概要
クラウンドファンディングで購入したATOM Camが届いたので早速分解する。プログラミングと直接関係あるところまで到達できないと思うが、中身をみてワクワクしよう！
なお、ひととおり分解し終えてから仮組みした状態で写真を撮影している。納品直後は各部品がズレなどなく組み付いていたことだけ銘記しておく。
（2020/04/28: シリアルコンソール上で取得したブートログを追記。）
続編もあります。
分解手順
下面パネルを外す
写真の丸で囲ったネジを外して、矢印で示した部分にツメがあることを意識しながら下面パネルごと脚を外す。
背面パネルを外す
背面パネルが４箇所のツメ（下図の矢印の場所）で止まっているので、一つずつ丁寧に外す。写真には無いが、背面パネルにはコネクタが付いており、FFCでメインのアッセンブリとつながっているので、注意が必要。
カメラモジュールを外す
カメラモジュールは下図の丸で囲ったネジ一本で外れる。他のネジは後ではずすのが正解。
コネクタ基板・スピーカを外す
背面カバーからコネクタ基板を外し、スピーカのコネクタも外す。
カメラモジュールを分解
カメラモジュールはPOWER基板、MCU基板（センサ＋ISP）、LED基板（IR照明＋SDスロット＋マイク）の3枚からなる。
コンポーネント概要
POWER基板
MCU基板
センサ側
ISPはIngenic T31。 メインがMIPSコアで、サブがRISCVコア。RISCVといえば、M5 Stick的なものを思い出す。サブ側でAI処理をやってると憶測。メイン側のOSはOpen WRT系なんじゃないかと憶測。
ISP系の機能はスペック上は良さげ。DOL WDRも持っているとのこと。実際に撮影してみて性能チェックすべし。
センサは見た目では分からないが、スペック的にはSONY IMX290あたりが近いかと。
センサはブートログによると、SmartSens TechnologyのSC2310とのこと。裏面照射型。
なお、レンズホルダを基板から取り外すのはオススメしない。レンズホルダ内にもゴムブロックや薄いガラスプレートが入っていて、不用意に開けると部品がこぼれる。
WiFi側
WiFiコントローラは、Realtek 8189FTVっぽい。
SPI NOR Flashメモリは、EN25QH128Aかと。
UARTについては後述。
LED基板
MEMSマイクが載っている。筐体を見るとマイクの下に焦電センサかリモコン受光部か照度センサかがあるように思えるが、基板上には見当たらず。
レンズ
どこのでしょうね？ レンズホルダの文字がRICOMっぽいが、よく分からず。
（レンズキャップ、ホルダ裏側の保護シールは、撮影時に保護のために付けたもの。）
ブートログ
シリアルターミナルは簡単に見れる。ラズパイ用のUSBシリアルで、写真で図示したGND側端子側から、ラズパイ用USBシリアルの黒・黄・オレンジで接続、115200baud、8N1で普通にみれる。パッドが四角になっているピンがGNDではないので注意。半田付けすると、反対側のピンだけ温まりが悪いことから察しはつくが。
U-Boot SPL 2013.07 (Mar 04 2020 - 15:05:06)
Timer init
CLK stop
PLL init
pll_init:366
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=116 nr = 1 od0 = 1 od1 = 2
cppcr is 07405100
CPM_CPAPCR 0740510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPMPCR 0640510d
nf=100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
CPM_CPVPCR 0640510d
cppcr 0x9a7b5510
apll_freq 1392000000
mpll_freq 1200000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 600000000
cclk 1392000000
l2clk 696000000
h0clk 240000000
h2clk 240000000
pclk 120000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11: 00000004
ddr_inno_phy_init ..! 22: 00000006
ddr_inno_phy_init ..! 33: 00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00f73011
T31_0x5: 00000007
T31_0x15: 0000000c
T31_0x4: 00000000
T31_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T31_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T31_118: 0000003c
T31_158: 0000003c
T31_190: 0000001e
T31_194: 0000001c
jz-04 : 0x00000051
jz-08 : 0x000000a0
jz-28 : 0x00000024
DDR PHY init OK
INNO_DQ_WIDTH :00000003
INNO_PLL_FBDIV :00000014
INNO_PLL_PDIV :00000005
INNO_MEM_CFG :00000051
INNO_PLL_CTRL :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL :00000006
INNO_CL :00000007
DDR Controller init
DDRC_STATUS 0x80000001
DDRC_CFG 0x0ae88a42
DDRC_CTRL 0x0000891c
DDRC_LMR 0x00400008
DDRC_DLP 0x00000000
DDRC_TIMING1 0x050f0a06
DDRC_TIMING2 0x021c0a07
DDRC_TIMING3 0x200a0722
DDRC_TIMING4 0x26240031
DDRC_TIMING5 0xff060405
DDRC_TIMING6 0x321c0505
DDRC_REFCNT 0x00911a03
DDRC_MMAP0 0x000020f8
DDRC_MMAP1 0x00002800
DDRC_REMAP1 0x03020100
DDRC_REMAP2 0x07060504
DDRC_REMAP3 0x0b0a0908
DDRC_REMAP4 0x0f0e0d0c
DDRC_REMAP5 0x13121110
DDRC_AUTOSR_EN 0x00000000
sdram init finished
SDRAM init ok
board_init_r
image entry point: 0x80100000
U-Boot 2013.07 (Mar 04 2020 - 15:05:06)
Board: ISVP (Ingenic XBurst T31 SoC)
DRAM: 128 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 405k for U-Boot at: 83f98000
Reserving 32784k for malloc() at: 81f94000
Reserving 32 Bytes for Board Info at: 81f93fe0
Reserving 124 Bytes for Global Data at: 81f93f64
Reserving 128k for boot params() at: 81f73f64
Stack Pointer at: 81f73f48
Now running in RAM - U-Boot at: 83f98000
MMC: msc: 0
the manufacturer 1c
SF: Detected EN25QH128A
In: serial
Out: serial
Err: serial
misc_init_r before change the wifi_enable_gpio
gpio_request lable = wifi_enable_gpio gpio = 57
misc_init_r after gpio_request the wifi_enable_gpio ret is 57
misc_init_r after change the wifi_enable_gpio ret is 0
misc_init_r before change the yellow_gpio
gpio_request lable = yellow_gpio gpio = 38
misc_init_r after gpio_request the yellow_gpio ret is 38
misc_init_r after change the yellow_gpio ret is 0
misc_init_r before change the blue_gpio
gpio_request lable = blue_gpio gpio = 39
misc_init_r after gpio_request the blue_gpio ret is 39
misc_init_r after change the blue_gpio ret is 1
gpio_request lable = night_gpio gpio = 49
misc_init_r after gpio_request the night_gpio ret is 49
misc_init_r after change the night_gpio ret is 0
gpio_request lable = USB_able_gpio gpio = 47
misc_init_r after gpio_request the USB_able_gpio ret is 47
misc_init_r after change the USB_able_gpio ret is 0
gpio_request lable = SPK_able_gpio gpio = 63
misc_init_r after gpio_request the SPK_able_gpio ret is 63
misc_init_r after change the SPK_able_gpio ret is 0
gpio_request lable = TF_en_gpio gpio = 50
misc_init_r after gpio_request the TF_en_gpio ret is 50
misc_init_r after change the TF_en_gpio ret is 0
gpio_request lable = TF_cd_gpio gpio = 59
misc_init_r after gpio_request the TF_cd_gpio ret is 59
misc_init_r after change the TF_cd_gpio ret is 0
gpio_request lable = SD_able_gpio gpio = 48
misc_init_r after gpio_request the SD_able_gpio ret is 48
misc_init_r after change the SD_able_gpio ret is 0
misc_init_r before change the wifi_enable_gpio
gpio_request lable = wifi_enable_gpio gpio = 57
misc_init_r after gpio_request the wifi_enable_gpio ret is 57
misc_init_r after change the wifi_enable_gpio ret is 1
Hit any key to stop autoboot: 0
Card did not respond to voltage select!
SD card is not insert
liuyang_do_auto_update!!!!!!!!!!!!!!!!!!!!!!!!
gpio_request lable = sdupgrade gpio = 51
the manufacturer 1c
SF: Detected EN25QH128A
jiabo_update_to_flash!!!!!!!!!!!!!!!!!!!!!!!!
jiabo_au_do_update!!!!!!!!!!!!!!!!!!!!!!!!
start=0
start=40000
len=40000
flash check read...
FWGRADEUP not find !!!!!!!!!
gradeup check fail!!!!!!!!!!!!!!!!!!!
the manufacturer 1c
SF: Detected EN25QH128A
Erasing SPI flash...Writing to SPI flash...done
the manufacturer 1c
SF: Detected EN25QH128A
--->probe spend 4 ms
SF: 2031616 bytes @ 0x40000 Read: OK
--->read spend 653 ms
## Booting kernel from Legacy Image at 80600000 ...
Image Name: Linux-3.10.14__isvp_swan_1.0__
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1696086 Bytes = 1.6 MiB
Load Address: 80010000
Entry Point: 803ab950
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.14__isvp_swan_1.0__ (xuxuequan@ubuntu) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #17 PREEMPT Mon Dec 23 09:43:27 CST 2019
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 RESET ERROR PC:2A0B0515
[ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[ 0.000000] FPU revision is: 00b70000
[ 0.000000] CCLK:1392MHz L2CLK:696Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 004c8000 @ 00010000 (usable)
[ 0.000000] memory: 00038000 @ 004d8000 (usable after init)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 05e00000 @ 00000000 (usable)
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x05dfffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x05dfffff]
[ 0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[ 0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 23876
[ 0.000000] Kernel command line: console=ttyS1,115200n8 mem=94M@0x0 rmem=34M@0x5E00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256K(boot),1984K(kernel),3904K(rootfs),3904K(app),1984K(kback),3904K(aback),384K(cfg),64K(para)
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 89508k/96256k available (3729k kernel code, 6748k reserved, 1163k data, 224k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] NR_IRQS:358
[ 0.000000] clockevents_config_and_register success.
[ 0.000015] Calibrating delay loop... 1391.00 BogoMIPS (lpj=6955008)
[ 0.087832] pid_max: default: 32768 minimum: 301
[ 0.092692] Mount-cache hash table entries: 512
[ 0.097639] Initializing cgroup subsys debug
[ 0.101897] Initializing cgroup subsys freezer
[ 0.108103] regulator-dummy: no parameters
[ 0.112296] NET: Registered protocol family 16
[ 0.126349] bio: create slab <bio-0> at 0
[ 0.131822] jz-dma jz-dma: JZ SoC DMA initialized
[ 0.136818] usbcore: registered new interface driver usbfs
[ 0.142336] usbcore: registered new interface driver hub
[ 0.147812] usbcore: registered new device driver usb
[ 0.152956] (null): set:249 hold:250 dev=100000000 h=500 l=500
[ 0.159100] media: Linux media interface: v0.10
[ 0.163639] Linux video capture interface: v2.00
[ 0.169677] Switching to clocksource jz_clocksource
[ 0.175008] jz-dwc2 jz-dwc2: cgu clk gate get error
[ 0.179963] cfg80211: Calling CRDA to update world regulatory domain
[ 0.186390] DWC IN OTG MODE
[ 0.189798] dwc2 dwc2: Keep PHY ON
[ 0.193162] dwc2 dwc2: Using Buffer DMA mode
[ 0.197512] dwc2 dwc2: Core Release: 3.00a
[ 0.201672] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[ 0.208019] dwc2 dwc2: new USB bus registered, assigned bus number 1
[ 0.215096] hub 1-0:1.0: USB hub found
[ 0.218826] hub 1-0:1.0: 1 port detected
[ 0.222876] dwc2 dwc2: DWC2 Host Initialized
[ 0.227330] NET: Registered protocol family 2
[ 0.232082] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.239133] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.245538] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.252004] TCP: reno registered
[ 0.255248] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.261154] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.267705] NET: Registered protocol family 1
[ 0.272290] RPC: Registered named UNIX socket transport module.
[ 0.278276] RPC: Registered udp transport module.
[ 0.282986] RPC: Registered tcp transport module.
[ 0.287763] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.294624] freq_udelay_jiffys[0].max_num = 10
[ 0.299047] cpufreq udelay loops_per_jiffy
[ 0.303470] dwc2 dwc2: ID PIN CHANGED!
[ 0.307319] 12000 59956 59956
[ 0.310526] 24000 119913 119913
[ 0.313968] 60000 299784 299784
[ 0.317502] 120000 599569 599569
[ 0.320954] 200000 999282 999282
[ 0.324486] 300000 1498924 1498924
[ 0.328274] 600000 2997848 2997848
[ 0.331903] 792000 3957159 3957159
[ 0.335628] 1008000 5036385 5036385
[ 0.339407] 1200000 5995696 5995696
[ 0.347091] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.353598] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[ 0.359424] msgmni has been set to 174
[ 0.364090] io scheduler noop registered
[ 0.368100] io scheduler cfq registered (default)
[ 0.373866] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[ 0.381471] console [ttyS1] enabled, bootconsole disabled
[ 0.381471] console [ttyS1] enabled, bootconsole disabled
[ 0.395304] brd: module loaded
[ 0.399790] loop: module loaded
[ 0.403457] zram: Created 2 device(s) ...
[ 0.407753] logger: created 256K log 'log_main'
[ 0.412826] jz TCU driver register completed
[ 0.417680] the id code = 1c7018, the flash name is EN25QH128A
[ 0.423704] JZ SFC Controller for SFC channel 0 driver register
[ 0.429872] 8 cmdlinepart partitions found on MTD device jz_sfc
[ 0.435988] Creating 8 MTD partitions on "jz_sfc":
[ 0.440926] 0x000000000000-0x000000040000 : "boot"
[ 0.446316] 0x000000040000-0x000000230000 : "kernel"
[ 0.451772] 0x000000230000-0x000000600000 : "rootfs"
[ 0.457307] 0x000000600000-0x0000009d0000 : "app"
[ 0.462514] 0x0000009d0000-0x000000bc0000 : "kback"
[ 0.467958] 0x000000bc0000-0x000000f90000 : "aback"
[ 0.473342] 0x000000f90000-0x000000ff0000 : "cfg"
[ 0.478604] 0x000000ff0000-0x000001000000 : "para"
[ 0.483897] SPI NOR MTD LOAD OK
[ 0.487230] tun: Universal TUN/TAP device driver, 1.6
[ 0.492444] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 0.498929] usbcore: registered new interface driver zd1201
[ 0.504808] usbcore: registered new interface driver usbserial
[ 0.510862] usbcore: registered new interface driver ch341
[ 0.516578] usbserial: USB Serial support registered for ch341-uart
[ 0.523069] usbcore: registered new interface driver pl2303
[ 0.528850] usbserial: USB Serial support registered for pl2303
[ 0.535202] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[ 0.544598] jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
[ 0.574582] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[ 0.579930] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[ 0.624662] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[ 0.630196] TCP: cubic registered
[ 0.633616] NET: Registered protocol family 17
[ 0.639930] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[ 0.647050] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 0.657772] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 0.665518] Freeing unused kernel memory: 224K (804d8000 - 80510000)
mdev is ok......
Ingenic login: [ 1.319290] @@@@ tx-isp-probe ok(version H20191022a), compiler date=Oct 22 2019 @@@@@
[ 1.358138] exFAT: Version 1.2.9
[ 1.385652] jz_codec_register: probe() successful!
[ 1.794972] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a07a1000)
[ 1.804115] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a0742000)
[ 1.813372] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a254f000)
[ 1.881872] jz_pwm_probe[212] d_name = tcu_chn0
[ 1.888353] The version of PWM driver is H20180309a
[ 1.899101] request pwm channel 0 successfully
[ 1.906908] pwm-jz pwm-jz: jz_pwm_probe register ok !
[ 2.143421] RTL871X: module init start
[ 2.148733] RTL871X: rtl8189ftv v4.3.24.7_21113.20170208.nova.1.02
[ 2.155177] RTL871X: build time: Mar 16 2020 18:34:53
[ 2.160389] wlan power on
[ 2.174967] RTL871X: module init ret=0
===========welcome to ver-comp tool=========
[ver-comp]dbg: appver: 4.33.1.38
[ 2.220424] mmc1: card claims to support voltages below the defined range. These will be ignored.
[ver-comp]dbg: rootver: 4.33.1.26
[ver-comp]exec cmd: cp -rf /system/bin/app.ver /configs/
[FC] step1 export sd power and en
[ 2.253879] mmc1: new SDIO card at address 0001
=====Welcome login sdk sync shellcall tool=====
[ 2.295817] RTL871X: ++++++++rtw_drv_init: vendor=0x024c device=0xf179 class=0x07
[FC] step2 poweron sd card
[ 2.350957] RTL871X: HW EFUSE
[ 2.354250] RTL871X: hal_com_config_channel_plan chplan:0x20
[ 2.522633] RTL871X: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1
[ 2.538833] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=80:9f:9b:04:d1:70
===========welcome to assis process=========
[Build date] Mar 27 2020 (20:44:53)
[threadpool,0132](init_job_node) jobNodeNumMin:6 jobNodeNumMax:9
[exec-assis:144]: msgSndId:0
[exec-assis:159]: msgRcvId:32769
[SDK-DOG]dbg: turn on watchdog success!
[watchdog.c|assis,0051](assis_wdg_init) OK!
[FC] step3 trigger cd pin
[ 4.024574] jzmmc_v1.2 jzmmc_v1.2.0: card removed, state=0
mount: mounting /dev/mmcblk0p1 on /media/mmc failed: No such file or directory
===========welcome to iCamera_app===========
[Build date] Mar 27 2020 (20:44:56)
[msg:82]log: msg_queue_create() ok MsgId:65538
[sdevice_can_work_set_callback]dbg: set ok! have 1 cb
init_log_module() ok
[sdevice_can_work_set_callback]dbg: set ok! have 2 cb
[exec-iCame:144]: msgSndId:0
[exec-iCame:159]: msgRcvId:32769
[exec-iCame,0484](no.300000) cmd:[/system/bin/sysMonitor.sh &]
[exec-assis:239]: (no.300000) cmd:[/system/bin/sysMonitor.sh &]
[threadpool,0132](init_job_node) jobNodeNumMin:25 jobNodeNumMax:37
[timer,146]dbg: init complete.
[exec-iCame,0417](no.100000) cmd:[ps |grep iCamera_app]
[exec-assis:239]: (no.100000) cmd:[ps |grep iCamera_app]
[exec-assis,0295](no.300000) system ret:[-1]
[exec-assis:256]: (no.100000) popen ret:[ 149 root 213m S /system/bin/iCamera_app
178 root 1596 S sh -c ps |grep iCamera_app
181 root 1588 S grep iCamera_app
]
[exec-iCame,0422](no.100000) msgque ret:[ 149 root 213m S /system/bin/iCamera_app
178 root 1596 S sh -c ps |grep iCamera_app
181 root 1588 S grep iCamera_app
]
[debug.c,0146]iCamera_app PID: 149
[exec-iCame,0417](no.100000) cmd:[ps |grep assis]
[exec-assis:239]: (no.100000) cmd:[ps |grep assis]
[exec-assis:256]: (no.100000) popen ret:[ 128 root 62168 S /system/bin/assis
184 root 1596 S sh -c ps |grep assis
186 root 1588 S grep assis
]
[exec-iCame,0422](no.100000) msgque ret:[ 128 root 62168 S /system/bin/assis
184 root 1596 S sh -c ps |grep assis
186 root 1588 S grep assis
]
[debug.c,0155]assis PID: 128
[debug.c,0161]debug_init() dbgId:0
watchdog_init() ok TimerId:1
create ok, ready to start
<Reading> /configs/.product_config
[product_config.c,0305][PRODUCT] [PRODUCT_TYPE ] [camera]
[product_config.c,0305][PRODUCT] [PRODUCT_MODEL] [AC1]
[product_config.c,0305][PRODUCT] [BOARD_TEST ] [00FF]
[product_config.c,0305][PRODUCT] [FACTORY_TEST ] [0000]
[product_config.c,0305][PRODUCT] [HARDWARE_VER ] [P00J0000]
[product_config.c,0305][PRODUCT] [NETRELATED_IP] [XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]
[product_config.c,0305][PRODUCT] [KEY_CHECKSUM ] [00004068]
[product_config.c,0305][PRODUCT] [CONFIG_INFO ] [XXXXXXXXXXXXXXXXXXXXXXXX]
[product_config.c,0314][PRODUCT] [macAddr ] [XXXXXXXXXXXX]
<Reading> /configs/app.ver
[product_config.c,0348][PRODUCT] [appver ] [4.33.1.38]
<Reading> /configs/.user_config
[user_config.c,0276][USERSET] [indicator ] [1]
[user_config.c,0276][USERSET] [nightVision ] [3]
[user_config.c,0276][USERSET] [bitRate ] [80]
[user_config.c,0276][USERSET] [res ] [1]
[user_config.c,0276][USERSET] [fps ] [20]
[user_config.c,0276][USERSET] [horSwitch ] [2]
[user_config.c,0276][USERSET] [verSwitch ] [2]
[user_config.c,0276][USERSET] [osdSwitch ] [1]
[user_config.c,0276][USERSET] [logSd ] [1]
[user_config.c,0276][USERSET] [logUdisk ] [1]
[user_config.c,0276][USERSET] [telntSwitch ] [2]
[user_config.c,0276][USERSET] [recordType ] [1]
[user_config.c,0276][USERSET] [MASwitch ] [2]
[user_config.c,0276][USERSET] [MALevel ] [5]
[user_config.c,0276][USERSET] [AASwitch ] [0]
[user_config.c,0276][USERSET] [AALevel ] [5]
[user_config.c,0276][USERSET] [SASwitch ] [0]
[user_config.c,0276][USERSET] [CASwitch ] [0]
[user_config.c,0276][USERSET] [TBStart ] [0]
[user_config.c,0276][USERSET] [TBDuration ] [1440]
[user_config.c,0276][USERSET] [drawBoxSwitch] [1]
[user_config.c,0276][USERSET] [timezone ] [0]
[user_config.c,0276][USERSET] [MMALevel ] [100]
[user_config.c,0276][USERSET] [AMALevel ] [100]
[user_config.c,0276][USERSET] [MAT ] [0]
[user_config.c,0276][USERSET] [AST ] [1]
[user_config.c,0276][USERSET] [motionTrack ] [2]
[user_config.c,0276][USERSET] [motionCruisin] [2]
[user_config.c,0276][USERSET] [AASX ] [25]
[user_config.c,0276][USERSET] [AASY ] [25]
[user_config.c,0276][USERSET] [AALX ] [50]
[user_config.c,0276][USERSET] [AALY ] [50]
[user_config.c,0276][USERSET] [motionback ] [1]
[user_config.c,0276][USERSET] [slide_x ] [0]
[user_config.c,0276][USERSET] [slide_y ] [0]
[user_config.c,0276][USERSET] [preset_x ] [0]
[user_config.c,0276][USERSET] [preset_y ] [0]
[user_config.c,0276][USERSET] [ubootflag ] [0]
[user_config.c,0276][USERSET] [exposureModel] [0]
[user_config.c,0276][USERSET] [limit_max_x ] [0]
[user_config.c,0276][USERSET] [limit_min_x ] [0]
[user_config.c,0276][USERSET] [limit_max_y ] [0]
[user_config.c,0276][USERSET] [limit_min_y ] [0]
[user_config[ 8.267376] name : i2c0 nr : 0
.c,0276][USERSET] [motor_limit ] [0]
[user_config.c,0276][USERSET] [resoluselect ] [1]
[user_config.c,0276][USERSET] [low_bitrate ] [30]
[user_config.c,0276][USERSET] [watermark_flag] [1]
[user_config.c,0276][USERSET] [speaker_vol ] [50]
[user_config.c,0276][USERSET] [pir_alaram ] [0]
[user_config.c,0276][USERSET] [nightLight ] [1]
[user_config.c,0276][USERSET] [sdeviceExist ] [0]
[user_config.c,0276][USERSET] [recordNum ] [0]
[user_config.c,0276][USERSET] [recordSize ] [0]
[user_config.c,0276][USERSET] [dongleLight ] [1]
[user_config.c,0276][USERSET] [alarmDate ] [255]
[user_config.c,0276][USERSET] [alarmInterval] [300]
[user_config.c,0276][USERSET] [sdevAction ] [1]
[user_config.c,0276][USERSET] [voiceSwitch ] [2]
[user_config.c,0276][USERSET] [voiceScene ] [1]
[user_config.c,0276][USERSET] [autoBitrate ] [2]
[user_config.c,0276][USERSET] [cloudSwitch ] [2]
[user_config.c,0203][USERNET] [ssid ] []
[user_config.c,0208][USERNET] [password ] []
[user_config.c,[ 8.365183] sensor_read: addr=0x3107 value = 0x23
0212][USERNET] [wifiType ] [5]
[user_config.c,0217][USER[ 8.375740] sensor_read: addr=0x3108 value = 0x11
NET] [p2pid ] []
[user_config.c,0222][USERNET] [r_enc[ 8.385568] info: success sensor find : sc2310
r ] []
[user_config.c,0226][USERNET] [bindOk ] [[ 8.395699] misc sinfo_release
0]
----------------------------------------
WELCOME TO LOCALSDK ('_)')
----------------------------------------
platform: ingenict20x
version : SDK20180815a
update : Mar 27 2020 (20:44:50)
----------------------------------------
[SDK-GPIO]dbg: Pin(39) Lvl(1) Dir(out)
[SDK-GPIO]dbg: Pin(38) Lvl(0) Dir(out)
[SDK-GPIO]dbg: Pin(52) Lvl(0) Dir(out)
[SDK-GPIO]dbg: Pin(53) Lvl(0) Dir(out)
[SDK-GPIO]dbg: Pin(63) Lvl(0) Dir(out)
[SDK-GPIO]dbg: Pin(48) Lvl(0) Dir(out)
[SDK-GPIO]dbg: Pin(51) Lvl(1) Dir(in)
[SDK-GPIO]dbg: Pin(50) Lvl(1) Dir(in)
[SDK-THREAD]dbg: Platform Thread Create OK! ('_)')
[localsdk_get_version][8]
init/init.c,1322:[init_local_sdk] localsdk version:8
[SDK-THREAD]dbg: Platform Thread Start...
##### sensor type: sc2310 #####
[ShellCall @Input ] insmod /system/driver/sensor_sc2310_t31.ko [len:42][type:w]
[ShellCall @Output] 0 [len:4]
[ 8.665805] sc2310 chip found @ 0x30 (i2c0)
[ 9.040755] Err [VIC_INT] : hor err ch1 !!!!!
[ 9.045251] Err [VIC_INT] : ver err ch0 !!!!!
[ 9.049736] Err [VIC_INT] : ver err ch1 !!!!!
[ 9.054224] Err [VIC_INT] : ver err ch2 !!!!!
[ 9.197763] sc2310 stream on
---- FPGA board is ready ----
Board UID : XXXXXXXX
Board HW ID : 72000460
Board rev. : 5DE5A975
Board date : 20190326
-----------------------------
##### sensor fps: 20 #####
[SDK-VIDEO]dbg: Enc_thread(chn0) create OK! ('_)')
[init.c,0998]set local_sdk_video_osd_set_parameters main
sdkosd.c 231 channel:0
[SDK-OSD]dbg: layer[0] is Enable...
sdkosd.c 246 channel:0 time_x_StartingPoint:1390 time_y_StartingPoint:1010
[SDK-OSD]dbg: layer[1] is Enable...
sdkosd.c 270 channel:0 logo_x_StartingPoint:52 logo_y_StartingPoint:900
[SDK-OSD]dbg: layer[2] is Enable...
sdkosd.c 293 channel:0 time_x_StartingPoint:1390 time_y_StartingPoint:1010
[SDK-OSD]dbg: layer[3] is Enable...
[SDK-THREAD]dbg: Set Video Enc Callback Doing...
sdkvideo.c 1358 <local_sdk_video_start> channel:0
sdkvideo.c 1378 <local_sdk_video_start> channel:0
sdkvideo.c 1382 <local_sdk_video_start> pEncConfig->index:0
sdkvideo.c 1396 <local_sdk_video_start> channel:0
sdkvideo.c 1406 <local_sdk_video_start> channel:0
[SDK-VIDEO]dbg: Encoder Chn0 Thread Start...
sdkvideo.c 1419 <local_sdk_video_start> channel:0
[SDK-OSD]dbg: channel[0] layer[0] layerHander[0] create OK...
[SDK-OSD]dbg: channel[0] layer[1] layerHander[1] create OK...
[SDK-OSD]dbg: channel[0] layer[2] layerHander[2] create OK...
[SDK-OSD]dbg: channel[0] layer[3] layerHander[3] create OK...
sdkvideo.c 1437 shiziquan ivsenable <local_sdk_video_start> channel:0 pFsConfig->algoEnable:0 pCb->pfunc:0
sdkvideo.c 1456 <local_sdk_video_start> shiziquan FS channel:0 tmpGrpCellIndex:0
sdkvideo.c 1472 <local_sdk_video_start> OSD channel:0 tmpGrpCellIndex:1
sdkvideo.c 1480 <local_sdk_video_start> ENC channel:0 tmpGrpCellIndex:2
sdkvideo.c 1489 <local_sdk_video_start> channel:0 i:1 tmpGrpCellIndex:3
[SDK-VIDEO]dbg: IMP_System_Bind(chn0) [FS]--bind->[OSD] OK!
sdkvideo.c 1489 <local_sdk_video_start> channel:0 i:2 tmpGrpCellIndex:3
[SDK-VIDEO]dbg: IMP_System_Bind(chn0) [OSD]--bind->[ENC] OK!
[SDK-VIDEO]dbg: start fs chn0...
[SDK-VIDEO]dbg: start enc chn0...
[SDK-VIDEO]dbg: Enc_thread(chn1) create OK! ('_)')
[init.c,1066]set local_sdk_video_osd_set_parameters sub
sdkosd.c 231 channel:1
[SDK-OSD]dbg: layer[0] is Enable...
sdkosd.c 246 channel:1 time_x_StartingPoint:440 time_y_StartingPoint:335
[SDK-OSD]dbg: layer[1] is Enable...
sdkosd.c 270 channel:1 logo_x_StartingPoint:20 logo_y_StartingPoint:305
[SDK-OSD]dbg: layer[2] is Enable...
sdkosd.c 293 channel:1 time_x_StartingPoint:440 time_y_StartingPoint:335
[SDK-OSD]dbg: layer[3] is Enable...
[SDK-THREAD]dbg: Set Video Enc Callback Doing...
[SDK-THREAD]dbg: Set algo_register Callback Doing...
sdkvideo.c 1358 <local_sdk_video_start> channel:1
sdkvideo.c 1378 <local_sdk_video_start> channel:1
sdkvideo.c 1382 <local_sdk_video_start> pEncConfig->index:1
[SDK-VIDEO]dbg: Encoder Chn1 Thread Start...
sdkvideo.c 1396 <local_sdk_video_start> channel:1
sdkvideo.c 1406 <local_sdk_video_start> channel:1
sdkvideo.c 1419 <local_sdk_video_start> channel:1
[SDK-OSD]dbg: channel[1] layer[0] layerHander[4] create OK...
[SDK-OSD]dbg: channel[1] layer[1] layerHander[5] create OK...
[SDK-OSD]dbg: channel[1] layer[2] layerHander[6] create OK...
[SDK-OSD]dbg: channel[1] layer[3] layerHander[7] create OK...
sdkvideo.c 1437 shiziquan ivsenable <local_sdk_video_start> channel:1 pFsConfig->algoEnable:1 pCb->pfunc:4498008
sdkvideo.c 1440 shiziquan ivsenable <local_sdk_video_start> channel:1
[IVS-MOTION]dbg: IMP_IVS_CreateGroup(0) ret:0!
sdkvideo.c 1456 <local_sdk_video_start> shiziquan FS channel:1 tmpGrpCellIndex:0
sdkvideo.c 1464 <local_sdk_video_start> IVS channel:1 tmpGrpCellIndex:1
sdkvideo.c 1472 <local_sdk_video_start> OSD channel:1 tmpGrpCellIndex:2
sdkvideo.c 1480 <local_sdk_video_start> ENC channel:1 tmpGrpCellIndex:3
sdkvideo.c 1489 <local_sdk_video_start> channel:1 i:1 tmpGrpCellIndex:4
[SDK-VIDEO]dbg: IMP_System_Bind(chn1) [FS]--bind->[IVS] OK!
sdkvideo.c 1489 <local_sdk_video_start> channel:1 i:2 tmpGrpCellIndex:4
[SDK-VIDEO]dbg: IMP_System_Bind(chn1) [IVS]--bind->[OSD] OK!
sdkvideo.c 1489 <local_sdk_video_start> channel:1 i:3 tmpGrpCellIndex:4
[SDK-VIDEO]dbg: IMP_System_Bind(chn1) [OSD]--bind->[ENC] OK!
[SDK-VIDEO]dbg: start fs chn1...
[SDK-VIDEO]dbg: start enc chn1...
[SDK-VIDEO]dbg: Yuv_thread(chn2) create OK! ('_)')
sdkvideo.c 1358 <local_sdk_video_start> channel:2
sdkvideo.c 1378 <local_sdk_video_start> channel:2
sdkvideo.c 1437 shiziquan ivsenable <local_sdk_video_start> channel:2 pFsConfig->algoEnable:0 pCb->pfunc:4498008
sdkvideo.c 1456 <local_sdk_video_start> shiziquan FS channel:2 tmpGrpCellIndex:0
[SDK-AUDIO]dbg: Audio Thread(chn0) create OK! ('_)')
[SDK-THREAD]dbg: Set Audio Enc Callback Doing...
[SDK-AUDIO]dbg: Audio Thread(chn0) Start...
[SDK-VIDEO]dbg: YUV Chn2 Thread Start...
[ 10.084613] codec_set_device: set device: MIC...
[sdkaudio.c:324]dbg: audio aec enable
set safe_suppression_value 2.000000
[ 10.394605] codec_set_device: set device: speaker...
[SDK-SPKER]dbg: speaker volume: 70
[SDK-SPKER]dbg: speaker gain: 30
[exec-iCame,0417](no.100000) cmd:[echo "# HUALAI DNS #" > /etc/resolv.conf]
[exec-assis:239]: (no.100000) cmd:[echo "# HUALAI DNS #" > /etc/resolv.conf]
[exec-assis:256]: (no.100000) popen ret:[]
[exec-iCame,0426](no.100000) msgque ret:[0]
[SDK-NET]exec: /sbin/ifconfig wlan0 down
[SDK-NET]exec: ifconfig wlan0 hw ether 7C:DD:E9:XX:XX:XX
aecMode = 0
dtdEnable = 1
dtdBandNum = 4
dtdPowThd = 6000000.000000
dtdDxRatio = 0.000001
safeSupression = 2.000000
[SDK-NET]exec: /system/bin/restart_wlan0.sh
up
[netServ.c,0259]dbg: Set net_state Callback Doing...
[init.c,0769]No SSID, waitting here...
[SDK-ALARM]dbg: [algo:0] Thread Create OK! ('_)')
[SDK-ALARM]dbg: algo[0] state goto: THREAD_STATE_START
[SDK-THREAD]dbg: Set Video PCM Callback Doing...
productservices/alarm/audioalarmfunc.c 136
[user_config.c,0331]paracfg_set_user_config_item(18, 0) param value equal!
productservices/alarm/audioalarmfunc.c 155
[user_config.c,0331]paracfg_set_user_config_item(17, 0) param value equal!
productservices/alarm/audioalarmfunc.c 117
[user_config.c,0331]paracfg_set_user_config_item(15, 0) param value equal!
[videoalarmfunc.c,0106]dbg: ##### localsdk alarm switch on, byid:0 #####
[SDK-THREAD]dbg: Set night_state Callback Doing...
[videoalarmfunc.c,0334][night_mode_init]dbg: USER_SWITCH_AUTO ...
<>===================< IRcut on >==================<>
<>===================< IRcut off 888 >=================<>
[SDK-THREAD]dbg: Set Video YUV Callback Doing...
[SDK-THREAD]dbg: Set setup_keydown Callback Doing...
[SDK-THREAD]dbg: Set reset_keydown Callback Doing...
productservices/osd/osd.c 248 osd_logo_init
productservices/osd/osd.c 251
[sdevice_can_work_set_callback]dbg: set ok! have 3 cb
# mp4 version is jz-20191031a#
request_hevc2mp4_handler handler_id = 0
[sdevice_can_work_set_callback]dbg: set ok! have 4 cb
productservices/localstorage/time_lapse_func.c 1438 <time_lapse_init> time_lapse_sdev_work_cb set
[sdevice_can_work_set_callback]dbg: set ok! have 5 cb
productservices/localstorage/time_lapse_func.c 1450 <time_lapse_init>
[exec-iCame,0417](no.100000) cmd:[cp /usr/www /tmp/ -fr ]
[exec-assis:239]: (no.100000) cmd:[cp /usr/www /tmp/ -fr ]
[exec-assis:256]: (no.100000) popen ret:[]
[exec-iCame,0426](no.100000) msgque ret:[0]
[SDK-THREAD]dbg: Set Device Monitor Callback Doing...
[SDK-THREAD]dbg: Set Device Monitor Callback Doing...
[SDK-THREAD]dbg: Set Device Monitor Callback Doing...
[SDK-ALARM]dbg: Set alarm_state Callback Doing...
[camerasleep.c,0124][camera_sleep_init]dbg: init ok!
[init.c,0598]code_test!!!
in: (night_mode_change_callback) state:[2]
[videoalarmfunc.c,0113]dbg: ##### localsdk alarm switch off, byid:1 #####
out: (night_mode_change_callback) state:[2]
in: (night_mode_change_callback) state:[1]
out: (night_mode_change_callback) state:[1]
dbg: ######### modify duty(0) ok! #########
<>===================< IRcut off 888 >=================<>
[sdk]wangbin_44444444444444444444_day_ev_to_night_state_44444444444444444444
in: (night_mode_change_callback) state:[0]
out: (night_mode_change_callback) state:[0]
<>===================< IRcut on >==================<>
dbg: ######### modify duty(1000000) ok! #########
in: (night_mode_change_callback) state:[3]
[videoalarmfunc.c,0106]dbg: ##### localsdk alarm switch on, byid:1 #####
out: (night_mode_change_callback) state:[3]
[watchdog]dbg: watchdog_snd_msg_feed [time:30]
timelapse_server_manager
[assis]WDG_CMD_FEED_DOG!!!!
[watchdog]dbg: watchdog_snd_msg_feed [time:60]
timelapse_server_manager
[assis]WDG_CMD_FEED_DOG!!!!
[exec-iCame,0417](no.100000) cmd:[cat /proc/149/status |grep VmRSS]
[exec-assis:239]: (no.100000) cmd:[cat /proc/149/status |grep VmRSS]
[exec-assis:256]: (no.100000) popen ret:[VmRSS: 9780 kB
]
[exec-iCame,0422](no.100000) msgque ret:[VmRSS: 9780 kB
]
[debug.c,0103]iCamera_app VmRSS: 9780 kB
[exec-iCame,0417](no.100000) cmd:[cat /proc/128/status |grep VmRSS]
[exec-assis:239]: (no.100000) cmd:[cat /proc/128/status |grep VmRSS]
[exec-assis:256]: (no.100000) popen ret:[VmRSS: 1448 kB
]
[exec-iCame,0422](no.100000) msgque ret:[VmRSS: 1448 kB
]
[debug.c,0112]assis VmRSS: 1448 kB
Ingenic login:
残念ながら、T20を搭載した前のバージョンのカメラ達のrootパスワードではログインできず(yashiさん情報ありがとう！)。u-bootのbootdelayも0でkernelcmdを弄れず。
次回予告
さてー、どうしましょう。どこかペリフェラルに異常を発生させたらinitが修復用のシェルを起動したりしないですかねー。しないでしょうねー。ブートログを見て気づくことがあったら教えてくださいませ〜。
あるいは、これ系のリバースエンジニアリングか。バイナリが暗号化されてたらなんともならんかなー。