shadow-1 / yi-hack-v3

Alternative Firmware for Xiaomi Cameras based on Hi3518e Chipset
GNU General Public License v3.0
1.16k stars 155 forks source link

Bricked camera, solid yellow light, help? #201

Open pomtom44 opened 6 years ago

pomtom44 commented 6 years ago

Hey everyone. Not sure if this is the best place to ask, but worth a shot My friend had a Yi Home camera, and was messing around with the files on it, Not sure what he was doing, but somehow he bricked the camera. He's given it to me as he doesnt know enough about them and can't be bothered fixing it, so i said id have a look and give it a go.

When booting up the yellow LED stays lit and nothing else happens, I have tried loading the home_y18 and rooty_18 files on, from various repo's and just booting without the SD card, but nothing seems to work

At a guess I think he may have modified one of the core linux files and has bricked the internal OS

Is there any way to reload the OS onto the camera? Or is it only good as a paperweight now? Thanks in advance

xcray commented 6 years ago

ttl, backup from same model by dd command, then restore by dd also. That’s all

pomtom44 commented 6 years ago

Ah Didn't know they had that okay ill have a look and see what I can do and will inform back in a few days

pomtom44 commented 6 years ago

Finally got around to it, but now I dont know where to go. Got a serial connection, booted the camera, and got a kernel panic.

Heres the whole serial log file.

U-Boot 2010.06 (Aug 13 2015 - 16:32:20)

Serial Number: hi3518c

Check spi flash controller v350... Found Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18 Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128" MMC: MMC FLASH INIT: No card on slot! *** using default environment for 16MB flash In: serial Out: serial Err: serial

do_auto_sd_update: detect flash size: 0x1000000, gsdexist=0

do_auto_flash_update: detect flash size: 0x1000000, gsdexist=0

do_auto_update: detect flash size: 0x1000000 USB: scanning bus for devices... 2 USB Device(s) found 0 Storage Device(s) found gpio7_7 =80 gpio2_5 =20 Press Ctrl+C to stop autoboot 16384 KiB hi_sfc at 0:0 is now current device

Booting kernel from Legacy Image at 82000000 ...

Image Name: Linux-3.0.8-7518-hi3518-kernel Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2894932 Bytes = 2.8 MiB Load Address: 80008000 Entry Point: 80008000 Loading Kernel Image ... OK OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel. Linux version 3.0.8 (rock07@Server) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #1 Wed Apr 30 16:56:49 CST 2014 CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177 CPU: VIVT data cache, VIVT instruction cache Machine: hi3518 Memory policy: ECC disabled, Data cache writeback AXI bus clock 200000000. Built 1 zonelists in Zone order, mobility grouping on. Total pages: 10160 Kernel command line: mem=40M console=ttyAMA0,115200 root=/dev/mtdblock4 rootfstype=jffs2 mtdparts=hi_sfc:256k(boot)ro,128k(env),128k(conf),3072k(os),3584k(rootfs),9088k(home),128k(vd) PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 40MB = 40MB total Memory: 35080k/35080k available, 5880k reserved, 0K highmem Virtual kernel memory layout: vector : 0xffff0000 - 0xffff1000 ( 4 kB) fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) DMA : 0xffc00000 - 0xffe00000 ( 2 MB) vmalloc : 0xc3000000 - 0xfe000000 ( 944 MB) lowmem : 0xc0000000 - 0xc2800000 ( 40 MB) modules : 0xbf000000 - 0xc0000000 ( 16 MB) .init : 0xc0008000 - 0xc0029000 ( 132 kB) .text : 0xc0029000 - 0xc0515000 (5040 kB) .data : 0xc0516000 - 0xc053a0e0 ( 145 kB) .bss : 0xc053a104 - 0xc0557380 ( 117 kB) SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:32 nr_irqs:32 32 sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms Console: colour dummy device 80x30 Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 Serial: AMBA PL011 UART driver uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2 console [ttyAMA0] enabled uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2 bio: create slab at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb cfg80211: Calling CRDA to update world regulatory domain Switching to clocksource timer1 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered named UNIX socket transport module. RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. NetWinder Floating Point Emulator V0.97 (double precision) VFS: Disk quotas dquot_6.5.2 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) JFFS2 version 2.2. (NAND) 2001-2006 Red Hat, Inc. fuse init (API version 7.16) msgmni has been set to 68 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler deadline registered (default) io scheduler cfq registered brd: module loaded loop: module loaded Spi id table Version 1.22 Spi(cs1) ID: 0xC8 0x40 0x18 0xC8 0x40 0x18 SPI FLASH start_up_mode is 3 Bytes Spi(cs1): Block:64KB Chip:16MB Name:"GD25Q128" spi size: 16MB chip num: 1 7 cmdlinepart partitions found on MTD device hi_sfc Creating 7 MTD partitions on "hi_sfc": 0x000000000000-0x000000040000 : "boot" 0x000000040000-0x000000060000 : "env" 0x000000060000-0x000000080000 : "conf" 0x000000080000-0x000000380000 : "os" 0x000000380000-0x000000700000 : "rootfs" 0x000000700000-0x000000fe0000 : "home" 0x000000fe0000-0x000001000000 : "vd" Fixed MDIO Bus: probed himii: probed usbcore: registered new interface driver rt2500usb usbcore: registered new interface driver rt73usb ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver hiusb-ehci hiusb-ehci.0: HIUSB EHCI hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1 hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000 hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver hiusb-ohci hiusb-ohci.0: HIUSB OHCI hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2 hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usbcore: registered new interface driver cdc_acm cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters usbcore: registered new interface driver cdc_wdm Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver ums-alauda usbcore: registered new interface driver ums-datafab usbcore: registered new interface driver ums-freecom usbcore: registered new interface driver ums-isd200 usbcore: registered new interface driver ums-jumpshot usbcore: registered new interface driver ums-sddr09 usbcore: registered new interface driver ums-sddr55 usbcore: registered new interface driver mdc800 mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera mousedev: PS/2 mouse device common for all mice usbcore: registered new interface driver usbhid usbhid: USB HID core driver TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 NET: Registered protocol family 17 NET: Registered protocol family 15 lib80211: common routines for IEEE802.11 drivers Registering the dns_resolver key type registered taskstats version 1 drivers/rtc/hctosys.c: unable to open rtc device (rtc0) usb 1-1: new high speed USB device number 2 using hiusb-ehci VFS: Mounted root (jffs2 filesystem) on device 31:4. Freeing init memory: 132K /sbin/init: '/lib/libc.so.0' is not an ELF file /sbin/init: '/lib/libc.so.0' is not an ELF file /sbin/init: can't load library 'libc.so.0' Kernel panic - not syncing: Attempted to kill init! Backtrace: [] (dump_backtrace+0x0/0x10c) from [] (dump_stack+0x18/0x1c) r6:00000009 r5:c053a3f0 r4:c053a3f0 r3:0000000a [] (dump_stack+0x0/0x1c) from [] (panic+0x64/0x190) [] (panic+0x0/0x190) from [] (do_exit+0x640/0x700) r3:60000013 r2:c2024000 r1:c2022120 r0:c04ba2a4 r7:c2022000 [] (do_exit+0x0/0x700) from [] (sys_exit+0x18/0x1c) r7:00000001 [] (sys_exit+0x0/0x1c) from [] (ret_fast_syscall+0x0/0x2c)

pomtom44 commented 6 years ago

Nevermind Seem to have got it to work Managed to load some firmware on through the sd card, no idea why it wasnt working before, but watching though the serial port I could see it loading the default files back onto the device.

Apapou commented 5 years ago

Hi guys,

I have the same bricked after update camera problem. I found this tread but as I am not an expert is there any chance to prompt what exactly to do to make it work again? I am afraid it is not clear to me how to connect it to my computer, where to get the firmware (anyone can share please?), what is dd command etc? Will really appreciate your help.

Thanks, Alex

Apapou commented 4 years ago

No one replied but I have found a solution so leaving it here in case someone needs it. See these pages on official UI website. It works!

https://help.yitechnology.com/hc/en-us/articles/230776087-Manual-Firmware-Update-Instructions