Since one incident, I've bought cameras to observe the area around my house. One of them (the first one I bought) is produced by Foscam, model FI9900P V1. Unfortunately, my camera broke on the last day of warranty. I packed it quickly and sent it to get the warranty repair. The repair lasted over a month, but the camera didn't work anyway, was as broken as before sending it. I decided to face the repair myself. With no experience in repairing similar things, it is really hard to find the point where to start.
In my case, I've been plugging the camera and watching the wireshark network traffic to see if the camera is trying to retrieve an address from dhcp (there was not a single packet), if it will configure itself on APIPA addresses in the absence of dhcp, or if I can finally connect to it on the default ip. Nothing.
The next step was to update the firmware. I contacted foscam company, described my problem and asked for help. I got a file with the firmware and instructions how to upload it to the camera.
The way was to place the file on a microsd card and connect this card to the camera. In theory, the camera should detect the presence of the magic file and flash it. In practice, nothing happened.
Looking for a solution in the Internet I found instructions how to connect the serial port to the camera (or other devices) and how to connect to the bootloader and flash from that level. And here begins the adventure, which I will describe.
Looking for information on how to connect to the camera in an emergency/service manner, I found out about serial connectors in such devices, which allow to connect to the operating system supporting the camera. You just have to look for the connector.
For connection I used a USB-TTL chip, in which it is necessary to set the jumper to 3.3V (the default is 5V).
After connecting the whole thing to the computer, you can run putty and connect to the serial port with the speed set to 115200 baud.
After the camera is switched on, a login terminal appeared on the screen and asked for a password.
Looking for it on google I came across an article where someone found this password and made it available, here it is: "ipc.fos~". The article where I found it is here: https://ipcamtalk.com/threads/bricked-foscam-fi9828p.12322/page-3
After typing, I saw the command line and could start my attempts.
BCH corrected failed (0xC00003FB)!
BCH corrected failed (0xC00003FB)!
BCH corrected failed (0xC00003FA)!
BCH corrected failed (0xC00003FB)!
___ ___ _________ _
/ _ \ | \/ || ___ \ | |
/ /_\ \| . . || |_/ / ___ ___ | |_
| _ || |\/| || ___ \ / _ \ / _ \ | __|
| | | || | | || |_/ /| (_) || (_) || |_
\_| |_/\_| |_/\____/ \___/ \___/ \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2014
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x3007005B POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
1st input Passwd:
2st input Passwd:
amboot> ~help
'~help' is not a recognized command! Type 'help' for help...
amboot> help
The following commands are supported:
r32 w32 boot erase
help reboot setenv show
memtest fs fdt nand
usbdl gpio tftp ping
sd
amboot> boot
pri image absent... skipping
sec image absent... skipping
amboot> printenv
'printenv' is not a recognized command! Type 'help' for help...
amboot> setenv eth 1 ip 192.168.1.2
amboot> setenv eth 1 gw 192.168.1.1
amboot> show netboot
amboot> ping
Help for 'ping':
ping [addr]
PING a host
amboot> ping 192.168.1.1
alive!
amboot> tftp
Help for 'tftp':
tftp boot [cmdline]
tftp program [file_name] [addr] [exec]
Load images from TFTP server
amboot> tftp boot
Invalid jump address
amboot> tftp program recover-
downloading [recover-]:
failed!
Download recover- fail ...
amboot>
amboot> tftp program recover_image_amba.bin
downloading [recover_image_amba.bin]:
................................................................
................................................................
.................................... got 43119712 bytes
Jumping to 0x00100000
tftp program recover_image_amba.bin 1048576
I learned a few interesting things (such as how to clip into an amboot), but I keep the subject open. I will have to take a closer look at the firmware files, maybe something will come out of them that will allow me to continue.
Until then, it seems I need to put another thing on my "to-learn" list.
amboot> tftp program f1.bin
downloading [f1.bin]:
................................................................
................................................................
................................................................
............................................... got 62718924 bytes
Jumping to 0x00100000
------------------------------------------------------
In-memory Firmware Flash Programming Utility (by C.C.)
Ambarella(R) Copyright (C) 2004-2008
------------------------------------------------------
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x3007005B POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
hook_pre_memfwprog
Get ptb failed
PTB load error!
bst code found in firmware!
crc32: 0xF1AE78BA
ver_num: 1.3
ver_date: 2016/6/4
img_len: 2048
mem_addr: 0x00000000
flag: 0x00000001
magic: 0xA324EB90
verifying image crc ... done
program bst into NAND
PTB on flash is outdated, sanitizing ...
program ok
bld code found in firmware!
crc32: 0x5C6844A4
ver_num: 1.3
ver_date: 2016/6/4
img_len: 193736
mem_addr: 0x00000000
flag: 0x00000000
magic: 0xA324EB90
verifying image crc ... done
program bld into NAND
progress: 100%
program ok
pba code found in firmware!
crc32: 0xB1A95A68
ver_num: 0.1
ver_date: 2016/6/4
img_len: 15210320
mem_addr: 0x00208000
flag: 0x00000002
magic: 0xA324EB90
verifying image crc ... done
program pba into NAND
progress: 100%
program ok
pri code found in firmware!
crc32: 0xAB720FD2
ver_num: 0.1
ver_date: 2016/6/4
img_len: 5240072
mem_addr: 0x00208000
flag: 0x00000000
magic: 0xA324EB90
verifying image crc ... done
program pri into NAND
progress: 100%
program ok
lnx code found in firmware!
crc32: 0xDBE61D38
ver_num: 0.1
ver_date: 2016/6/4
img_len: 39976960
mem_addr: 0x00000000
flag: 0x00000001
magic: 0xA324EB90
verifying image crc ... done
program lnx into NAND
late developed bad block.
Try next block...
program ok
add code found in firmware!
crc32: 0x950F20A4
ver_num: 0.1
ver_date: 2016/6/4
img_len: 1966080
mem_addr: 0x00000000
flag: 0x00000001
magic: 0xA324EB90
verifying image crc ... done
program add into NAND
progress: 100%
program ok
DTB found in firmware!
program ok
------ Report ------
bst: success
bld: success
pba: success
pri: success
lnx: success
add: success
hook_post_memfwprog
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.10.73 (root@foscam-virtual-machine) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #1 PREEMPT Tue Nov 17 11:33:40 CST 2015
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9
[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0
[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000
[ 0.000000] CPU: All CPU(s) started in SVC mode.
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940
[ 0.000000] Kernel command line: console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 110MB = 110MB total
[ 0.000000] Memory: 106280k/106280k available, 6360k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x87000000 - 0xff000000 (1920 MB)
[ 0.000000] lowmem : 0x80000000 - 0x86e00000 ( 110 MB)
[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 MB)
[ 0.000000] .text : 0x80008000 - 0x804a30d4 (4717 kB)
[ 0.000000] .init : 0x804a4000 - 0x804c77b4 ( 142 kB)
[ 0.000000] .data : 0x804c8000 - 0x80507508 ( 254 kB)
[ 0.000000] .bss : 0x80507508 - 0x80527778 ( 129 kB)
[ 0.000000] NR_IRQS:240
[ 0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.233814] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[ 0.292607] pid_max: default: 32768 minimum: 301
[ 0.297299] Mount-cache hash table entries: 512
[ 0.304085] CPU: Testing write buffer coherency: ok
[ 0.309231] Setting up static identity map for 0x8037fb48 - 0x8037fbb8
[ 0.318027] devtmpfs: initialized
[ 0.322606] pinctrl core: initialized pinctrl subsystem
[ 0.328049] NET: Registered protocol family 16
[ 0.333265] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.340670] L310 cache controller enabled
[ 0.344671] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[ 0.354201] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[ 0.362204] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[ 0.372211] bio: create slab at 0
[ 0.377257] ambarella-dma e0005000.dma: Ambarella DMA Engine
[ 0.384385] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[ 0.391368] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[ 0.399317] Switching to clocksource ambarella-cs-timer
[ 0.404620] cfg80211: Calling CRDA to update world regulatory domain
[ 0.417618] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[ 0.425928] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 0.434798] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[ 0.511127] ambarella-sd e0002000.sdmmc0: 1 slots @ 24000000Hz
[ 0.517110] NET: Registered protocol family 2
[ 0.522259] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.529225] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.536635] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.543049] TCP: reno registered
[ 0.546266] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.552109] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.558528] NET: Registered protocol family 1
[ 0.563180] RPC: Registered named UNIX socket transport module.
[ 0.569082] RPC: Registered udp transport module.
[ 0.573814] RPC: Registered tcp transport module.
[ 0.578497] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.585301] ambarella-adc e801d000.adc: Ambarella ADC driver init
[ 0.593101] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.599297] msgmni has been set to 207
[ 0.604360] NET: Registered protocol family 38
[ 0.608882] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.616417] io scheduler noop registered
[ 0.620323] io scheduler deadline registered
[ 0.624623] io scheduler cfq registered (default)
[ 0.629777] ambarella-fb ambarella-fb.0: ambfb_probe: use prealloc.
[ 0.636320] ambarella-fb ambarella-fb.0: probe p[320x240] v[320x480] c[16] b[0] l[1280] @ [0x00100000:0x00100000]!
[ 0.647006] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[ 0.654772] brd: module loaded
[ 0.660413] loop: module loaded
[ 0.666184] ambarella-nand e0001000.nand: in ecc-[6]bit mode
[ 0.671868] ambarella_nand: Use On Flash BBT
[ 0.676204] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[ 0.688827] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003ff), addr is 0x[7fe0000]!
[ 0.697739] Bad block table found at page 65472, version 0x01
[ 0.703598] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003ff), addr is 0x[7fe0000]!
[ 0.712613] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fe), addr is 0x[7fc0000]!
[ 0.721492] Bad block table found at page 65408, version 0x01
[ 0.727350] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003ff), addr is 0x[7fe0000]!
[ 0.736229] nand_bbt: ECC error in BBT at 0x000007fe0005
[ 0.741665] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fe), addr is 0x[7fc0000]!
[ 0.750527] nand_bbt: ECC error in BBT at 0x000007fc0005
[ 0.755830] Scanning device for bad blocks
[ 1.014830] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fa), addr is 0x[7f40000]!
[ 1.023961] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fb), addr is 0x[7f60000]!
[ 1.033086] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fc), addr is 0x[7f80000]!
[ 1.041948] Bad eraseblock 1020 at 0x000007f80000
[ 1.046761] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fd), addr is 0x[7fa0000]!
[ 1.055621] Bad eraseblock 1021 at 0x000007fa0000
[ 1.060435] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fe), addr is 0x[7fc0000]!
[ 1.069298] Bad eraseblock 1022 at 0x000007fc0000
[ 1.074124] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003ff), addr is 0x[7fe0000]!
[ 1.082984] Bad eraseblock 1023 at 0x000007fe0000
[ 1.087666] No space left to write bad block table
[ 1.092530] ambarella-nand: probe of e0001000.nand failed with error -28
[ 1.099635] ambarella-spi e0020000.spi: SPI[0] uses DMA
[ 1.105044] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.
[ 1.171068] libphy: Ambarella MII Bus: probed
[ 1.175889] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[ 1.183137] ambarella-eth e000e000.ethernet: MAC Address[00:62:6e:68:2b:a0].
[ 1.190447] mousedev: PS/2 mouse device common for all mice
[ 1.196349] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[ 1.204064] i2c /dev entries driver
[ 1.208147] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[ 1.215196] TCP: cubic registered
[ 1.218495] Initializing XFRM netlink socket
[ 1.222789] NET: Registered protocol family 17
[ 1.227292] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 1.234946] ThumbEE CPU extension supported.
[ 1.240455] UBI error: ubi_init: UBI error: cannot initialize UBI, error -2
[ 1.247499] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)
[ 1.257027] UBIFS error (pid 1): ubifs_mount: cannot open "ubi0:rootfs", error -19
[ 1.264625] VFS: Cannot open root device "ubi0:rootfs" or unknown-block(0,0): error -19
[ 1.272618] Please append a correct "root=" boot option; here are the available partitions:
[ 1.280953] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.289194] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
[ 1.295044] [<800133ac>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[ 1.303642] [<80011a14>] (show_stack+0x10/0x14) from [<8037993c>] (panic+0xa4/0x1e0)
[ 1.311379] [<8037993c>] (panic+0xa4/0x1e0) from [<804a4f94>] (mount_block_root+0x1d4/0x278)
[ 1.319800] [<804a4f94>] (mount_block_root+0x1d4/0x278) from [<804a5304>] (prepare_namespace+0xa8/0x1d4)
[ 1.329259] [<804a5304>] (prepare_namespace+0xa8/0x1d4) from [<804a4c1c>] (kernel_init_freeable+0x1b0/0x1c0)
[ 1.339074] [<804a4c1c>] (kernel_init_freeable+0x1b0/0x1c0) from [<803788e8>] (kernel_init+0xc/0x154)
[ 1.348276] [<803788e8>] (kernel_init+0xc/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[ 1.014830] ambarella-nand e0001000.nand: BCH corrected failed (0xc00003fa), addr is 0x[7f40000]![ 1.087666] No space left to write bad block table[ 1.257027] UBIFS error (pid 1): ubifs_mount: cannot open "ubi0:rootfs", error -19
___ ___ _________ _
/ _ \ | \/ || ___ \ | |
/ /_\ \| . . || |_/ / ___ ___ | |_
| _ || |\/| || ___ \ / _ \ / _ \ | __|
| | | || | | || |_/ /| (_) || (_) || |_
\_| |_/\_| |_/\____/ \___/ \___/ \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2014
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x3007005B POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
1st input Passwd:
2st input Passwd:
amboot> help
The following commands are supported:
r32 w32 boot erase
help reboot setenv show
memtest fs fdt nand
usbdl gpio tftp ping
sd
Use 'help' to get help on a specific command
amboot> nand
Help for 'nand':
nand show bb|bbt|partition
nand erase bbt
nand erase BLOCK BLOCKS
nand markbad BLOCK
nand rclm init|late|other|all
nand verify free|all|BLOCK [no_ecc]
nand dump PAGE [PAGES] [no_ecc]
nand prog PAGE [PAGES] [no_ecc] [BITFLIP]
nand speed [free]|[BLOCK BLOCKS]
amboot> nand verify all
running nand stress test ...
press any key to terminate!
start_block = 0, blocks = 1024
................ 559/1024 (54%)
nand verify data error count 1
failed at block 570
................ 1023/1024 (99%)
total bad blocks: 1
done!
amboot> erase
partition needs to be specified!
Help for 'erase':
erase [bst|ptb|bld|spl|pba|pri|sec|bak|rmd|rom|dsp|lnx|raw|all|os]
Where [os] means pba,pri,sec,bak,rmd,rom,dsp,lnx,swp,add,adc
[all] means full chip.
Erase a parition as specified
amboot> erase all
erase all ...
amboot> tftp program f1.bin
Invalid: tftpd!
But after restarting.....
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.10.73 (root@foscam-virtual-machine) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #1 PREEMPT Tue Nov 17 11:33:40 CST 2015
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9
[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0
[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000
[ 0.000000] CPU: All CPU(s) started in SVC mode.
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940
[ 0.000000] Kernel command line: console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 110MB = 110MB total
[ 0.000000] Memory: 106280k/106280k available, 6360k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x87000000 - 0xff000000 (1920 MB)
[ 0.000000] lowmem : 0x80000000 - 0x86e00000 ( 110 MB)
[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 MB)
[ 0.000000] .text : 0x80008000 - 0x804a30d4 (4717 kB)
[ 0.000000] .init : 0x804a4000 - 0x804c77b4 ( 142 kB)
[ 0.000000] .data : 0x804c8000 - 0x80507508 ( 254 kB)
[ 0.000000] .bss : 0x80507508 - 0x80527778 ( 129 kB)
[ 0.000000] NR_IRQS:240
[ 0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.233820] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[ 0.292607] pid_max: default: 32768 minimum: 301
[ 0.297300] Mount-cache hash table entries: 512
[ 0.304083] CPU: Testing write buffer coherency: ok
[ 0.309231] Setting up static identity map for 0x8037fb48 - 0x8037fbb8
[ 0.318023] devtmpfs: initialized
[ 0.322590] pinctrl core: initialized pinctrl subsystem
[ 0.328038] NET: Registered protocol family 16
[ 0.333254] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.340657] L310 cache controller enabled
[ 0.344657] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[ 0.354189] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[ 0.362186] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[ 0.372204] bio: create slab at 0
[ 0.377249] ambarella-dma e0005000.dma: Ambarella DMA Engine
[ 0.384373] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[ 0.391358] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[ 0.399289] Switching to clocksource ambarella-cs-timer
[ 0.404595] cfg80211: Calling CRDA to update world regulatory domain
[ 0.417570] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[ 0.425878] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 0.434746] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[ 0.511106] ambarella-sd e0002000.sdmmc0: 1 slots @ 24000000Hz
[ 0.517089] NET: Registered protocol family 2
[ 0.522224] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.529190] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.536600] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.543015] TCP: reno registered
[ 0.546233] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.552077] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.558500] NET: Registered protocol family 1
[ 0.563150] RPC: Registered named UNIX socket transport module.
[ 0.569052] RPC: Registered udp transport module.
[ 0.573788] RPC: Registered tcp transport module.
[ 0.578471] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.585272] ambarella-adc e801d000.adc: Ambarella ADC driver init
[ 0.593077] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.599274] msgmni has been set to 207
[ 0.604332] NET: Registered protocol family 38
[ 0.608854] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.616388] io scheduler noop registered
[ 0.620294] io scheduler deadline registered
[ 0.624595] io scheduler cfq registered (default)
[ 0.629746] ambarella-fb ambarella-fb.0: ambfb_probe: use prealloc.
[ 0.636290] ambarella-fb ambarella-fb.0: probe p[320x240] v[320x480] c[16] b[0] l[1280] @ [0x00100000:0x00100000]!
[ 0.646973] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[ 0.654748] brd: module loaded
[ 0.660393] loop: module loaded
[ 0.666159] ambarella-nand e0001000.nand: in ecc-[6]bit mode
[ 0.671841] ambarella_nand: Use On Flash BBT
[ 0.676162] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[ 0.688796] Bad block table found at page 65472, version 0x01
[ 0.694717] Bad block table found at page 65408, version 0x01
[ 0.700673] 8 ofpart partitions found on MTD device amba_nand
[ 0.706422] Creating 8 MTD partitions on "amba_nand":
[ 0.711471] 0x000000000000-0x000000020000 : "bst"
[ 0.716903] 0x000000020000-0x000000160000 : "bld"
[ 0.722293] 0x000000160000-0x0000002a0000 : "ptb"
[ 0.727624] 0x0000002a0000-0x0000012a0000 : "pba"
[ 0.733006] 0x0000012a0000-0x000001aa0000 : "pri"
[ 0.738340] 0x000001aa0000-0x000004aa0000 : "lnx"
[ 0.743787] 0x000004aa0000-0x0000050a0000 : "add"
[ 0.749156] 0x0000050a0000-0x000007ca0000 : "adc"
[ 0.755019] ambarella-spi e0020000.spi: SPI[0] uses DMA
[ 0.760384] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.
[ 0.821045] libphy: Ambarella MII Bus: probed
[ 0.825887] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[ 0.833177] ambarella-eth e000e000.ethernet: MAC Address[00:62:6e:68:2b:a0].
[ 0.840486] mousedev: PS/2 mouse device common for all mice
[ 0.846399] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[ 0.854131] i2c /dev entries driver
[ 0.858240] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[ 0.865297] TCP: cubic registered
[ 0.868596] Initializing XFRM netlink socket
[ 0.872890] NET: Registered protocol family 17
[ 0.877393] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 0.885048] ThumbEE CPU extension supported.
[ 0.890429] UBI: attaching mtd5 to ubi0
[ 0.992275] UBI: scanning is finished
[ 1.013445] UBI: volume 0 ("rootfs") re-sized from 303 to 360 LEBs
[ 1.020110] UBI: attached mtd5 (name "lnx", size 48 MiB) to ubi0
[ 1.026152] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 1.032934] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 1.039610] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 1.046470] UBI: good PEBs: 384, bad PEBs: 0, corrupted PEBs: 0
[ 1.052376] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 1.059486] UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1994749371
[ 1.068515] UBI: available PEBs: 0, total reserved PEBs: 384, PEBs reserved for bad PEB handling: 20
[ 1.077637] UBI: background thread "ubi_bgt0d" started, PID 41
[ 1.083498] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)
[ 1.156841] UBIFS: background thread "ubifs_bgt0_0" started, PID 42
[ 1.256166] UBIFS: start fixing up free space
[ 5.725922] UBIFS: free space fixup complete
[ 5.741867] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 5.747860] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 5.757015] UBIFS: FS size: 44441600 bytes (42 MiB, 350 LEBs), journal size 6348800 bytes (6 MiB, 50 LEBs)
[ 5.766655] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 5.771704] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 1BC34606-762A-4792-B2EA-BB8F7E3B4CC2, small LPT model
[ 5.783115] VFS: Mounted root (ubifs filesystem) on device 0:12.
[ 5.789659] devtmpfs: mounted
[ 5.792821] Freeing unused kernel memory: 140K (804a4000 - 804c7000)
Welcome to Ambarella Flexible Linux S2LM (2.5.0)!
Expecting device dev-ttyS0.device...
[ OK ] Reached target Remote File Systems.
[ OK ] Reached target Paths.
[ OK ] Reached target Swap.
[ OK ] Created slice Root Slice.
[ OK ] Created slice User and Session Slice.
[ OK ] Listening on /dev/initctl Compatibility Named Pipe.
[ OK ] Listening on Delayed Shutdown Socket.
[ OK ] Listening on Journal Socket (/dev/log).
[ OK ] Listening on udev Control Socket.
[ OK ] Listening on udev Kernel Socket.
[ OK ] Listening on Journal Socket.
[ OK ] Created slice System Slice.
[ OK ] Created slice system-serial\x2dgetty.slice.
Mounting POSIX Message Queue File System...
Starting Create list of required static device nodes...rrent kernel...
Starting udev Coldplug all Devices...
Mounting Debug File System...
Starting Setup Virtual Console...
Starting Load Kernel Modules...
Starting Apply Ambarella Specific Kernel Variables...
Starting Journal Service...
[ OK ] Started Journal Service.
[ OK ] Reached target Slices.
Starting Remount Root and Kernel File Systems...
Mounting Temporary Directory...
[ OK ] Mounted Debug File System.
[ OK ] Mounted POSIX Message Queue File System.
[ OK ] Mounted Temporary Directory.
[ OK ][ 6.534625] dsp: module license 'Proprietary' taints kernel.
Started Create list of required static device nodes ...current kernel.
[ OK ] Started Setup Vi[ 6.583292] Disabling lock debugging due to kernel taint
rtual Console.
[ OK ] Started Apply Ambarella Specific Kernel Variables.
[ OK ] Started Remount Root and Kernel File Systems.
[ 6.663400] Vout notice: vout0:0 probed!
[ 6.667663] Vout notice: vout1:1 probed!
[ OK ] Started udev Coldplug all Devices.
[ 6.766935] VIN: vin0: probed!
[ 6.780268] VIN: vin1: probed!
[ 6.800727] amba_debug_init 248:248.
[ 6.814017] Vout notice: CVBS:0@1 probed!
[ 6.863457] usbcore: registered new interface driver usbfs
[ 6.868987] usbcore: registered new interface driver hub
[ 6.875099] usbcore: registered new device driver usb
[ 6.899394] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 6.920535] ambarella-ehci e0018000.ehci: EHCI Host Controller
[ 6.927172] ambarella-ehci e0018000.ehci: new USB bus registered, assigned bus number 1
[ 6.943720] ambarella-ehci e0018000.ehci: irq 39, io mem 0xe0018000
[ 6.961100] ambarella-ehci e0018000.ehci: USB 2.0 started, EHCI 1.00
[ 6.967535] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 6.989558] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 7.001083] usb usb1: Product: EHCI Host Controller
[ 7.005953] usb usb1: Manufacturer: Linux 3.10.73 ehci_hcd
Starting[ 7.021679] usb usb1: SerialNumber: AmbUSB
Load/Save Rando[ 7.027769] hub 1-0:1.0: USB hub found
m Seed...
[ 7.033682] hub 1-0:1.0: 2 ports detected
Starting Rebuild Hardware Database...
Starting Create System Users...
[FAILED] Failed to start Load Kernel Modules.
See 'systemctl status systemd-modules-load.service' for details.
[ OK ] Started Load/Save Random Seed.
[ OK ] Started Rebuild Hardware Database.
[ OK ] Started Create System Users.
Starting Create Static Device Nodes in /dev...
Mounting Configuration File System...
Starting Apply Kernel Variables...
[ OK ] Mounted Configuration File System.
[ OK ] Started Create Static Device Nodes in /dev.
[ OK ] Started Apply Kernel Variables.
Starting udev Kernel Device Manager...
[ OK ] Reached target Local File Systems (Pre).
[ OK ] Reached target Local File Systems.
[ 7.502867] systemd-udevd[93]: starting version 215
Starting Trigger Flushing of Journal to Persistent Storage...
Starting Rebuild Journal Catalog...
Starting Create Volatile Files and Directories...
[ OK ] Started udev Kernel Device Manager.
[ OK ] Started Rebuild Journal Catalog.
[ OK ] Started Create Volatile Files and Directories.
[ 7.840953] ambarella-udc e0006000.udc: ambarella_udc: version 2 August 2011
[ 7.880929] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 7.904855] systemd-journald[58]: Received request to flush runtime journal from PID 1
[ OK ] Started Trigger Flushing of Journal to Persistent Storage.
[ 7.941785] ambarella-spi-slave e0026000.spi_slave: Ambarella SPI Slave Controller 0 created!
[ 7.985525] ambarella-ohci e0019000.ohci: Ambarella OHCI
[ 7.990857] ambarella-ohci e0019000.ohci: new USB bus registered, assigned bus number 2
[ 8.061299] ambarella-ohci e0019000.ohci: irq 44, io mem 0xe0019000
[ 8.083127] ambarella-crypto f0020000.crypto: Ambarella Media Processor Cryptography Engine probed(interrupt mode).
[ 8.125368] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
[ OK ] Found device /dev/ttyS0.
[ 8.185385] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
Starting Update UTMP about System Boot/Shutdown...
Starting Update is Completed...
[ 8.262751] usb usb2: Product: Ambarella OHCI
[ 8.267102] usb usb2: Manufacturer: Linux 3.10.73 ohci_hcd
[ 8.343707] usb usb2: SerialNumber: AmbUSB
[ OK ] Started Update is Completed.
[ 8.370194] hub 2-0:1.0: USB hub found
[ 8.401972] hub 2-0:1.0: 2 ports detected
[ OK ] Started Update UTMP about System Boot/Shutdown.
[ OK ] Reached target System Initialization.
[ OK ] Listening on D-Bus System Message Bus Socket.
[FAILED] Failed to listen on Journal Gateway Service Socket.
See 'systemctl status systemd-journal-gatewayd.socket' for details.
[ OK ] Reached target Sockets.
[ OK ] Reached target Timers.
Starting Restore Sound Card State...
[ OK ] Reached target Basic System.
Starting /etc/rc.local Compatibility...
[ OK ] Started /etc/rc.local Compatibility.
Starting Login Service...
Starting D-Bus System Message Bus...
[ OK ] Started D-Bus System Message Bus.
[ 8.920738] UBI: attaching mtd6 to ubi1
[ 8.953648] UBI: scanning is finished
[ 8.981135] UBI: volume 1 ("config") re-sized from 13 to 24 LEBs
[ 8.996345] UBI: attached mtd6 (name "add", size 6 MiB) to ubi1
[ 9.002635] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 9.009467] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 9.017146] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 9.024188] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[ 9.030269] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 9.038144] UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 2118889232
[ 9.047464] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 20
[ 9.057256] UBI: background thread "ubi_bgt1d" started, PID 137
[ 9.133143] UBIFS: background thread "ubifs_bgt1_1" started, PID 139
[ 9.173540] UBIFS: start fixing up free space
[ 9.224167] UBIFS: free space fixup complete
Starting Permit User Sessions...
[ OK ] Started Restore Sound Card State.
[ 9.250296] UBIFS: mounted UBI device 1, volume 1, name "config"
[ 9.269592] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ OK ] Started Permit User Sessions.
[ 9.292946] UBIFS: FS size: 1777664 bytes (1 MiB, 14 LEBs), journal size 1142785 bytes (1 MiB, 8 LEBs)
[ 9.312757] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 9.317806] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 7B5453FB-BDE1-4F66-88BE-FF8B1168393A, small LPT model
Starting Serial Getty on ttyS0...
[ OK ] Started Serial Getty on ttyS0.
[ OK ] Reached target Login Prompts.
[ OK ] Started Login Service.
set default system time
[ OK
at Jan 1 08:00:00 UTC 2000
Welcome to Ambarella
Ambarella login: net.core.wmem_max = 5000000
net.core.wmem_default = 5000000
==== Your model name is FI9900P V1 SENSOR=10 WIFI=3 LANGUAGE=2 MODELVERSION=74 MODELNUM=5026 ====
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/bin:/sbin:/bin:/sbin:/tmp/bin
[ 11.821045] SYSCLK:SO[74175824]
[ 11.861026] VIN: OV4689 init(4-lane mipi)
Default init without lens driver
Use default settings
map_size = 0x400000, nr_item = 3
addr_offset = 0x00000000, filename = orccode.bin
addr_offset = 0x00300000, filename = orcme.bin
addr_offset = 0x003a0000, filename = default_binary.bin
mmap returns 0x76aa1000
loading /lib/firmware/orccode.bin...addr = 0x76aa1000, size = 0x16bbc8
loading /lib/firmware/orcme.bin...addr = 0x76da1000, size = 0x4f63c
loading /lib/firmware/default_binary.bin...addr = 0x76e41000, size = 0x40000
===============================
u_code version = 2015/10/23 246559.246766
===============================
load dsplog driver
start load param for diff model:5026
version: 0.2
argv=-n
nvfn=/lib/firmware/broadcom/bcm43143/nvram_wubb-738gn.nvm
argv=/lib/firmware/broadcom/bcm43143/fw_bcmdhd-43143b0-6.10.198.52_r32-cooee.bin.trx
fwfn=/lib/firmware/broadcom/bcm43143/fw_bcmdhd-43143b0-6.10.198.52_r32-cooee.bin.trx
argv=-C
cnt=10
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=0
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=1
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=2
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=3
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=4
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=5
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=6
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=7
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=8
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=9
Vendor 0x1d6b ID 0x1
Vendor 0x1d6b ID 0x2
No devices found
Error: usbdev_init failed... cnt=10
Run out of cnt
ifconfig: SIOCGIFFLAGS: No such device
[ 17.375448] snd_soc_card_s2lmkiwi sound.3: ak4951-hifi <-> e001a000.i2s mapping ok
numid=15,iface=MIXER,name='PMMP Value'
; type=BOOLEAN,access=rw------,values=1
: values=on
[ 17.772353] ambarella-ehci e0018000.ehci: port 2 reset error -110
killall: ImageServer: no process killed
killall: devMng: no process killed
killall: codec: no process killed
killall: UDTMediaServer: no process killed
killall: webService: no process killed
killall: storage: no process killed
killall: FirmwareUpgrade: no process killed
killall: RtspServer: no process killed
killall: NVTService: no process killed
killall: BaiduRtmp: no process killed
LIVE555 Media Server
version 0.77 (LIVE555 Streaming Media library version 2014.02.10).
streamType=-1
Play streams from this server using the URL
rtsp://0.0.0.0:65534/
where is a file present in the current directory.
Each file's type is inferred from its name suffix:
".264" => a H.264 Video Elementary Stream file
".aac" => an AAC Audio (ADTS format) file
".ac3" => an AC-3 Audio file
".amr" => an AMR Audio file
".dv" => a DV Video file
".m4e" => a MPEG-4 Video Elementary Stream file
".mkv" => a Matroska audio+video+(optional)subtitles file
".mp3" => a MPEG-1 or 2 Audio file
".mpg" => a MPEG-1 or 2 Program Stream (audio+video) file
".ts" => a MPEG Transport Stream file
(a ".tsx" index file - if present - provides server 'trick play' support)
".vob" => a VOB (MPEG-2 video with AC-3 audio) file
".wav" => a WAV Audio file
".webm" => a WebM audio(Vorbis)+video(VP8) file
See http://www.live555.com/mediaServer/ for additional documentation.
***note:***
*if you want to get H264 video Stream real-time from IPCam
* is one of a follow value:
"videoMain" => Main code stream of IP Camera Video
"videoSub" => Sub code stream of IP Camera Video
"audio" => Sub code stream of IP Camera Audio
"*.avi" => IP Camera RecordConnection established with kernel.
streamType=-1
time.nist.gov: Unknown host
mkdir: can't create directory '/usr/local/pureftpd': File exists
[ 24.323985] net eth0: adv: sym 0, asym: 0
mkdir: can't create directory '/usr/local/pureftpd/etc': File exists
creatSystemUser
Changing password for ftpuser1
New password:
Bad password: too short
Retype password:
passwd: password for ftpuser1 is unchanged
creatVirtualUser
Password:
Enter it again:
killall: CGIProxy.fcgi: no process killed
killall: lighttpd: no process killed
Lighttpd Server BUILD:Mar 15 2016 11:06:36
WARNING: can't open config file: /usr/local/opensslamb/ssl/openssl.cnf
2000-01-01 08:00:14: (log.c.182) server started foscam
killall: pure-ftpd: no process killed
[ 27.761063] VIN: 4 lane 4M
[ 27.763880] VIN: Linear mode
[ 27.891502] VIN: 4 lane 4M
[ 27.894618] VIN: Linear mode
numid=4,iface=MIXER,name='Digital Output Volume'
; type=INTEGER,access=rw---R--,values=1,min=0,max=255,step=0
: values=220
| dBscale-min=-90.00dB,step=0.50dB,mute=1
[ 28.192408] VIN: 4 lane 4M
[ 28.198333] VIN: Linear mode
>>> pipline:1, hdr_mode:0, expo_num:1, raw_pitch:0
>>> main:size 1920x1088, raw:2688x1520, resolution:10
no translater for filter 10
init 3A done
loop start now
>>> ======= [DONE] mw_start_aaa =======
open /sys/class/backlight/0.pwm_bl/brightness failed!
pwm proc should be opened when dc iris is on!
map_warp: start = 0x741d1000, total size = 0x12000
Dewarp Library Version: Ambarella S2L Dewarp Library-1.3.7 (Last updated: 20150921)
[INFO] dewarp_init: Focal length 1466.773193
[INFO] dewarp_init: Max correction radius is 2304.000000 (FOV = 90 degree)
Input size 2256x1472, offset 212x8
Output size 1920x1080, offset 0x0
Hor Table 61x47, grid 1x1 (32x32)
Ver Table 61x35, grid 1x1 (32x32)
ME1 Ver Table 16x18, grid 1x0 (32x16)
Save hor table to [/tmp/ldc/ldc_hor].
Save ver table to [/tmp/ldc/ldc_ver].
Save ver table to [/tmp/ldc/ldc_me1_ver].
Motion Buffer pitch 480, width 480, height 270
##OnImageServerMsgSetSaturation1
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
[ 29.480938] net eth0: adv: sym 0, asym: 0
killall: udhcpc: no process killed
ifconfig: SIOCGIFFLAGS: No such device
udhcpc (v1.22.1) started
Sending discover...
Sending select for 192.168.1.46...
Lease of 192.168.1.46 obtained, lease time 7200
deleting routers
route: SIOCDELRT: No such process
adding dns 192.168.1.1
adding dns 192.168.1.1
sh: /bin/ppp/pppoe-stop: not found
route: SIOCDELRT: No such device
cp: can't stat '/etc/resolv.conf.bak': No such file or directory
[ 38.046277] usb 2-2: new low-speed USB device number 2 using ambarella-ohci
[ 38.245769] usb 2-2: device descriptor read/64, error -62
[ 38.541104] usb 2-2: device descriptor read/64, error -62
[ 38.831141] usb 2-2: new low-speed USB device number 3 using ambarella-ohci
[ 39.031128] usb 2-2: device descriptor read/64, error -62
[ 39.321143] usb 2-2: device descriptor read/64, error -62
[ 39.611102] usb 2-2: new low-speed USB device number 4 using ambarella-ohci
[ 40.031677] usb 2-2: device not accepting address 4, error -62
[ 40.211099] usb 2-2: new low-speed USB device number 5 using ambarella-ohci
[ 40.631094] usb 2-2: device not accepting address 5, error -62
[ 40.637376] hub 2-0:1.0: unable to enumerate USB device on port 2
[ 41.781184] usb 2-2: new low-speed USB device number 6 using ambarella-ohci
[ 41.981185] usb 2-2: device descriptor read/64, error -62
[ 42.281185] usb 2-2: device descriptor read/64, error -62
[ 42.571099] usb 2-2: new low-speed USB device number 7 using ambarella-ohci
[ 42.771096] usb 2-2: device descriptor read/64, error -62
[ 43.071139] usb 2-2: device descriptor read/64, error -62
[ 43.361222] usb 2-2: new low-speed USB device number 8 using ambarella-ohci
[ 43.801060] usb 2-2: device not accepting address 8, error -62
[ 43.981259] usb 2-2: new low-speed USB device number 9 using ambarella-ohci
[ 44.411075] usb 2-2: device not accepting address 9, error -62
[ 44.418392] hub 2-0:1.0: unable to enumerate USB device on port 2
Connection established with kernel.
[ 48.361211] usb 2-2: new low-speed USB device number 10 using ambarella-ohci
[ 48.551284] usb 2-2: device descriptor read/64, error -62
[ 48.845680] usb 2-2: device descriptor read/64, error -62
[ 49.141100] usb 2-2: new low-speed USB device number 11 using ambarella-ohci
[ 49.331094] usb 2-2: device descriptor read/64, error -62
[ 49.631088] usb 2-2: device descriptor read/64, error -62
[ 49.921186] usb 2-2: new low-speed USB device number 12 using ambarella-ohci
[ 50.341078] usb 2-2: device not accepting address 12, error -62
[ 50.531087] usb 2-2: new low-speed USB device number 13 using ambarella-ohci
[ 50.961140] usb 2-2: device not accepting address 13, error -62
[ 50.968272] hub 2-0:1.0: unable to enumerate USB device on port 2
[ 52.781244] usb 2-2: new low-speed USB device number 14 using ambarella-ohci
[ 52.981259] usb 2-2: device descriptor read/64, error -62
[ 53.271084] usb 2-2: device descriptor read/64, error -62
[ 53.561237] usb 2-2: new low-speed USB device number 15 using ambarella-ohci
[ 53.761193] usb 2-2: device descriptor read/64, error -62
[ 54.051311] usb 2-2: device descriptor read/64, error -62
[ 54.351301] usb 2-2: new low-speed USB device number 16 using ambarella-ohci
[ 54.781168] usb 2-2: device not accepting address 16, error -62
[ 54.971090] usb 2-2: new low-speed USB device number 17 using ambarella-ohci
[ 55.411142] usb 2-2: device not accepting address 17, error -62
[ 55.424126] hub 2-0:1.0: unable to enumerate USB device on port 2
Works!. Thank you Benamin for your firmware, you have saved my camera!
Hi Jaro
ReplyDeleteGot as far flash with TFTPD....
I am looking for FI9900 V3.0 flash file
Any chance helping me out there?
Cheers
Hi, I have reached out to Benamin who has helped me with firmware last time but didn't get answer yet. If he answers, I'll share it. Cheers!
DeleteHi Jaro. No luck with firmware for V3 I assume
DeleteMeanwhile I loaded V5 firmware (tftp program flash_FI9900PV5_1.11.1.13_2.74.1.64.bin) for a test and that loaded correctly (-recovery success-!!!) sort of works, i. e. I can log into the camera again. There is no picture and I think, this is caused by
######easy_setup_iovar
[ 116.481022] ambarella-i2c e8003000.i2c: No ACK from address 0x78, 0:0!
[ 116.487747] ov2735_write_reg(80): VIN: failed(-16): [0x33:0x1]
######easy_setup_iovar
This looks like a specific i2c video device in V5, which is not in V3. This messages keep coming and also cause a slow response the browser interface.
So still need the V3 firmware. I tried FOSCAM.us The only send me sdcard file, but that does not work. Any ideas of how to get to the correct flash file?
Cheers
I tried Foscam support (again) and got flash_FI9900PV3_1.11.1.10_2.74.1.49.bin
DeleteTftp'd it to my FI9900P V3 and now it works.
After that did System upgrade with FI9900PV3_A0E8DE491F67 (FosIPC_F_app_ver2.x.1.79.bin) to
system firmware 1.11.1.10
appl firmware 2.74.1.79
plug-in version 5.1.0.13
I have no clue why it won't go to 1.11.1.13 (tried several times), but all works fine!
This comment has been removed by the author.
DeleteI tried to find a reason why it would not upgrade to 1.11.1.13 and did
Delete"nand verify all"
to see if there was a problem with memory. It finished without failures and then the serial output stopped. Power off/on, reset button, nothing brings back my serial output and tcp/ip (no response from cam) Is it really BRICKED now???
Could I have destroyed the bootloader with that command - no clue why and if the bootlader is part of the ram that could be touched. Any suggestions to further check welcome!!
Hi, it sucks if it doesn't work with serial. I have found only one place which refers to similar situation https://ipcamtalk.com/threads/another-how-to-unbrick-a-huisun-mini-ptz-v2.19484/page-5, but don't give up, somebody has to be first to do it. When you find a way to reflash it, I'll try to dump my camera amboot so you'll have something to put on your flash.
DeleteThanks for your support, Jaro and pointing me to ipcamtalk. I have no clue what the NAND is on my board. There is a small chip called 4951547B. How do I publish a picture of pcb here?
DeleteThe Ambarella chip states "Boot from SPI-NOR, SPI-EEPROM, NAND flash, USB or eMMC" so maybe the SDCARD with special program could upload the boot program to flash. I.e. the SDCARD should be connected to one this i/f. How does Foscam the NAND?. Just a thought....
Found the NAND flash on the back of PCB S34ML01G200TFI000, is
DeleteFLASH - NAND Memory IC 1Gb (128M x 8) Parallel 48-TSOP.
As said in previous post, I think this needs to be programmed by CPU in some way
Hi folks, glad to see there is more and more folks trying to bring back Foscam cameras.
Deletejandemna sorry to hear that „nand *verify* all” somehow bricked your NAND memory.
That command sounds so non destructive.
I wish you luck with finding a way to repair it from sdcard.
I wonder why files provided by foscam for sdcard do not work and we need to use tftp method. Maybe file name must be specific like in recovery guide from Foscam.
They had so simple recovery metod github.com/santeri3700/misc/blob/master/foscam_recovery_images.md
but is looks like excluded firmware is exactly the same version that is present in Foscam V3.
jandemna do you still have that flash_FI9900PV3_1.11.1.10_2.74.1.49.bin ?
I want to try with my camera, maybe I will be able to find some more details based on DEFCON talks about hacking Foscam cameras. Cheers.
Hi Raf Babi,
DeleteYou can download from http://g34.nl/foccam/flash_FI9900PV3_1.11.1.10_2.74.1.49.bin
I still got the cam, but thinks it is useless as I don't know how to get the boot code (or something like that) in the NAND. Maybe you find something. Interesting.
I also have flash_FI9900PV5_1.11.1.13_2.74.1.64.bin and recover_image_amba.bin