Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Driver for sensor SC4210 #149

Closed
jimsmt opened this issue Jan 9, 2022 · 16 comments
Closed

Driver for sensor SC4210 #149

jimsmt opened this issue Jan 9, 2022 · 16 comments

Comments

@jimsmt
Copy link
Contributor

jimsmt commented Jan 9, 2022

Hi, I have an Uniview camera with Hi3516DV300, CMOS sensor is SmartSens SC4210. It has 2GB memory and 8GB onboard EMMC storage. As told in another issue, you can add support for this sensor if I have the .so files for the sensor.

Unfortunately, the shell access is limited to only a few commands, the uboot tftp command is limited to download only, so I can't get a dump of the EMMC chip. But I do have a firmware image for upgrade. The entire firmware is more than 500MB large, I can't upload it here on github, so I upload it somewhere else: https://ufile.io/se1e8xam or https://tmpsend.com/grGCGuh0 The uimage.bin is 12MB large

uboot # printenv
arch=arm
baudrate=115200
board=hi3516dv300
board_name=hi3516dv300
bootargs=mem=512M console=ttyAMA0,115200 blkdevparts=mmcblk2:1M(boot),2M(bootlogo),16M(kernel),16M(kernel_bak),16M(config),16M(config_bak),1M(cliinfo),1M(cliinfo_bak),1M(mtd_runtime),32M(calibration),512K(update),1224M(program),1224M(cache),4208M(data),-(other)
bootcmd=mmc read 0 82000000 1800 8000;bootm 0x82000000
bootdelay=2
cpu=armv7
ethact=eth0
ethaddr=42:c1:84:f1:25:6e
ipaddr=192.168.2.22
netmask=255.255.255.0
serverip=192.168.2.88
soc=hi3516dv300
stderr=serial
stdin=serial
stdout=serial
vendor=hisilicon
verify=n
uboot # help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
cipher_test- CIPHER Encrypt And Decrypt Test
cmp     - memory compare
config  - config  --- config mac address,ddr test flag

coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
ddr     - ddr training function
decjpg  - jpgd   - decode jpeg picture.
decjpg [format]
dhcp    - boot image via network using DHCP/TFTP protocol
dm      - Driver model low level access
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
erase   - erase FLASH memory
exit    - exit script
false   - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatsize - determine a file's size
flinfo  - print FLASH memory information
getinfo - print hardware information
go      - start application at address 'addr'
go_cpu1 - Perform power on and unreset  CPU1_A7
gzwrite - unzip and write memory to block device
hash    - Calcluate hash
hash_test- hash_test [x]:[0] SHA1; [1] SHA256; [2] HMAC-SHA1; [3] HMAC-SHA256;
help    - print command description/usage
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
klad_test- KLAD Test
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
manuinfo- download,erase,display manuinfo

md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
part    - disk partition related commands
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
pxe     - commands to get and boot from pxe files
reset   - Perform RESET of the CPU
rng_test- RNG Test
rsa_enc_test- RSA PKCS1# V1_5 encrypt/decrypt Test
rsa_sign_test- RSA PKCS1# V1_5 Sign Test
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
setvobg - setvobg   - set vo backgroud color.
        - setvobg [dev color]
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
startgx - startgx   - open graphics layer.
        - startgx [layer addr stride x y w h]

startvl - startvl   - open video layer.
        - startvl [layer addr stride x y w h]

startvo - startvo   - open vo device with a certain output interface.
        - startvo [dev intftype sync]
stopgx  - stopgx   - close graphics layer.
        - stopgx [layer]
stopvl  - stopvl   - close video layer.
        - stopvl [layer]
stopvo  - stopvo   - close interface of vo device.
        - stopvo [dev]
sysboot - command to get and boot from syslinux files
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
unzip   - unzip a memory region
update  - update image via network using TFTP protocol and write into emmc/flash.
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version

Please take a look and see if you can extract the .so files from it

Thank you very much

@dimerr
Copy link
Collaborator

dimerr commented Jan 9, 2022

Unfortunately this firmware is encrypted, so emmc dump is needed. I see uboot has support for mmc, do you have mmc slot on board?

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 9, 2022

I noticed that too before I used the mmc write command to flash the uimage.bin file to EMMC chip. Now I can’t even boot to kernel, uboot says can’t find kernel image :( tftp 0x82000000 uimage.bin then bootm 0x82000000 gave the same result

Seems you can’t update the kernel partition in uboot, you can only do that in the web panel, there should be a decryption process before writing kernel files to EMMC chip

Yes there’s a micro SD card slot, I will try to get a dump of the other partitions which I haven’t overwritten tomorrow, and contact Uniview support to see if I can get a replacement

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 10, 2022

I tried the micro-SD card slot, but the mmc command inside uboot can only find the onboard emmc chip. I will send the device back to UNV support service, they will likely replace the PCB board. I will continue to try to get the partition dumps after I got it back

uboot # mmcinfo
Device: himci
Manufacturer ID: 15
OEM: 100
Name: 8GTF4
Tran Speed: 200000000
Rd Block Len: 512
MMC version 5.1
High Capacity: Yes
Bus Width: 4-bit
Erase Group Size: 512 KiB
HC WP Group Size: 8 MiB
User Capacity: 7.3 GiB ENH WRREL
User Enhanced Start: 0 Bytes
User Enhanced Size: 8 MiB
Boot Capacity: 4 MiB ENH
RPMB Capacity: 512 KiB ENH
uboot # mmc dev 0
scan edges:2 p2f:6 f2p:1
mix set temp-phase 3
scan elemnts: startp:120 endp:111
Tuning SampleClock. mix set phase:[03/07] ele:[10d/15]
** First descriptor is NOT a primary desc on 0:1 **
switch to partitions #0, OK
mmc0(part 0) is current device
uboot # mmc dev 1
MMC Device 1 not found
no mmc device at slot 1
uboot # mmc dev 2
MMC Device 2 not found
no mmc device at slot 2

@dimerr
Copy link
Collaborator

dimerr commented Jan 15, 2022

Refer to this message from our telegram channel

also found I can use md.b to display memory in hex.. I also found a python program to convert this back into binary. Seems to work...

this will be extremely long but possible...

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 15, 2022

Unfortunately the nand chip is already flashed with encrypted image, and UNV refused my request to replace a PCB board, now I'm looking for another same model to get a dump, this will take some time

The method you mentioned could be very useful when there's no tftp upload function or no network access at all, could you please give the name of that python program, thanks

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 15, 2022

I made some search and found that the xxd command in debian can directly convert the copy-pasted hex texts to binary file, but it does take a long time

xxd -r -seek -0x82000000 input.txt output.bin

0x82000000 is the memory offset

@dimerr
Copy link
Collaborator

dimerr commented Jan 15, 2022

https://github.com/smorin/hextool/blob/master/hexdump.py prolly this, but xxd will work too, but it will generate a 2gig file, which you will have to cut manually later

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 15, 2022

but it will generate a 2gig file, which you will have to cut manually later

Use the -seek parameter to ignore the none existing contents before

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 15, 2022

Just curious, Is it possible to create an uimage together with rootfs inside it, so we can load it into memory by tftp and boot into it with the bootm command, then mount the partitions to get a dump

@dimerr
Copy link
Collaborator

dimerr commented Jan 15, 2022

It's possible, but much easier is to use nfsroot

@dimerr
Copy link
Collaborator

dimerr commented Jan 16, 2022

I've just noticed that you've asked about cv500 family, have you checked available sensors? I see yours is there....

https://github.com/OpenIPC/firmware/blob/master/general/package/hisilicon-osdrv-hi3516cv500/files/sensor/

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 16, 2022

I've just noticed that you've asked about cv500 family, have you checked available sensors? I see yours is there....

Thanks but I didn't asked about cv500, I don't have one either. Currently I have 3516av100+imx185, 3516av200+imx385, 3516dv100+imx385 and 3516dv300+sc4210

@dimerr
Copy link
Collaborator

dimerr commented Jan 16, 2022

3516dv300 is 3516cv500

@jimsmt
Copy link
Contributor Author

jimsmt commented Jan 16, 2022

thanks, so do I need to install the cv500 firmware instead of 3516dv300?

@dimerr
Copy link
Collaborator

dimerr commented Jan 16, 2022

install firmware for your soc, but they share same family, so there will be same files in all of them

@dimerr dimerr closed this as completed Jan 20, 2022
@jimsmt
Copy link
Contributor Author

jimsmt commented Feb 25, 2022

Hi, I have manged to get a dump of the emmc chip, please let me know if you still need them, attached are the libsns files
libsns.zip

root@root:/nfs/HIC5641# ./ipctool
---
chip:
  vendor: HiSilicon
  model: 3516DV300
ethernet:
  mac: "6c:xxxxxxxx"
  u-mdio-phyaddr: 1
  phy-id: 0xffffffff
  d-mdio-phyaddr: 0
ram:
  total: 2048M
  media: 1535M
firmware:
  kernel: "4.9.37 (SMP Thu Oct 29 16:38:14 CST 2020)"
  toolchain: gcc version 6.3.0 (HC&C V100R002C00B017_20180728)
  sdk: "Hi3516CV500_MPP_V2.0.1.0 B090 Release (Jan 14 2019, 20:23:45)"
  main-app: mwareserver
sensors:
- vendor: SmartSens
  model: SC4210
  control:
    bus: 0
    type: i2c
    addr: 0x60

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants