Compatibility with CMSXJ13B

[ppisljar]

Is this compatible ?

I tried downloading tf_recovery.bin to sdcard and flashing. The file was renamed but nothing happened. I have yet to try with different SD card. Is there a procedure i could follow to add compatibility in case its not yet working ?

How similar/different is this to other xiaomi mija hacks (https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks, https://github.com/TheCrypt0/yi-hack-v4, ...) ? Are they all based on the same technique ? and how hard would it be to bring some of their features into this or add support for this camera to their versions ?

thanks!

[telmomarques]

I'm not finding much information on this camera. Do you happen to know the SoC (processor) brand and model?

[ppisljar]

no idea, i'll have to take it apart .... is there any guide on doing so ?

[ppisljar]

i doubt i'll ever be able to put it back together :)

[crckmc]

Looks like it is the same SoC Mstar313E. Do you have access to a soldering iron?

If yes try to get serial access with the pads TX0, RX0 and GND. You will need a USB TTL converter.

[ppisljar]

got it connected ... whats the speed ? i tried with 9600 and 115200 and its just garbage

[crckmc]

It should be 115200 are you sure there is no ground problem?

[ppisljar]

▒▒▒▒▒
IPL gd156225
D-01.
HW Reset
64MB
BIST0_0001-OK
[NOR]
offset:00010000
size:7fc8 chks:5551a134 ok

IPL_CUST gbf16da4
MXP found at 0x00020000
  decomp_size=0x0004ad24

U-Boot 2015.01 (Dec 21 2018 - 17:50:28), Build: jenkins-IPC013D_english-133

Version: I3g574ecbf
DEVINFO: 313E
[WDT] Enalbe WATCHDOG 60s
       Watchdog enabled
I2C:   ready
DRAM:  64 MiB
gpio[100] is 1
WARNING: Caches not enabled
MMC:   MStar SD/MMC: 0
nor_flash_mxp allocated success!!
Flash is detected (0x090F, 0x1C, 0x70, 0x18)
SF: Detected nor0 with total size 16 MiB
MXP found at mxp_offset[1]=0x00020000, size=0x1000
env_offset=0x4F000 env_size=0x1000
Flash is detected (0x090F, 0x1C, 0x70, 0x18)
SF: Detected nor0 with total size 16 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   MAC Address 00:30:1B:BA:02:DB
Auto-Negotiation...
AN failLink Status Speed:10 Full-duplex:0
Status Error!
mstar_emac
Warning: mstar_emac using MAC address from net device

read file start
reading tf_recovery.img
** Unable to read file tf_recovery.img **
read len = -1, actlen = 0
read file tf_recovery.img error.
[NetUpgrade] ts_1st=0x10d4
[NetUpgrade] Get Device MacAddr(00:30:1b:ba:02:db)
NetUpgrade Timeout
[NetUpgrade] ts_1st=0x10d4, ts_2nd=0x14c0, delt_ts=0x3ec
Flash is detected (0x090F, 0x1C, 0x70, 0x18)
SF: Detected nor0 with total size 16 MiB
SF: 2490368 bytes @ 0x50000 Read: OK
##  Booting kernel from Legacy Image at 21000000 ...
   Image Name:   MVX2##I3g574ecbfKL_LX318####[BR:
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    1724656 Bytes = 1.6 MiB
   Load Address: 20008000
   Entry Point:  20008000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...
[XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!!
   XZ: uncompressed size=0x36c9e0, ret=7
OK
ERR: Can't find KIMG header and initrd address, 0x00000000
atags:0x20000000

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 3.18.30 (jenkins@vm10-2-192-25.ksc.com) (gcc version 4.9.4 (Buildroot 2017.08-gf8e1e38) ) #1 PREEMPT Fri Dec 21 17:57:10 CST 2018
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
early_atags_to_fdt() success
Machine model: INFINITY3 MSC000A-S03A-64M
Reserved memory: created CMA memory pool at 0x22c00000, size 20 MiB
Reserved memory: initialized node cma0, compatible id shared-dma-pool
Memory policy: Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200n8r init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw isp_flag=0x0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 40592K/65536K available (2155K kernel code, 234K rwdata, 1032K rodata, 84K init, 146K bss, 24944K reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
    vmalloc : 0xc4800000 - 0xff000000   ( 936 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf800000 - 0xc0000000   (   8 MB)
      .text : 0xc0008000 - 0xc0324ecc   (3188 kB)
      .init : 0xc0325000 - 0xc033a000   (  84 kB)
      .data : 0xc033a000 - 0xc03749e0   ( 235 kB)
       .bss : 0xc03749e0 - 0xc0399578   ( 147 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Preemptible hierarchical RCU implementation.
        Dump stacks of tasks blocking RCU-preempt GP.
NR_IRQS:16 nr_irqs:16 16
Find CLK_cpupll_clk, hook ms_cpuclk_ops
[ms_cpuclk_init] get dvfs gpio  vid_1
Architected cp15 timer(s) running at 6.00MHz (virt).
sched_clock: 56 bits at 6MHz, resolution 166ns, wraps every 2863311527936ns
Switching to timer-based delay loop, resolution 166ns
console [ttyS0] enabled
Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=20000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x20204d48 - 0x20204d78
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations

Version : MVX2##I3g574ecbfKL_LX318####[BR:HEAD]#XVM

GPIO: probe end[OTG] Mstar_otg_device_init
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
MSYS:  INIT DONE. TICK=0x050A5B5C
Advanced Linux Sound Architecture Driver Initialized.
Switched to clocksource arch_sys_counter
cfg80211: Calling CRDA to update world regulatory domain
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 2, 20480 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
NET: Registered protocol family 1
futex hash table entries: 256 (order: 0, 7168 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Mstar_ehc_init version:20150512
Mstar-ehci-2 H.W init
Titania3_series_start_ehc start
enable USB function
[USB] config miu select [1] [ef] [ef] ][ef]
[USB] enable miu lower bound address subtraction
[USB] worring.... no platform_data
hcd->rsrc_start:0xfd286400
BC disable
[USB] soc:Mstar-ehci-2 irq --> 119
soc:Mstar-ehci-2 soc:Mstar-ehci-2: EHCI Host Controller
soc:Mstar-ehci-2 soc:Mstar-ehci-2: new USB bus registered, assigned bus number 1
soc:Mstar-ehci-2 soc:Mstar-ehci-2: irq 119, io mem 0xfd286400
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: EHCI Host Controller
usb usb1: Manufacturer: Linux 3.18.30 ehci_hcd
usb usb1: SerialNumber: mstar
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Mstar-ehci-1 H.W init
CHIP_FUNCTION SET. ID=4, param=1
Can't get power-enable-pad from DTS, set default GPIO(1)
[mstar_usb_vbus_control] Enable USB VBUS GPIO(81)
Titania3_series_start_ehc start
enable USB function
[USB] config miu select [1] [ef] [ef] ][ef]
[USB] enable miu lower bound address subtraction
[USB] worring.... no platform_data
hcd->rsrc_start:0xfd284800
BC disable
[USB] soc:Mstar-ehci-1 irq --> 95
soc:Mstar-ehci-1 soc:Mstar-ehci-1: EHCI Host Controller
soc:Mstar-ehci-1 soc:Mstar-ehci-1: new USB bus registered, assigned bus number 2
soc:Mstar-ehci-1 soc:Mstar-ehci-1: irq 95, io mem 0xfd284800
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: EHCI Host Controller
usb usb2: Manufacturer: Linux 3.18.30 ehci_hcd
usb usb2: SerialNumber: mstar
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
i2c /dev entries driver
logger: created 256K log 'log_main'
[ms_uart_probe] uart port 0 use MUX_PM_UART
1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 98, base_baud = 10750000) is a unknown
[ms_uart_probe] uart port 1 use MUX_UART1
1f221200.uart1: ttyS1 at MMIO 0x0 (irq = 99, base_baud = 10750000) is a unknown
>> [sdmmc] ms_sdmmc Driver Initializing...
>> [sdmmc] ms_sdmmc_probe
>> [sdmmc_0] Int CDZ use Ext GPIO IRQ: (151)
>> [sdmmc_0] Get CD => (1)
>> [sdmmc_0] Probe Platform Devices...(Ret:0)
infinity-audio soc:sound: ASoC: CODEC DAI infinity-codec-dai-main not registered
platform soc:sound: Driver infinity-audio requests probe deferral
infinity-audio infinity-codec: ASoC: CODEC DAI infinity-codec-dai-main not registered
platform infinity-codec: Driver infinity-audio requests probe deferral
netif_napi_add() called with weight 128 on device eth%d
MSYS: DMEM request: [EMAC_BUFF]:0x00002000
==20150512==> hub_port_init 1 #0
Plug in USB Port1
[EMAC]Init EMAC success! (add delay in reset)
[HVSP]u32Dropmode on/n
[VIP]gu32CMDQmode off/nMSYS: DMEM request: [VIP_CMDQ]:0x00004000
[SCL] SCL init success
mload_size = 35040
mload_virt_addr = c2c50000
mload_dma_addr = 0x22c50000
>> [sdmmc_0] Set IOS => Clk=48000000 (Real=48000000)
MSYS: DMEM request: [ISP_base]:0x0001B120
mmc0: new high speed SDHC card at address 0001
ShareData_Meminfo phyaddr:0x224ab740, viraddr:0xc24ab740, len:0x38
mmcblk0: mmc0:0001 SD 7.32 GiB
AE Base: virt=0xC2C60000 size=0xB400
 mmcblk0: p1
AWB Base: virt=0xC2C6B400 size=0x8700
AF Base: virt=0xC2C73B00 size=0xF0
HISTO Base: virt=0xC2C73BF0 size=0x2F0
MOT Base: virt=0xC2C73EE0 size=0x6E40
RGBIR Base: virt=0xC2C7AD20 size=0x400
[ISP] register driver success
[CSI] register driver success[SAR] infinity_sar_probe
[JPE, JpeProbe] set base=0xfd264000 irq=93, nClockRate=288000000
MSYS: DMEM request: [BDMA_FSP_WBUFF]:0x00000100
[Ser flash] phys=0x22c49000, virt=0xc2c49000, bus=0x02c49000
[FSP] Unknown flash type (0xFF, 0xFF, 0xFF) and use default flash type 0x0000
[FSP] 1-1-1 FAST_READ MODE
mtd .name = NOR_FLASH, .size = 0x01000000 (16MiB)
 .erasesize = 0x00010000 .numeraseregions = 0
MXP_PARTS!!
MXP found at mxp_offset[1]=0x00020000, size=0x1000
Creating 6 MTD partitions on "NOR_FLASH":
usb 2-1: new high-speed USB device number 2 using soc:Mstar-ehci-1
0x000000000000-0x000000050000 : "BOOT"
0x000000050000-0x000000260000 : "KERNEL"
0x000000260000-0x0000009b0000 : "ROOTFS"
0x0000009b0000-0x000000fe0000 : "DATA"
0x000000fe0000-0x000000ff0000 : "CONFIG"
0x000000ff0000-0x000001000000 : "FACTORY"
MSYS: DMEM request: [AESDMA_ENG]:0x00001000
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000
infinity_aes soc:aesdma: MSTAR AES engine enabled.
cryptodev: driver aesdmadev loaded.
[ms_cpufreq_init] cpu current clk=796917760
ms_pwm->pad_ctrl[0]=16
ms_pwm->pad_ctrl[1]=70
ms_pwm->pad_ctrl[2]=255
ms_pwm->pad_ctrl[3]=255
ms_pwm->pad_ctrl[4]=53
ms_pwm->pad_ctrl[5]=255
ms_pwm->pad_ctrl[6]=255
ms_pwm->pad_ctrl[7]=56
mstar-i3pwm 1f003400.pwm: probe successful
mstar notify driver install successfully
TCP: cubic registered
NET: Registered protocol family 17
ThumbEE CPU extension supported.
MSYS: DMEM request: [pcmC0D0p]:0x00018000
MSYS: DMEM request: [pcmC0D0c]:0x00014000
infinity-audio soc:sound: infinity-codec-dai-main <-> infinity-cpu-dai mapping ok
ALSA device list:
  #0: infinity_snd_machine
^@VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
devtmpfs: mounted
Freeing unused kernel memory: 84K (c0325000 - c033a000)
usb 2-1: New USB device found, idVendor=148f, idProduct=7601
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+ source /etc/hooks/pre-init
+ exec chroot . /bin/busybox linuxrc
^@devpts: called with bogus options
mkdir: can't create directory '/system': Read-only file system
ln: /system/bin: No such file or directory
ln: /system/etc: No such file or directory
ln: /system/lib: No such file or directory
random: property_servic urandom read with 1 bits of entropy available
init: property_service started...
init: minit[MVX2####g348e306CM_MINIT#####XVM]
MSYS: DMEM request: [VENC-49]:0x0001E000
PHYS=0x22CC0000,KVIRT=0xC2CC0000, LENGTH=0x0001EMSYS: DMEM request: [VENC-48]:0x0001E000
000
PHYS=0x22CE0000,KVIRT=0xC2CE0000, LENGTH=0x0001EMSYS: DMEM request: [VENC-32]:0x000CC000
000
PHYS=0x22D00000,KVIRT=0xC2D00000, LENGTH=0x000CCMSYS: DMEM request: [S1:VENCDMP1]:0x00069AE0
000
PHYS=0x22DD0000,KVIRT=0xC2DD0000, LENGTH=0x00069AE0
MSYS: DMEM request: [S1:VENCDMP0]:0x00069AE0
PHYS=0x22E40000,KVIRT=0xC2E40000, LENGTH=0x00069MSYS: DMEM request: [S1:VENCDMOUT]:0x0000A100
AE0
PHYS=0x22EB0000,KVIRT=0xC2EB0000, LENGTH=0x0000A100
MSYS: DMEM request: [S0:VENCDMP1]:0x0007F800
PHYS=0x22EC0000,KVIRT=0xC2EC0000, LENGTH=0x0007FMSYS: DMEM request: [S0:VENCDMP0]:0x0007F800
800
PHYS=0x22F40000,KVIRT=0xC2F40000, LENGTH=0x0007FMSYS: DMEM request: [S0:VENCDMOUT]:0x0000A800
800
PHYS=0x22FC0000,KVIRT=0xC2FC0000, LENGTH=0x0000A800
MSYS: DMEM request: [VSPL-I0P3B0]:0x00016800
PHYS=0x22FD0000,KVIRT=0xC2FD0000, LENGTH=0x00016MSYS: DMEM request: [VSPL-I0P2B1]:0x0005A000
800
PHYS=0x22FF0000,KVIRT=0xC2FF0000, LENGTH=0x0005AMSYS: DMEM request: [VSPL-I0P2B0]:0x0005A000
000
PHYS=0x23050000,KVIRT=0xC3050000, LENGTH=0x0005AMSYS: DMEM request: [VSPL-I0P1B1]:0x0005A000
000
PHYS=0x230B0000,KVIRT=0xC30B0000, LENGTH=0x0005AMSYS: DMEM request: [VSPL-I0P1B0]:0x0005A000
000
PHYS=0x23110000,KVIRT=0xC3110000, LENGTH=0x0005AMSYS: DMEM request: [VSPL-I0P0B1]:0x0005A000
000
PHYS=0x23170000,KVIRT=0xC3170000, LENGTH=0x0005AMSYS: DMEM request: [VSPL-I0P0B0]:0x0005A000
000
PHYS=0x231D0000,KVIRT=0xC31D0000, LENGTH=0x0005AMSYS: DMEM request: [MS-01]:0x00357000
000
PHYS=0x23230000,KVIRT=0xC3230000, LENGTH=0x00357000
MSYS: DMEM request: [MS-00]:0x00357000
PHYS=0x23590000,KVIRT=0xC3590000, LENGTH=0x00357000
MSYS: DMEM request: [SCL_MCNR_M]:0x000FF000
PHYS=0x238F0000,KVIRT=0xC38F0000, LENGTH=0x000FFMSYS: DMEM request: [SCL_MCNR_YC]:0x003FC000
000
PHYS=0x239F0000,KVIRT=0xC39F0000, LENGTH=0x003FC000
MSYS: fix_dmem enabled
[FB]Set 68
[DRVHVSP]Drv_HVSP_SetFbManageConfig(645):8000
DNRR OFF
[FB]Set 57
[DRVHVSP]Drv_HVSP_SetFbManageConfig(645):100
UNLOCK
Starting logging: OK
04:CF:8C:C4:59:14
mtprealloc: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
==>[0]:PreBuff:0xc2054000, DmaAddr:0x22054000
==>[1]:PreBuff:0xc206c000, DmaAddr:0x2206c000
==>[2]:PreBuff:0xc2074000, DmaAddr:0x22074000
==>[3]:PreBuff:0xc2060000, DmaAddr:0x22060000
==>[4]:PreBuff:0xc207c000, DmaAddr:0x2207c000
==>[5]:PreBuff:0xc2088000, DmaAddr:0x22088000
==>[6]:PreBuff:0xc208c000, DmaAddr:0x2208c000
==>[7]:PreBuff:0xc2090000, DmaAddr:0x22090000
==>[8]:PreBuff:0xc2094000, DmaAddr:0x22094000
==>[9]:PreBuff:0xc2098000, DmaAddr:0x22098000
==>[10]:PreBuff:0xc209c000, DmaAddr:0x2209c000
==>[11]:PreBuff:0xc20a0000, DmaAddr:0x220a0000
==>[12]:PreBuff:0xc20a4000, DmaAddr:0x220a4000
==>[13]:PreBuff:0xc20a8000, DmaAddr:0x220a8000
==>[14]:PreBuff:0xc20ac000, DmaAddr:0x220ac000
==>[15]:PreBuff:0xc20b0000, DmaAddr:0x220b0000
==>[16]:PreBuff:0xc20b4000, DmaAddr:0x220b4000
==>[17]:PreBuff:0xc20b8000, DmaAddr:0x220b8000
==>[18]:PreBuff:0xc20bc000, DmaAddr:0x220bc000
==>[19]:PreBuff:0xc20c0000, DmaAddr:0x220c0000
==>[20]:PreBuff:0xc20c4000, DmaAddr:0x220c4000
==>[21]:PreBuff:0xc20c8000, DmaAddr:0x220c8000
==>[22]:PreBuff:0xc20cc000, DmaAddr:0x220cc000
==>[23]:PreBuff:0xc20d0000, DmaAddr:0x220d0000
==>[24]:PreBuff:0xc20d4000, DmaAddr:0x220d4000
==>[25]:PreBuff:0xc25db000, DmaAddr:0x225db000
==>[26]:PreBuff:0xc25d9000, DmaAddr:0x225d9000
==>[27]:PreBuff:0xc20d8000, DmaAddr:0x220d8000
==>[28]:PreBuff:0xc20e0000, DmaAddr:0x220e0000
==>[29]:PreBuff:0xc20e8000, DmaAddr:0x220e8000
==>[30]:PreBuff:0xc20f0000, DmaAddr:0x220f0000
==>[31]:PreBuff:0xc20f8000, DmaAddr:0x220f8000
==>[32]:PreBuff:0xc2100000, DmaAddr:0x22100000
==>[33]:PreBuff:0xc2108000, DmaAddr:0x22108000
==>[34]:PreBuff:0xc2110000, DmaAddr:0x22110000
==>[35]:PreBuff:0xc2004c00, DmaAddr:0x22004c00
install prealloc ok
rtusb init rt2870 --->

=== pAd = c4a4d000, size = 1584912 ===

allocate tx ringidx 0
RTMPQMemAddr[0]
allocate tx ringidx 1
RTMPQMemAddr[1]
allocate tx ringidx 2
RTMPQMemAddr[2]
allocate tx ringidx 3
RTMPQMemAddr[3]
allocate tx ringidx 4
RTMPQMemAddr[4]
allocate tx ringidx 0
RTMPQMemAddr[5]
allocate tx ringidx 1
RTMPQMemAddr[6]
allocate tx ringidx 2
RTMPQMemAddr[7]
allocate tx ringidx 3
RTMPQMemAddr[8]
allocate tx ringidx 4
RTMPQMemAddr[9]
allocate tx ringidx 0
RTMPQMemAddr[10]
allocate tx ringidx 1
RTMPQMemAddr[11]
allocate tx ringidx 2
RTMPQMemAddr[12]
allocate tx ringidx 3
RTMPQMemAddr[13]
allocate tx ringidx 4
RTMPQMemAddr[14]
allocate tx ringidx 0
RTMPQMemAddr[15]
allocate tx ringidx 1
RTMPQMemAddr[16]
allocate tx ringidx 2
RTMPQMemAddr[17]
allocate tx ringidx 3
RTMPQMemAddr[18]
allocate tx ringidx 4
RTMPQMemAddr[19]
RTMPQMemAddr[25]
RTMPQMemAddr[26]
RTMPQMemAddr[27]
RTMPQMemAddr[28]
RTMPQMemAddr[29]
RTMPQMemAddr[30]
RTMPQMemAddr[31]
RTMPQMemAddr[32]
RTMPQMemAddr[33]
RTMPQMemAddr[34]
RTMPQMemAddr[35]
<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
STA Driver version-JEDI.MP1.mt7601u.v1.5.1_20181115
Compile time-Dec 21 2018,17:58:34
==>WaitForAsicReady MAC_CSR0=0x76010500
==>WaitForAsicReady MAC_CSR0=0x76010500
NVM is EFUSE
Endpoint(8) is for In-band Command
Endpoint(4) is for WMM0 AC0
Endpoint(5) is for WMM0 AC1
Endpoint(6) is for WMM0 AC2
Endpoint(7) is for WMM0 AC3
Endpoint(9) is for WMM1 AC0
Endpoint(84) is for Data-In
Endpoint(85) is for Command Rsp
80211> RFICType = 3
NumOfChan ===> 58
80211> Number of channel = 0x44
80211> Number of rate = 12
80211> CurTxPower = 0 dBm
80211> TxStream = 0
crda> requlation requestion by core: 00
80211> CFG80211_Register
usbcore: registered new interface driver rt2870
exFAT: Version 1.2.9
[Mstar GPIO] gpio(98) to irq(152)
[Mstar GPIO] gpio(99) to irq(153)
[Mstar GPIO] gpio(100) to irq(154)
[PWN] mstar_pwm_config duty_ns=0, period_ns=120000
reg=0x1F003410 clk=12000000, period=0x64
reg=0x1F003408 clk=12000000, u32Duty=0x0
[gpio] Set PAD_SR_IO12 as GPIO(controlled by ISP bank)
[Mstar GPIO] gpio(36) to irq(-1)
Starting mdev...
Try copy log from TF card
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
read-only file system detected...done
Starting network: OK
Starting wifi ......
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
wlan0
++++ ok
Enabling wifi STA mode
Entering service runlevel normal
Teltonika_Router
WPA
killall: udhcpc: no process killed
killall: wpa_supplicant: no process killed
killall: hostapd: no process killed
killall: udhcpd: no process killed
================> UP : RTMP_SEM_EVENT_WAIT(STA)
1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
==>WaitForAsicReady MAC_CSR0=0x76010500
FW Version:0.1.00 Build:7640
Build Time:201301040941____
ILM Length = 44276(bytes)
DLM Length = 0(bytes)
Loading FW....
miio_qrcode: set for deactivation
rescan triggered for deactivation set on 1 service
fetch_av: set for activation
rescan triggered for activation set on 1 service
miio_agent: set for activation
rescan triggered for activation set on 1 service
miio_alarm: set for activation
rescan triggered for activation set on 1 service
miio_algo: set for activation
rescan triggered for activation set on 1 service
miio_client: set for activation
rescan triggered for activation set on 1 service
miio_client_helper: set for activation
rescan triggered for activation set on 1 service
miio_devicekit: set for activation
rescan triggered for activation set on 1 service
miio_nas: set for activation
rescan triggered for activation set on 1 service
miio_ota: set for activation
rescan triggered for activation set on 1 service
miio_record: set for activation
rescan triggered for activation set on 1 service
miio_sdcard: set for activation
rescan triggered for activation set on 1 service
miio_stream: set for activation
rescan triggered for activation set on 1 service
[Mstar GPIO] gpio(18) to irq(-1)
[Mstar GPIO] gpio(83) to irq(166)
[Mstar GPIO] gpio(78) to irq(182)
mortox: set for activation
rescan triggered for activation set on 1 service
########DBG(Change PMU LEVEL)
RTMP_TimerListAdd: add timer obj c4b75cec!
RTMP_TimerListAdd: add timer obj c4b75d1c!
RTMP_TimerListAdd: add timer obj c4b75d4c!
Starting crond...
RTMP_TimerListAdd: add timer obj c4b75cbc!
RTMP_TimerListAdd: add timer obj c4b75c2c!
RTMP_TimerListAdd: add timer obj c4b75c5c!
RTMP_TimerListAdd: add timer obj c4b0a264!
RTMP_TimerListAdd: add timer obj c4af6ad4!
RTMP_TimerListAdd: add timer obj c4af6b08!
Start detecting tf_recovery.img
/mnt/sdcard/tf_recovery.img not exist
RTMP_TimerListAdd: add timer obj c4b0a304!
Starting netcheck...
RTMP_TimerListAdd: add timer obj c4af9484!
RTMP_TimerListAdd: add timer obj c4af8cc4!
RTMP_TimerListAdd: add timer obj c4af9450!
RTMP_TimerListAdd: add timer obj c4af97b0!
RTMP_TimerListAdd: add timer obj c4af94b8!

Welcome to Mijia_camera.
mijia_camera login: RTMP_TimerListAdd: add timer obj c4af94ec!
RTMP_TimerListAdd: add timer obj c4af9520!
RTMP_TimerListAdd: add timer obj c4a517fc!
RTMP_TimerListAdd: add timer obj c4a5103c!
RTMP_TimerListAdd: add timer obj c4a517c8!
RTMP_TimerListAdd: add timer obj c4a51b28!
RTMP_TimerListAdd: add timer obj c4a51a4c!
RTMP_TimerListAdd: add timer obj c4a88b74!
RTMP_TimerListAdd: add timer obj c4a883b4!
RTMP_TimerListAdd: add timer obj c4a88b40!
RTMP_TimerListAdd: add timer obj c4a88ea0!
RTMP_TimerListAdd: add timer obj c4a88ba8!
RTMP_TimerListAdd: add timer obj c4a88bdc!
RTMP_TimerListAdd: add timer obj c4a88c10!
RTMP_TimerListAdd: add timer obj c4b0a204!
RTMP_TimerListAdd: add timer obj c4b0a2d4!
RTMP_TimerListAdd: add timer obj c4bcdb98!
RTMP_TimerListAdd: add timer obj c4bcdbc8!
RTMP_TimerListAdd: add timer obj c4bcdbf8!
RTMP_TimerListAdd: add timer obj c4bcdc28!
RTMP_TimerListAdd: add timer obj c4bcdc58!
RTMP_TimerListAdd: add timer obj c4bcdc8c!
RTMP_TimerListAdd: add timer obj c4b75c8c!
RTMP_TimerListAdd: add timer obj c4af5aec!
RTMP_TimerListAdd: add timer obj c4af5abc!
RTMP_TimerListAdd: add timer obj c4af5a8c!
RTMP_TimerListAdd: add timer obj c4b0a234!
P2pGroupTabInit .
P2pScanChannelDefault <=== count = 3, Channels are 1, 6,11 separately
P2pCfgInit::
==>WaitForAsicReady MAC_CSR0=0x76010500
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
###### Force at HT20 (BW_20) mode !!! ########
1. Phy Mode = 14
2. Phy Mode = 14
NVM is Efuse and its size =1d[1e0-1fc]
ERROR!!! MT7601 E2PROM: WRONG VERSION 0xd, should be 9
3. Phy Mode = 14
AntCfgInit: primary/secondary ant 0/1
---> InitFrequencyCalibration
InitFrequencyCalibrationMode:Unknow mode = 3
InitFrequencyCalibration: frequency offset in the EEPROM = 99(0x63)
<--- InitFrequencyCalibration
RTMPSetPhyMode: channel is out of range, use first channel=1
MCS Set = ff 00 00 00 01
<==== STA : rt28xx_init, Status=0
80211> re-init bands...
80211> RFICType = 1
NumOfChan ===> 14
80211> Number of channel = 0x44
80211> Number of rate = 12
80211> CurTxPower = 0 dBm
80211> TxStream = 1
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
<================ UP : RTMP_SEM_EVENT_UP(STA)
Successfully initialized wpa_supplicant
MSYS: DMEM request: [ISP_MLOAD]:0x000088E0
rfkill: Cannot open RFKILL control device
80211> CFG80211_OpsPmksaFlush ==>
Successfully initialized wpa_supplicant
MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
rfkill: Cannot open RFKILL control device
MT7601_ChipSwitchChannel: SwitchChannel#2(RF=15, 1T)
80211> CFG80211_OpsPmksaFlush ==>
ctrl_iface exists and seems to be in use - cannot override it
Delete '/var/run/wpa_supplicant/wlan0' manually if it is not used anymore
Failed to initialize control interface '/var/run/wpa_supplicant'.
You may have another wpa_supplicant process already running or the file was
left by an unclean termination of wpa_supplicant in which case you will need
to manually remove this file before starting wpa_supplicant again.

nl80211: deinit ifname=wlan0 disabled_11b_rates=0
MSYS: DMEM request: [DLC_MEM]:0x00000400
MT7601_ChipSwitchChannel: SwitchChannel#3(RF=15, 1T)
[DRVSCLDMA] Double Buffer Status :0
chuangmi_camera_ipc013d
[HVSP1] Size must be align 16, Vsize=1080, Pitch=1920
[HVSP1] Buffer is single, Vsize=1080, Pitch=1920
udhcpc: started,MSYS: DMEM request: [SCL_MCNR_YC]:0x003FC000
 v1.28.1
MSYS: DMEM kept entry found: name=SCL_MCNR_YC, phys=0x239F0000, length=0x003FC000
MSYS: DMEM request: [SCL_MCNR_M]:0x000FF000
MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
MSYS: DMEM kept entry found: name=SCL_MCNR_M, phys=0x238F0000, length=0x000FF000
[HVSP1]: MCNR YC: Phy:239f0000  Vir:c39f0000
[HVSP1]: MCNR CIIR: Phy:0  Vir:0
[HVSP1]: MCNR M: Phy:238f0000  Vir:c38f0000
MSYS: DMEM request: [VSPL-I0P0B0]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P0B0, phys=0x231D0000, length=0x0005A000
MT7601_ChipSwitchChannel: SwitchChannel#5(RF=15, 1T)
MSYS: DMEM request: [VSPL-I0P0B1]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P0B1, phys=0x23170000, length=0x0005A000
H2BR@v0.0.00:vsi rq-controller
MSYS: DMEM request: [MS-00]:0x00357000
MSYS: DMEM kept entry found: name=MS-00, phys=0x23590000, length=0x00357000
MSYS: DMEM request: [MS-01]:0x00357000
MSYS: DMEM kept entry found: name=MS-01, phys=0x23230000, length=0x00357000
MSYS: DMEM request: [VENC-32]:0x000CC000
hrqc_set_conf - skip set RQCT_CFG_SEQ
MSYS: DMEM kept entry found: name=VENC-32, phys=0x22D00000, length=0x000CC000
MT7601_ChipSwitchChannel: SwitchChannel#6(RF=15, 1T)
vhe-skip set RQCT_CFG_FPS(30720/1024)
hrqc_set_conf - skip set RQCT_CFG_SEQ
MSYS: DMEM request: [S0:VENCDMOUT]:0x0000A800
MSYS: DMEM kept entry found: name=S0:VENCDMOUT, phys=0x22FC0000, length=0x0000A800
udhcpc: sending MSYS: DMEM request: [S0:VENCDMP0]:0x0007F800
discover
MSYS: DMEM kept entry found: name=S0:VENCDMP0, phys=0x22F40000, length=0x0007F800
MSYS: DMEM request: [S0:VENCDMP1]:0x0007F800
MSYS: DMEM kept entry found: name=S0:VENCDMP1, phys=0x22EC0000, length=0x0007F800
H2BR@v0.0.00:vsi rq-controller
MSYS: DMEM request: [VSPL-I0P1B0]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P1B0, phys=0x23110000, length=0x0005A000
MSYS: DMEM request: [VSPL-I0P1B1]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P1B1, phys=0x230B0000, length=0x0005A000
MSYS: DMEM request: [VENC-48]:0x0001E000
hrqc_set_conf - skip set RQCT_CFG_SEQ
vhe-skip set RQCT_CFG_FPS(30720/1024)
MSYS: DMEM kept entry found: name=VENC-48, phys=0x22CE0000, length=0x0001E000
hrqc_set_conf - skip set RQCT_CFG_SEQ
MSYS: DMEM request: [S1:VENCDMOUT]:0x0000A100
MSYS: DMEM kept entry found: name=S1:VENCDMOUT, phys=0x22EB0000, length=0x0000A100
MSYS: DMEM request: [S1:VENCDMP0]:0x00069F00
vhe-return buffer is null
MT7601_ChipSwitchChannel: SwitchChannel#7(RF=15, 1T)
MSYS: dmem realloc S1:VENCDMP0
MSYS: DMEM [S1:VENCDMP0]@0x22E40000 successfully released
MSYS: DMEM request: [S1:VENCDMP1]:0x00069F00
MSYS: dmem realloc S1:VENCDMP1
MSYS: DMEM [S1:VENCDMP1]@0x22DD0000 successfully released
MSYS: DMEM request: [VSPL-I0P2B0]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P2B0, phys=0x23050000, length=0x0005A000
MSYS: DMEM request: [VSPL-I0P2B1]:0x0005A000
MSYS: DMEM kept entry found: name=VSPL-I0P2B1, phys=0x22FF0000, length=0x0005A000
MSYS: DMEM request: [VENC-49]:0x0001E000
MSYS: DMEM kept entry found: name=VENC-49, phys=0x22CC0000, length=0x0001E000
MSYS: DMEM request: [VSPL-I0P3B0]:0x00016800
MSYS: DMEM kept entry found: name=VSPL-I0P3B0, phys=0x22FD0000, length=0x00016800
vhe-return buffer is null
MT7601_ChipSwitchChannel: SwitchChannel#8(RF=15, 1T)
MT7601_ChipSwitchChannel: SwitchChannel#9(RF=15, 1T)
[Mstar GPIO] gpio(17) to irq(-1)
MSYS: DMEM request: [VSPL-I0P3B0]:0x00016800
MSYS: DMEM kept entry found: name=VSPL-I0P3B0, phys=0x22FD0000, length=0x00016800
MT7601_ChipSwitchChannel: SwitchChannel#10(RF=15, 1T)
[PWN] mstar_pwm_config duty_ns=0, period_ns=120000
reg=0x1F003410 clk=12000000, period=0x64
reg=0x1F003408 clk=12000000, u32Duty=0x0
[PWN] mstar_pwm_config duty_ns=0, period_ns=120000
reg=0x1F003410 clk=12000000, period=0x64
reg=0x1F003408 clk=12000000, u32Duty=0x0
MT7601_ChipSwitchChannel: SwitchChannel#11(RF=15, 1T)
MT7601_ChipSwitchChannel: SwitchChannel#12(RF=15, 1T)
MT7601_ChipSwitchChannel: SwitchChannel#13(RF=15, 1T)
MT7601_ChipSwitchChannel: SwitchChannel#1(RF=15, 1T)
80211> cfg80211_scan_done
[1114][Debug][CFG80211OS_ScanEnd] FlgIsAborted = 0
#####check WPS IE
ConnInfo.bWpsConnection ===> Not WPS IE
80211> Connect bssid 3c:37:86:29:14:07
CNTL - iterate BSS 0 of 4
MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
PeerBeaconAtJoinAction(): HT-CtrlChannel=4, CentralChannel=>4
PeerBeaconAtJoinAction(): Set CentralChannel=4
MT7601_ChipSwitchChannel: SwitchChannel#4(RF=15, 1T)
udhcpc: performing DHCP renew
udhcpc: sending discover
RTMP_TimerListAdd: add timer obj c4bc5ab0!
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
Rcv Wcid(1) AddBAReq
Start Seq = 00000002
RTMP_TimerListAdd: add timer obj c4bc7ad0!
udhcpc: sending select for 10.0.0.68
udhcpc: lease of 10.0.0.68 obtained, lease time 86400
deleting routers
adding dns 10.0.0.1
get ip addr :
10.0.0.68

[ppisljar]

it complains about not being able to read the file ....

[ppisljar]

tried different card ... looking good:

IPL gd156225
D-01.
HW Reset
64MB
BIST0_0001-OK
offset:00010000
size:7fc8 chks:5551a134 ok

IPL_CUST gbf16da4
MXP found at 0x00020000
  decomp_size=0x0004ad24

U-Boot 2015.01 (Dec 21 2018 - 17:50:28), Build: jenkins-IPC013D_english-133

Version: I3g574ecbf
DEVINFO: 313E
[WDT] Enalbe WATCHDOG 60s
       Watchdog enabled
I2C:   ready
DRAM:  64 MiB
gpio[100] is 1
WARNING: Caches not enabled
MMC:   MStar SD/MMC: 0
nor_flash_mxp allocated success!!
Flash is detected (0x090F, 0x1C, 0x70, 0x18)
SF: Detected nor0 with total size 16 MiB
MXP found at mxp_offset[1]=0x00020000, size=0x1000
env_offset=0x4F000 env_size=0x1000
Flash is detected (0x090F, 0x1C, 0x70, 0x18)
SF: Detected nor0 with total size 16 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   MAC Address 00:30:1B:BA:02:DB
Auto-Negotiation...
AN failLink Status Speed:10 Full-duplex:0
Status Error!
mstar_emac
Warning: mstar_emac using MAC address from net device

read file start
reading tf_recovery.img
read len = 0, actlen = 16318544
data check start
Verifying singature using libsodium
Hashing 1048576 bytes, 0 %
Hashing 1048576 bytes, 6 %
Hashing 1048576 bytes, 12 %
Hashing 1048576 bytes, 19 %
Hashing 1048576 bytes, 25 %
Hashing 1048576 bytes, 32 %
Hashing 1048576 bytes, 38 %
Hashing 1048576 bytes, 44 %
Hashing 1048576 bytes, 51 %
Hashing 1048576 bytes, 57 %

[ppisljar]

yeey flashed.

can you maybe answer my above question about other xiaomi camera hacks ? each one is for different IC ? or do some of the hacks target the same IC ? how hard would it be to take some of the features and bring it in, or add support for our devices to one of the projects with more features ?

[crckmc]

@ppisljar as far as I know the yi and dafang cameras have a different chipset/software so I think it would be hard to port the features of the other hacks

[telmomarques]

Great work guys, glad you got it working!

[MarcosAndre]

Sorry guys, I have a camera with that module, can you help me to add the Telmo hacks?

[MarcosAndre]

@ppisljar :)

[cokete]

yeey flashed.

can you maybe answer my above question about other xiaomi camera hacks ? each one is for different IC ? or do some of the hacks target the same IC ? how hard would it be to take some of the features and bring it in, or add support for our devices to one of the projects with more features ?

have you been able to flash it? Can you explain us, please?

@ppisljar

[edugrt]

@MarcosAndre, hey, did you manage to flash it?

[MarcosAndre]

Nop, I prefer to wait for a stable version.

[ppisljar]

sorry to disappear, update from my side: managed to flash the camera but the firmware doesn't work out of the box and i gave up

[edugrt]

Hi, @telmomarques. Would you be able to tell us how hard would it be to adapt the firmware to this model version also? I’d like to know if I could help in any way. Thanks!