrequencyCalibrationMode:Unknow mode = 3
[    5.850223] InitFrequencyCalibration: frequency offset in the EEPROM = 95(0x5f)
[    5.858274] <--- InitFrequencyCalibration
[    5.862818] RTMPSetPhyMode: channel is out of range, use first channel=1
[    5.873239] MCS Set = ff 00 00 00 01
[    5.887246] <==== STA : rt28xx_init, Status=0
[    5.895682] 80211> re-init bands...
[    5.899306] 80211> RFICType = 1
[    5.905252] NumOfChan ===> 14
[    5.908335] 80211> Number of channel = 0x44
[    5.913132] 80211> Number of rate = 12
[    5.917022] 80211> CurTxPower = 0 dBm
[    5.921288] 80211> TxStream = 1
[    5.925187] 0x1300 = 00064300
[    5.928262] RTMPDrvOpen(1):Check if PDMA is idle!
[    5.934147] RTMPDrvOpen(2):Check if PDMA is idle!
[    5.939320] <================ UP : RTMP_SEM_EVENT_UP(STA)
Hello World!
[    5.969071] Bus Mode Reg after reset: 0x00020101, cnt=0

Ingenic login: ysx_log_path[/var/log/monitor.log]
killall: wpa_supplicant: no process killed
killall: udhcpc: no process killed
killall: iwlist: no process killed
killall: ping: no process killed
ysx_log_path[/var/log/tstreamer.log]
[    8.430937] jffs2: Node totlen on flash (0xffffffff) != totlen from node ref (0x00000044)
play pcm file /usr/notify/tanks.pcm ..
/bin/sh: can't create /proc/jz/aw8733a/mode: nonexistent directory
[    8.810572] codec_set_device: set device: speaker...
[QCAM] 01-01 01:00:08.816 ysx_get_gain:45 Set spk_gain= value(24)

speaker gain = 24[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:669 AO Agc config : TargetLevelDbfs=6 ,CompressionGaindB=10
[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:705 malloc audio buf size:1280
[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:712 Audio Out GetPubAttr samplerate:16000
[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:713 Audio Out GetPubAttr   bitwidth:16
[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:714 Audio Out GetPubAttr  soundmode:1
[QCAM] 01-01 01:00:08.999 QCamAudioOutputOpen:715 Audio Out GetPubAttr     frmNum:10
[QCAM] 01-01 01:00:09.000 QCamAudioOutputOpen:716 Audio Out GetPubAttr  numPerFrm:640
[QCAM] 01-01 01:00:09.000 QCamAudioOutputOpen:717 Audio Out GetPubAttr     chnCnt:1
before transfer:vol=65
set output volume = 54
play done !
[   11.218441] codec_codec_ctl: set CODEC_TURN_OFF...
[QCAM] 01-01 01:00:11.240 QCamAudioOutputClose:796 AUDIO Output close!

/bin/sh: can't create /proc/jz/aw8733a/mode: nonexistent directory
1234 network_first_init

1234
route: fscanf
[   11.510578] codec_set_device: set device: speaker...
[QCAM] 01-01 01:00:11.516 ysx_get_gain:45 Set spk_gain= value(24)

[   11.550626] ================> DOWN : RTMP_SEM_EVENT_WAIT(STA)
speaker gain = 24[QCAM] 01-01 01:00:11.559 QCamAudioOutputOpen:669 AO Agc config : TargetLevelDbfs=6 ,CompressionGaindB=10
[QCAM] 01-01 01:00:11.559 QCamAudioOutputOpen:705 malloc audio buf size:1280
[QCAM] 01-01 01:00:11.563 QCamAudioOutputOpen:712 Audio Out GetPubAttr samplerate:16000
[QCAM] 01-01 01:00:11.563 QCamAudioOutputOpen:713 Audio Out GetPubAttr   bitwidth:16
[QCAM] 01-01 01:00:11.563 QCamAudioOutputOpen:714 Audio Out GetPubAttr  soundmode:1
[QCAM] 01-01 01:00:11.563 QCamAudioOutputOpen:715 Audio Out GetPubAttr     frmNum:10
[QCAM] 01-01 01:00:11.563 QCamAudioOutputOpen:716 Audio Out GetPubAttr  numPerFrm:640
[QCAM[   11.612168] unlink cmd rsp urb
] 01-01 01:00:11.564 QCamAudioOutputOpen:717 Audio Out GetPubAttr     chnCnt:1
before transfer:vol=15
set output volume = 18
[   11.702521] <=============== DOWN : RTMP_SEM_EVENT_UP(STA)
[   11.817939] ================> UP : RTMP_SEM_EVENT_WAIT(STA)
[   11.824353] 1. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
[   11.829529] 2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
[   11.835129] ==>WaitForAsicReady MAC_CSR0=0x76010500
[   11.844619] RTMP_TimerListAdd: add timer obj c070b764!
[   11.849962] RTMP_TimerListAdd: add timer obj c070b794!
[   11.857847] RTMP_TimerListAdd: add timer obj c070b7c4!
[   11.863497] RTMP_TimerListAdd: add timer obj c070b734!
[   11.868886] RTMP_TimerListAdd: add timer obj c070b6a4!
[   11.874654] RTMP_TimerListAdd: add timer obj c070b6d4!
[   11.879989] RTMP_TimerListAdd: add timer obj c069fcdc!
[   11.885707] RTMP_TimerListAdd: add timer obj c068c5d0!
[   11.891360] RTMP_TimerListAdd: add timer obj c068c604!
[   11.896693] RTMP_TimerListAdd: add timer obj c069fd7c!
[   11.902403] RTMP_TimerListAdd: add timer obj c068ef80!
[   11.907737] RTMP_TimerListAdd: add timer obj c068e7c0!
[   11.913467] RTMP_TimerListAdd: add timer obj c068ef4c!
[   11.918802] RTMP_TimerListAdd: add timer obj c068f29c!
[   11.924506] RTMP_TimerListAdd: add timer obj c068efb4!
[   11.929913] RTMP_TimerListAdd: add timer obj c068efe8!
[   11.935799] RTMP_TimerListAdd: add timer obj c068f01c!
[   11.941433] RTMP_TimerListAdd: add timer obj c05e740c!
[   11.946764] RTMP_TimerListAdd: add timer obj c05e6c4c!
[   11.952447] RTMP_TimerListAdd: add timer obj c05e73d8!
[   11.957835] RTMP_TimerListAdd: add timer obj c05e7728!
[   11.963399] codec_set_device: set device: MIC...
[QCAM] 01-01 01:00:11.967 QCamAudioInputOpen_ysx:125 Audio In Ge[   11.971080] RTMP_TimerListAdd: add timer obj c05e765c!
tChnParam usrFrmDepth : 40

set volume = 60
[QCAM] 01-01 01:00:11.968 ysx_get_gain:45 Set mic_gain= value(12)

mic gain = 1[   11.985181] RTMP_TimerListAdd: add timer obj c061e684!
2
[QCAM] 01-01 01:00:11.968 QCamAudioInputOpen_ysx:191 Audio In  samplerate : 16000
[QCAM] 01-01 01:00:11.969 QCamAudioInputOpen_ysx:192 Audio In    bitwidth : 16
[QCAM] 01-01 01:00:11.969 QCamAudioInputOpen_ysx:193 Audio[   12.010639] RTMP_TimerListAdd: add timer obj c061dec4!
 In   soundmode : 1
[QCAM] 01-01 01:00:11.969 QCamAudioInputOpen_ysx:194 Audio In      frmNum :[   12.025672] RTMP_TimerListAdd: add timer obj c061e650!
 40
[QCAM] 01-01 01:00:11.969 QCamAudioInputOpen_ysx:195 Audio [   12.034831] RTMP_TimerListAdd: add timer obj c061e9a0!
In   numPerFrm : 640
[QCAM] 01-01 01:00:11.969 QCamAudioInputOp[   12.046491] RTMP_TimerListAdd: add timer obj c061e6b8!
en_ysx:196 Audio In      chnCnt : 1
[   12.057421] RTMP_TimerListAdd: add timer obj c061e6ec!
[   12.066079] RTMP_TimerListAdd: add timer obj c061e720!
[   12.072618] RTMP_TimerListAdd: add timer obj c069fc7c!
[   12.078749] RTMP_TimerListAdd: add timer obj c069fd4c!
[   12.085565] RTMP_TimerListAdd: add timer obj c0762d20!
[   12.092115] RTMP_TimerListAdd: add timer obj c0762d50!
[   12.098243] RTMP_TimerListAdd: add timer obj c0762d80!
[   12.104875] RTMP_TimerListAdd: add timer obj c0762db0!
[   12.112297] RTMP_TimerListAdd: add timer obj c0762de0!
[   12.118432] RTMP_TimerListAdd: add timer obj c0762e14!
[   12.125078] RTMP_TimerListAdd: add timer obj c070b704!
[   12.131672] RTMP_TimerListAdd: add timer obj c068b5ec!
[   12.137946] RTMP_TimerListAdd: add timer obj c068b5bc!
[   12.144573] RTMP_TimerListAdd: add timer obj c068b58c!
[   12.151145] RTMP_TimerListAdd: add timer obj c069fcac!
[   12.162023] P2pGroupTabInit .
[   12.171029] P2pScanChannelDefault <=== count = 3, Channels are 1, 6,11 separately
[   12.179063] P2pCfgInit::
[   12.185154] ==>WaitForAsicReady MAC_CSR0=0x76010500
aacEncOpen ok
################input frameLength = 1024
[QCAM] 01-01 01:00:12.356 QCamAudioInputStart:375 Audio Start Record.

[   12.591144] cfg_mode=9
[   12.593596] cfg_mode=9
[   12.604986] wmode_band_equal(): Band Equal!
[   12.623704] Key1Str is Invalid key length(0) or Type(0)
[   12.629255] Key2Str is Invalid key length(0) or Type(0)
[   12.642082] Key3Str is Invalid key length(0) or Type(0)
[   12.649094] Key4Str is Invalid key length(0) or Type(0)
[   12.664249] ###### Force at HT20 (BW_20) mode !!! ########
[   12.710894] 1. Phy Mode = 14
[   12.713889] 2. Phy Mode = 14
[   12.721436] NVM is Efuse and its size =1d[1e0-1fc]
[   12.736972] ERROR!!! MT7601 E2PROM: WRONG VERSION 0xd, should be 9
[   12.781294] 3. Phy Mode = 14
[   12.784291] AntCfgInit: primary/secondary ant 0/1
Curren IMP Version is IMP-3.11.0 --- YSX Version is v-0.0.4[QCAM] 01-01 01:00:12.847 system_sensor_init:106 Input Device Init start
[   12.965473] set sensor gpio as PA-12bit
[   12.997399] ---> InitFrequencyCalibration
[   13.002084] InitFrequencyCalibrationMode:Unknow mode = 3
[   13.007662] InitFrequencyCalibration: frequency offset in the EEPROM = 95(0x5f)
[   13.015751] <--- InitFrequencyCalibration
[   13.023522] bg0806 0-0032: bg0806 chip found @ 0x32 (i2c0)
[   13.029210] tx_isp: Registered sensor subdevice bg0806 0-0032
[   13.035925] RTMPSetPhyMode: channel is out of range, use first channel=1
[   13.047676] MCS Set = ff 00 00 00 01
[   13.067132] <==== STA : rt28xx_init, Status=0
[   13.072383] 80211> re-init bands...
[   13.076221] 80211> RFICType = 1
[   13.079509] NumOfChan ===> 14
[   13.083701] 80211> Number of channel = 0x44
[   13.088294] 80211> Number of rate = 12
[   13.092659] 80211> CurTxPower = 0 dBm
[   13.096710] 80211> TxStream = 1
[   13.102553] 0x1300 = 00064300
[   13.112669] RTMPDrvOpen(1):Check if PDMA is idle!
[   13.118717] RTMPDrvOpen(2):Check if PDMA is idle!
[   13.126421] <================ UP : RTMP_SEM_EVENT_UP(STA)
Successfully initialized wpa_supplicant
[   13.953922] ###### image_tuning_v4l2_open 4219 #######
[QCAM] 01-01 01:00:14.200 QCamVideoInput_SetInversion:1207 QCamVideoInput_SetInversion Done

Sensor Init ok!
[QCAM] 01-01 01:00:14.203 system_sensor_init:161 ISP: num=20, den=1
[QCAM] 01-01 01:00:14.204 system_sensor_init:171 IMP_ISP_Tuning_SetAeStrategy done
[QCAM] 01-01 01:00:14.204 system_sensor_init:175 IMP_ISP_Tuning_GetAeStrategy=1 done

[   14.246516] &&& chan1  scaler.max_width = 1920 max_height = 1080  min_width = 128 min_height = 128 &&&
FrameSource Create Success.[chn0] scaler->outwidth = 0 scaler->outheight = 0, sscaler.outwidth =[   14.269952] &&& chan2  scaler.max_width = 800 max_height = 800  min_width = 128 min_height = 128 &&&
 0 sscaler.outheight = 0
Enable chn0 , [chn1] scaler->outwidth = 640 scaler->outheight = 360, sscaler.outwidth = 640 sscaler.outheight = 360
Enable chn1 , Create Encoder Group 0
[QCAM] 01-01 01:00:14.304 channel_attr_set:741 frmnum = 15,maxQp=51,minQp=20,maxBitrate=896,maxGop=30

rfkill: Cannot open RFKILL control device
nl80211: Could not re-add multicast membership for vendor events: -2 (No such file or directory)
i264e[info]: profile High, level 4.0
[QCAM] 01-01 01:00:14.854 ysx_jpeg_init:1017 ysx_jpeg_init OK
[QCAM] 01-01 01:00:14.854 QCamVideoInput_AddChannel:708 Add Channel.1 Done!

Create Encoder Group 1
[QCAM] 01-01 01:00:14.855 channel_attr_set:741 frmnum = 15,maxQp=51,minQp=20,maxBitrate=256,maxGop=30

i264e[info]: profile High, level 2.2
[QCAM] 01-01 01:00:14.884 QCamVideoInput_AddChannel:708 Add Channel.2 Done!

[QCAM] 01-01 01:00:14.931 QCamVideoInput_Start:919 start Channel :
start:find it 2start:find it 1[QCAM] 01-01 01:00:14.932 QCamVideoInput_Start:932 Start recv stream [2]
[QCAM] 01-01 01:00:14.932 QCamVideoInput_Start:932 Start recv stream [1]
[QCAM] 01-01 01:00:14.932 QCamVideoInput_Start:937 Enable FrameSource chn0 ,chn1 .start ok.
start polling stream chn 1
start polling stream chn 2
[   15.439012] 80211> CFG80211_OpsPmksaFlush ==>
[QCAM] 01-01 01:00:15.732 QCamSetIRMode:2064 set ir mode = 0
Day mode...set isp running mode 0
 ircut turn off!
[QCAM] 01-01 01:00:15.740 Thread_IR_Auto:1748 lg_top threshold value(0)

[QCAM] 01-01 01:00:15.740 Thread_IR_Auto:1754 Ev value:ev1(460381),ev2(223511)

[   16.780443] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[   16.952137] MT7601_ChipSwitchChannel: SwitchChannel#2(RF=15, 1T)
[   17.110654] MT7601_ChipSwitchChannel: SwitchChannel#3(RF=15, 1T)
[QCAM] 01-01 01:00:17.134 ysx_ircut_set:2037 Set Sensor Fps = 20 , mode = 2

p0(1464,0), p1(1919,47)
[QCAM] 01-01 01:00:17.226 QCamVideoInput_SetOSD:452 grp = 0,handle=0

p0(488,0), p1(639,15)
[QCAM] 01-01 01:00:17.226 QCamVideoInput_SetOSD:452 grp = 1,handle=1

[QCAM] 01-01 01:00:17.232 ysx_update_thread:337 font width = 8, height = 16

[QCAM] 01-01 01:00:17.232 ysx_update_thread:337 font width = 24, height = 48

[   17.260729] MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
[   17.420657] MT7601_ChipSwitchChannel: SwitchChannel#5(RF=15, 1T)
[QCAM] 01-01 01:00:17.467 QCamVideoInput_SetInversion:1207 QCamVideoInput_SetInversion Done

[QCAM] 01-01 01:00:17.468 QCamSetIRMode:2064 set ir mode = 0
roirect(0) = ((0,0)-(159,119))-sense(4)
roirect(1) = ((160,0)-(319,119))-sense(4)
roirect(2) = ((320,0)-(479,119))-sense(4)
roirect(3) = ((480,0)-(639,119))-sense(4)
roirect(4) = ((0,120)-(159,239))-sense(4)
roirect(5) = ((160,120)-(319,239))-sense(4)
roirect(6) = ((320,120)-(479,239))-sense(4)
roirect(7) = ((480,120)-(639,239))-sense(4)
roirect(8) = ((0,240)-(159,359))-sense(4)
roirect(9) = ((160,240)-(319,359))-sense(4)
roirect(10) = ((320,240)-(479,359))-sense(4)
roirect(11) = ((480,240)-(639,359))-sense(4)
roirect(12) = ((0,360)-(159,479))-sense(4)
roirect(13) = ((160,360)-(319,479))-sense(4)
roirect(14) = ((320,360)-(479,479))-sense(4)
roirect(15) = ((480,360)-(639,479))-sense(4)
roirect(16) = ((0,0)-(0,0))-sense(0)
roirect(17) = ((0,0)-(0,0))-sense(0)
roirect(18) = ((0,0)-(0,0))-sense(0)
roirect(19) = ((0,0)-(0,0))-sense(0)
roirect(20) = ((0,0)-(0,0))-sense(0)
roirect(21) = ((0,0)-(0,0))-sense(0)
roirect(22) = ((0,0)-(0,0))-sense(0)
roirect(23) = ((0,0)-(0,0))-sense(0)
roirect(24) = ((0,0)-(0,0))-sense(0)
roir[   17.570679] MT7601_ChipSwitchChannel: SwitchChannel#6(RF=15, 1T)
ect(25) = ((0,0)-(0,0))-sense(0)
roirect(26) = ((0,0)-(0,0))-sense(0)
roirect(27) = ((0,0)-(0,0))-sense(0)
roirect(28) = ((0,0)-(0,0))-sense(0)
roirect(29) = ((0,0)-(0,0))-sense(0)
roirect(30) = ((0,0)-(0,0))-sense(0)
roirect(31) = ((0,0)-(0,0))-sense(0)
roirect(32) = ((0,0)-(0,0))-sense(0)
roirect(33) = ((0,0)-(0,0))-sense(0)
roirect(34) = ((0,0)-(0,0))-sense(0)
roirect(35) = ((0,0)-(0,0))-sense(0)
roirect(36) = ((0,0)-(0,0))-sense(0)
roirect(37) = ((0,0)-(0,0))-sense(0)
roirect(38) = ((0,0)-(0,0))-sense(0)
roirect(39) = ((0,0)-(0,0))-sense(0)
roirect(40) = ((0,0)-(0,0))-sense(0)
roirect(41) = ((0,0)-(0,0))-sense(0)
roirect(42) = ((0,0)-(0,0))-sense(0)
roirect(43) = ((0,0)-(0,0))-sense(0)
roirect(44) = ((0,0)-(0,0))-sense(0)
roirect(45) = ((0,0)-(0,0))-sense(0)
roirect(46) = ((0,0)-(0,0))-sense(0)
roirect(47) = ((0,0)-(0,0))-sense(0)
roirect(48) = ((0,0)-(0,0))-sense(0)
roirect(49) = ((0,0)-(0,0))-sense(0)
roirect(50) = ((0,0)-(0,0))-sense(0)
roirect(51) = ((0,0)-(0,0))-sense(0)
[   17.750698] MT7601_ChipSwitchChannel: SwitchChannel#7(RF=15, 1T)
Nigth mode...set isp running mode 1
 ircut turn on!
[   17.930920] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
[   18.100772] MT7601_ChipSwitchChannel: SwitchChannel#9(RF=15, 1T)
[   18.290728] MT7601_ChipSwitchChannel: SwitchChannel#10(RF=15, 1T)
Error resolving 0.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:18 ntpdate[247]: Can't find host 0.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:18 ntpdate[247]: no servers can be used, exiting
[QCAM] 01-01 01:00:18.326 ysx_ircut_set:2037 Set Sensor Fps = 10 , mode = 1

[   18.510686] MT7601_ChipSwitchChannel: SwitchChannel#11(RF=15, 1T)
[   18.690735] MT7601_ChipSwitchChannel: SwitchChannel#12(RF=15, 1T)
Error resolving 1.pool.ntp.org: Name or service not known (-2)
udhcpc (v1.22.1) started
 1 Jan 01:00:18 ntpdate[259]: Can't find host 1.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:18 ntpdate[259]: no servers can be used, exiting
[   18.880778] MT7601_ChipSwitchChannel: SwitchChannel#13(RF=15, 1T)
[   19.061759] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[   19.111391] 80211> cfg80211_scan_done
Error resolving 0.debian.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:19 ntpdate[268]: Can't find host 0.debian.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:19 ntpdate[268]: no servers can be used, exiting
Error resolving asia.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:19 ntpdate[274]: Can't find host asia.pool.ntp.org: Name or service not known (-2)
 1 Jan 01:00:19 ntpdate[274]: no servers can be used, exiting
Sending discover...
Sending discover...
[   26.320220] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[   26.470600] MT7601_ChipSwitchChannel: SwitchChannel#2(RF=15, 1T)
[   26.630591] MT7601_ChipSwitchChannel: SwitchChannel#3(RF=15, 1T)
[   26.780653] MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
[   26.940663] MT7601_ChipSwitchChannel: SwitchChannel#5(RF=15, 1T)
[   27.090827] MT7601_ChipSwitchChannel: SwitchChannel#6(RF=15, 1T)
Sending discover...
[   27.240602] MT7601_ChipSwitchChannel: SwitchChannel#7(RF=15, 1T)
[   27.391476] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
[   27.540647] MT7601_ChipSwitchChannel: SwitchChannel#9(RF=15, 1T)
[   27.690700] MT7601_ChipSwitchChannel: SwitchChannel#10(RF=15, 1T)
[   27.840608] MT7601_ChipSwitchChannel: SwitchChannel#11(RF=15, 1T)
[   27.990757] MT7601_ChipSwitchChannel: SwitchChannel#12(RF=15, 1T)
[   28.141605] MT7601_ChipSwitchChannel: SwitchChannel#13(RF=15, 1T)
[   28.292049] MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
[   28.309803] 80211> cfg80211_scan_done
[   28.317349] #####check WPS IE
[   28.321288] ConnInfo.bWpsConnection ===> Not WPS IE
[   28.326427] 80211> Connect bssid e4:95:6e:44:83:21
[   28.332660] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
[   28.375806] PeerBeaconAtJoinAction(): Set CentralChannel=8
[   28.401454] MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)

@xatr0z could you bring your i141cb with hacked firmware to run?

Hi @xcometz , no after flashing uBoot i didnt make any more progress. However, after recreating your steps I'm a bit further now. Everything works except video. Thanks :)

A few questions.

First, is this the uEnv you are using? baudrate=115200 bootargs=console=ttyS1,115200n8 mem=32M@0x0 ispmem=8M@0x2000000 rmem=24M@0x2800000 init=/linuxrc root=/dev/mmcblk0p1 rootwait rootfstype=ext3 rw mtdparts=jz_sfc:256k(boot),2048k(kernel),1792k(rootfs),3584k(user),2048k(kernel2),1792k(rootfs2),3584k(user2),1024k(mtd),-(factory) bootcmd=ext4load mmc 0:1 0x80600000 kernel-t20.bin;bootm 0x80600000
You say you disabled the dafang sensor. Is this commenting out the jxf22 and jxf23 modules in /etc/init.d/rcS. Correct?

I also had to comment out the lines in /etc/init.d/rcS regarding params, because there doesnt seem to be a params partition:

#mount -t jffs2 /dev/mtdblock9 /params
#MAC=$(grep MAC < /params/config/.product_config | cut -c16-27 | sed 's/\(..\)/\1:/g;s/:$//')

I don't have been able to extract sensor_bg0806.ko so far. Do you have it for me?
After adding video with the bg0806 module, is everything working ? (except ethernet)

EliasKotlyar / Xiaomi-Dafang-Hacks

Sannce I21AG Support #625

busybox

cat /proc/mtd