YooSee SD-M5 doorbell: 1080p, PoE, RTSP, Onvif, only $66

I now have a different problem. Probably messed something up because de camera won't mount the SD card anymore. Already tried reformatting on different machines (where the card is recognised and writeable).
The log shows:
Code: 
<6>mmc1: new high speed SD card at address b368
<6>mmcblk0: mmc1:b368 SD01G 953 MiB
<3>mmcblk0: error -110 sending status command, retrying
<3>mmcblk0: error -84 sending status command, retrying
<3>mmcblk0: error -84 sending status command, aborting
<3>end_request: I/O error, dev mmcblk0, sector 0
<3>Buffer I/O error on device mmcblk0, logical block 0
<3>mmcblk0: error -110 sending status command, retrying
<3>mmcblk0: error -84 sending status command, retrying
<3>mmcblk0: error -84 sending status command, aborting
<3>end_request: I/O error, dev mmcblk0, sector 0
<3>Buffer I/O error on device mmcblk0, logical block 0
<3>mmcblk0: error -110 sending status command, retrying
<3>mmcblk0: error -84 sending status command, retrying
<3>mmcblk0: error -84 sending status command, aborting
<3>end_request: I/O error, dev mmcblk0, sector 0
<3>Buffer I/O error on device mmcblk0, logical block 0
<6> mmcblk0: unable to read partition table

Any thoughts?
 
I now tried:
- 64GB NTFS -> Not recognised, not mentioned in /proc/kmsg and no mmcblk under /dev/
- 128GB FAT32 -> Not recognised, not mentioned in /proc/kmsg and no mmcblk under /dev/

The original 1GB FAT/FAT32 -> Error reading bootsector, multiple errors in /proc/kmsg and new device /dev/mmcblk (the errors are as stated previously)
 
You could try to dd the partition table on the doorbell, take it out, dd on a linux machine you own, and look at the diffs?
 
Just to be complete: I once again did a sudo mkfs.vfat -F 32 /dev/sdb -I on my Linux machine. Then placed some files on the card and unmounted it properly.
While the doorbell was powered off, inserted the SD card and then powered it up. This is what cat /proc/kmsg shows:
Code: 
<6>Booting Linux on physical CPU 0
<5>Linux version 3.4.35 (root@ubuntu) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #61 Wed Aug 30 18:45:19 CST 2017
<4>CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
<4>CPU: VIVT data cache, VIVT instruction cache
<4>Machine: hi3518ev200
<4>Memory policy: ECC disabled, Data cache writeback
<7>On node 0 totalpages: 7168
<7>free_area_init_node: node 0, pgdat c03e3ff8, node_mem_map c0414000
<7>  Normal zone: 56 pages used for memmap
<7>  Normal zone: 0 pages reserved
<7>  Normal zone: 7112 pages, LIFO batch:0
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 7112
<5>Kernel command line: mem=28M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=squashfs mtdparts=hi_sfc:384k(boot),2048k(kernel),2560k(rootfs),320k(rom),-(app)
<6>PID hash table entries: 128 (order: -3, 512 bytes)
<6>Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
<6>Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
<6>Memory: 28MB = 28MB total
<5>Memory: 24200k/24200k available, 4472k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5>    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
<5>    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
<5>    vmalloc : 0xc2000000 - 0xff000000   ( 976 MB)
<5>    lowmem  : 0xc0000000 - 0xc1c00000   (  28 MB)
<5>    modules : 0xbf000000 - 0xc0000000   (  16 MB)
<5>      .text : 0xc0008000 - 0xc03a0000   (3680 kB)
<5>      .init : 0xc03a0000 - 0xc03bcfc4   ( 116 kB)
<5>      .data : 0xc03be000 - 0xc03e46e0   ( 154 kB)
<5>       .bss : 0xc03e4704 - 0xc0413c98   ( 190 kB)
<6>SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
<6>NR_IRQS:32
<6>VIC @fe0d0000: id 0x00641190, vendor 0x41
<6>sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
<6>Console: colour dummy device 80x30
<6>Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
<6>pid_max: default: 32768 minimum: 301
<6>Mount-cache hash table entries: 512
<6>Initializing cgroup subsys freezer
<6>CPU: Testing write buffer coherency: ok
<6>Setting up static identity map for 0x802b9a88 - 0x802b9ae0
<6>NET: Registered protocol family 16
<6>Serial: AMBA PL011 UART driver
<6>uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
<6>console [ttyAMA0] enabled
<6>uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
<6>uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
<6>bio: create slab <bio-0> at 0
<5>SCSI subsystem initialized
<5>hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
<5>hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<6>Switching to clocksource timer0
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 1024 (order: 1, 8192 bytes)
<6>TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP: Hash tables configured (established 1024 bind 1024)
<6>TCP: reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
<7>yaffs: yaffs built Aug  8 2017 15:48:49 Installing.
<6>msgmni has been set to 47
<6>Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>io scheduler cfq registered
<6>brd: module loaded
<6>Check Flash Memory Controller v100 ...  Found.
<6>SPI Nor(cs 0) ID: 0xc2 0x20 0x17
<6>Block:64KB Chip:8MB Name:"MX25L6436F"
<6>SPI Nor total size: 8MB
<5>5 cmdlinepart partitions found on MTD device hi_sfc
<5>5 cmdlinepart partitions found on MTD device hi_sfc
<5>Creating 5 MTD partitions on "hi_sfc":
<5>0x000000000000-0x000000060000 : "boot"
<5>0x000000060000-0x000000260000 : "kernel"
<5>0x000000260000-0x0000004e0000 : "rootfs"
<5>0x0000004e0000-0x000000530000 : "rom"
<5>0x000000530000-0x000000800000 : "app"
<6>SPI Nand ID Table Version 2.2
<4>Cannot found a valid SPI Nand Device
<6>himii: probed
<6>ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
<6>hiusb-ehci hiusb-ehci.0: HIUSB EHCI
<6>hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
<6>hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
<6>hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 1 port detected
<6>ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
<6>hiusb-ohci hiusb-ohci.0: HIUSB OHCI
<6>hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
<6>hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
<6>hub 2-0:1.0: USB hub found
<6>hub 2-0:1.0: 1 port detected
<6>dwc_otg: version 3.00a 10-AUG-2012
<4>Core Release: 3.10a
<4>Setting default values for core params
<4>Using Buffer DMA mode
<4>Periodic Transfer Interrupt Enhancement - disabled
<4>Multiprocessor Interrupt Enhancement - disabled
<4>OTG VER PARAM: 0, OTG VER FLAG: 0
<4>Dedicated Tx FIFOs mode
<6>i2c /dev entries driver
<5>hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
<5>hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
<5>hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
<6>TCP: cubic registered
<6>Initializing XFRM netlink socket
<6>NET: Registered protocol family 17
<6>NET: Registered protocol family 15
<6>lib80211: common routines for IEEE802.11 drivers
<7>lib80211_crypt: registered algorithm 'NULL'
<5>Registering the dns_resolver key type
<6>VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
<6>Freeing init memory: 112K
<6>usb 1-1: new high-speed USB device number 2 using hiusb-ehci
<6>HISI_IRDA-MF @Hi3518v100R001
<4>hiir: init ok. ver=Jan  3 2007, 19:33:43.
<4>uart1 init ok. ver=May 24 2007, 18:50:36.
<6>usbcore: registered new interface driver rtl8188fu
<6>Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
<6>Hisilicon Media Memory Zone Manager
<4>Module himedia: init ok
<4>hi3518e_base: module license 'Proprietary' taints kernel.
<4>Disabling lock debugging due to kernel taint
<4>load sys.ko for Hi3518EV200...OK!
<4>load tde.ko ...OK!
<6>load region.ko ....OK!
<4>load vgs.ko for Hi3518EV200...OK!
<6>ISP Mod init!
<4>load viu.ko for Hi3518EV200...OK!
<6>load vpss.ko ....OK!
<6>load vou.ko ....OK!
<4>load hifb.ko OK!
<4>load rc.ko for Hi3518EV200...OK!
<4>load venc.ko for Hi3518EV200...OK!
<4>load chnl.ko for Hi3518EV200...OK!
<4>load h264e.ko for Hi3518EV200...OK!
<4>load jpege.ko for Hi3518EV200...OK!
<4>load ive.ko for Hi3518EV200...OK!
<4>acodec inited!
<1>mipi_init
<4>init phy power successful!
<4>load hi_mipi driver successful!
<4>sHiRegCmd.dwBaseAddr = 0x20120000 0xc4
<4>sHiRegCmd.dwBaseAddr = 0x20120000 0xc4
<4>sHiRegCmd.dwBaseAddr = 0x20120000 0xc8
<4>sHiRegCmd.dwBaseAddr = 0x20120000 0xc8
<6>PHY: himii:00 - Link is Up - 100/Full
<6>PHY: himii:00 - Link is Up - 100/Full
 
Guys, someone can describe how to do FPS drop fix in detail?
I understand it is impossible to do this via telnet?
 
In case anyone is interested, I've rewritten my code and extended it a bit. I'm now able to send messages to a Nextcloud chat group. Also, all the steps have been taken to setup a call to a Nextcloud chat group, which leaves me to the next step: use native WebRTC to start sending video footage to your Nextcloud chat group. And I must say, what a hellhole is native WebRTC....
 
  • Like
Reactions: exotsk
mrxyz said:
In case anyone is interested, I've rewritten my code and extended it a bit. I'm now able to send messages to a Nextcloud chat group. Also, all the steps have been taken to setup a call to a Nextcloud chat group, which leaves me to the next step: use native WebRTC to start sending video footage to your Nextcloud chat group. And I must say, what a hellhole is native WebRTC....
Click to expand...
I got a WebRTC stream using a great homeassistant component(AlexxIT/WebRTC). Separately, thanks to this forum, nothing worked without fixing the FPS!
Thx @Florissilfhout !!!
 
If anyone is interested, I could post the patched firmware which has the FPS fix, has Telnet enabled, and should stay up and running for more than 3 days when not connected to WAN.

In the meantime, I overcame the issue of the malfunctioning SD card reader:
I am using Home Assistant running inside Docker on my Synology. I added the mosquitto_pub on the 'www' section of Home Assistant so I could then wget 192.168.1.3:8123/local/mosquitto_pub from the doorbell.
Then, I wrote a little script on the doorbell itself with vi:
Code: 
#!bin/sh                                                                         
                                                                                
cat /proc/kmsg | while read line; do                                               
    if (echo $line == *"sHiRegCmd.dwBaseAddr"*); then   
        echo "Button is pushed"                                           
        ./mosquitto_pub -h 192.168.1.3 -p 1883 -u USER -P PASSWORD -t "TOPIC/" -m "MESSAGE"
    fi
done
Then on the Home Assistant, I am listening on the MQTT topic which then sends notifications to my phone and plays a 'dingdong' sound from my Google Nest Mini.
(Did I already mention I couldn't get the chime to work anymore? Pairing is impossible)
 
  • Like
Reactions: Evo
Florissilfhout said:
If anyone is interested, I could post the patched firmware which has the FPS fix, has Telnet enabled, and should stay up and running for more than 3 days when not connected to WAN.

In the meantime, I overcame the issue of the malfunctioning SD card reader:
I am using Home Assistant running inside Docker on my Synology. I added the mosquitto_pub on the 'www' section of Home Assistant so I could then wget 192.168.1.3:8123/local/mosquitto_pub from the doorbell.
Then, I wrote a little script on the doorbell itself with vi:
Code: 
#!bin/sh                                                                        
                                                                               
cat /proc/kmsg | while read line; do                                              
    if (echo $line == *"sHiRegCmd.dwBaseAddr"*); then  
        echo "Button is pushed"                                          
        ./mosquitto_pub -h 192.168.1.3 -p 1883 -u USER -P PASSWORD -t "TOPIC/" -m "MESSAGE"
    fi
done
Then on the Home Assistant, I am listening on the MQTT topic which then sends notifications to my phone and plays a 'dingdong' sound from my Google Nest Mini.
(Did I already mention I couldn't get the chime to work anymore? Pairing is impossible)
Click to expand...

Yes. Could you please share the patched firmware?
Your efforts are much appreciated.
 
Patched Firmware 13.01.01.31 based on 13.01.01.30:
  • Has Telnet enabled
  • Has FPS fix, steady on 15fps
  • Stays up&running > 3 days, even when disconnected from WAN

Instructions to install:
Place npcupg.bin on root of (preferably empty) SD card
Insert SD card into slot on Doorbell
Open YooSee App -> Settings -> Firmware and select install. This will install the local firmware from SD.

I like to thank users @mrxyz, @sp00025, @SecuritySeeker, @petervk for their input and for sharing their work here.
I take no responsibility for any kind of damages or malfunctioning resulting from using attached firmware.
 

Attachments

  • Like
Reactions: hamx71, Evo, dustysmurf and 4 others
I don't even have a YouSee, but that's really nice of you to post that.
 
  • Like
Reactions: whoami ™
Florissilfhout said:
Patched Firmware 13.01.01.31 based on 13.01.01.30:
  • Has Telnet enabled
  • Has FPS fix, steady on 15fps
  • Stays up&running > 3 days, even when disconnected from WAN

Instructions to install:
Place npcupg.bin on root of (preferably empty) SD card
Insert SD card into slot on Doorbell
Open YooSee App -> Settings -> Firmware and select install. This will install the local firmware from SD.

I like to thank users @mrxyz, @sp00025, @SecuritySeeker, @petervk for their input and for sharing their work here.
I take no responsibility for any kind of damages or malfunctioning resulting from using attached firmware.
Click to expand...

Thank you!

Is is possible to upload the patched firmware, via IPC_upgrade_Tool_en_v2 software?
 
I have a Reolink NVR RLN8-410, and wondering if anyone has managed to successfully connect the YooSee SD-M5 doorbell to this NVR.
I have tried RTSP, and Onvif with no luck.
 
petervk said:
Well I've successfully managed to corrupt my filesystem, and now npc wont run, either from SD or Flash :) . I should be able to recover by reflashing from uboot, will report back when I've got something useful to share.
Click to expand...
Could you please share your instructions for reflashing the firmware over UART from u-boot?
 
Using the IPC tool I was able to reupload the patched firmware (probably ran out of space/inodes because the system wouldn't let me save scripts anymore). Again using wget I was able to get mosquitto_pub and the doorbell.sh onto the device.
My question: using Telnet to start the doorbell.sh and testing a button press: everything works. Then exiting out of Telnet (doorbell.sh still running) and pressing the doorbell: no MQTT message anymore... How to overcome this situation?
I am using roughly the same script petervk made:
Code: 
#!/bin/sh

while read line; do
    if (echo $line == *"sHiRegCmd.dwBaseAddr"*); then
        ./mosquitto_pub -h 192.168.x.x -p 1883 -u USER -P Password -t "Home/Groundfloor/Outside/Doorbell" -m "DINGDONG"
    fi
done < /proc/kmsg
 
Florissilfhout said:
Using the IPC tool I was able to reupload the patched firmware (probably ran out of space/inodes because the system wouldn't let me save scripts anymore). Again using wget I was able to get mosquitto_pub and the doorbell.sh onto the device.
My question: using Telnet to start the doorbell.sh and testing a button press: everything works. Then exiting out of Telnet (doorbell.sh still running) and pressing the doorbell: no MQTT message anymore... How to overcome this situation?
I am using roughly the same script petervk made:
Code: 
#!/bin/sh

while read line; do
    if (echo $line == *"sHiRegCmd.dwBaseAddr"*); then
        ./mosquitto_pub -h 192.168.x.x -p 1883 -u USER -P Password -t "Home/Groundfloor/Outside/Doorbell" -m "DINGDONG"
    fi
done < /proc/kmsg
Click to expand...
install screen or something similar.
 
Florissilfhout said:
Could you please share your instructions for reflashing the firmware over UART from u-boot?
Click to expand...

Um, I think I ended up using the linux mtd utiliies rather than uboot.


Florissilfhout said:
Then exiting out of Telnet (doorbell.sh still running) and pressing the doorbell: no MQTT message anymore... How to overcome this situation?
Click to expand...

@mrxyz's right. the script is probably getting killed once the telnet session is disconnected. Maybe put this script in your /npc/npc script, or call it from there ?
 
You must log in or register to reply here.
Top Bottom