Compile custom firmware - GrumpyMeow/XiaomiXiaofangFirmware GitHub Wiki

These instructions will enable you to construct your own firmware for the Xiaomi Xiaofang camera. These instructions will result in a firmware with only the ROOTFS-R image. Thus keeping the original kernel image intact. To gain extra space on the ROOTFS-R image for applications, the image will be made larger than default. The rescue image will be sacrificed for this extra space.

These instructions will compile a wifi driver for the rtl8188eu. In this driver the CONCURRENT MODE will be enabled to have STA and AP functionality at the same time (be connected to an Accesspoint and also be a AccessPoint itself).

This firmware revolves around the Sonix Galaxy Server, which is a RTSP server. This server is combined with a WebAdmin interface, Onvif support. But unfortunatly not everything is working yet.

For the initial WiFi setup Realtek Simple Config will be used. This will enable setting up the device via an App using a pincode.

The firmware file "FIRMWARE_660R.bin" should be placed in the root of a FAT formatted sdcard. Holding the setup button for 10 seconds during powering-on the camera with the sdcard inserted.

Prerequisites

To follow the steps the following prerequisites are needed:

  • Sonix Build Environment Image (Virtual Appliance image)
  • Sonix SDK SN986 (for instance: v1.60)
  • Assets package (compiled for this instruction)
  • [optional] "USR SimpleConfig" from the AppStore to configure the camera for initial WiFi setup.

extract the SDK

We will start up with preparing the SDK in the Build Environment

  • Boot up the Sonix Build Environment in VirtualBox
  • Login as: root / devel
  • Navigate to a directory: cd /root
  • Place the Sonix SDK .tgz file in the folder "/root"
  • Extract the sdk in the /root: tar xvf /home/dev/SN986_1.60_QR_Scan_019a_20160606_0951.tgz
  • Navigate to the directory of the extracted sdk: cd /root/SN986_1.60_QR_Scan_019a_20160606_0951
  • [SDK 1.60 specific] Replace the empty "usb-wifi.tgz" of SDK 1.60 with the version of the Assets package. Overwrite in: "/root/SN986_1.60_QR_Scan_019a_20160606_0951.org/package/driver/"
  • Unpack the SDK: ./snx_unpack.sh
  • Move the snx_sdk directory (for shorter pathnames) to the root: mv snx_sdk /snx_sdk

Replace the unknown root password

The password files which are present in the SDK have an unknown root password. We replace these password hashes with the hash of the password "ismart12":

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/shadow
  • Replace: root:$1$2368HyEJ$kwdhYsA4j0BOLLvdohThM1:10933:0:99999:7:::
  • With: root:rJ0FHsG0ZbyZo:17092:0:99999:7:::

Remove the default WPA_SUPPLICANT

WPA_SUPPLICANT is a configuration file to have the device connect to a specific accesspoint. We will configure this later via another way.

  • Remove: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/wpa_supplicant.conf
  • Remove: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/Wireless/

Remove eth0

The SN98660 chipset has an ethernet interface, but is disconnected for the Xiaofang. Loading the ethernet (snx_mac) driver will also hang the device during boot.

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/network/interfaces
  • Remove:
# Configure Ethernet
auto eth0
iface eth0 inet dhcp

Modify default configured nameserver

The "resolv.conf" is a configuration file used by DNS resolvement.

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/resolv.conf
  • Replace contents with: nameserver 8.8.8.8

Modify rcS

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rcS
  • Remove the line: #modprobe rt3070sta
  • Remove the line: #modprobe rt5370sta
  • Uncomment the line: modprobe 8188eu
  • Keep the line as-is: #insmod isp driver
  • Uncomment the line: #modprobe snx_rtc
  • Uncomment the line: #modprobe snx_vb2
  • Uncomment the line: #modprobe snx_vc snx_vb2=1 snx_percent=0
  • Uncomment the line: #modprobe snx_vo
  • Keep the the line commented: #modprobe snx_dhid
  • Uncomment the block:
#mkdir -p /tmp/record
#mount -t tmpfs tmpfs /tmp/record -o size=4m
#dd if=/dev/zero of=/tmp/record/record_fs bs=1024 count=4608
#losetup /dev/loop0 /tmp/record/record_fs
#mkfs.ext2 -q /dev/loop0
#mount -t ext2 /dev/loop0 /tmp/record

auto start Sonix Galaxy Server and components

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rcS

  • Add as last line of the file: sonix_proj 2>/dev/null 1>/dev/null &

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rc.local

  • Uncomment:

echo "Start http-tunneling-serv ..."
/bin/http-tunneling-serv &
echo
  • Uncomment (and redirect output to null):
echo "Start sonix-proj ..."
/bin/sonix-proj 2>/dev/null 1>/dev/null &
echo
  • Ucomment:
if [ -f /usr/bin/SnOnvif ]; then
    echo "Start Onvif ..."
    /usr/bin/SnOnvif &
    echo 
fi
  • Uncomment:
#echo "Start wsdd ..."
#/bin/wsdd &
#echo

fix hwclock clock

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rcS
  • Comment the line: modprobe snx_rtc
  • Comment the line: timing_cali &
  • Keep commented the line: #hwclock -s

Modify rc.local

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rc.local
  • Uncomment the line for telnet: #telnetd
  • Uncomment the line for webserver: #boa -f /etc/boa/boa.conf
  • Uncomment the line for samba/cifs: #/usr/sbin/inetd
  • Uncomment the line: /bin/twowayaudio &
  • Uncomment the line: #start_module
  • Uncomment the block:
#mkdir -p /var/spool/cron/crontabs 
#cp /etc/web/cron.hourly /var/spool/cron/crontabs/root > /dev/null 2>&1
#crond
#echo
  • Uncomment the block:
#if [ -f /usr/bin/IspService ]; then
#	echo "Start isp tuning tool ..."
#	/usr/bin/IspService &
#	echo
#fi
  • Comment out this line: snx_scan &

add sc2135 sensor support

add sc2135 sensor to make menuconfig

  • Edit the file: /snx_sdk/buildscript/driver_Kconfig
  • Add:
config VIDEO_SENSOR_SC2135
	bool "SC2135"
 	default n

Add sc2135 to sensor.list

  • Edit the file: /snx_sdk/driver/video/ko/isp3/Makefile
  • Add:
ifdef CONFIG_VIDEO_SENSOR_SC2135
INS_SENSOR		+= sc2135
endif

Place SC2135 binary files

  • extract "sc2135.ko.gz" to: /snx_sdk/driver/video/ko/isp3/sensor/
  • extract "sc2135.ko.gz" to: /snx_sdk/driver/video/rootfs/lib/modules/2.6.35.12/kernel/drivers/
  • extract "IQ.bin.gz" to: /snx_sdk/driver/iq/ko/isp3/firmware/sc2135/
  • extract "IQ.bin.gz" to: /snx_sdk/driver/iq/rootfs/root/etc_default/firmware/sc2135/

Add a snx_isp.ko with support for sc2135

The snx_isp.ko that comes with the SDK does not have support for the Humansens SC2135 optical sensor. To overcome this we will use the version from the Assets package.

  • Replace the file /snx_sdk/driver/video/ko/isp3/snx_isp.ko with the version from the assets to support the sc2135 optical sensor.

Enable support for NVRAM

The NVRAM is used to store a unique ID which will be read during the initial setup via EZ-SETUP or the Xiaomi setup. We will enable the NVRAM, but it's unused with Realtek Simple Config.

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rcS
  • Add the line: modprobe snx_nvram

Modify time-zone settings

  • Edit the file: /snx_sdk/app/web-admin/rootfs/root/etc_default/ntp.conf
  • Replace GMT+08_Beijing,Hong_Kong,Shanghai with GMT+01_Amsterdam,Berlin,Rome,Stockholm,Warsaw
  • Edit the file: /snx_sdk/app/web-admin/rootfs/root/etc_default/TZ
  • Replace GMT-08:00 with GMT+01:00

Add instructions for compilation of the wifi drivers

The "modules" file will be used by the SDK to generate the Makefile.mod. In this Makefile there needs to be support for compiling the drivers from source.

  • Edit the file: snx_sdk/buildscripts/modules
  • Search for: [usb-wifi]
  • Append "source": type=driver|compile_rescue|source

Correct wifi driver version keys

In the Makefile the CONFIG keys which are being checked for are not exactly the same as the keys which are set. The buildnumber is added and needs to be removed from the key names.

  • Edit the file: /snx_sdk/driver/usb-wifi/src/driver/Makefile
  • Modify the line to this: SUB_DIRS-$(CONFIG_MODULE_USB_WIFI_RTL8188EUS_4_3_0_3) += rtl8188EUS_v4.3.0.3_10997
  • Modify the line to this: SUB_DIRS-$(CONFIG_MODULE_USB_WIFI_RTL8188EUS_4_3_15) += rtl8188EUS_v4.3.15_13239_simpleconfig

Start Realtek SimpleConfig during boot

For now i've chosen to use Realtek Simple Config for the initial WiFi setup. I'm using the /tmp folder as the tool writes out WiFi scan results to files.

  • Edit the file: snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rc.local
  • Add the following instruction at the end of the file:
if [ ! -f /etc/wpa_supplicant.conf ]; then
	cp /bin/rtw_simple_config /tmp
	cd /tmp
	./rtw_simple_config -i wlan0 -p 12345678 -n camera -c /etc/wpa_supplicant.conf &
	sleep 5s
fi
ifconfig wlan1 up
hostapd -B /etc/hostapd.conf

Enable concurrent mode

The RTL8188 device supports STA+AP mode. Thus be connected to an Accesspoint and be an Accesspoint itself.

  • Edit the file: /snx_sdk/driver/usb-wifi/src/driver/rtl8188EUS_v4.3.15_13239_simpleconfig/Makefile
  • Search for: SONIX926
  • Uncomment the line: #EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rc.local
  • Create file hostapd.conf in: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/ With contents:
interface=wlan1
ctrl_interface=/var/run/hostapd
ssid=camera
channel=2
wpa=2
wpa_passphrase=password
auth_algs=1
ignore_broadcast_ssid=0
eap_server=1

driver=rtl871xdrv
beacon_int=100
hw_mode=g
ieee80211n=1
wme_enabled=1
ht_capab=[SHORT-GI-20][SHORT-GI-40]
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
max_num_sta=8
wpa_group_rekey=86400

[Work in progress] Enable Sonix EZ-SETUP

  • later on select "EZ-SETUP" in "make menuconfig".
  • Edit the file: /snx_sdk/app/ez-setup/src/ez-setup/Makefile
  • Change: "CONFIG_MODULE_USB_WIFI_RTL8188EUS_4_3_0_3_10997" to "CONFIG_MODULE_USB_WIFI_RTL8188EUS_4_3_0_3"
  • Add:
ifeq ($(CONFIG_MODULE_USB_WIFI_RTL8188EUS_4_3_15), y)
CFLAGS 		+= -DRTL8188=1
endif

Compilation of the firmware

  • navigate to: /snx_sdk/buildscripts/
  • execute: make sn98660_402mhz_sf_defconfig
  • execute: make menuconfig
  • modify size: Flash Layout > NVRAM Partition > NVRAM partition size: 16
  • deselect both: Flash Layout > Kernel Partition (don't put kernel in any FIRMWARE)
  • Modify size: Flash Layout > Root File System > Root File System Partition Size: 300 (224 -> 300)
  • Deselect: Flash Layout > Rescue System Partition
  • Select both: Flash Layout > Configure File partition > erase etc
  • Select: User / Vendor Setting > wpa version 0.8
  • Select: Sonix Driver > select optical sensor sc2135 (deselect others)
  • Select: Sonix Driver > USB WiFi Drivers > RTL8188EUS v4.3.0.15 with simpleconffig
  • Select: Sonix Driver > NVRAM support: enable
  • Optional: Select: rtsp_server, ez-setup
  • Execute: make
  • Execute: make install
  • Copy the file FIRMWARE_660R.bin from /snx_sdk/image/ and place it on a sdcard to flash to the camera.

TODO:

  • Fix missing wsdd, download sourcecode and cross compile.
  • Fix and describe snx_rtsp_server usage
  • Modify snx_rtsp_server to write out to /usr/bin and not /usr/bin/example/ipc_func/.....
  • Fix sonix_proj
  • Describe how to install snx_rtsp_server
  • Describe how to add Sonix_proj
  • Describe how to setup the camera
  • Describe how to change the password
  • Describe how to connect telnet
  • Play sound files to indicate status (first boot, boot, button push)
  • Describe how to modify files to listen to your own smoke alarms.
  • Describe how to view the webui at: http://xx.xx.xx.xx:8000
  • Enable Sonix EZ-SETUP ssid=UID.conf ssid_key=w^2smpAz snx_rst

How to connect to the camera

8 digits pincode: 12345678 For IOS download the app "USR SimpleConfig" from the AppStore. Make sure you are connected on a 2.4Ghz network

Create online a QRCode with the pincode

snx_rtsp_server output to /usr/bin and not /usb/bin/example/ipc_func

  • Edit the file: /snx_sdk/app/example/src/ipc_func/rtsp_server/Makefile
  • Replace line: BIN_INS_DIR := $(INSTALL_DIR)/bin/example with BIN_INS_DIR := $(INSTALL_DIR)/bin
	@ if [ ! -d $(BIN_INS_DIR)/$(CATEGORY) ]; \
	then \
		install -d $(BIN_INS_DIR)/$(CATEGORY); \
	fi
	install -c $(NAME) $(BIN_INS_DIR)/$(CATEGORY)

	@ if [ ! -d $(BIN_INS_DIR) ]; \
	then \
		install -d $(BIN_INS_DIR); \
	fi
	install -c $(NAME) $(BIN_INS_DIR)

Add NVram

  • Edit the file: /snx_sdk/filesystem/rootfs/src/target/linuxrc
  • Replace:
#Add nvram inode
modprobe snx_crypto

with:

#Add nvram inode
modprobe snx_crypto
modprobe snx_nvram
mknod /dev/nvram c 251 0

Fix Sonix EzSetup

  • Edit the file: /snx_sdk/app/ez-setup/src/ez-setup/snx_scan.c Comment the lines:
printf("Send To Uart2 \n");
SendToUart2((char*)data);
  • Uncomment the lines:
gQuit_scan_flag = 0;
gRec_success_flag = 1;

Default hostapd.conf

interface=wlan1
channel=1
ctrl_interface=/var/run/hostapd
driver=rtl871xdrv
ssid=camera
beacon_int=100
hw_mode=g
ieee80211n=1
wme_enabled=1
ht_capab=[SHORT-GI-20][SHORT-GI-40]
max_num_sta=8
auth_algs=1
wpa_passphrase=cameraX
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
interface=wlan0
ignore_broadcast_ssid=0

Load snx_i2s_gpio driver

  • edit the file: /snx_sdk/filesystem/rootfs/src/target/root/etc_default/init.d/rcS
  • Add: modprobe snx_i2s_gpio

#power on sensor /bin/gpio_ms1 -n 6 -m 1 -v 1 modprobe mt7601Usta

hostapd -B -P /var/run/hostapd.pid /etc/hostapd.conf

todo: etc/rc folder is needed.

extract rc.gz in folder /media/cramfs/root/etc_default/rc/

if [ ! -f /etc/wpa_supplicant.conf ]; then cp /bin/rtw_simple_config /tmp cd /tmp ./rtw_simple_config -i wlan0 -p 12345678 -n camera -c /etc/wpa_supplicant.conf & sleep 5s fi ifconfig wlan1 up hostapd -B /etc/hostapd.conf

todo: Add load iptables

  • Add to rc.local or rcS: modprobe iptables

todo: Fix ntp.conf file

*add to ntp.conf:

	time_zone       GMT+01_Amsterdam,Berlin,Rome,Stockholm,Warsaw
	ntp_server      0.europe.pool.ntp.org
	time_daylight   on

todo: Fix exception off 'monitor_action'

  • Reads from /tmp/record
  • file is used for motiondetection by the WebAdmin motion-detection page
  • file is in /usr/sbin
  • Writes out to /var/log/monitor_action
  • Writes out to /media/mmcblk0
  • Writes out to /usr/web/images/motion_person.bmp
  • Reads from /proc/codec???
  • Reads video streams: stream1video, stream2video, stream3video