Introduction

The camera is powered by dual-core ARM Cortex-A7 1.2Ghz CPU SigmaStar SSC338Q and is equipped with H.264 and H.265 hardware encoders. ssc338q main board layer 1 The main board has the label SSC338Q_38M_2.0 ssc338q main board layer 2

Pinout

TODO: add screen with numbers

UART access

TODO

ISP access by I2C

The camera doesn’t require I2C pull-up resistors as it already has two 4.7K resistors. You can use CH341A programmer with a tool https://github.com/OpenIPC/snander-mstar to download and upload firmware.

Or use

with a tool https://github.com/fifteenhex/snander_electricboogaloo

For more details check the link https://linux-chenxing.org/isp/

If you have SPI NOR memory, check this https://boeglin.org/blog/index.php?entry=Flashing-a-BenQ-Z-series-for-free

U-Boot

To get U-Boot shell during the first boot seconds of the boot (when you have UART string like U-Boot 2015.01 (Nov 08 2021 - 23:14:14)) press the ENTER key several times.

printenv output

Mstarbin=20150709
bootargs=ubi.mtd=UBI,2048 root=/dev/mtdblock8 rootfstype=squashfs ro init=/linuxrc LX_MEM=0xffe0000 mma_heap=mma_heap_name0,miu=0,sz=0x949C000 mma_heap=mma_heap_ipu,miu=0,sz=0x164000 cma=2M mtdparts=nand0:768k@)
bootcmd=nand read.e 0x22000000 KERNEL 0x500000; bootm 0x22000000;nand read.e 0x22000000 RECOVERY 0x500000; bootm 0x22000000
ethact=sstar_emac
ethaddr=<REMOVED>
fileaddr=21000000
filesize=1A28000
mtddevname=IPL0
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:768k@0x140000(IPL0),384k(IPL_CUST0),384k(IPL_CUST1),384k(UBOOT0),384k(UBOOT1),256k(ENV0),5m(KERNEL),5m(RECOVERY),6m(rootfs),384k(MISC),-(UBI)
partition=nand0,0
stderr=serial
stdin=serial
stdout=serial

Environment size: 871/131068 bytes

Hot to restore U-Boot with I2C (ISP) and CH341A programmer

https://github.com/OpenIPC/wiki/blob/master/en/sigmastar-unbrick.md

SPI flash partitions

0x000000140000-0x000000200000 : "IPL0"
0x000000200000-0x000000260000 : "IPL_CUST0"
0x000000260000-0x0000002c0000 : "IPL_CUST1"
0x0000002c0000-0x000000320000 : "UBOOT0"
0x000000320000-0x000000380000 : "UBOOT1"
0x000000380000-0x0000003c0000 : "ENV0"
0x0000003c0000-0x0000008c0000 : "KERNEL"
0x0000008c0000-0x000000dc0000 : "RECOVERY"
0x000000dc0000-0x0000013c0000 : "rootfs"
0x0000013c0000-0x000001420000 : "MISC"
0x000001420000-0x000008000000 : "UBI"

For more details about IPL (Initial Program Loader) partitions, see here https://wx.comake.online/doc/doc/SigmaStarDocs-SSC9381G_9351_Pudding-ULS00V040-20210913/customer/faq/securityboot/OTP-Key.html

RTSP stream urls

rtsp://CAMERA_IP/11 - Frame size 3840x2160

rtsp://CAMERA_IP/111 - Frame size 3840x2160

rtsp://CAMERA_IP/101 - Frame size 1280x720

OpenIPC alternative firmware

This chip supports open-source OpenIPC firmware https://openipc.org/cameras/vendors/sigmastar/socs/ssc338q

Boot log from UART

Some IDs were replaced by <REMOVED>

IPL 1ab38bf
D-11
HW Reset
MCP1866_4X
miupll_400MHz
256MB
BIST0_0001-OK
HS on
[SDMMC] NO SD!
Load IPL_CUST from SPINAND

 BlSize 00006850
Checksum OK
JMP+++
IPL_CUST 1ab38bf
[SDMMC] NO SD!
_IPLCustSNandOp
Load BL from SPINAND
  decomp_size=0x000703fc


U-Boot 2015.01 (Nov 08 2021 - 23:14:14)

Version: I6E#g#######
I2C:   ready
DRAM:
WARNING: Caches not enabled
SPINAND_I:  SPINAND: _MDrv_SPINAND_GET_INFO: Found SPINAND INFO
(0xC8) (0x51)
SPINAND: board_nand_init: CIS contains part info
128 MiB
MMC:   MStar SD/MMC: 0
In:    serial
Out:   serial
Err:   serial
Net:   MAC Address <REMOVED>
Auto-Negotiation...
AN failLink Status Speed:10 Full-duplex:0
Status Error!
sstar_emac
Warning: sstar_emac using MAC address from net device


NAND read: device 0 offset 0x3c0000, size 0x500000
Time:980103 us, speed:5349 KB/s
 5242880 bytes read: OK
##  Booting kernel from Legacy Image at 22000000 ...
   Image Name:   MVX4##I6E#g#######KL_LX409##[BR:
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    1896356 Bytes = 1.8 MiB
   Load Address: 20008000
   Entry Point:  20008000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ...
[XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!!
   XZ: uncompressed size=0x3c8000, ret=7
OK
atags:0x20000000

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 4.9.84 (super@super-virtual-machine) (gcc version 9.1.0 (GCC) ) #6 SMP PREEMPT Mon Jul 19 19:28:50 HKT 2021
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
CPU: div instructions available: patching division code
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
early_atags_to_fdt() success
OF: fdt:Machine model: INFINITY6E SSC012B-S01A
LXmem is 0xffe0000 PHYS_OFFSET is 0x20000000
Add mem start 0x20000000 size 0xffe0000!!!!

LX_MEM  = 0x20000000, 0xffe0000
LX_MEM2 = 0x0, 0x0
LX_MEM3 = 0x0, 0x0
EMAC_LEN= 0x0
DRAM_LEN= 0x0
deal_with_reserve_mma_heap memblock_reserve success mma_config[0].reserved_start=
0x26b44000

deal_with_reserve_mma_heap memblock_reserve success mma_config[1].reserved_start=
0x269e0000

cma: Reserved 2 MiB at 0x26600000
Memory policy: Data cache writealloc
[infinity6e_smp_init_cpus]
percpu: Embedded 13 pages/cpu @c699c000 s21272 r8192 d23784 u53248
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64992
Kernel command line: ubi.mtd=UBI,2048 root=/dev/mtdblock8 rootfstype=squashfs ro init=/linuxrc LX_MEM=0xffe0000 mma_heap=mma_heap_name0,miu=0,sz=0x949C000 mma_heap=mma_heap_ipu,miu=0,sz=0x164000 cma=2M mtdparts=nand0:768k@0x140000(IPL0),384k(IPL_CUST0),384k(IPL_CUST1),384k(UBOOT0),384k(UBOOT1),256k(ENV0),5m(KERNEL),5m(RECOVERY),6m(rootfs),384k(MISC),-(UBI)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 99816K/262016K available (2252K kernel code, 186K rwdata, 1140K rodata, 156K init, 148K bss, 160152K reserved, 2048K cma-reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xd0000000 - 0xff800000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xcffe0000   ( 255 MB)
    modules : 0xbf800000 - 0xc0000000   (   8 MB)
      .text : 0xc0008000 - 0xc023b424   (2254 kB)
      .init : 0xc0379000 - 0xc03a0000   ( 156 kB)
      .data : 0xc03a0000 - 0xc03ce8e8   ( 187 kB)
       .bss : 0xc03d0000 - 0xc03f50f8   ( 149 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Preemptible hierarchical RCU implementation.
        Build-time adjustment of leaf fanout to 32.
        RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
RCU: Adjusting geometry for rcu_fanout_leaf=32, nr_cpu_ids=2
NR_IRQS:16 nr_irqs:16 16
ms_init_main_intc: np->name=ms_main_intc, parent=gic
ms_init_pm_intc: np->name=ms_pm_intc, parent=ms_main_intc
ss_init_gpi_intc: np->name=ms_gpi_intc, parent=ms_main_intc
Find CLK_ven_pll, hook ms_venpll_ops
Find CLK_cpupll_clk, hook ms_cpuclk_ops
arm_arch_timer: Architected cp15 timer(s) running at 6.00MHz (virt).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x1623fa770, max_idle_ns: 440795202238 ns
sched_clock: 56 bits at 6MHz, resolution 166ns, wraps every 4398046511055ns
Switching to timer-based delay loop, resolution 166ns
console [ttyS0] enabled
Calibrating delay loop (skipped), value calculated using timer frequency.. 12.00 BogoMIPS (lpj=60000)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
CPU0: update cpu_capacity 1024
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x20008240 - 0x2000828c
[infinity6e_boot_secondary]
CPU1: update cpu_capacity 1024
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (24.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 16 (order: -2, 1024 bytes)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations


Version : MVX4##I6E#g#######KL_LX409##[BR:g]#XVM

GPIO: probe end[Padmux]reset PAD42(reg 0x103c00:6f; mask0x7) t0 SD1_MODE_2 (org: I2C0_MODE_1)
[Padmux]reset PAD49(reg 0x103c00:60; mask0x180) t0 GPIO (org: EJ_MODE_1)
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 3, 40960 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
UDP hash table entries: 128 (order: 0, 6144 bytes)
UDP-Lite hash table entries: 128 (order: 0, 6144 bytes)
NET: Registered protocol family 1
hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Infinity6e PHY probe, base:fd2a4600
libphy: Fixed MDIO Bus: probed
i2c /dev entries driver
1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 45, base_baud = 10800000) is a unknown
1f221200.uart1: ttyS1 at MMIO 0x0 (irq = 46, base_baud = 10800000) is a unknown
1f220400.uart2: ttyS2 at MMIO 0x0 (irq = 49, base_baud = 10800000) is a unknown
[MS_PM_INTC] hw:9 -> v:72
[MS_PM_INTC] hw:10 -> v:73
MSYS: DMEM request: [emac0_buff]:0x00000812
MSYS: DMEM request: [emac0_buff]:0x00000812 success, CPU phy:@0x26645000, virt:@0xC6645000
libphy: mdio: probed
mdio_bus mdio-bus@emac0: /soc/emac0/mdio-bus/ethernet-phy@0 has invalid PHY address
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 0
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 1
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 2
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 3
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 4
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 5
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 6
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 7
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 8
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 9
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 10
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 11
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 12
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 13
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 14
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 15
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 16
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 17
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 18
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 19
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 20
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 21
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 22
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 23
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 24
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 25
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 26
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 27
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 28
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 29
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 30
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 31
[emac_phy_connect][3328] connected mac emac0 to PHY at mdio-bus@emac0:00 [uid=11112222, driver=SStar 10/100 Ethernet Phy]
ms_rtcpwc 1f006800.rtcpwc: rtc core: registered 1f006800.rtcpwc as rtc0
MSYS: DMEM request: [AESDMA_ENG]:0x00001000
MSYS: DMEM request: [AESDMA_ENG]:0x00001000 success, CPU phy:@0x26646000, virt:@0xC6646000
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000 success, CPU phy:@0x26647000, virt:@0xC6647000
[ms_cpufreq_init] Current clk=796917760
[i6e][pwm] use ms_pwm->group_data
[NOTICE]pwm-isr(62) success. If not i6e or i6b0, pls confirm it on .dtsi
mstar_spinand_probe: mstar_spinand enableClock
MSYS: DMEM request: [BDMA]:0x00000840
MSYS: DMEM request: [BDMA]:0x00000840 success, CPU phy:@0x26648000, virt:@0xC6648000
MDrv_SPINAND_Init: Detected ID: MID =c8, DID =51
_dumpNandInformation:warning, Bytes / Page :  2048
_dumpNandInformation:warning, Pages / Block:  64
_dumpNandInformation:warning, Sector/ Page :  512
_dumpNandInformation:warning, Spare / Page :  64
_dumpNandInformation:warning, Current config r:1 w:1 drv:1
mstar_spinand_probe: Magic memcmp pass
mstar_spinand_probe: Get partition (Block 0 : page 1)
mstar_spinand_probe: CIS contains part info
mstar_spinand_probe: Before nand_scan()...
11 cmdlinepart partitions found on MTD device nand0
mstar_spinand_probe: Mtd parts parse
Creating 11 MTD partitions on "nand0":
0x000000140000-0x000000200000 : "IPL0"
0x000000200000-0x000000260000 : "IPL_CUST0"
0x000000260000-0x0000002c0000 : "IPL_CUST1"
0x0000002c0000-0x000000320000 : "UBOOT0"
0x000000320000-0x000000380000 : "UBOOT1"
0x000000380000-0x0000003c0000 : "ENV0"
0x0000003c0000-0x0000008c0000 : "KERNEL"
0x0000008c0000-0x000000dc0000 : "RECOVERY"
0x000000dc0000-0x0000013c0000 : "rootfs"
0x0000013c0000-0x000001420000 : "MISC"
0x000001420000-0x000008000000 : "UBI"
mstar notify driver install successfully
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
[mstar_pm_init] resume_pbase=0x200114B5, suspend_imi_vbase=0xD0057000
ThumbEE CPU extension supported.
Registering SWP/SWPB emulation handler
ubi0: attaching mtd10
[emac_phy_link_adjust] EMAC Link Down
ubi0: scanning is finished
ubi0: attached mtd10 (name "UBI", size 107 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 863, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 4/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 95, total reserved PEBs: 768, PEBs reserved for bad PEB handling: 20
ubi0: background thread "ubi_bgt0d" started, PID 437
Please set rtc timer (hwclock -w)
ms_rtcpwc 1f006800.rtcpwc: setting system clock to 1970-01-01 00:00:01 UTC (1)
OF: fdt:not creating '/sys/firmware/fdt': CRC check failed
VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
devtmpfs: mounted
This architecture does not have kernel memory protection.
mount: can't find devpts in /etc/fstab
net.core.rmem_default = 163840
net.core.rmem_max = 163840
net.core.wmem_default = 524288
net.core.wmem_max = 1048576
net.ipv4.tcp_mem = 924  1232  1848
net.ipv4.tcp_rmem = 4096  87380  325120
net.ipv4.tcp_wmem = 4096  131072  393216
/etc/init.d/rcS: line 14: telnetd: not found
mount: mounting none on /sys failed: Device or resource busy
mount: mounting none on /sys/kernel/debug/ failed: Device or resource busy
UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 454
UBIFS (ubi0:0): recovery needed
UBIFS (ubi0:0): recovery completed
UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "miservice"
UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:0): FS size: 9269248 bytes (8 MiB, 73 LEBs), journal size 1650688 bytes (1 MiB, 13 LEBs)
UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 07BD1086-29CE-46A8-9259-7D10FE6561FF, small LPT model
UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 458
UBIFS (ubi0:1): recovery needed
UBIFS (ubi0:1): recovery completed
UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "customer"
UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:1): FS size: 79740928 bytes (76 MiB, 628 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS (ubi0:1): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:1): media format: w4/r0 (latest is w4/r0), UUID 52410A3A-3D27-4DB8-9A6A-7159F66772B6, small LPT model
fuse: device not found, try 'modprobe fuse' first
rled: loading out-of-tree module taints kernel.
rled driver init successful!
BANK:0x111B 16bit-offset 0x06
0x0000
wifien driver init successful!
>> [sdmmc] ms_sdmmc_probe
>> [sdmmc_0] Probe Platform Devices
>> [sdmmc_1] Probe Platform Devices
sd
sd
/mnt/mtd/ipc/web/ClientPlus_Setup.exe
/mnt/mtd/ipc/web/js/libffmpeg.wasm
watchdog: watchdog0: watchdog did not stop!
Mstar_ehc_init version:20180309
Sstar-ehci-1 H.W init
Get power-enable-pad from DTS GPIO(107)
Titania3_series_start_ehc start
[USB] config miu select [70] [e8] [ef] [ef]
[USB] enable miu lower bound address subtraction
[USB] init squelch level 0x2
BC disable
==20180309==> hub_port_init 1 #0
Plug in USB Port1
insmod: can't insert '/config/modules/4.9.84/ms_notify.ko': No such file or directory
[CSI] probe
Request CSI IRQ[0]#30
CSI interrupt registered
vif driver probe
Create device file. vif_ints,0
jpe driver probed
[Isp_Driver_Init]
[s32CurClkIdx] = 0
[ISP] Request IRQ: 29, 57
[IspMid_Driver_Init]
ispsclttl:0
DivpProcInit 526
module [sys] init
config...... cmdpath:/config/config_tool, argv0:load_config
config...... cmdpath:/config/config_tool, argv1:/misc/config.ini
config...... cmdpath:/config/config_tool, argv2:/misc/PQConfig.ini
config...... cmdpath:/config/config_tool, argv3:(null)
[emac_phy_link_adjust] EMAC Link Down
module [sensor] init
module [mipitx] init
module [ao] init
module [rgn] init
module [ldc] init
module [vpe] init
module [shadow] init
module [gyro] init
module [vif] init
module [venc] init Jan 20 2021 16:08:47
module [panel] init
module [disp] init
module [ipu] init
module [divp] init
module [ai] init
module [vdisp] init
CamOsMutexInit already inited, LR:0xBF98D297
CamOsMutexInit already inited, LR:0xBF98D297
audioout driver init successful!
extalarm driver init successful  !
ircut driver init successful!
relay driver init successful!
reset driver init successful!
rs485 driver init successful!
wled driver init successful!
start_addr=(0x0), end_addr=(0x20000), buffer_size=(0x20000), smp_number_max=(16384)
Successfully initialized wpa_supplicant
OK

 RTC time 1970-01-01 00:00:06
Set system time as date -s 2023.04.01-14:10:11
Sat Apr  1 14:10:11 STD 2023
BusyBox v1.20.2 (2021-07-15 10:39:39 HKT) multi-call binary.

Usage: route [{add|del|delete}]

Edit kernel routing tables

        -n      Don't resolve names
        -e      Display other/more information
        -A inet{6}      Select address family

8731
8731
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
'TERMINATE' command timed out.
Configuration file: /mnt/mtd/ipc/tmpfs/hostapd.conf
Using interface wlan0 with hwaddr 70:3a:2d:72:3f:15 and ssid "IPCAM-444725"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
route: SIOCADDRT: File exists
udhcpd (v1.20.2) started
udhcpd: max_leases=235 is too big, setting to 101
killall: gerddns: no process killed
killall: upnp_map: no process killed
killall: upnp_map: no process killed
killall: ddns_update: no process killed

IPCamera login: workthread: log init succeed.
workthread: timer init succeed.
timer: proc start.
libs_initnettype(WiFi): succeed.
macaddr: 70:3A:2D:72:3F:15
macflag: 1
videocomm(0): 18(18) 3840 2160
videocomm(1): 6(6) 1280 720
TimeZone: -8
DevType(ini): product old(C6F0SpZ3N0P0L2)
DevType(ini): product new(C6F0SpZ3N0PmL2)
ini: open gcardinit2014.dat failed!
workthread: init ini succeed.
workthread: ntpsvr init succeed.
cloud: domestic
cloud: hx
cloud: cloudenable=0
ntp: enable=1, svr=ntp.main, interval=1
cloud: tmall: enable=0
cloud: tmallsvr proc start.
cloud: amazon: enable=0
cloud: amazonudpsvr proc start.
cloud: amazontcpsvr proc start.
cloud: update_usrpwd=0, update_timezone=0
workthread: cloud start.
cloud: cloudsvr proc start.
ircut: switch, imagetype=0.
ircut: switch, imagetype=1.
HI_Media_LiveStreamInit: mdalarm_type=1, smd_enable=1, md_enable=1
HI_Media_LiveStreamInit: sound_enable=0, sound_type=0, sound_time=10
sdkmgr: alarm mask enable.
HI_Media_SDKInit: SDKInitStart(uptime=35)...
sdkmgr: maxchn=2,profile=3
HI_Media_SDKInit: efreq=50,maxchn=2,wdr=0,mdresh=80,resolution=122,maxresolution=18,maxwidth=3840,maxheight=2160
HI_Media_SDKInit: maxchannel=2
HI_Media_SDKInit: maxresolution[0]=18
HI_Media_SDKInit: maxresolution[1]=6
u8Sensor: 201
index 0, Crop(0,0,3840,2160), outputsize(3860,2250), maxfps 20, minfps 3, ResDesc 3840x2160@20fps
index 1, Crop(0,0,3072,2048), outputsize(3096,2190), maxfps 30, minfps 3, ResDesc 3072x2048@30fps
index 2, Crop(0,0,3072,1728), outputsize(3096,1758), maxfps 30, minfps 3, ResDesc 3072x1728@30fps
index 3, Crop(0,0,2592,1944), outputsize(2616,1974), maxfps 30, minfps 3, ResDesc 2592x1944@30fps
index 4, Crop(0,0,2944,1656), outputsize(2976,1686), maxfps 30, minfps 3, ResDesc 2944x1656@30fps
index 5, Crop(0,0,2560,1440), outputsize(2592,1470), maxfps 30, minfps 3, ResDesc 2560x1440@30fps
index 6, Crop(0,0,1920,1080), outputsize(1920,1080), maxfps 60, minfps 3, ResDesc 1920x1080@60fps
index 7, Crop(0,0,3840,2160), outputsize(3864,2192), maxfps 30, minfps 3, ResDesc 3840x2160@30fps
---------------------------------------------
stSnrPlane0Info.s8SensorName: IMX415_MIPI
stSnrPlane0Info.u32ShutterUs: 99947
stSnrPlane0Info.u32SensorGainX1024: 0
stSnrPlane0Info.stCapRect.u16Width: 3840
stSnrPlane0Info.stCapRect.u16Height: 2160
ePixPrecision: 1, eBayerId: 3
u8DevId=0
u8DevId=1
u8DevId=2
HDN_sample 0, extheight 0
chipidx 3, revision 2
CmdqProcInit 821
CmdQ Free ID = 0, IspLocalCmdQHnd = 0xbfa8d138
ioc eRunningMode=24
CamOsMutexInit already inited, LR:0xBF9A05F5
CUS3A ver : Sigm[0] AE=1, AWB=0, AF=0, nFlagCus3A = 0x02
astar Module misc_cus3a version: project_commit.e06ed406 sdk_commit.ef2f530 build_time.20210120160917
[MI_ISP_CUS3A_Enable] AE = 1, AWB = 0, AF = 0
change isp[0] AE=1, AWB=1, AF=0, nFlagCus3A = 0x0A
root : /config/i[0] AE=1, AWB=1, AF=1, nFlagCus3A = 0x1A
qfile
Load iq file /config/iqfile/iqfile0.bin
[DIP] Virtual IRQ: 27
[MI_ISP_CUS3A_Enable] AE = 1, AWB = 1, AF = 0
[MI_ISP_CUS3A_Enable] AE = 1, AWB = 1, AF = 1
[iqserver_net_fun.c][mst_Sock_Listen] ListenSock=15
========================
 ===== [MhalCameraOpen] begin ===== VifMask : 0
Ch= 0, SNR ID: 0x0, VifCh = 0x0, PreOpen = 0
3DNR = 2, Rotation = 0, AckTie : 0
(W, H): (3840, 2160)
PixelFmt: 1, BayerID: 3, YuvOrder: 0
Mode: 0, HdrType: 0
GroupID: 0, Sync3A Type: 0
================[CameraReadIqData] isp root is /config/iqfile, nCh = 0
============================
[ALGO_MSG_MSG] MI_MD_Init
[ALGO_MSG_MSG] IC version check pass, MD Lib ver 20200210
[ALGO_MSG_MSG] MD_working_buf=0x1a4c30, length=3692
ldc: enable=1
ldc: 4k_720p init.
[sstar ae_init] isp_gain_max = 0x3fff, sgl_min = 0x400, sgl_max = 0x3e3400, sgs_min  0x400, sgs_max = 0x3e3400
[sstar ae_init], shl_min = 17 us, shl_max = 333333 us, shl_step = 17778 us, shs_min = 17 us, shs_max = 333333 us, shs_step = 17778 us
[sstar ae_init], FNum = 18, fps = 30
change isproot : /config/iqfile
Load iq file /config/iqfile/iqfile0.bin
************ af_init **********
[AF_InitParameters-1763] Error!! Initial motor parameters got from motor driver are unreasonable.
[AF_InitParameters-1764] InitPos = 0, MinMotorPos = 16711680, MaxMotorPos = 0, MinMotorStep = 1, MaxMotorStep = -16711680
[MI WRN ]: MI_LDC_UpdateViewRes[1828]: LDC Output should be aligned to (viewId: 0 width:3840 heighm:[MI WRN ]: MI_LDC_UpdateViewRes[1828]: LDC Output should be aligned to (viewId: 0 width:1280 height:736, cur: w1280 h720)

HI_SDK_Init: TH_flag=0,temp=0.000000,hum=0
HI_Media_SDKInit: sensor: 201
extalarm: off open
cCamOsTsemInit already inited, LR:0xBF9B3D43
olor(ini): b=0x008000, c=0x00ffff, trans=64
HI_SDK_InitOSD [AUDIO ERROR]DrvAudApiDtsInit, Failed to gpio_request amp-gpio !

initaudio: inputtype=1, input=75, output=70, aec=0
[_MI_AI_IMPL_AllocTmpBuffer:3844] tmp buffer addr[c4a7f000].
 _MI_AI_OpenAecLib: success
 _MI_AI_OpenVqeLib: success
 _MI_AI_OpenSrcLib: success
 _MI_AI_OpenG711Lib: success
 _MI_AI_OpenG726Lib: success
 _MI_AI_OpenAedLib: success
 _MI_AI_OpenSslLib: success
 _MI_AI_OpenBfLi[_MI_AO_Init:1248] Init Ao Gain.
b: success
 _MI_AO_OpenVqeLib: success
 _MI_AO_OpenSrcLib: success
 _MI_AO_OpenG711Lib: success
 _MI_AO_Create mi dev0
OpenG726Lib: sucCreate mi dev0
[MI WRN ]: _MI_VENC_CreateMiDevice[7850]: mi device:0 has been inited
cess
[_MI_AI_ApCreate mi dev1
cInit:2122] Dev0Create mhal DEV0.
 Chn0 Vqe buffer size:114684.
[[ven-w][wrap] illegal width and height. will use default value (3840 2176)
ALGO_MSG_MSG] Ch[ven-m][wrap] venc_dev_preset:1406 GetMMaHeapName s32Ret=0xa009201f, u8MMAHeapName=.
ecking IC....
[ven-m][wrap] fw_path /config/venc_fw/chagall.bin
[ALGO_MSG_MSG] [APC] APC IC check pass. ver.2019.1119.0000
[ALGO_MSG_MSG] [APC] FFT mode: floating point mode
[ALGO_MSG_MSG] [APC] Point Number: 128
[ALGO_MSG_MSG] [APC] Channel: 1
[ALGO_MSG_MSG] [APC] Sample rate: 8000
�z--------------------------------------------------------------------------------�{
�x                                                                                �x
�x                                   NEON ENABLE              Create mhal DEV1.
[ven-w][wrap] venc MMA callback function duplicate registration Force OverWrite!!
[ven-w][wrap] venc dev created, not support set E_MHAL_VENC_MAX_ENCODE_RESOLUTION, pls set before createdev
                Create mhal DEV2.
    �x
�x                                                                                �x
�|--------------------------------------------------------------------------------�}
[ALGO_MSG_MSG] [NR] Converge mode: Normal
[ALGO_MSG_MSG] [AGC] The AudioAgcProcessStruct initial succeed
[ALGO_MSG_MSG] [AGC] AGC IC check pass. ver.2019.1119.0000
[FFT] Please assigned the begining address about FFT workingbuffer in Init.
�z--------------------------------------------------------------------------------�{
�x                                                                                �x
�x                                   NEON ENABLE                                  �x
�x                                                                                �x
�|--------------------------------------------------------------------------------�}
[ALGO_MSG_MSG] [AGC] The AudioAgcProcessStruct initial succeed
[ALGO_MSG_MSG] [AGC] AGC IC check pass. ver.2019.1119.0000
[FFT] Please assigned the begining address about FFT workingbuffer in Init.
�z--------------------------------------------------------------------------------�{
�x                                                                                �x
�x                                   NEON ENABLE                                  �x
�x                                                                                �x
�|--------------------------------------------------------------------------------�}
[ALGO_MSG_MSG] [APC] APC internal initialize succeed
HI_Media_SDKInit: vctrl: enable=1, recchn=0
video(chn=0): profile=3, resolution=18, cbclient [891] connected, module:ipu
r=0, bitrate=800, frame=10, iframe=80, quality=0, minq=23, maxq=43
audio(chn=0): enable=1, type=1
video(chn=1): profile=3, resolution=6, cbr=0, bitrate=370, frame=10, iframe=80, quality=0, minq=23, maxq=43
audio(chn=1): enable=1, type=1
OSD(area=0): show=1, place=1, x=3536, y=0, str=YYYY-MM-DD hh:mm:ss
OSD(area=1): show=1, place=0, x=0, y=0, str=IP Camera
x=3194,y=0, w=628,h=112
x=1032,y=0, w=242,h=36
audio: denoise=1
audiovol: 1 75 70
HI_Media_SDKInit: vctrl: mdvalue=50
MD(area=1): enable=1, x=0, y=96, w=3840, h=2064, s=35
HI_neit: HI_SDK_StartEnuocceed.
video(chn=0): cbr=0, bitrate=800, frame=10, iframe=80, quality=0, minq=23, maxq=43
[MI WRN ]: MI_AI_GetFrame[7284]: Dev0 Chn0 Buffer(s) is lost due to slow fetching!!!
[MI WRN ]: MI_AI_GetFrame[7285]: Current buf index[8], recording buf index[0].
HI_SDK_StartMDChannel OK
HI_Media_SDKInit: HI_SDK_StartEncode(chn=1) succeed.
video(chn=1): cbr=0, bitrate=370, frame=10, iframe=80, quality=0, minq=23, maxq=43
HI_Media_SDKInit: display mode: color
[MAJOR]: ispversion(1) in sdk, ispversion(1) in binfile.
[MINOR]: ispversion(6) in sdk, ispversion(6) in binfile.
******************** Load api bin Success - /mnt/mtd/ipc/sensor/IMX415_day.bin ********************
HI_Media_SDKDisplayConfig: load sensor.bin succeed.
display(mode=1): brightness=50, contrast=50, saturation=50, sharpness=50, ae=2, targetY=70, night=0, mirror=0, flip=0, imgmode=1, noise=0, shutterau8SetProId[0]:0x71
miu_number:0,start:0x269e0000,end:0x26b44000,flag:1
=1000
display(mode=1): wdr=0, w_hal_to_cpu_isr invalid isr 1
drvalue=30
-----what is the a_manager------
IPU SDK version: 1.1.2_verified_21010811
client [891] Create IPU device, reference=1
Model version: 1.1.3_verified_21030809
VPS[0]=AAAAAUABDAH//wFgAAADAAADAAADAAADAJasCQ==
SPS[0]=AAAAAUIBAQFgAAADAAADAAADAAADAJagAeAgAhxY2uSTJrlnAIAAAfSAABONBA==
PLI[0]=000001
PPS[0]=AAAAAUQB4HawJkA=
VPS[1]=AAAAAUABDAH//wFgAAADAAADAAADAAADAJasCQ==
SPS[1]=AAAAAUIBAQFgAAADAAADAAADAAADAJagAoCALRY2uSTJrlnAIAAAfSAABONB
PLI[1]=000001
PPS[1]=AAAAAUQB4HawJkA=
sdkmgr: build vps/sps/pps succeed.
sdkmgr: alarm mask disable.
vctrl: alarm_push_recv.
[MI WRN ]: MI_SYS_IMPL_ConfigPrivateMMAPool[5594]: The current project supports MMU, and the private pool is disabled by default
client [891] Cre[0] AE=1, AWB=1, AF=1, nFlagCus3A = 0x1A
ate IPU channel 0
smd: threshold=60
setThreshold s32Ret = 0
smd: global_rect=1
smd: resolution=0(640x352)
smd: enable=1, threshold=43, x=0, y=0, w=3840, h=2160, multiflag=1

CUS3A ver : Sigmastar Module misc_cus3a version: project_commit.e06ed406 sdk_commit.ef2f530 build_time.20210120160917
[MI_ISP_CUS3A_Enable] AE = 1, AWB = 1, AF = 1
record: recchn=0, rectype=1, snapchn=0, snapnum=1
cloud: RecInit: cloudenable=1, recchn=0, mdrectime=30
cloudrec: ossloginflag=0, ossendtimeflag=0
[CLOUDREC SERVER] Rec_Chn=0, RB_Total_Size=5120k
cloud: recrb proc start.
cloud: recupload proc start.
cloud: recsvr proc start.
************ HI_SDK_AF_Start **********
record: relay_interval=5
cloudrec: rec_enable=0, rec_interval=5
ALARM_SERVER:
HI_Record_Stop succeed.
[RECORD SERVER] RB_PreRecTime=10s, RB_Total_Size=5120k
cloudrec: profile=3, width=3840, height=2160, aformat=0
HI_Media_RecInit: sd_chn=0, cloud_chn=0 succeed.
HI_Websvr_Init: init media succeed.
HI_Websvr_Init: PBServer start.
acl: enable=0, errnum=10
websvr: enable=1
HI_Websvr_Init: enable=1, httpport=80, snapchn=1
Interrupts_Proc: start.
g4: 4g module not exist!
workthread: init 4g succeed.
timerreboot: rndm=2120
workthread: timerreboot init succeed.
smdtrack: init succeed.
ptz type: rs485
rs485: flip=0, mirror=0
rs485: pandir=0, tiltdir=0
rs485: open fd(37) succeed.
motor: alarm_preset_enable=0, alarm_preset_index=0, alarm_preset_interval=2
workthread: ptz init succeed.
workthread: infrared init succeed.
rs485: MoveProc start.
ircut: freq=50
ircut: c2b_value=500, b2c_value=300
ircut: lamp_flag=2, lamp_mode=0, lamp_timeout=30
ircut: rled_status=2
ircut: lamp_status=2
infra: light_state=0
rled: open.
livestream: total_alarm_enable=1
timerreboot: enable=1, day=5, rand=2120, time=02:35:20
workthread: ircut init succeed.
ADC: proc start.
HI_Reset_Init: smart: enable=-1
HI_Reset_Init: light: enable=1
HI_Reset_Init: apmode: status=1
workthread: reset init succeed.
workthread: wifikey init succeed.
netdetect: wifi_flag=yes
netdetect: 4g_flag=no
workthread: netdetect init succeed.
netdetect: WiFi (Enable).
netdetect: netflag(WiFi).
workthread: search start.
ircut: proc start, lamp_mode=0
workthread: p2p start.
workthread: wdt init succeed.
===================================================
ipc_server start  : 2023-04-01 14:10:40
ipc_server version: V22.1.11.26.3-20231121
===================================================
wdt: default timeout: 60 sec.
wdt: default timeout: 5 sec.
rs485: read failed!
rs485: query hxv2 failed!
rs485: read failed!
rs485: query hxv2 failed!
SDKInitMonitorProc: exit!
infra: light_state=1
rled: open.
rs485: read failed!
rs485: query hxv2 failed!
timesvr: connect failed!
rs485: read failed!
rs485: query hxv2 failed!
/mnt/mtd/ipc/tmpfs/ipc.ok
rs485: read failed!
rs485: query hxv2 failed!
rs485: read failed!
rs485: query hxv2 failed!
rs485: not support hxv2 protocol!
rs485: read failed!
rs485: read failed!
rs485: read failed!
rs485: read failed!
rs485: read failed!
rs485: read failed!
rs485: not support hxv1 protocol!
rs485: ------ chk_ptz_ver=0 ------
rs485: pan_range=574, pan_home=287, tilt_range=114, tilt_home=23
umount: can't forcibly umount /mnt/mtd/ipc/tmpfs/sd: Invalid argument
rs485: MoveStatusProc start.
upgrade(sd): check start...
hichip: start: 2023-04-01 14:10:45
Platfrom Pram:
szUID=<REMOVED>
szServerID=EJLXSWPJLKEPPGHUIBEEARHYSTIHLUAOEIPDEGSQLNPAHXLTIDERLQENLKIEEOHUEHIAEEELEK-$$
szPushIp=47.242.178.139
szCrcKey=
u32StreamCtrl=1
pHichipID->aszPushIp
HI_HichipLink_Svr_Start
szUID = <REMOVED>, szCrcKet=nocrckey, u32StreamCtrl=1, aszPushIp=47.242.178.139
login dev success! handle[0]=-1268568352
login dev success! handle[1]=-1268566200
login dev success! handle[alarm]=-1268564048
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HI_Media_LiveStreamRegisterMediaLink: index=0,ip=127.0.0.1,type=http,avchn=0,ringbuflen=10k,onlinenum=0
HI_Media_LiveStreamParseStreamEx: cntindex=0,cntip=127.0.0.1,websocket=0,sock=46,avchn=0,mediatype=4
SendMediaDataThread(entry): cntindex=0,cntip=127.0.0.1,websocket=0,avchn=0,af=1,sock=46,maxframelen=1k
 start stream succeed(ret=0x0)! handle(alarm)=-1268564048
netlib:threadID -2025569200 ReceiveStreamData entry max frame len 16KB
login dev success! handle[alarm_2]=-1268545504
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HI_Media_LiveStreamRegisterMediaLink: index=1,ip=127.0.0.1,type=http,avchn=1,ringbuflen=10k,onlinenum=0
 start stream succeed(ret=0x0)! handle(alarm_2)=-1268545504
netlib:threadID -2059140016 ReceiveStreamData entry max frame len 16KB
HI_Media_LiveStreamParseStreamEx: cntindex=1,cntip=127.0.0.1,websocket=0,sock=48,avchn=1,mediatype=4
u32CodeType = 265
SendMediaDataThread(entry): cntindex=1,cntip=127.0.0.1,websocket=0,avchn=1,af=1,sock=48,maxframelen=1k
it is fl (-1)
it is smarttrack (1)
First1:
 HTTP/1.1 200 OK
Server: Hipcam
Cache-Control: no-cache
Content-Type:text/html
Connection: close
Content-Length: 232

var smd_enable="1";
var smd_threshold="43";
var smd_x="0";
var smd_y="0";
var smd_w="1280";
var smd_h="720";
var smd_type="0";
var smd_default_gthresh="60";
var smd_gthresh="60";
var smd_rect="1";
var md_alarm_type="on";

p2p_all_info.haveu32DrawRect 1
p2p_all_info.haveHsr 1
p2p_all_info.haveCloud 1
Mobile Net 0
CloudNation 1
it is CH(1)
it is EN(1)
Ver: V1.0.0.1
API V: 14071101
1-
Session[6]
Channel[6]
Buffer[1024]
Packet[1024]

2-
Session[6]
Channel[6]
Buffer[1024]
Packet[1024]

AF: rs485_auto_detec stop.
Unable to send data: Connection timed out
ChkSDUpgrade: sd detect ok.
Unable to send data: Connection timed out
Unable to send data: Connection timed out
no ms32006
AF HI_AF_I2cInit error
AF: init failed!
AF: status proc exit.
rs485: af_auto_detec stop.
rs485: goto preset(0)...
rs485: SMDTrack: enable=0, htimems=700, vtimems=300, timeout=60, type=3, preset=30, width=640, height=352, aftype=99, mirror=0, flip=0
rs485: MoveProc exit!
HI_P2P_SessionProcess listen start
UID:<REMOVED>
CRC:nocrckey
<REMOVED> 47.242.178.139
Hi_PushAlarm_GetServerAddr connect 47.242.178.139 failed
uAlarmPushHandle=-1268571136, sAlarmExitFlag=1
vctrl: svr start.
vctrl: enable=1, debug=0, mode=normal
vctrl: planrecenable=1, recchn=0, maxmdrectime=30
ChkSDUpgrade: not sd_flag file.
upgrade(sd): check end.
SmartWIFI: proc exit!
superDev_thread sucessfully!!
ircut: switch status off.
onvif: TZ: STD-8:0:0

onvif: TZInterval: 28800
onvif: login dev success! handle=555648
onvif: login dev success! handle[alarm]=557800
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HI_Media_LiveStreamRegisterMediaLink: index=2,ip=127.0.0.1,type=http,avchn=0,ringbuflen=10k,onlinenum=0
onvif: start stream succeed(ret=0x0)! handle(alarm)=557800
netlib:threadID -1235856288 ReceiveStreamData entry max frame len 16KB
HI_Media_LiveStreamParseStreamEx: cntindex=2,cntip=127.0.0.1,websocket=0,sock=50,avchn=0,mediatype=4
SendMediaDataThread(entry): cntindex=2,cntip=127.0.0.1,websocket=0,avchn=0,af=1,sock=50,maxframelen=1k
[ONVIF INFOR] FILE: src/onvif_media.c, LINE: 2945: Video configuration options use exterior.
onvif: timg: productid=C6F0SpZ3N0PmL2
[ONVIF INFOR] FILE: src/onvif_priv.c, LINE: 620: Success to start UDP service in ONVIF.
p_srv->sport  8080
onvif: V2.04-20211112
onvif: start: 2023-04-01 14:10:52
[ONVIF INFOR] FILE: src/onvif_priv.c, LINE: 1441: Success to add eth0 ip[192.168.1.88] to multicast[239.255.255.250](new fd)
timesvr: connect failed!
vctrl: switch to ---> lowrate mode.
video(chn=0): cbr=0, bitrate=288, frame=2, iframe=16, quality=1, minq=24, maxq=44
timesvr: connect failed!
timesvr: connect failed!
timesvr: get svrtime failed!
ntp: update failed!
rs485: move count/home stop.
rs485: move stop.
timesvr: connect failed!

IPCamera login:

References:

https://wx.comake.online/doc/doc/SigmaStarDocs-SSC9381G_9351_Pudding-ULS00V040-20210913/customer/faq/securityboot/OTP-Key.html https://github.com/roleoroleo/yi-hack-MStar