How to (Mini PTZ V2) - find which sensor, and backup the system.

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
*edit* This proposed method for figuring the sensor may not be accurate - see post #6 and later.
It's looking like Huisun are not necessarily programming correct info in the sensor line of config_hw.ini
But there may be another similar way - keep reading!

This is aimed at helping out over the uncertainty of the
"What sensor is in my Mini PTZ V2' and will it brick if I upgrade with the new firmware?"
quandary.
We know that following the shortage of IMX322 sensors following the Japanese earthquake, Huisun manufactured some Mini PTZ V2 with the IMX122 sensor.
We also know from posts on here that some V2s with the other sensor were bricked when updating with some new firmware.
And it seems that the ordering / delivery timing isn't a reliable way to determine what sensor may be installed.
So this post is aimed at gathering enough info from members that maybe a sticky can be created and maintained about what works with what and what doesn't.
And to protect against any future accidents - it would be good to have a recovery backup.


So how can I find out what sensor is in my Mini PZT V2? @pozzello has already posted about this, but to recap here is how I believe it's possible:
With your favourite telnet client (PuTTY or Linux or Windows telnet) start a telnet session to port 3232 on your Mini PTZ V2.
Rather than expose Huisun's not-very-well-protected root password, those interested can PM me.
We do want to keep Huisun on-side, after all, we're not aiming to enable paid-for locked features, just aiming to make best use of the camera.
This is the /home/config area.
In there are various types of files - those related to user-defined configuration settings, those related to default values, those relating to the camera hardware, written during manufacturing and holding items such as sensor bad pixel map, serial number, MAC address, model code etc - and the sensor installed.
The file of interest for the sensor is config_hw.ini
Code:
alastair@PC-I5 ~ $ telnet 192.168.1.131 3232
Trying 192.168.1.131...
Connected to 192.168.1.131.
Escape character is '^]'.

Ambarella login: root
Password: 
# cd /home/config
# ls -al
total 532
drwxr-xr-x    4 root     root             0 Jul 23 17:04 .
drwxr-xr-x    4 root     root             0 Jul 23 02:42 ..
-rwsr-sr-t    1 root     root        276480 Apr  7 13:17 badpixel_1080P.bin
-rwxr--r--    1 root     root          7359 Jun 25  2015 boa.conf
-rwxrw-r--    1 root     root           409 Oct 14  2015 capability
-rw-r--r--    1 root     root          1641 Jan  8  1970 config_hw.ini
-rw-r--r--    1 root     root         17129 Jul 23 17:04 config_media.ini
-rwxrw-r--    1 root     root         15904 Mar  1 17:07 config_media_130w.ini
-rwxrw-r--    1 root     root         15816 Mar  1 17:07 config_media_200w.ini
-rwxrw-r--    1 root     root         15811 Mar  1 17:07 config_media_ov4689_200w.ini
-rwxrw-r--    1 root     root         15804 Mar  1 17:07 config_media_ov4689_400w.ini
-rw-r--r--    1 root     root          2760 Jul 20 23:52 config_net.ini
-rw-r--r--    1 root     root         18489 Jan  1  1970 config_onvif.ini
-rw-r--r--    1 root     root            99 Apr  7 13:15 config_strange.ini
-rw-r--r--    1 root     root            99 Jul 23 03:00 config_time.ini
drwxr-xr-x    2 root     root             0 Jan  1  1970 default
-rw-------    1 root     root        101008 Jul 23 18:03 dome_setting.bin
-rwxrwxr-x    1 root     root         37168 Mar  3 18:31 hwconf_server
-rwxrw-r--    1 root     root          1775 Oct 19  2015 ipnc.pem
-rw-r--r--    1 root     root          3072 Jun 20 14:59 ptz_preset_value.bin
-rw-------    1 root     root          6528 Jan  1  1970 ptz_sequence_value.bin
-rw-r--r--    1 root     root           270 Jan  8  1970 qrcode.png
-rwxrw-r--    1 root     root           134 Oct 19  2015 stunnel.conf
-rwxrw-r--    1 root     root          1050 Jan  7  2016 tinyproxy.conf
drwxrwxr-x    2 root     root             0 Mar  3 18:31 upgrade
# cat config_hw.ini
;fixed feature
[mac]                                            
macaddr                        = 58:04:CB:10:C2:D3

checkcode                      = 9689d10aa375fca039eda9414ca5596fcd0b652b
[product]                                        
factoryid                      = 10C2D35702515B63CD
model                          =                
inner_model                    = PCS022C0010AIDAD0A0000
[watchdog]                                       
watchdog                       = 5              

[hardware]                                       
videoin                        = 1              
videoout                       = 0              
audioin                        = 0              
audioout                       = 0              
alarmin                        = 0              
alarmout                       = 0              
comnum                         = 0              
multicam                       = 0              
rotate                         = 0              
peertype                       = 2001           

;---------
alarmsync                      = 1              
rs485                          = 1              
ptzctrl                        = 1              
;-----------
sensor                         = imx122         
lens                           = 3001           ;XXYY XX(zoom) YY(index)  3000 3001 2000 3001 1000 1001 300 301 100 101

[focus]                                          
type                           = 0              ;0 - iris + focus , 1 - only focus , 2 - nothing       
zoomlist                       = 10,40,80,120,160,0,0,0,0,0,0,0,0,0,0,0;size must be 16,0 means invalid.  
#
Check out the value in the line marked 'sensor'. In this case it's imx122
Remembering that the camera I'm connected to was @pozzello 's, which was bricked by a firmware update, and recovered, the observant among you may ask 'Why does it say imx122?'
Good question.
The answer is that the camera was recovered by applying a copy of mtdblock4 that @pozzello provided from his working camera. So this one is now a clone. @pozzello - this implies that the camera you grabbed mtdblock4 from has an imx122 sensor. Do you agree?
And that the bricked one was purchased in a time frame that covered the use of the imx122.

It will be of interest if others could do this check and we can reach a concensus that it works and is vaid.

Now a word about backups - and not just your configuration backups -
OK - so in case I brick the camera in future, how can I back up the flash contents for possible recovery?
That's pretty straightforward. With telnet access, the entire flash storage can be dumped as a backup by taking copies of mtdblock0-4
It's not necessary to have an SMB/CIFS or NFS share on your network, this can conveniently be done using tftp to send the files to a tftp server.
For a Windows PC, an old but good tftp server is the Jounin one here : http://www.jounin.net/tftpd32.html
Here is a session transcript of how to extract the mtdblocks from the camera.
We are using /tmp as the temporary area as it's in RAM and there should be enough space for the 16MB extract.
If there isn't enough space, mounting an NFS share would eliminate that problem.
Code:
alastair@PC-I5 ~ $ telnet 192.168.1.131 3232
Trying 192.168.1.131...
Connected to 192.168.1.131.
Escape character is '^]'.

Ambarella login: root
Password: 
# df
Filesystem                Size      Used Available Use% Mounted on
/dev/root                13.9M     13.1M    896.0K  94% /
devtmpfs                 60.3M         0     60.3M   0% /dev
tmpfs                    60.4M      4.0K     60.4M   0% /tmp
tmpfs                    60.4M         0     60.4M   0% /dev/shm
tmpfs                    60.4M     60.0K     60.3M   0% /run
none                     60.4M     10.2M     50.2M  17% /ipnc
none                      4.0M         0      4.0M   0% /ipnc/snapshot
none                      2.0M     20.0K      2.0M   1% /ipnc/log
none                      5.0M         0      5.0M   0% /ipnc/ringbuf
# dd if=/dev/mtdblock0 of=/tmp/mtdblock0
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.016249 seconds, 3.8MB/s
# dd if=/dev/mtdblock1 of=/tmp/mtdblock1
384+0 records in
384+0 records out
196608 bytes (192.0KB) copied, 0.054247 seconds, 3.5MB/s
# dd if=/dev/mtdblock2 of=/tmp/mtdblock2
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.015964 seconds, 3.9MB/s
# dd if=/dev/mtdblock3 of=/tmp/mtdblock3
3456+0 records in
3456+0 records out
1769472 bytes (1.7MB) copied, 0.488210 seconds, 3.5MB/s
# cd /tmp
# ls -al
total 2052
drwxrwxrwt    2 root     root           140 Jul 23 23:52 .
drwxr-xr-x   20 root     root             0 Jan  1  1970 ..
-rw-r--r--    1 root     root         65536 Jul 23 23:51 mtdblock0
-rw-r--r--    1 root     root        196608 Jul 23 23:51 mtdblock1
-rw-r--r--    1 root     root         65536 Jul 23 23:51 mtdblock2
-rw-r--r--    1 root     root       1769472 Jul 23 23:52 mtdblock3
-rw-r--r--    1 root     root            23 Jul 23 23:49 resolv.conf
# tftp -p -l mtdblock0 192.168.1.21
mtdblock0            100% |*******************************| 65536   0:00:00 ETA
# tftp -p -l mtdblock1 192.168.1.21
mtdblock1            100% |*******************************|   192k  0:00:00 ETA
# tftp -p -l mtdblock2 192.168.1.21
mtdblock2            100% |*******************************| 65536   0:00:00 ETA
# tftp -p -l mtdblock3 192.168.1.21
mtdblock3            100% |*******************************|  1728k  0:00:00 ETA
# rm mtdblock*
# dd if=/dev/mtdblock4 of=/tmp/mtdblock4
28544+0 records in
28544+0 records out
14614528 bytes (13.9MB) copied, 4.074778 seconds, 3.4MB/s
# tftp -p -l mtdblock4 192.168.1.21
mtdblock4            100% |*******************************| 14272k  0:00:00 ETA
# rm mtdblock*
# ls -al
total 4
drwxrwxrwt    2 root     root            60 Jul 23 23:53 .
drwxr-xr-x   20 root     root             0 Jan  1  1970 ..
-rw-r--r--    1 root     root            23 Jul 23 23:49 resolv.conf
# echo "that was easy!"
that was easy!
#
 
Last edited by a moderator:

Q™

IPCT Contributor
Joined
Feb 16, 2015
Messages
4,990
Reaction score
3,989
Location
Megatroplis, USA
Is there a simple utility which can be built to query and return the "Sensor" value?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Given that PuTTY is installed, the plink command-line utility should allow a remote logon and execute a command file.
I've used that before on Windows - it's dumb and crude but works.
I might check it out later, my PC is on a heavy date with Linux just now.
 
  • Like
Reactions: PDJ

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
I will check both cams that i didn't mount yet but are you positive that it's really correct setting or the fact that it has imx122? The IQ has improved in v2 cams over v1. BTW can anyone with v1 cam check this as well?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
are you positive that it's really correct setting or the fact that it has imx122?
I think it's pretty likely it's a reliable indicator of the sensor installed, as the file holds other values specific to an individual camera.
Presumably it was bricked with the firmware update because it really is imx122, but I don't know what the purchase date was, that is not on the label. @pozzello will advise.
 
Last edited by a moderator:

pozzello

Known around here
Joined
Oct 7, 2015
Messages
2,270
Reaction score
1,117
Both my cams were purchased and delivered before the April earthquakes we assume caused the sony cmos shortages.

If my cams were indeed IMX222's, why did one get bricked loading up the imx222-specific firmware?

And how could they be fine running the 3/3/2016 (IMX322) firmware?

I think we just haven't yet found the definitive software flags to know for sure what sensor is installed...
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Hmmm.... well that does throw doubt - a lot - on my theory.
As does this fragment from the serial console:
sink 0 is CVBS
[ 12.199515] ambarella_vout_clk_set_rate: rate = 27000000
Init vout1 done.
>>> *************resource_limit_setup**************
>>> main : 1920 * 1080 - 1920 * 1080
>>> second : 704 * 576 - 704 * 576
>>> third : 704 * 576 - 1920 * 1080
>>>
SENSOR_IMX322
no translater for filter 10
############set af filter:0
init 3A done
And this fragment from the kernel log, accessible from a telnet root shell:
<7>[ 9.517492] hw_pts_init(110): Audio clock freq: 12288000, HW timer clock freq: 90000!
<6>[ 9.532967] VIN: vin0: probed!
<6>[ 9.536021] VIN: vin1: probed!
<5>[ 9.741949] Vout notice: CVBS:0@1 probed!
<6>[ 9.899565] SYSCLK:SO[74175824]
<6>[ 9.929703] VIN: IMX322-SPI init(parallel)
<7>[ 9.971149] dsplog dev init done, dev_id = 248:249.
<7>[ 9.972284] dsplog_printk: DSP log by Timer New
<6>[ 12.018476] net eth0: adv: sym 0, asym: 0
<7>[ 12.182647] iav_goto_idle(742): Goto Idle from STATE_INIT.
OK - so maybe Huisun have been a bit careless with the contents of config_hw.ini
But maybe the bootup initialisation will work.
I'll edit the first post later to include that check - it's easy to do.
 

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
ok, let us know what command we need to run to get this info! Thank you for all the info on this!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
At a root telnet prompt, if the camera has been recently rebooted (the log doesn't go back for ever, and the message is during startup) :
alastair@PC-I5 ~ $ telnet 192.168.1.131 3232
Trying 192.168.1.131...
Connected to 192.168.1.131.
Escape character is '^]'.

Ambarella login: root
Password:
# dmesg | grep -i imx
[ 9.929703] VIN: IMX322-SPI init(parallel)
#
 

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
Ran the command on both cams:

Fixed cam

[ 10.039683] VIN: IMX322-SPI init(parallel)

New cam
[ 9.799892] VIN: IMX322-SPI init(parallel)

@Larebear or @bob2701 could you try this commmand with your v1s?
 

GeoSale

n3wb
Joined
Mar 27, 2016
Messages
8
Reaction score
0
Just my experience for Imporx v2 mini-ptz:

from the file:
sensor = imx122

after the command:
[ 10.692188] VIN: IMX322-SPI init(parallel)
 
Last edited by a moderator:

bob2701

Getting comfortable
Joined
Jan 7, 2016
Messages
1,009
Reaction score
482
Location
Jersey Shore
The 2 V2 10X cameras I have shown below.

# dmesg | grep -i imx
[ 9.739874] VIN: IMX322-SPI init(parallel)

# dmesg | grep -i imx
[ 9.789728] VIN: IMX322-SPI init(parallel)

I also tried it on my V1 3X cameras and it did not return anything.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I also tried it on my V1 3X cameras and it did not return anything.
@bob2701 It may be that the sensor is shown differently in your different camera - maybe post your whole dmesg as a
Code:
 or attach as a file?
 
Last edited by a moderator:

bob2701

Getting comfortable
Joined
Jan 7, 2016
Messages
1,009
Reaction score
482
Location
Jersey Shore
@bob2701 It may be that the sensor is shown differently in your different camera - maybe post your whole dmesg as a
Code:
 or attach as a file?[/QUOTE]

I'm getting different results with the V1 3X and the V2 4X as show below.

V1 3X:
 
Ambarella login: root
Password:
# dmesg
total_resoution: 921600
[   57.218660] iav: overlay area 0 clut address 0x07A02000, clut id 8, data addr 0x4BB95C00.
[   57.218693] iav: overlay data offset is 0xbcc00
[   57.218733] iav: overlay area 1 clut address 0x07A02400, clut id 9, data addr 0x4BB99300.
[   57.218759] iav: overlay data offset is 0xc0300
[   58.007368] iav: total_resoution: 2073600
[   58.007470] iav: overlay area 0 clut address 0x07A00000, clut id 0, data addr 0x4BADC000.
[   58.007500] iav: overlay data offset is 0x3000
and 23 pages just like this....

V2 4X:

Ambarella login: root
Password:
# dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73 (robot@dev-ubuntu-14) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #6 PREEMPT Wed Nov 11 13:58:11 CST 2015
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] Memory policy: ECC disabled, Data cache writeback

And more which i have not really looked at yet.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Yes, there will be big differences, different hardware.
But I just wondered if there was a sensor reference that may not be preceded with "imx", but something different.
 
Top