Open BmdOnline opened 6 months ago
BmdOnline
commented
5 months ago It works.
rootfs contains full rcS script and all removed files once running
/lib/modules/cywdhd.ko
/lib/modules/3.10.14-Archon/cywdhd.ko
/lib/firmware/fw_bcm43438a1.bin
/stone/mainNow we can access main process if needed.
BmdOnline
commented
5 months ago I've tried to kill main process : camera restarts.
I've tried to copy main file into stone folder : camera restarts.
Maybe some files on sdcard may be created for enabling some features. Or adding some parameters in config files... but I don't know what to look for.
Some stuff for investigating :
$ strings main | grep -F sdcard | sort | uniq
/mnt/sdcard/%s.%s.txt
/tmp/mnt/sdcard/
/tmp/mnt/sdcard/DCIM
/tmp/mnt/sdcard/DCIM/%04d/%02d/%02d
/tmp/mnt/sdcard/DCIM/%04d/%02d/%02d/
/tmp/mnt/sdcard/biz.dat
/tmp/mnt/sdcard/factory/
/tmp/mnt/sdcard/factory/factory.ini
/tmp/mnt/sdcard/factory/insmod_usb/insmod_usb.sh
/tmp/mnt/sdcard/factory/network_config.ini
/tmp/mnt/sdcard/factory_update
/tmp/mnt/sdcard/sn_play
/tmp/mnt/sdcard/tuya.dat
/tmp/mnt/sdcard/update.bin
insmod /tmp/mnt/sdcard/factory/asix.ko
insmod /tmp/mnt/sdcard/factory/dwc2.ko
insmod /tmp/mnt/sdcard/factory/usb-common.ko
insmod /tmp/mnt/sdcard/factory/usbcore.ko
insmod /tmp/mnt/sdcard/factory/usbnet.ko
rm /tmp/mnt/sdcard/tuya.dat
sdcard is full ,mkidr test fail
sdcard not exist!
sdcard_info$ strings main | grep -F \.cfg | sort | uniq
/config/common//imp.cfg
/config/common/battery_last.cfg
/config/common/key.cfg
/config/common/net.cfg
/config/common/reconnect_info.cfg
/config/common/sys.cfg
/config/common/wifi.cfg
/config/dat/dev.cfg
/config/dat/factory.cfg
/config/dat/sn.cfg
open dev.cfg failed!
open factory.cfg error!
open key.cfg error!
open sn.cfg error!
open update.cfg error!
read file factory.cfg failed.
update.cfg$ strings main | grep -F \.ini | sort | uniq
.init
/tmp/mnt/sdcard/factory/factory.ini
/tmp/mnt/sdcard/factory/network_config.ini
read factory.ini file failed.$ strings main | grep -F \.dat | sort | uniq
!NULL==mask.data
.cpr.dat.hex
.data
.data.rel.ro
/conf/dat/biz.dat
/conf/dat/tuya.dat
/config/dat/biz.dat
/config/dat/ctcc.dat
/config/dat/dot.dat
/config/dat/tuya.dat
/store/biz.dat
/store/tuya.dat
/tmp/mnt/sdcard/biz.dat
/tmp/mnt/sdcard/tuya.dat
NULL==mask.data
b.data[i] != 0
biz.dat
calloc pcontainer->pelem[%d].data failed
cpr.dat
ctcc.dat
dot.dat
rm /tmp/mnt/sdcard/tuya.dat
tutk.dat
tuya.dat$ strings main | grep -F https: | sort | uniq
# https://curl.haxx.se/docs/http-cookies.html
https://
https://%s%s/%s%s%s&v=1.0&bucket=%s&typath=%s
https://%s.%s%s?Expires=%d&OSSAccessKeyId=%s&Signature=%s&v=1.0&bucket=%s&security-token=%s
https://%s.%s%s?X-Amz-Security-Token=%s&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=%s&X-Amz-Date=%s&X-Amz-Expires=60&X-Amz-SignedHeaders=host&bucket=%s&v=1.0&X-Amz-Signature=%s
https://a2-ueaz.tuyaus.com/d.json
https://a2-weaz.tuyaeu.com/d.json
https://a2.tuyacn.com/d.json
https://a2.tuyaeu.com/d.json
https://a2.tuyaus.com/d.json$ strings main | grep -F .com | sort | uniq
*.tuya.com0
*.tuya.com0
*.tuya.com1
*.tuyaaf.com1
*.tuyaas.com1
*.tuyacn.com1
*.tuyaeu.com1
*.tuyain.com1
*.tuyajp.com1
*.tuyarf.com1
*.tuyasa.com1
*.tuyaus.com1
*.wgine.com1
.comment
ftp@example.com
https://a2-ueaz.tuyaus.com/d.json
https://a2-weaz.tuyaeu.com/d.json
https://a2.tuyacn.com/d.json
https://a2.tuyaeu.com/d.json
https://a2.tuyaus.com/d.json
iot_world@tuya.com1
m2.tuyacn.com
m2.tuyaeu.com
m2.tuyaus.com
mes.wisdomep.com
mq.gw.tuyacn.com
time.pool.aliyun.com
time.twc.weather.com
time.windows.com$ strings main | grep -F .cn | sort | uniq
*.tuya-inc.cn1
cn.ntp.org.cn
de.ntp.org.cn
edu.ntp.org.cn
jp.ntp.org.cn
kr.ntp.org.cn
sgp.ntp.org.cn
tw.ntp.org.cn
us.ntp.org.cn$ strings main | grep -F rtsp | sort | uniq
===============rtsp url:%s
rtsp
rtsp://%s:%d/h264/1/main/av_stream
rtspUrl
guino
commented
5 months ago @BmdOnline when you killed the main process, did you try running it immediately after (from SD card) ? If we kill the main process on other cameras (ppsapp) the camera also restarts because of the watchdog, but (in most cases) if we start the main process again it keeps working -- which allows us to run a modified/patched version of the main application.
We even made a 'watchdog feeder' for the other camera types which allowed us to keep the device running while the main application was not running. I doubt the same code would work for this device, but I'm sure it would be possible to do something similar. I also have seen some separate tools (on specific devices) to disable the watchdog altogether, sometimes it's just a parameter in an executable with unrelated name (so only way to know is execute whatever tools may be available hoping to see some parameter information).
BmdOnline
commented
5 months ago @guino, I've just tried this script
set -x
kill -9 `pidof main`
kill -9 `pidof alps`
cp /tmp/mnt/sdcard/mtdblock3.rootfs/stone/main /stone/main
/usr/bin/alps &
/stone/main &
sleep 0.3
rm -f /stone/main &
Camera keeps alive longer, but restarts after approximately 15 seconds.
I've tried to play with alps and main scripts together, same behavior.
guino
commented
5 months ago @BmdOnline I don't know if you've tried this yet but I assume you have tried it:
If you've tried the above and it none of it helped then we would have to modify the flash to run the main application from the SD card (when available) instead of running it from the flash memory -- otherwise there's no point in even trying to modify the main application.
mihovilkolaric
commented
5 months ago Hi,
keeping the camera alive is rather easy ... looking at `ls -l /proc/91/fd/ (91 is the pid of the main-process) showed that it accesses /dev/watchdog.
So I just tried
watch -n 1 "echo 1 > /dev/watchdog"
in one telnet-session, and in another I could kill main (connection to LSC-App failed of course), while the telnet-session kept alive for minutes:
root@Zeratul:~]# kill 91
[root@Zeratul:~]# date
Sat Jun 15 23:32:10 CST 2024
[root@Zeratul:~]# date
Sat Jun 15 23:36:02 CST 2024
[root@Zeratul:~]#Yes, it works.
I imagine we can create a new camera software, or a patched version of main process, enabling rtsp, avoid use of tuya servers...
BTW, feeding watchdog seems to prevent camera to enter sleep mode.
gtxaspec
commented
5 months ago You can try running thingino firmware on it. The streamer and associated sources are fully open, as well as the build system being buildroot based.
mihovilkolaric
commented
5 months ago Hi all,
I also did some tests in restarting the main-application.
Interesting finding: Copy main from sdcard before killing running instance leads to immediate reboot.
Thus I used following approach:
While feeding the watchdog by a shell-script rom another terminal, I used:
[root@Zeratul:sdcard]# kill 91 ; cp stone/main /stone/ ; /stone/main > main_log.txt
(I haven't touched alps so far)
Which lead to a reboot after ~15 sec, as @BmdOnline described. However, it produced following log: main_log.txt
Some findings in the log:
Main complains about another missing file:
[0;32;31m[-][ERROR][muart_get_key][202] open key.cfg error!
(Looks like it is expected in /config/common/:
$ strings stone/main | grep key.cfg
/config/common/key.cfg
open key.cfg error!but not present on my cam.)
and the last line that makes it to the logfile is:
[06-19 22:26:25-- TUYA Err][mqtt_client.c:1283] __mq_recv err op_ret:-1 recv_len:0
(no idea yet which o the two conditions trigger the reboot - but as I was still feeding it externally, it is rather an explicit reboot, than a watchdog-restart.
mihovilkolaric
commented
5 months ago You can try running thingino firmware on it. The streamer and associated sources are fully open, as well as the build system being buildroot based.
Do you know which existing model/build is similar to this hardware, and do you think that booting the "stock" linux, killing main, and running thingino's streamer (while feeding the watchdog externally) might work (as a "proof of concept")?
BmdOnline
commented
5 months ago Binaries from wz_mini_hacks are working.
For example, I can start ffmpeg from wz_mini_hacks.
@gtxaspec, maybe we can use go2rtc_linux_mipsel ?
How can we configure it without entire SD_ROOT package ?
Things to do :
wireskark but it's beyond my skills.
Maybe broadcast packet ? mac request ?main process with another streamer
How to compile a standalone thingino's streamer ?
How to use go2rtc ?gtxaspec
commented
5 months ago 1.if you keep feeding the watchdog and it reboots after 5 minutes, there could be an external mcu that has it's own watchdog. can you please share photos of the entire pcb board, back and front?
you can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/
BmdOnline
commented
5 months ago
gtxaspec
commented
5 months ago judging by the two sets of UART tx/rx pads, there is an external MCU. you should inspect the board chip by chip, and see which one is an MCU
mihovilkolaric
commented
5 months ago Regarding "wake up without tuya app": From my wireshark-traces, I understand following:
So, maybe it is possible using an own DNS-Server to redirect m2.tuyaeu.com to the IP of a custom "faked" MQTT-Server, which is then used to trigger the wake-up-messages. But this is (yet) highly theoretical.
BmdOnline
commented
5 months ago judging by the two sets of UART tx/rx pads, there is an external MCU. you should inspect the board chip by chip, and see which one is an MCU
Camera side : NS4152M : NS4152X Series 3.0W Mono Class D Audio Power Amplifier
Front side : XMC chip Ingenic T31 4057AN : Lithium-Ion Battery Management Chip PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.
We also have another board inside the camera (last picture below). I assume it was for motion and IR sensors.
BmdOnline
commented
5 months ago This connection is used for waking up the camera: When selecting it in the LSC-App, the camera receives a "Publish Message" for the topic "w" (and some unknown string as value). This triggers that the MQTT-Connection is closed, and the linux boots.
From what you say, the network connection and IP address are still active even when the camera is hibernating ? I thought there would only be an sort of a wake on lan.
When camera is active :
# nmap -p- 192.168.0.155
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-20 23:44 CEST
Nmap scan report for 192.168.0.155
Host is up (0.036s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
23/tcp open telnet
6668/tcp open irc
MAC Address: A8:41:xx:xx:xx:xx (AzureWave Technology)When camera is inactive :
# nmap -p- 192.168.0.155
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-20 23:47 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.51 secondsyou can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/
Tried :
main, replace with watchdog feeder.alps# ./prudynt-T31-static
[INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef
[INFO:main.cpp]: Starting Prudynt Video Server.
[INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6
[INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6
[INFO:IMP.cpp]: CPU Information: T31-ZC
[INFO:IMP.cpp]: Sensor:
[ERROR:IMP.cpp]: System Init Failed
[ERROR:main.cpp]: IMP initialization failed.PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.
Seem to be PUYA PY32 F030... (maybe F030F16) https://www.puyasemi.com/en/py32_series.html#common https://py32.org/en/mcu/PY32F030xx.html
gtxaspec
commented
5 months ago you can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/
Tried :
- Kill
main, replace with watchdog feeder.- Kill / don't kill
alps# ./prudynt-T31-static [INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef [INFO:main.cpp]: Starting Prudynt Video Server. [INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6 [INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6 [INFO:IMP.cpp]: CPU Information: T31-ZC [INFO:IMP.cpp]: Sensor: [ERROR:IMP.cpp]: System Init Failed [ERROR:main.cpp]: IMP initialization failed.
for prudynt, you need to make sure another streamer is not running, and second, you need to configure /etc/prudynt.cfg with the sensor info, name, i2c address, etc. then try and run
gtxaspec
commented
5 months ago PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.
Seem to be PUYA PY32 F030... (maybe F030F16) https://www.puyasemi.com/en/py32_series.html#common https://py32.org/en/mcu/PY32F030xx.html
yeah that looks like its it. have you tried to read the UART logs of the MCU? that would help.
BmdOnline
commented
5 months ago Sensor is jxf37p
# cat /proc/jz/isp/isp-m0
****************** ISP INFO **********************
Software Version : H20220209a
SENSOR NAME : jxf37p
SENSOR OUTPUT WIDTH : 1920
SENSOR OUTPUT HEIGHT : 1080
ISP OUTPUT FPS : 15 / 1
SENSOR OUTPUT RAW PATTERN : BGGR
ISP Top Value : 0xb4742009
ISP Runing Mode : Day
ISP Custom Mode : Disable
ISP WDR Mode : Disable
SENSOR Integration Time : 34 lines
SENSOR Max Integration Time : 2246 lines
SENSOR analog gain : 0
MAX SENSOR analog gain : 158
SENSOR digital gain : 0
MAX SENSOR digital gain : 0
ISP digital gain : 0
MAX ISP digital gain : 64
ISP Tgain DB : 0
ISP EV value: 34
ISP EV value log2: 333411
ISP EV value us: 1007
ISP EV min int: 2
ISP EV min again: 1024
ISP WB weighted rgain: 350
ISP WB weighted bgain: 451
ISP WB color temperature: 4191
ISP AWB Start rgain 262: bgain 290
Saturation : 128
Saturation : 128
Sharpness : 128
Contrast : 128
Brightness : 124
Antiflicker : 0
Mirror: Enable, Flip: Enable
debug : ch0 done 4137,ip done 4157,0,0,0,0,0,0
debug1 : 0,0,900i2c address is 0x40
# ./busybox i2cdetect 0
i2cdetect: WARNING! This program can confuse your I2C bus
Continue? [y/N] y
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: UU -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --cat prudynt.cfg
general: {
loglevel: "DEBUG"; # Logging level. Options: DEBUG, INFO, WARNING, ERROR.
};sensor: { model: "jxf37p"; # Sensor model. i2c_address: 0x40; # I2C address of the sensor. fps: 24; # Frames per second captured by the sensor. width: 1920; # Width of the sensor's image (in pixels). height: 1080; # Height of the sensor's image (in pixels). };
* `prudynt-T31-static` output[DEBUG:IMP.cpp]: IMP System Initialized [DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled [DEBUG:IMP.cpp]: ISP Tuning Defaults set [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24 [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnRotate == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set [DEBUG:Encoder.cpp]: Encoder Group created [ERROR:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled [DEBUG:Encoder.cpp]: Encoder Channel 0 created [DEBUG:Encoder.cpp]: Encoder Channel 0 registered [DEBUG:Encoder.cpp]: OSD enabled [DEBUG:OSD.cpp]: OSD init begin [DEBUG:OSD.cpp]: FREETYPE init failed. [ERROR:Encoder.cpp]: OSD Init Failed [ERROR:main.cpp]: Encoder initialization failed.
* OSD disabled in cfg[DEBUG:IMP.cpp]: IMP System Initialized [DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled [DEBUG:IMP.cpp]: ISP Tuning Defaults set [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24 [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnRotate == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set [DEBUG:Encoder.cpp]: Encoder Group created [ERROR:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled [DEBUG:Encoder.cpp]: Encoder Channel 0 created [DEBUG:Encoder.cpp]: Encoder Channel 0 registered [DEBUG:Encoder.cpp]: OSD disabled [DEBUG:Encoder.cpp]: IMP_System_Bind(FS, ENC) [ERROR:Encoder.cpp]: IMP_FrameSource_EnableChn() == -1 [ERROR:main.cpp]: Encoder initialization failed.
run logcat and share the output please
BmdOnline
commented
5 months ago yeah that looks like its it. have you tried to read the UART logs of the MCU? that would help.
I have strange behaviour when I'm connecting to GND/TX/RX pins. Camera doesn't starts correctly, finally camera fully resets (lost all parameters). I have no console output.
run
logcatand share the output please
Normal usage of camera
# logcat
I/OSD ( 91): IMP_OSD_SetPoolSize:524288
D/Sample-Common( 91): sample_system_init start
D/IMP-ISP ( 91): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
D/IMP-ISP ( 91): sensor:jxf37p, widht = 1920, height = 1080
I/IMP-ISP ( 91): IMP_ISP_AddSensor,487: paddr = 0x0, size = 0x477e70
I/Alloc Manager( 91): MEM Alloc Method is kmalloc
D/KMEM Method( 91): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method( 91): alloc->mem_alloc.method = kmalloc
D/KMEM Method( 91): alloc->mem_alloc.vaddr = 0x73a3c000
D/KMEM Method( 91): alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method( 91): alloc->mem_alloc.length = 25165824
I/Alloc Manager( 91): MEM Manager Method is continuous
I/IMP Alloc APIs( 91): Sensor Width:1920 Height:1080 init_vw:1920 init_vh:1080
I/IMP Alloc APIs( 91): FASTSTART_EN width:1920 height:1080 nrvbs:2 ncubuf_len:4685424 wdrbuf_len:0
I/IMP Alloc APIs( 91): ncubuf alloc use g_ncubuf_alloc
D/System ( 91): IMP_System_Init Zeratul SDK Version:1.1.5-667713c9-Tue Aug 30 16:27:21 2022 +0800, built: Aug 31 2022 10:14:25
D/System ( 91): system_init()
D/System ( 91): Calling DSystem
D/System ( 91): Calling FrameSource
D/System ( 91): [ignored]read /proc/cpuinfo ret is NULL
D/System ( 91): Calling IVS
D/System ( 91): Calling OSD
D/System ( 91): Calling Encoder
D/System ( 91): Calling FB
I/FB ( 91): FB device open error:No such file or directory
I/FB ( 91): FB is unavailable
D/Sample-Common( 91): ImpSystemInit success
E/MemPool ( 91): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder ( 91): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder ( 91): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
E/MemPool ( 91): IMP_Encoder_GetPool(64):chnNum: 1 not bind pool
I/Encoder ( 91): encChn=1,srcFrameCnt=3,srcFrameSize=353280
I/Encoder ( 91): encChn=1,srcStreamCnt=2,enc_chn->stream_frame_size=119808
W/Encoder ( 91): Jpeg channel will not share buff
E/MemPool ( 91): IMP_Encoder_GetPool(64):chnNum: 5 not bind pool
I/Encoder ( 91): encChn=5,srcFrameCnt=2,srcFrameSize=353280
I/Encoder ( 91): encChn=5,srcStreamCnt=1,enc_chn->stream_frame_size=287104
D/System ( 91): system_bind(): bind DST-OSD-0(4.0.0) to SRC-Framesource-0(0.0.0)
D/System ( 91): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-OSD-0(4.0.0)
D/System ( 91): system_bind(): bind DST-OSD-1(4.1.0) to SRC-Framesource-1(0.1.0)
D/System ( 91): system_bind(): bind DST-Encoder-1(1.1.0) to SRC-OSD-1(4.1.0)
I/OSD ( 91): IMP_OSD_CreateRgn(1202) create handle=0 success
I/OSD ( 91): IMP_OSD_CreateRgn(1202) create handle=1 success
I/Framesource( 91): [chn1]: width = 640 height = 360
E/VBM ( 91): VBMCreatePool()-1: w=640 h=360 f=842094158
E/VBM ( 91): VBMCreatePool()-1: pool->config.fmt.fmt.pix.sizeimage=353280 sizeimage=353280
E/Framesource( 91): IMP_FrameSource_GetPool(3296):chnNum: 1 not bind pool
E/VBM ( 91): VBMCreatePool()-1: sizeimage=353280
I/VBM ( 91): PoolId:1, frame=0x13be680, frame->priv=0x13be6a8, frame[0].virAddr=74f0b000, frame[0].phyAddr=3ccf000
I/VBM ( 91): PoolId:1, frame=0x13beaa0, frame->priv=0x13beac8, frame[1].virAddr=74f61400, frame[1].phyAddr=3d25400
I/Framesource( 91): [chn0]: width = 1920 height = 1080
E/VBM ( 91): VBMCreatePool()-0: w=1920 h=1080 f=842094158
E/VBM ( 91): VBMCreatePool()-0: pool->config.fmt.fmt.pix.sizeimage=0 sizeimage=3133440
E/Framesource( 91): IMP_FrameSource_GetPool(3296):chnNum: 0 not bind pool
I/IMP Alloc APIs( 91): VBMPool0 alloc use g_VBMPool0_alloc
E/VBM ( 91): VBMCreatePool()-0: sizeimage=3133440
I/VBM ( 91): PoolId:0, frame=0x140be40, frame->priv=0x140be68, frame[0].virAddr=73eb4000, frame[0].phyAddr=2c78000
I/VBM ( 91): PoolId:0, frame=0x140c260, frame->priv=0x140c288, frame[1].virAddr=741b1000, frame[1].phyAddr=2f75000
I/ai ( 91): AI Enable: 1
I/ai ( 91): AI Enable Chn: 1-0
I/ai ( 91): EXIT AI Enable Chn: 1-0
I/ai ( 91): AI Set Vol: 90
I/ai ( 91): AI Set Gain: 30
I/ai ( 91): AI NS ENABLE: mode = 2
I/ai ( 91): AI HPF Enable
I/ai ( 91): HPF version is: Ingenic High Pass Filter 1.1.0
I/ai ( 91): AI AGC ENABLE: targetLevelDbfs = 12, compressionGaindB = 41, limiterEnable =1
I/ao ( 91): AO Enable: 0
I/ao ( 91): AO Ch Enable: 0:0
I/ao ( 91): EXIT AO Ch Enable: 0:0
I/ao ( 91): AO Set Vol: 45
I/ao ( 91): AO Get Gain: 28
I/TTFF ( 91): [frame_pooling_thread--419 Channel:1 ]:1086(ms)
I/Encoder ( 91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder ( 91): enc_chn->index=1, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=30, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=2, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder ( 91): enc_chn->index=1, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder ( 91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/TTFF ( 91): [IMP_Encoder_GetStream_Impl--2558 Channel:1 ]:1089(ms)
I/ao ( 91): AO Set Vol: 45
D/Encoder ( 91): IMP_Encoder_SetChnFrmRate:encChn=0, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1
D/Encoder ( 91): IMP_Encoder_SetChnFrmRate:encChn=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1
I/TTFF ( 91): [frame_pooling_thread--419 Channel:0 ]:1554(ms)
I/Encoder ( 91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder ( 91): enc_chn->index=0, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=30, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=2, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder ( 91): enc_chn->index=0, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder ( 91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/Encoder ( 91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder ( 91): enc_chn->index=5, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=0, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=1, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder ( 91): enc_chn->index=5, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder ( 91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/TTFF ( 91): [IMP_Encoder_GetStream_Impl--2558 Channel:5 ]:1559(ms)
I/TTFF ( 91): [IMP_Encoder_GetStream_Impl--2558 Channel:0 ]:1569(ms)
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
I/VBM ( 91): fval[0].frame=0x13be680
I/VBM ( 91): fval[0].vaddr=0x74f0b000
I/VBM ( 91): fval[0].paddr=0x3ccf000
I/VBM ( 91): fval[0].ref=0
I/VBM ( 91): fval[1].frame=0x13beaa0
I/VBM ( 91): fval[1].vaddr=0x74f61400
I/VBM ( 91): fval[1].paddr=0x3d25400
I/VBM ( 91): fval[1].ref=0
I/VBM ( 91): fval[2].frame=0x140be40
I/VBM ( 91): fval[2].vaddr=0x73eb4000
I/VBM ( 91): fval[2].paddr=0x2c78000
I/VBM ( 91): fval[2].ref=0
I/VBM ( 91): fval[3].frame=0x140c260
I/VBM ( 91): fval[3].vaddr=0x741b1000
I/VBM ( 91): fval[3].paddr=0x2f75000
I/VBM ( 91): fval[3].ref=0
I/VBM ( 91): fval[4].frame=(nil)
I/VBM ( 91): fval[4].vaddr=0x0
I/VBM ( 91): fval[4].paddr=0x0
I/VBM ( 91): fval[4].ref=0
I/VBM ( 91): fval[5].frame=(nil)
I/VBM ( 91): fval[5].vaddr=0x0
I/VBM ( 91): fval[5].paddr=0x0
I/VBM ( 91): fval[5].ref=0
I/VBM ( 91): fval[6].frame=(nil)
I/VBM ( 91): fval[6].vaddr=0x0
I/VBM ( 91): fval[6].paddr=0x0
I/VBM ( 91): fval[6].ref=0
I/VBM ( 91): fval[7].frame=(nil)
I/VBM ( 91): fval[7].vaddr=0x0
I/VBM ( 91): fval[7].paddr=0x0
I/VBM ( 91): fval[7].ref=0
I/VBM ( 91): fval[8].frame=(nil)
I/VBM ( 91): fval[8].vaddr=0x0
I/VBM ( 91): fval[8].paddr=0x0
I/VBM ( 91): fval[8].ref=0
I/VBM ( 91): fval[9].frame=(nil)
I/VBM ( 91): fval[9].vaddr=0x0
I/VBM ( 91): fval[9].paddr=0x0
I/VBM ( 91): fval[9].ref=0
I/VBM ( 91): fval[10].frame=(nil)
I/VBM ( 91): fval[10].vaddr=0x0
I/VBM ( 91): fval[10].paddr=0x0
I/VBM ( 91): fval[10].ref=0
I/VBM ( 91): fval[11].frame=(nil)
I/VBM ( 91): fval[11].vaddr=0x0
I/VBM ( 91): fval[11].paddr=0x0
I/VBM ( 91): fval[11].ref=0
I/VBM ( 91): fval[12].frame=(nil)
I/VBM ( 91): fval[12].vaddr=0x0
I/VBM ( 91): fval[12].paddr=0x0
I/VBM ( 91): fval[12].ref=0
I/VBM ( 91): fval[13].frame=(nil)
I/VBM ( 91): fval[13].vaddr=0x0
I/VBM ( 91): fval[13].paddr=0x0
I/VBM ( 91): fval[13].ref=0
I/VBM ( 91): fval[14].frame=(nil)
I/VBM ( 91): fval[14].vaddr=0x0
I/VBM ( 91): fval[14].paddr=0x0
I/VBM ( 91): fval[14].ref=0
I/VBM ( 91): fval[15].frame=(nil)
I/VBM ( 91): fval[15].vaddr=0x0
I/VBM ( 91): fval[15].paddr=0x0
I/VBM ( 91): fval[15].ref=0
I/VBM ( 91): fval[16].frame=(nil)
I/VBM ( 91): fval[16].vaddr=0x0
I/VBM ( 91): fval[16].paddr=0x0
I/VBM ( 91): fval[16].ref=0
I/VBM ( 91): fval[17].frame=(nil)
I/VBM ( 91): fval[17].vaddr=0x0
I/VBM ( 91): fval[17].paddr=0x0
I/VBM ( 91): fval[17].ref=0
I/VBM ( 91): fval[18].frame=(nil)
I/VBM ( 91): fval[18].vaddr=0x0
I/VBM ( 91): fval[18].paddr=0x0
I/VBM ( 91): fval[18].ref=0
I/VBM ( 91): fval[19].frame=(nil)
I/VBM ( 91): fval[19].vaddr=0x0
I/VBM ( 91): fval[19].paddr=0x0
I/VBM ( 91): fval[19].ref=0
I/VBM ( 91): fval[20].frame=(nil)
I/VBM ( 91): fval[20].vaddr=0x0
I/VBM ( 91): fval[20].paddr=0x0
I/VBM ( 91): fval[20].ref=0
I/VBM ( 91): fval[21].frame=(nil)
I/VBM ( 91): fval[21].vaddr=0x0
I/VBM ( 91): fval[21].paddr=0x0
I/VBM ( 91): fval[21].ref=0
I/VBM ( 91): fval[22].frame=(nil)
I/VBM ( 91): fval[22].vaddr=0x0
I/VBM ( 91): fval[22].paddr=0x0
I/VBM ( 91): fval[22].ref=0
I/VBM ( 91): fval[23].frame=(nil)
I/VBM ( 91): fval[23].vaddr=0x0
I/VBM ( 91): fval[23].paddr=0x0
I/VBM ( 91): fval[23].ref=0
I/VBM ( 91): fval[24].frame=(nil)
I/VBM ( 91): fval[24].vaddr=0x0
I/VBM ( 91): fval[24].paddr=0x0
I/VBM ( 91): fval[24].ref=0
I/VBM ( 91): fval[25].frame=(nil)
I/VBM ( 91): fval[25].vaddr=0x0
I/VBM ( 91): fval[25].paddr=0x0
I/VBM ( 91): fval[25].ref=0
I/VBM ( 91): fval[26].frame=(nil)
I/VBM ( 91): fval[26].vaddr=0x0
I/VBM ( 91): fval[26].paddr=0x0
I/VBM ( 91): fval[26].ref=0
I/VBM ( 91): fval[27].frame=(nil)
I/VBM ( 91): fval[27].vaddr=0x0
I/VBM ( 91): fval[27].paddr=0x0
I/VBM ( 91): fval[27].ref=0
I/VBM ( 91): fval[28].frame=(nil)
I/VBM ( 91): fval[28].vaddr=0x0
I/VBM ( 91): fval[28].paddr=0x0
I/VBM ( 91): fval[28].ref=0
I/VBM ( 91): fval[29].frame=(nil)
I/VBM ( 91): fval[29].vaddr=0x0
I/VBM ( 91): fval[29].paddr=0x0
I/VBM ( 91): fval[29].ref=0
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource( 91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is runThen running prudynt
I/OSD ( 3700): IMP_OSD_SetPoolSize:131072
D/IMP-ISP ( 3700): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
I/IMP-ISP ( 3700): IMP_ISP_AddSensor,480: paddr = 0x0, size = 0x477e70
I/Alloc Manager( 3700): MEM Alloc Method is kmalloc
D/KMEM Method( 3700): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method( 3700): alloc->mem_alloc.method = kmalloc
D/KMEM Method( 3700): alloc->mem_alloc.vaddr = 0x75f0a000
D/KMEM Method( 3700): alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method( 3700): alloc->mem_alloc.length = 25165824
I/Alloc Manager( 3700): MEM Manager Method is continuous
D/System ( 3700): IMP_System_Init SDK Version:1.1.6-a6394f42-Mon Dec 5 14:39:51 2022 +0800, built: Dec 29 2022 15:38:51
D/System ( 3700): system_init()
D/System ( 3700): Calling DSystem
D/System ( 3700): Calling FrameSource
D/System ( 3700): [ignored]read /proc/cpuinfo ret is NULL
D/System ( 3700): Calling IVS
D/System ( 3700): Calling OSD
D/System ( 3700): Calling Encoder
D/System ( 3700): Calling FB
D/Encoder ( 3700): IMP_Encoder_SetbufshareChn: encChn:1, shareChn:0
E/MemPool ( 3700): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder ( 3700): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder ( 3700): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
D/System ( 3700): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-Framesource-0(0.0.0)
E/Framesource( 3700): [chn0]: VIDIOC_S_FMT error
E/Framesource( 3700): [chn0]: chn_attr.picWidth=1920, chn_attr.picHeight=1080, chn_attr.pixFmt=10
E/Framesource( 3700): [chn0]: chn_attr.crop.enable=0, chn_attr.crop.top=0, chn_attr.crop.left=0, chn_attr.crop.width=1920, chn_attr.crop.height=1080
E/Framesource( 3700): [chn0]: chn_attr.fcrop.enable=0, chn_attr.fcrop.top=0, chn_attr.fcrop.left=0, chn_attr.fcrop.width=0, chn_attr.fcrop.height=0
E/Framesource( 3700): [chn0]: chn_attr.scaler.enable=0, chn_attr.scaler.outwidth=640, chn_attr.scaler.outheight=360
E/Framesource( 3700): IMP_FrameSource_EnableChn(): chn 0 reset channel attr errorE/Framesource( 3700): [chn0]: VIDIOC_S_FMT error indicates that there is a toolchain version mismatch between the modern prudynt streamer and the built-in kernel + kernel modules for the ISP and sensor.
so unless you recompile prudynt with the ancient gcc 4.7.2 ingenic toolchain, not going to work, unless you do a full thingino install. thingino & prudynt are compiled with gcc13/14
gtxaspec
commented
5 months ago can you run this too? for reference to get the gpio map for your device:
mount -t debugfs none /sys/kernel/debug
cat /sys/kernel/debug/gpio
E/Framesource( 3700): [chn0]: VIDIOC_S_FMT errorindicates that there is a toolchain version mismatch between the modern prudynt streamer and the built-in kernel + kernel modules for the ISP and sensor.so unless you recompile prudynt with the ancient gcc 4.7.2 ingenic toolchain, not going to work, unless you do a full thingino install. thingino & prudynt are compiled with gcc13/14 thingino means reflash camera.
I prefer to recompile prudynt, but I have to create an entire build environment...
can you run this too? for reference to get the gpio map for your device:
[root@Zeratul:~]# mount -t debugfs none /sys/kernel/debug [root@Zeratul:~]# cat /sys/kernel/debug/gpio GPIOs 0-31, GPIO A:
GPIOs 32-63, GPIO B: gpio-41 (sysfs ) out lo gpio-43 (sysfs ) out lo gpio-50 (oob irq ) in lo gpio-52 (home key ) in lo gpio-53 (mmc_detect ) in lo gpio-59 (sysfs ) out lo gpio-60 (IR_N ) out lo gpio-61 (IR_P ) out lo gpio-62 (sysfs ) out lo gpio-63 (sysfs ) out lo
GPIOs 64-95, GPIO C:
try https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit
Seem so be too complicated for me. too many dependencies, errors...
Building deps :
Right from the start, to compile freetype.
fatal error: bzlib.h: No such file or directory
Trying to build prudynt :
unrecognized command line option '-std=c++20'
mihovilkolaric
commented
4 months ago try https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit
Finally I managed to compile it (with a few modifications),
but with the config
general: {
loglevel: "DEBUG"; # Logging level. Options: DEBUG, INFO, WARNING, ERROR.
};
sensor: {
model: "jxf37p"; # Sensor model.
i2c_address: 0x40; # I2C address of the sensor.
fps: 24; # Frames per second captured by the sensor.
width: 1920; # Width of the sensor's image (in pixels).
height: 1080; # Height of the sensor's image (in pixels).
};
osd: {
enabled: false; # Enable or disable the OSD (On-Screen Display).
};I still get following output on stdout:
[root@Zeratul:sdcard]# ./prudynt
[INFO:main.cpp]: PRUDYNT Video Daemon: Jul 12 2024 21:21:49_ba49bec
[DEBUG:Logger.cpp]: Logger Init.
[INFO:main.cpp]: Starting Prudynt Video Server.
[INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6
[INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6
[INFO:IMP.cpp]: CPU Information: T31-ZC
[DEBUG:IMP.cpp]: IMP_OSD_SetPoolSize == 131072
[DEBUG:IMP.cpp]: ISP Opened!
[INFO:IMP.cpp]: Sensor: jxf37p
[DEBUG:IMP.cpp]: Sensor Added
[DEBUG:IMP.cpp]: Sensor Enabled
---- FPGA board is ready ----
Board UID : 30AB6E51
Board HW ID : 72000460
Board rev. : 5DE5A975
Board date : 20190326
-----------------------------
[DEBUG:IMP.cpp]: IMP System Initialized
[DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled
[DEBUG:IMP.cpp]: ISP Tuning Defaults set
[DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24
[DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0
[DEBUG:IMP.cpp]: IMP_FrameSource_SetChnRotate == 0
[DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created
[DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set
[DEBUG:Encoder.cpp]: Encoder Group created
[DEBUG:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled
[DEBUG:Encoder.cpp]: Encoder Channel 0 created
[DEBUG:Encoder.cpp]: Encoder Channel 0 registered
[DEBUG:Encoder.cpp]: OSD disabled
[DEBUG:Encoder.cpp]: IMP_System_Bind(FS, ENC)
[ERROR:Encoder.cpp]: IMP_FrameSource_EnableChn() == -1
[ERROR:main.cpp]: Encoder initialization failed.
Segmentation fault
[root@Zeratul:sdcard]# and following output in logcat:
I/OSD ( 7192): IMP_OSD_SetPoolSize:131072
D/IMP-ISP ( 7192): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
I/IMP-ISP ( 7192): IMP_ISP_AddSensor,480: paddr = 0x0, size = 0x477e70
I/Alloc Manager( 7192): MEM Alloc Method is kmalloc
D/KMEM Method( 7192): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method( 7192): alloc->mem_alloc.method = kmalloc
D/KMEM Method( 7192): alloc->mem_alloc.vaddr = 0x7591a000
D/KMEM Method( 7192): alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method( 7192): alloc->mem_alloc.length = 25165824
I/Alloc Manager( 7192): MEM Manager Method is continuous
D/System ( 7192): IMP_System_Init SDK Version:1.1.6-a6394f42-Mon Dec 5 14:39:51 2022 +0800, built: Dec 29 2022 15:38:51
D/System ( 7192): system_init()
D/System ( 7192): Calling DSystem
D/System ( 7192): Calling FrameSource
D/System ( 7192): [ignored]read /proc/cpuinfo ret is NULL
D/System ( 7192): Calling IVS
D/System ( 7192): Calling OSD
D/System ( 7192): Calling Encoder
D/System ( 7192): Calling FB
D/Encoder ( 7192): IMP_Encoder_SetbufshareChn: encChn:1, shareChn:0
E/MemPool ( 7192): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder ( 7192): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder ( 7192): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
D/System ( 7192): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-Framesource-0(0.0.0)
E/Framesource( 7192): [chn0]: VIDIOC_S_FMT error
E/Framesource( 7192): [chn0]: chn_attr.picWidth=1920, chn_attr.picHeight=1080, chn_attr.pixFmt=10
E/Framesource( 7192): [chn0]: chn_attr.crop.enable=0, chn_attr.crop.top=0, chn_attr.crop.left=0, chn_attr.crop.width=1920, chn_attr.crop.height=1080
E/Framesource( 7192): [chn0]: chn_attr.fcrop.enable=0, chn_attr.fcrop.top=0, chn_attr.fcrop.left=0, chn_attr.fcrop.width=0, chn_attr.fcrop.height=0
E/Framesource( 7192): [chn0]: chn_attr.scaler.enable=0, chn_attr.scaler.outwidth=640, chn_attr.scaler.outheight=360
E/Framesource( 7192): IMP_FrameSource_EnableChn(): chn 0 reset channel attr error-> no change.
mihovilkolaric
commented
4 months ago Just realized that "my" binary still uses
IMP_System_Init SDK Version:1.1.6-a6394f42-Mon Dec 5 14:39:51 2022 +0800, built: Dec 29 2022 15:38:51
while the original stone/main logs:
IMP_System_Init Zeratul SDK Version:1.1.5-667713c9-Tue Aug 30 16:27:21 2022 +0800, built: Aug 31 2022 10:14:25
Changed the Makefile to use:
cp ingenic-lib/$1/lib/1.1.5/uclibc/4.7.2/* $TOP/3rdparty/install/lib
when building the deps.
(and needed to comment out the call to IMP_FrameSource_SetChnRotate in IMP.cpp in order to compile)
Output with the same config as before:
[root@Zeratul:sdcard]# ./prudynt
[INFO:main.cpp]: PRUDYNT Video Daemon: Jul 12 2024 22:39:36_ba49bec
[DEBUG:Logger.cpp]: Logger Init.
[INFO:main.cpp]: Starting Prudynt Video Server.
[INFO:IMP.cpp]: LIBIMP Version IMP-1.1.5
[INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.5
[INFO:IMP.cpp]: CPU Information: T31-ZC
[DEBUG:IMP.cpp]: IMP_OSD_SetPoolSize == 131072
[DEBUG:IMP.cpp]: ISP Opened!
[INFO:IMP.cpp]: Sensor: jxf37p
[DEBUG:IMP.cpp]: Sensor Added
[DEBUG:IMP.cpp]: Sensor Enabled
---- FPGA board is ready ----
Board UID : 30AB6E51
Board HW ID : 72000460
Board rev. : 5DE5A975
Board date : 20190326
-----------------------------
[DEBUG:IMP.cpp]: IMP System Initialized
[DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled
[DEBUG:IMP.cpp]: ISP Tuning Defaults set
[DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24
[DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0
[DEBUG:IMP.cpp]: DISABLED IMP_FrameSource_SetChnRotate() for IMP 1.1.5
[DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created
[DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set
[DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set
[DEBUG:Encoder.cpp]: Encoder Group created
[DEBUG:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled
[DEBUG:Encoder.cpp]: Encoder Channel 0 created
[DEBUG:Encoder.cpp]: Encoder Channel 0 registered
[DEBUG:Encoder.cpp]: OSD disabled
[DEBUG:Encoder.cpp]: IMP_System_Bind(FS, ENC)
[DEBUG:Encoder.cpp]: Frame Source Channel 0 enabled
Segmentation fault
[root@Zeratul:sdcard]#and logcat says:
I/OSD ( 3205): IMP_OSD_SetPoolSize:131072
D/IMP-ISP ( 3205): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
I/IMP-ISP ( 3205): IMP_ISP_AddSensor,480: paddr = 0x0, size = 0x477e70
I/Alloc Manager( 3205): MEM Alloc Method is kmalloc
D/KMEM Method( 3205): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method( 3205): alloc->mem_alloc.method = kmalloc
D/KMEM Method( 3205): alloc->mem_alloc.vaddr = 0x765d3000
D/KMEM Method( 3205): alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method( 3205): alloc->mem_alloc.length = 25165824
I/Alloc Manager( 3205): MEM Manager Method is continuous
D/System ( 3205): IMP_System_Init SDK Version:1.1.5-83df8b7-Thu May 12 17:34:01 2022 +0800, built: May 14 2022 13:51:32
D/System ( 3205): system_init()
D/System ( 3205): Calling DSystem
D/System ( 3205): Calling FrameSource
D/System ( 3205): [ignored]read /proc/cpuinfo ret is NULL
D/System ( 3205): Calling IVS
D/System ( 3205): Calling OSD
D/System ( 3205): Calling Encoder
D/System ( 3205): Calling FB
D/Encoder ( 3205): IMP_Encoder_SetbufshareChn: encChn:1, shareChn:0
E/MemPool ( 3205): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder ( 3205): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder ( 3205): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
D/System ( 3205): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-Framesource-0(0.0.0)
I/Framesource( 3205): [chn0]: width = 1920 height = 1080
E/VBM ( 3205): VBMCreatePool()-0: w=1920 h=1080 f=842094158
E/VBM ( 3205): VBMCreatePool()-0: pool->config.fmt.fmt.pix.sizeimage=3133440 sizeimage=3133440
E/Framesource( 3205): IMP_FrameSource_GetPool(3245):chnNum: 0 not bind pool
E/VBM ( 3205): VBMCreatePool()-0: sizeimage=3133440
I/VBM ( 3205): PoolId:0, frame=0xcb3a20, frame->priv=0xcb3a48, frame[0].virAddr=772cff00, frame[0].phyAddr=34fcf00
I/VBM ( 3205): PoolId:0, frame=0xcb3e40, frame->priv=0xcb3e68, frame[1].virAddr=775ccf00, frame[1].phyAddr=37f9f00This is btw. the binary I used: prudynt.zip
dmesg logs:
[ 85.377041] probe ok ------->jxf37p
[ 85.377082] jxf37p chip found @ 0x40 (i2c0)
[ 85.377089] sensor driver version H20231024a
[ 85.377401] Calibration len = 159736
[ 85.377457] Calibration len = 159736
[ 85.377469] Load Sensor Setting DATE:calibration mode 0 MD5:calibration crc 4018056183
[ 85.377477] Calibration len = 159736
[ 85.537312] jxf37p stream on
[ 85.636508] do_page_fault() #2: sending SIGSEGV to prudynt for invalid read access from
[ 85.636508] 00000000 (epc == 00000000, ra == 00415438)
[ 85.713035] jxf37p stream offtry https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit
Finally I managed to compile it (with a few modifications),
Another step forward. Great :+1:
Can you provide a patch file, or explain your changes ? So we can compile it ourselves.
Thanks.
gtxaspec
commented
4 months ago Just realized that "my" binary still uses
IMP_System_Init SDK Version:1.1.6-a6394f42-Mon Dec 5 14:39:51 2022 +0800, built: Dec 29 2022 15:38:51while the originalstone/mainlogs:IMP_System_Init Zeratul SDK Version:1.1.5-667713c9-Tue Aug 30 16:27:21 2022 +0800, built: Aug 31 2022 10:14:25Changed the
Makefileto use:cp ingenic-lib/$1/lib/1.1.5/uclibc/4.7.2/* $TOP/3rdparty/install/libwhen building the deps. (and needed to comment out the call toIMP_FrameSource_SetChnRotatein IMP.cpp in order to compile)Output with the same config as before:
[root@Zeratul:sdcard]# ./prudynt [INFO:main.cpp]: PRUDYNT Video Daemon: Jul 12 2024 22:39:36_ba49bec [DEBUG:Logger.cpp]: Logger Init. [INFO:main.cpp]: Starting Prudynt Video Server. [INFO:IMP.cpp]: LIBIMP Version IMP-1.1.5 [INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.5 [INFO:IMP.cpp]: CPU Information: T31-ZC [DEBUG:IMP.cpp]: IMP_OSD_SetPoolSize == 131072 [DEBUG:IMP.cpp]: ISP Opened! [INFO:IMP.cpp]: Sensor: jxf37p [DEBUG:IMP.cpp]: Sensor Added [DEBUG:IMP.cpp]: Sensor Enabled ---- FPGA board is ready ---- Board UID : 30AB6E51 Board HW ID : 72000460 Board rev. : 5DE5A975 Board date : 20190326 ----------------------------- [DEBUG:IMP.cpp]: IMP System Initialized [DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled [DEBUG:IMP.cpp]: ISP Tuning Defaults set [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24 [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0 [DEBUG:IMP.cpp]: DISABLED IMP_FrameSource_SetChnRotate() for IMP 1.1.5 [DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set [DEBUG:Encoder.cpp]: Encoder Group created [DEBUG:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled [DEBUG:Encoder.cpp]: Encoder Channel 0 created [DEBUG:Encoder.cpp]: Encoder Channel 0 registered [DEBUG:Encoder.cpp]: OSD disabled [DEBUG:Encoder.cpp]: IMP_System_Bind(FS, ENC) [DEBUG:Encoder.cpp]: Frame Source Channel 0 enabled Segmentation fault [root@Zeratul:sdcard]#and
logcatsays:I/OSD ( 3205): IMP_OSD_SetPoolSize:131072 D/IMP-ISP ( 3205): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~ I/IMP-ISP ( 3205): IMP_ISP_AddSensor,480: paddr = 0x0, size = 0x477e70 I/Alloc Manager( 3205): MEM Alloc Method is kmalloc D/KMEM Method( 3205): CMD Line Rmem Size:25165824, Addr:0x02800000 D/KMEM Method( 3205): alloc->mem_alloc.method = kmalloc D/KMEM Method( 3205): alloc->mem_alloc.vaddr = 0x765d3000 D/KMEM Method( 3205): alloc->mem_alloc.paddr = 0x02800000 D/KMEM Method( 3205): alloc->mem_alloc.length = 25165824 I/Alloc Manager( 3205): MEM Manager Method is continuous D/System ( 3205): IMP_System_Init SDK Version:1.1.5-83df8b7-Thu May 12 17:34:01 2022 +0800, built: May 14 2022 13:51:32 D/System ( 3205): system_init() D/System ( 3205): Calling DSystem D/System ( 3205): Calling FrameSource D/System ( 3205): [ignored]read /proc/cpuinfo ret is NULL D/System ( 3205): Calling IVS D/System ( 3205): Calling OSD D/System ( 3205): Calling Encoder D/System ( 3205): Calling FB D/Encoder ( 3205): IMP_Encoder_SetbufshareChn: encChn:1, shareChn:0 E/MemPool ( 3205): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool I/Encoder ( 3205): encChn=0,srcFrameCnt=3,srcFrameSize=3133440 I/Encoder ( 3205): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248 D/System ( 3205): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-Framesource-0(0.0.0) I/Framesource( 3205): [chn0]: width = 1920 height = 1080 E/VBM ( 3205): VBMCreatePool()-0: w=1920 h=1080 f=842094158 E/VBM ( 3205): VBMCreatePool()-0: pool->config.fmt.fmt.pix.sizeimage=3133440 sizeimage=3133440 E/Framesource( 3205): IMP_FrameSource_GetPool(3245):chnNum: 0 not bind pool E/VBM ( 3205): VBMCreatePool()-0: sizeimage=3133440 I/VBM ( 3205): PoolId:0, frame=0xcb3a20, frame->priv=0xcb3a48, frame[0].virAddr=772cff00, frame[0].phyAddr=34fcf00 I/VBM ( 3205): PoolId:0, frame=0xcb3e40, frame->priv=0xcb3e68, frame[1].virAddr=775ccf00, frame[1].phyAddr=37f9f00This is btw. the binary I used: prudynt.zip
dmesglogs:[ 85.377041] probe ok ------->jxf37p [ 85.377082] jxf37p chip found @ 0x40 (i2c0) [ 85.377089] sensor driver version H20231024a [ 85.377401] Calibration len = 159736 [ 85.377457] Calibration len = 159736 [ 85.377469] Load Sensor Setting DATE:calibration mode 0 MD5:calibration crc 4018056183 [ 85.377477] Calibration len = 159736 [ 85.537312] jxf37p stream on [ 85.636508] do_page_fault() #2: sending SIGSEGV to prudynt for invalid read access from [ 85.636508] 00000000 (epc == 00000000, ra == 00415438) [ 85.713035] jxf37p stream off
Static or dynamic binary? Try a static binary and see if it makes a difference
mihovilkolaric
commented
4 months ago Can you provide a patch file, or explain your changes ?
Of course ... just needed to clean up a bit (I tried many different things, and this is now the bare minimum required to compile prudynt).
Here is what I did:
make_unique.TXT
-> rename to make_unique.hpp and copy to src
LSC_solar_changes.TXT
-> rename to .patch, and apply
Clone https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit somewhere
Build with:
PRUDYNT_CROSS=<FULL_PATH_TO>/mips-gcc472-glibc216-64bit/bin/mips-linux-gnu- ./build.sh deps T31 -static
followed by
PRUDYNT_CROSS=<FULL_PATH_TO>/mips-gcc472-glibc216-64bit/bin/mips-linux-gnu- ./build.sh prudynt T31 -static
Static or dynamic binary? Try a static binary and see if it makes a difference
As seen above, I tried static only, to avoid any troubles with library-path or similar.
mihovilkolaric
commented
4 months ago One more thing:
I just realized that some logs are lost, such as:
LOG_INFO("Loaded configuration from " + cfgFilePath);
which I don't find neither on stdout, nor in logcat - are there other places to search for, or other logging-settings beyond loglevel: "DEBUG"; ?
BmdOnline
commented
4 months ago I manage to compile too, but I had to disable bzip2 (--without-bzip2) when I build freetype2.
Now I have the same error as you.
gtxaspec
commented
4 months ago Can you share dmesg logs after segfault? Also, a firmware dump would help.
Has anyone tried to install thingino? Much easier to run everything compiled from the same tool chain.
mihovilkolaric
commented
4 months ago Can you share dmesg logs after segfault?
Sure:
[ 470.786608] probe ok ------->jxf37p
[ 470.786645] jxf37p chip found @ 0x40 (i2c0)
[ 470.786653] sensor driver version H20231024a
[ 470.786961] Calibration len = 159736
[ 470.787017] Calibration len = 159736
[ 470.787029] Load Sensor Setting DATE:calibration mode 0 MD5:calibration crc 4018056183
[ 470.787037] Calibration len = 159736
[ 470.936217] jxf37p stream on
[ 470.974654] do_page_fault() #2: sending SIGSEGV to prudynt for invalid read access from
[ 470.974654] 00000000 (epc == 00000000, ra == 00415438)
[ 470.993099] jxf37p stream offAlso, a firmware dump would help.
Unfortunately, I have no programmer, so I did not manage to dump the flash. @BmdOnline has one - maybe he can send it to you.
Has anyone tried to install thingino? Much easier to run everything compiled from the same tool chain.
No idea how to do that - especially as it's homepage says that zeratul is not (yet) supported.
gtxaspec
commented
4 months ago zeratul chips can run just fine in non-zeratul mode, so firmware for non-zeratul devices will work. The worry is the external MCU, forcing the SOC to reset.
if you can bypass the MCU resetting the SOC, then another firmware will work fine.
a programmer is the best way to install, on development devices, as it turns out
BmdOnline
commented
4 months ago Also, a firmware dump would help.
My firmware dump contains personal data (mac, ssid & passsword). I can share specific parts (I've extracted all parts) if you want, or I can try to wipe personal data using an hex editor.
Has anyone tried to install thingino? Much easier to run everything compiled from the same tool chain.
I prefer avoid to flash a new firmware if possible. I like idea to use sdcard without altering original firmware.
BmdOnline
commented
4 months ago I've uploaded each partition except config which contains personal data (rename files from dmp to bin).
| partition | Size | Designation | Format | Donwload |
|---|---|---|---|---|
| mtdblock0 | 256 Ko | boot | mtdblock0.dmp | |
| mtdblock1 | 352 Ko | tag | mtdblock1.dmp | |
| mtdblock2 | 5 Mo | kernel | uimage | mtdblock2.dmp |
| mtdblock3 | 6 Mo | rootfs | lzo | mtdblock3.dmp |
| mtdblock4 | 2.5 Mo | recovery | lzma | mtdblock4.dmp |
| mtdblock5 | 1.4 Mo | system | squashfs | mtdblock5.dmp |
| mtdblock6 | 512 Ko | config | jffs2 | mtdblock6.sha256sum.txt (contains personal data) |
| mtdblock7 | 16 Mo | all |
You can recreate entire firmware
cat mtdblock0.bin mtdblock1.bin mtdblock2.bin mtdblock3.bin \
mtdblock4.bin mtdblock5.bin mtdblock6.bin > firmware.binOr extract each partition individually
rootfs
mv mtdblock3.bin rootfs_camera.cpio.lzo
echo -ne \\x89\\x4C\\x5A\\x4F | dd conv=notrunc count=1 of=rootfs_camera.cpio.lzo
lzop -d rootfs_camera.cpio.lzo
mkdir rootfs_camera && cd rootfs_camera
cpio -idmv < ../rootfs_camera.cpiorecovery
dd if=mtdblock4.bin skip=1 bs=64 of=recovery.lzma
7z e recovery.lzma
mv recovery recovery.img
mkdir recovery && cd recovery
7z x ../recovery.imgsystem
mv mtdblock5.bin system.squashfs
mkdir system && cd system
unsquashfs ../system.squashfsconfig
mv mtdblock6.bin config.jffs2
mkdir config && cd config
jefferson ../config.jffs2@mihovilkolaric, can you dump your config partition
dd if=/dev/mtdblock6 of=/tmp/mnt/sdcard/mtdblock6.bin
Then extract its contents and calculate all sha256sum
find . -type f -exec sha256sum {} \;
So we can compare yours and mine and identify generic files and personal data.
If you want, you can extract your firmware using
dd if=/dev/mtdblock7 of=/tmp/mnt/sdcard/firmware.bin
mtdblock7 means entire firmware. The same as when I dumped XMC directly.
mihovilkolaric
commented
4 months ago I managed to get a coredump from the crashing prudynt: prudynt-coredump.zip (but was not able to find analyze it - does someone have an idea how to get useful information out of the dump?)
I'm trying to customize this model.
Connecting with Tuya Smart, the camera is v4.0.117. An upgrade to v4.0.120 is suggested. I don't install it.
What I've tried, without success :
Each time, only 6668 port is opened :
I'm using a Sandisk 64Gb, FAT32 MicroSD. Each time "DCIM" folder is created on the card, so it doesn't seem to be related to the card.
I don't know what else to do for the moment. I will try to open the camera, but I don't know how to do without damaging it.