Bill Farrow

Chumby upgrade problems

2010-12-27T12:42:00.000-05:00

My Chumby One hasn't automatically upgraded it software since I bought it earlier this year. So I downloaded the latest firmware file onto a USB stick and did a manual upgrade.

After upgrading to "chumby one version 1.0.7 and control panel version 2.8.73" (from fw 1.0.3) via USB stick, the "My Streams" function would not produce any audio output when playing an mp3 stream URL.

Rebooting the Chumby did not help.
The volume knob moved the on screen volume slider.
The sound worked for the FM Radio function.

So the last resort was to log in via SSH and look around. I was finally able to get btplay working via ssh:

killall btplayd; btplay --start-daemon --output=alsa:plug:dmixer http://202.6.74.107:8060/triplej.mp3

After running the above command once on my Chumby, it now plays My Streams properly, even after a rebooting. All fixed.

My other complaint was that I had to re-enter all my mp3 streaming URLs, and all of my custom Alarms via the touchscreen. Shouldn't these settings be carried forward during the upgrade ?

It's fun to see how other Embedded Linux devices are setup and managed - I am always looking to improve my professional work.

Userspace access to PCI memory

2010-09-06T12:04:00.000-04:00

Intro

When I start working on a new PCI device driver I generally go through a discovery phase of reading and writing to certain regsiters on the PCI card. Over the years I have written lots of small kernel modules to probe addresses within the PCI memory space, constantly iterating: modify code, recompile, scp to target, load module, unload module, dmesg.

Urk! There has to be a better way - sysfs and mmap() to the rescue.

Sysfs

Let's start at with the PCI files under sysfs:

bash# ls -l /sys/devices/pci0001\:00/0001\:00\:07.0/

total 0

-rw-r--r-- 1 root root     4096 Jul  2 20:13 broken_parity_status

lrwxrwxrwx 1 root root        0 Jul  2 20:13 bus -> ../../../bus/pci

-r--r--r-- 1 root root     4096 Jul  2 20:13 class

-rw-r--r-- 1 root root      256 Jul  2 20:13 config

-r--r--r-- 1 root root     4096 Jul  2 20:13 device

-r--r--r-- 1 root root     4096 Jul  2 20:13 devspec

-rw------- 1 root root     4096 Jul  2 20:13 enable

-r--r--r-- 1 root root     4096 Jul  2 20:13 irq

-r--r--r-- 1 root root     4096 Jul  2 20:13 local_cpus

-r--r--r-- 1 root root     4096 Jul  2 20:13 modalias

-rw-r--r-- 1 root root     4096 Jul  2 20:13 msi_bus

-r--r--r-- 1 root root     4096 Jul  2 20:13 resource

-rw------- 1 root root     4096 Jul  2 20:13 resource0

-rw------- 1 root root    65536 Jul  2 20:13 resource1

-rw------- 1 root root 16777216 Jul  2 20:13 resource2

lrwxrwxrwx 1 root root        0 Jul  2 20:13 subsystem -> ../../../bus/pci

-r--r--r-- 1 root root     4096 Jul  2 20:13 subsystem_device

-r--r--r-- 1 root root     4096 Jul  2 20:13 subsystem_vendor

-rw-r--r-- 1 root root     4096 Jul  2 20:13 uevent

-r--r--r-- 1 root root     4096 Jul  2 20:13 vendor

The vendor and device files report the PCI vendor ID and device ID:

bash# cat device

0x0001

This info is also available from lspci

bash# lspci -v

0001:00:07.0 Class 0680: Unknown device bec0:0001 (rev 01)

    Flags: bus master, 66MHz, medium devsel, latency 128, IRQ 31

    Memory at 8d010000 (32-bit, non-prefetchable) [size=4K]

    Memory at 8d000000 (32-bit, non-prefetchable) [size=64K]

    Memory at 8c000000 (32-bit, non-prefetchable) [size=16M]

This PCI card makes 3 separate regions of memory available to the host computer. The sysfs resource0 file corresponds to the first memory region. The PCI card lets the host computer know about these memory regions using the BAR registers in the PCI config.

mmap()

These sysfs resource can be used with mmap() to map the PCI memory into a userspace applications memory space. The application then has a pointer to the start of the PCI memory region and can read and write values directly. (There is a bit more going on here with respect to memory pointers, but that is all taken care of by the kernel).

fd = open("/sys/devices/pci0001\:00/0001\:00\:07.0/resource0", O_RDWR | O_SYNC);

ptr = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

printf("PCI BAR0 0x0000 = 0x%4x\n",  *((unsigned short *) ptr);

Utils

The utility application "pcimem" reads and writes single values within the PCI memory space.

bash# ./pcimem /sys/devices/pci0001\:00/0001\:00\:07.0/resource0  0 w

/sys/devices/pci0001:00/0001:00:07.0/resource0 opened.
Target offset is 0x0, page size is 4096
mmap(0, 4096, 0x3, 0x1, 3, 0x0)
PCI Memory mapped to address 0x4801f000.
Value at offset 0x0 (0x4801f000): 0xC0BE0100

Download the source: http://github.com/billfarrow/pcimem

PowerPC

To make this work on a PowerPC architecture you also need to make a small
change to the pci core. My example is from kernel 2.6.34, and hopefully this will be fixed for us in a later kernel version.

bash# vi arch/powerpc/kernel/pci-common.c

    /* If memory, add on the PCI bridge address offset */

     if (mmap_state == pci_mmap_mem) {

-#if 0 /* See comment in pci_resource_to_user() for why this is disabled */

+#if 1 /* See comment in pci_resource_to_user() for why this is disabled */

         *offset += hose->pci_mem_offset;

 #endif

         res_bit = IORESOURCE_MEM;

         /* We pass a fully fixed up address to userland for MMIO instead of
         * a BAR value because X is lame and expects to be able to use that
         * to pass to /dev/mem !
         *
         * That means that we'll have potentially 64 bits values where some
         * userland apps only expect 32 (like X itself since it thinks only
         * Sparc has 64 bits MMIO) but if we don't do that, we break it on
         * 32 bits CHRPs :-(
         *
         * Hopefully, the sysfs insterface is immune to that gunk. Once X
         * has been fixed (and the fix spread enough), we can re-enable the
         * 2 lines below and pass down a BAR value to userland. In that case
         * we'll also have to re-enable the matching code in
         * __pci_mmap_make_offset().
         *
         * BenH.
         */
-#if 0
+#if 1
        else if (rsrc->flags & IORESOURCE_MEM)
                offset = hose->pci_mem_offset;
#endif

Macbook OS X disk recovery

2010-05-29T21:59:00.000-04:00

This is another story of why we should all do automated backups...

Problem:
Kelly's Macbook stopped booting. It would show the Apple Logo and a progress bar, and then just switch itself off.

Diagnosis:
To show boot sequence details; hold down the "Command" and "V" keys when powering on. This is called the Verbose Boot Mode, and it might show you what is going wrong. In my case the boot sequence was failing at the filesystem check:

** The volume Macintosh HD could not be repaired.

Raw Disk Backup:
Before risking further damage and loss of data, I make a backup of the entire drive. Many failures like this are caused by a failing hard disk with bad sectors. Normal copying programs fail when they hit a back sector, so I use the GNU ddrescue tool. This makes a low level raw copy of the disk, and attempts to recover as much data as possible from dying disks.

The ddrescue tool is available for on most Linux distributions. I used an Ubuntu computer with the Macbook hard drive attached via a SATA cable for maximum speed. You will need to work out which disk is the macbook drive, and then run:

mount /dev/sdb1 /mnt
ddrescue /dev/sda /mnt/macbook-ddrescue.img /mnt/macbook-ddrescue.log

If ddrescue fails to fully recover all of the data from the disk due to back sectors, you can run it again to make further attempts. Don't worry, it uses the log file to only repeat reading the parts that it couldn't copy the first time.

File Backup:
Now that I have a full raw disk image, I am less concerned about doing something wrong and loosing data. Putting the hard drive back into the macbook and booting into Single User mode, I was able to mount the broken filesystem in read-only mode and copy the files to another backup drive over USB. This backup drive was previously formatted with HFS+, and could be mounted in Single User Mode.

Insert the Snow Leopard Install DVD and boot it by holding "C" down while powering on.

Eventually the Snow Leopard install screen will be displayed. Don't follow the usual install process, but select Terminal from the Utilities menu. From the terminal we can hopefully mount the broken drive and backup the files.

mkdir  /Volumes/internal
mount -o rdonly /dev/disk0s2 /Volumes/internal

mkdir  /Volumes/backup
mount /dev/disk9s2 /Volumes/backup

ditto  -v -V /Volumes/internal /Volumes/backup/.

First Attempted fix:
Boot into Single User mode by holding down the "Command" and "S" keys while powering on, and run the filesystem check by hand.

fsck -fy /dev/disk0s2

If this doesn't work, try running this command to rebuild the B-Tree catalog:

fsck_hfs -r  /dev/disk0s2

Some people reported that they had to run this up to three times to finally fix their filesystem. In my case this didn't help.

Manufacturers Disk Diagnostic Tools
Most hard drive manufactures provide free tools to check and diagnose their disks for low level hardware errors. They do this to help minimize people RMA'ing perfectly good disks due to software problems.

The Seagate tools are available as a DOS bootable CDROM image. Run the short test first, and then the extended tests. These tests can take several hours, so be patient.

Re-Installing Snow Leopard
Now that I have the two separate backups, I felt more confidant about erasing the Macbook drive and re-installing Snow Leopard from scratch.

Insert the OS X installation DVD and hold down the "C" key to boot from the DVD drive.

The installation process will present you with an option to restore from a backup or migrate data from another machine. I was able to plug in the USB backup drive and restore all of the user data and applications. This was the easy part - thankyou Apple.

After all that, the Macbook is up and running with everything exactly as it was. Nice.

OTA Digital TV Antenna

2010-02-18T23:02:00.000-05:00

This post is about setting up an Over-The-Air (OTA) Digital TV Antenna in Raleigh, North Carolina, USA.

Background:
Our living room TV is a large computer screen connected to a quiet Linux PC. We watch OTA Digital TV using MythTV and a Silicondust HDHomeRun tuner. We get following channels over the air for free:

WUNC (PBS), WRAL (CBS), WTVD (ABC), WNCN (NBC), WLFL (CW), WRDC (MNT), WRPX (ION, qubo, ION Life), WRAZ (FOX, RTN).

Gray Hoverman Antenna:
I built a Gray Hoverman antenna out of a cardboard box, some fencing wire, hot glue, and a $5 balun from Radio Shack. The antenna is mounted upstairs in the loft along with the HDHomerun box and just an ethernet cable running down to the main network switch.

Local TV Transmission Towers:
The Gray Hoverman antenna is directional by design, which makes it sensitive to small variations in rotation and tilt. I used a combination of the webpages listed below and hdhomerun_config_gui which tunes into each channel and displays the signal strength.

Raleigh Map

Right now we point our antenna directly East so that it picks up WRAL (CBS) and most other channels except UNC (PBS) which is in the opposite direction.

Future directions:
There are some occasional drops in signal quality which cause glitches in the picture. If I can't improve these by tweaking the antenna position then I may have to try adding an omnidirectional antenna to my setup. Suggestions are welcome.

Resources:
Gray Hoverman antenna plans:
http://www.digitalhome.ca/ota/superantenna/

This webpage lists the local stations around your zip code:
http://antennaweb.org

This webpage displays a Google Map of the transmission towers around major cities in the USA
http://www.hdtvmagazine.com/programming/broadcast.php

OpenWRT on Linksys WRT350N

2009-01-04T22:06:00.009-05:00

My Linksys WRT350N wireless router started locking up more frequently recently, requiring a power cycle to reset it. When this started happening every day, I decided to re-flash it with OpenWRT and replace the buggy Linksys v1.03.7 firmware last updated in 2007.

I made the mistake of installing a pre-built Kamikaze 8.09 RC1 image (openwrt-wrt350n_v1-squashfs.bin) using the upgrade webpage on the router. When the router rebooted itself the Power LED flashed continuosly for a couple of minutes and then stayed on, but the ethernet switch was not functioning.

TFTP
The router responded to pings on 192.168.1.1 for the first few of seconds after the router was powered up. This indicates that that the bootloader was functional and sending a new firmware image using TFTP should work. See Installing OpenWRT via TFTP

echo -e "binary\nrexmt 1\ntimeout 60\ntrace\nput openwrt-wrt350n_v1-squashfs.bin\n" | tftp 192.168.1.1

Unfortunatly this didn't work for me, the transfer would complete successfully but the router didn't appear to recover or reflash itself with the new image.

Serial Port
The only option left was to add a serial port and gain access to the bootload console. This wepage has instructions on Modding the Linksys WRT350N v1 and WRT350N External Serial shows a way to access the serial port via the WAN port. Several Linksys models have this special serial port connector on the WAN port, but there don't seem to be any connectors sold for it. So I ended up opening the case and soldering on a header and custom cable - yuk. Armed with an RS232 level converter and USB serial adaptor I got a serial console running and access to the bootloader.

Bootloader
When the router boots it outputs the bootloader and kernel console info on the serial port (115200 baud, 8bits, no parity). With access to the bootloader I was able to tftp and flash a new image. Simple really.

Configuration
OpenWRT has lots of configuration options, more than most routers. My favorite features include being able to assign a dhcp assigned IP address to a particular MAC address and then give this IP address a host name. Now I can browse to my PAP2 VOIP box using "http://voip/" from any computer on my network. No more typing in IP addresses.

Software Packages
Now that it was booting and I could log in via telnet and the web interface, I was able to cross-compile more packages from OpenWRT and install them. First off the line was dropbear ssh server, install my ssh key, and disable telnet and ssh password logins. Extra packages include statistic charting using collectd.

Conclusion
My router has been running OpenWRT software for over a month now and has been doing a fantastic job. There is still room for improvement and polish, but everything just feels solid.

Metal Casting

2008-12-30T21:35:00.006-05:00

Over the last couple of years I have been dabbling in metal casting. Metals include Pewter, Copper, and Aluminium.

Pewter Casting
At Canterbury Fair in 2006 a NZ knight, Sir Sebastian vom dem
Schwarzwald, taught a class on making soapstone molds and casting with Pewter. After seeing this I was hooked.

Longhouse Token

I wanted to make a nice Event Token for the Arrowsreach Longhouse feast with a Viking theme. Some quick research on Viking hordes turned up quite a few silver pendants and broaches that could be replicated in Pewter.

Dess. nr. 144 Found in a gravesite at Lillevang, Bornholm, Denmark. Dated circa 1,000 A.D. Stylized Viking ship, originally a brooch. Dragon heads clearly depicted on stern. Produced in silver and bronze.
http://uk.turm.dk/dk/default.asp?underside=/dk/pendants.asp

I also found an online store selling similar reproductions in silver. http://www.urweg.com/

Soapstone Mold
Here is the hand carved soapstone mold for the token. Notice the "scratches" to allow the gases to escape when the metal poured. There is a second mold at the bottom of this stone for making vervelles.

Completed Token
Here is the completed token with cord attached.

Touch Lighting Controller

2008-12-30T21:17:00.008-05:00

This was created for my nephew, Mark W, as a component of his year 12 high school design project. He wanted mood lighting for a Four Poster Bed.

Touch Sensors
The Capacitive Touch Sensor is similar to this circuit. To simplify the electronics I used the AVR to generate the 20kHz signal and a simplified transistor circuit.

PIR Sensors
The PIR Motion Sensors was bought from JayCar and stripped down and hacked.

RF Remote Control
The reading lights on the bed are 240v halogen lamps and I didn't want to be responsible for electrocuting someone so these are controlled using RF Power Switch devices. The remote control unit was re-wired and is now controlled by the AVR micro.

White LEDs
The bed has 12 White LEDs around the base. These provide mood lighting and turn on and off via touch sensors and PIR motion sensors. They are controlled by the AVR micro and are pulse width modulated to provide dimming.

AVR Micro
The central controller was built using an old AVR 2313 micro (superseded by the AtTiny2313).

My Old Webcams

2008-12-30T20:15:00.007-05:00

"Reference Design"
This is the cheapest webcamera that I could find, and at AU$11 you get what you pay for. Bought from http://msy.com.au

Name: PC Camera
Vendor/Product: 0x0C45:0x613A
Bridge Chip: SN9C120
Image Sensor: OV7648
{{bill:lsusb_microdia.txt|lsusb -v -d 0c45:613a}}

I have tried the following Linux drivers:

OVCam Drivers: http://alpha.dyndns.org/ov511/
Generic SN9Cxxx http://www.linux-projects.org (closed source)
GSPCA / SPCA5xx http://mxhaard.free.fr/
Usb Video Class UVC http://linux-uvc.berlios.de/

I'm really not confident in getting this webcam working on Linux. It seems to be very hard to get the chip specifications, which leaves us with reverse engineering and usb packet sniffing. It's probably not worth my time given the crappy image quality.

I have been communicating with Sonix, the maker of the SN9C120 chip, and so far they have stated that they don't release the Register Descriptions or source code. They then said that the SN9C120 was supported by gspca and UVC :-)

Windows Driver Info
The Install disk for Windows says that it is installing "USB PC CAM-168" drivers and applications. This installs an application "C:\Windows\AMCap.exe" and some driver files:

Windows INF file {{linux:oem36.inf.txt|oem36.inf}}

Datasheets

SN9C102 (similar to SN9C120) http://www.mnementh.co.uk/sonix/sn9c102.pdf
OV7648 http://www.ime.co.kr/Data/Omni/Web-sources/FB7648-FRF.pdf
http://pdf1.alldatasheet.com/datasheet-pdf/view/121707/ETC/OV7640/datasheet.pdf

GSPCA

I'm running Kubuntu on my laptop, so initially I installed the gspca-source package and used module-assistant to do the compilation. When it didn't recognise the webcam, I modified the gspca_core.c code to include the 0x613a product id by copying the 0x613b code. The commands to try this out are:

sudo -i
./gspca_build
rmmod gspca.ko
insmod gspca.ko debug=5
dmesg | tail

It still doesn't actually work, but it is closer. The camera image is just a gray square with some periodic dots. The problem is probably that the I configured the sensor chip as the OV7660 because there was no entry for the OV7648 yet. Next step is to add the usb and i2c init sequence for this sensor.

Here is a good email about adding sensor support: http://lists-archives.org/spca50x-devs/01093-modifying-settings-for-0c45-613b.html

To capture images from the webcam I am trying out fswebcam from http://www.firestorm.cx/fswebcam/

UVC
[215180.048000] usbcore: registered new interface driver uvcvideo [215180.048000] USB Video Class driver (v0.1.0) [215194.344000] usb 1-1: USB disconnect, address 6 [215201.336000] usb 1-1: new full speed USB device using uhci_hcd and address 7 [215201.496000] usb 1-1: configuration #1 chosen from 1 choice [215201.500000] /usr/src/modules/gspca/gspca_core.c: driver gspca probing [215201.500000] /usr/src/modules/gspca/gspca_core.c: driver gspca allocating memory [215201.500000] /usr/src/modules/gspca/gspca_core.c: driver gspca detecting camera [215201.500000] /usr/src/modules/gspca/gspca_core.c: USB SPCA5XX camera found. SONIX JPEG (sn9c1xx) [215201.500000] /usr/src/modules/gspca/gspca_core.c: [spca5xx_probe:3997] Camera type JPEG [215201.500000] /usr/src/modules/gspca/gspca_core.c: [spca5xx_getcapability:1192] maxw 640 maxh 480 minw 160 minh 120
luvcview version 0.2.1
Video driver: x11
A window manager is available
video /dev/video0
Error opening device /dev/video0: unable to query device.
Init v4L2 failed !! exit fatal

Reverse Engineering
I'm now using the latest source code: gspcav1-20070508.tar.gz

After adding the i2c init sequence for the OV7648 that I reverse engineered from the Windows driver USB packet sniff, I still get the same "test pattern" image as above.

Turn the camera LEDs on by writing 0x44 to the SN9C120 register 0x02 to set the required GPIO lines. This code example uses the usb functions provided in the gspca module code.


__u8 regF1 = 0x44;
sonixRegWrite(spca50x->dev, 0x08, 0x02, 0x0000, &regF1, 1);

QuickCam Express
This camera is operational - more details to come when I get time.

Ubuntu (Dapper) kernel quickcam driver
Standard v4l applications like xawtv and streamer

$ lsusb
Bus 003 Device 003: ID 046d:0870 Logitech, Inc. QuickCam Express

$dmesg
[254694.256000] usb 2-1: new full speed USB device using uhci_hcd and address 5
[254694.420000] usb 2-1: configuration #1 chosen from 1 choice
[254695.320000] Linux video capture interface: v2.00
[254695.416000] quickcam: QuickCam USB camera found (driver version QuickCam USB 0.6.6 $Date: 2006/11/04 08:38:14 $)
[254695.416000] quickcam: Kernel:2.6.22-14-generic bus:2 class:FF subclass:FF vendor:046D product:0870
[254695.424000] quickcam: Sensor HDCS-1020 detected
[254695.428000] quickcam: Registered device: /dev/video0
[254695.428000] usbcore: registered new interface driver quickcam

Aiptek Pencam

This camera is operational - more details to come when I get time.

GPhoto2 is able to capture and download "preview" photos


$ lsusb
Bus 002 Device 012: ID 2770:9120 NHJ, Ltd Che-ez! Snap / iClick Tiny VGA Digital Camera

$ gphoto2 --auto-detect
Model                          Port
----------------------------------------------------------
Argus DC-1510                  usb:
Argus DC-1510                  usb:002,012

$ ghoto2 --capture-preview
Saving file as sq_cap.ppm