Here the little story : A friend ask me to repair his bricked Heden cam copy (no-name). So let’s open it, find a serial port and look what’s going on. I used the bus-pirate of course. I discovered that only the bootloader is working, the whole flash seems empty.I searched a long time, and tried severals stuffs, but I was unable to find the right firmware (in the right format) for his no-name camera.

NetOS opened camera

So my friend sent the camera back (warranty), and receive a new one. Now, he ask me to backup the flash memory, to fix the problem if this occurs in a few months again.

The main issue is : The camera has no backup web interface, no MTD dump shell binary (nor ftp, scp..), and it’s not really easy to compile the mtd tools because the system has no library installed (only a few static binary files). I’m unable to backup the firmware throught the OS. Let’s try see the bootloader.

The bootloader has no backup firmware features, but it can dump the memory content (flash included), and it has a builtin “ls” like command that display base memory segments. With the simple “d 0xAAAA”, you can dump the memory at 0xAAAA address. Fine, I decided to write a little script that walk the memory, dump the content and rebuild the binary file.

#!/usr/bin/env python2
import serial,sys,string

log_file = None

def ser_open():
    ser = serial.Serial("/dev/ttyUSB0", 115200, timeout = 0.1)
    return ser

def log(line):
    l=string.split(line,' ')
    data='%s%s%s%s' % (l[1],l[2],l[4],l[5])
    for i in range(0,32,2):
        octet = int(data[i:i+2],16)
        log_file.write('%s' % chr(octet))

def dump(ser,addr):
    s = "d -s 0x%x\n" % addr
    ser.write(s)

    l=[]
    i = 0
    while 1:
        data = ser.read()
        if not data:break
        l.append(data)
        if (data=='\r'):
            s = string.join(l,'')
            if (s[0] == '['):
                log(s)
            l=[]

d = ser_open()
log_file = open('log.raw','a')

img_start = 0x7F0E0000
img_size = 0xC3C00

for i in range(img_start,img_start+img_size+0x100,0x100):
    dump(d,i)
    print "0x%x"% i

As you can see, this code isn’t really clean and well written, but it give me a nice binary file for a given offset and size. Simply dump the memory through serial port, do a little parsing, and store the result in binary file named log.raw.

I used this to backup the camera linux.bin file, and the romfs.img. Of course you can use this to dump the whole memory too. To check if the files are Ok, you can try to g-unzip the Linux Kernel, and mount the romfs.

To check the romfs, I simply mount it with : mount -t roomfs -o loop log.raw ./log

So now, I have a backup for this no-name camera, and next time the whole memory will drop, I will try to restore it ;).

This method seems really crude (and dirty), but it work without too much trouble, and can be tweaked for a lot of systems. It should work on every Linux embedded system with an dump memory feature in the bootloader (quite every one).

Enjoy memory ;)

I decided to switch my desktop computer to another distro. After about 5 years with the same Debian Sid install, I switched to Manjaro. Manjaro use the same base system as Arch Linux but seems to be more user friendly.

Anyway, the hibernate don’t work out-of-the-box. When you restart the computer, it doesn’t restore the hibernate image from the swap. You can fix that quickly. Edit /etc/mkinitcpio.conf file and add “resume” to the HOOK flag like this.

HOOKS="base udev autodetect modconf block resume filesystems keyboard fsck"

After that, you must rebuild the initcpio file :

 sudo mkinitcpio -p linux39

That’s enough, you can now test with a simple pm-hibernate.

/Enjoy Linux again.

So, first step : search the file resources.zip (in /opt/spotify/spotify-client/Data/ on Debian). Extract the file skin.xml. In this file, search for line like this.

<font ci="FriendsListFont" color="#dddddd" shadow="#333333" size="11" />

So change all font sizes, save the file, re-pack the ressources file .. and Voila. You can fix this manually (or with a special XML editor), but the file contain 245 font definitions. I decided to fix with a Python script.

import xml.etree.ElementTree as xml

tree = xml.parse("./skin.xml")
root = tree.getroot()

for f in root.findall('font'):
	taille = f.get('size')
	if taille:
		taille = int(taille) + 4
		f.set('size',str(taille))


file = open("new_skin.xml", 'w')

xml.ElementTree(root).write(file)

Let’s try this new skin :  

This should be a easier for the big screen :)

/Enjoy music

In fact, if you use Jackd (and perhaps Pulse) you can change the sound card used by Spotify, but this is overkill for my needs (mainly cause, I use Spotify on a litte old netbook and Jackd is a nightmare to configure)

After some strace dump, Alsa (libasound2) source reading, I decided to fix it by myself. Let’s go for some Monkey Patching. Monkey patching on closed source binary isn’t that easy, the hard step : find the right function to hack. Here the Alsa tutorial come to rescue (ldd of course too). So we need to modify the snd_pcm_open call.

Let’s give it a try : First we need to dynamically re-route this call to a wrapper. The easier way to do this, is to build a special library and to force Spotify to use the wrapper with an LD_PRELOAD hack. (see code below). In fact, Spotify call the snd_pcm_open with name=”default” which is the default sound card, so we can change this to “usb” for example, and fix the .asoundrc to point “usb” sound card to the right hardware card.

That’s enough, let’s code :

#define _GNU_SOURCE

#include <dlfcn.h>
#include <stdio.h>
#include <alsa/asoundlib.h>

static int (*wrap_snd_pcm_open)(snd_pcm_t **pcm, const char *name, snd_pcm_stream_t stream, int mode) = NULL;

void * wrap(void * func,char *name)
{
    char *msg;
    if (func == NULL) {
        func = dlsym(RTLD_NEXT, name);
        fprintf(stderr, "** wrapping %s =>  %p\n", name,func);
        if ((msg = dlerror()) != NULL) {
            fprintf(stderr, "** %s: dlopen failed : %s\n", name,msg);
            exit(1);
        } else {
            fprintf(stderr, "** %s: wrapping done\n",name);
        }
    }
    return func;
}

int snd_pcm_open(snd_pcm_t **pcm, const char *name, snd_pcm_stream_t stream, int mode)
{
    int temp;

    sprintf(name,"usb");

    wrap_snd_pcm_open = wrap(wrap_snd_pcm_open,"snd_pcm_open");
    temp = wrap_snd_pcm_open(pcm,name,stream,mode);
    fprintf(stderr, "** Calling snd_pcm_open for path:[%s] => fd:[%d]\n",name,temp);
    fflush(stderr);
    return temp;

}

As you can see in the code, I use a generic wrapper function because during my code session, I used this function to re-route some other functions. To build the library :

gcc -g -fPIC -shared -Wl,-soname,preload.so -ldl -o preload.so  main.c

Load the lib, with export LD_PRELOAD=./preload.so before running Spotify. Spotify (and all other software using Alsa) will use “usb” as default sound card.

Note: C reader will note that name is a const char pointer, and so we can’t change it, but even if gcc raise a big warning, the code do trick fine.

Enjoy good quality sound even w/ closed source

First step: Simply use the Arduino IDE and the Wire lib. I use an Seeeduino because I need an Arduino that works at 3.3v level. Here the code :

#include <Wire.h>
void setup()
{
  Wire.begin(4);                // join i2c bus with address #4
  Wire.onReceive(receiveEvent); // register event
  Wire.onRequest(requestEvent); // register event
  Serial.begin(38400);           // start serial for output
  Serial.println("Boot Ok");
}

void loop()
{ delay(100); }

void receiveEvent(int howMany)
{
  char c = NULL;
  while(Wire.available()) // loop through all
  {
    c = Wire.receive(); // receive byte as a character
    Serial.print(c);         // print the character
  }
  Serial.println();
  Serial.println("===");
}

void requestEvent()
{
  Serial.println("read");
  Wire.send("Hello world from Arduino");
}

To test the Arduino I used a Bus Pirate, this is quite simple and fun, here a little snipset of my initial test with the BP (note the string are different). The I2C slave is at the 0×4 address (check the setup()).

Searching I2C address space. Found devices at:
0x08(0x04 W) 0x09(0x04 R) 

Read content from the device, 'ABCD'
I2C>[0x09 rrrrrr]
I2C START BIT
WRITE: 0x09 ACK
READ: 0x41
READ:  ACK 0x42
READ:  ACK 0x43
READ:  ACK 0x44
READ:  ACK 0xFF
READ:  ACK 0xFF
NACK
I2C STOP BIT
I2C>

send content to the device 'ABC'
I2C>[0x08 0x41 0x42 0x43]
I2C START BIT
WRITE: 0x08 ACK
WRITE: 0x41 ACK
WRITE: 0x42 ACK
WRITE: 0x43 ACK
I2C STOP BIT

Second step: Plug the Arduino to the NGW100. I used the wrapping technique. Simply connect SDA, SCL, and GND. (NGW100 pinouts : SDA=>9, SCL=>10, GND=>2)

On Linux, load the I2C-GPIO kernel module. On OpenWRT (used on the NGW100), simply load the kmod-i2c-gpio package.

Final step: If everything is Ok, we can now test the communication. I used a small piece of C code to deal with I2C on Linux.

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/i2c-dev.h>
#include <sys/ioctl.h>
#include <fcntl.h>

void i2c_run(void) {
    int file;
    char filename[40];
    int addr = 0x4;
    char buf[32] = {0};
    int i;

    sprintf(filename,"/dev/i2c-0");
    if ((file = open(filename,O_RDWR)) < 0) {
        printf("Failed to open the bus.");
        exit(1);
    }

    if (ioctl(file,I2C_SLAVE,addr) < 0) {
        printf("Failed to acquire bus access and/or talk to slave.\n");
        exit(1);
    }

    i = 24;
    // read I2C
    if (read(file,buf,i) != i) {
      printf("Failed to read from the i2c bus.\n");
    } else {
      printf("Read %d bytes from I2C: [%s]\n",i,buf);
    }

    sprintf(buf,"IC2 from Linux to Arduino");
    i = strlen(buf);
    if (write(file,buf,i) != i) {
        printf("Failed to write to the i2c bus.\n");
    } else {
      printf("Sent %d bytes to I2C: [%s]\n",i,buf);
    }
}

int main()
{
  i2c_run();
  return 0;
}

As you can see this code is a bit rude, but works really well : Read the I2C bus, and send a sample string, a proof ? :)

Of course, I used string values but in real life a small protocol shoud be used. Another important thing: I used a NGW100 but you can use the same idea on all Linux embedded board like the Fonera, or anything else.

Update: Of course you can use the i2c-tools on Linux to detect your own device. To do that : Grab the i2c-tools source, and cross compile it for the AVR32. (You only have to change the CC path in the Makefile).

/Enjoy small Linux

The AVR Dragon is nice because you can use it as a small developpement device without any other requirement: Simply drop the needed ATMega on the board, some little wrapping for : Jtag + power supply.

As you can see, this is compact and nothing else is needed. The power supply come from the USB port, and I soldered a DIP on the board.. and that’s it.

I use the Jtag connector, so now I can use a real debugger instead of playing with the UART. Simply put a breakpoint, and enjoy :) By this way, I figure out that most of the time I simply push some stuff in arrays, and inspect them with debugger. This is really efficient. For example, last week I need to fix a timing issue with a IR sensor, simply wrap the little board, and push all interrupts in a array with the related timing. Of course, this can be done with a serial connection too, but it will take more time, and even worst if you encounter a bug, you will have to find where is it (the UART printf, or the code itself) ..

So, how to use this with a Linux OS ?

First you need to use AVaRICE to program the ATMega with a command like this :

avarice -g -j usb --erase --program --file main.hex :4242

Here the result:

AVaRICE flash the hex file to the ATMega, and wait for a GDB connection on port 4242. GDB is fine, but not really visual ;)

Let’s take a look at DDD

To use DDD with avr-gdb (the gdb for AVR), you need to edit a config file, for example gdb.conf and put this in :

file main.out
target remote localhost:4242

And the final command, just launch DDD like this :

ddd --debugger "avr-gdb -x gdb.conf"

Next step: Simply place some breakpoint, and the press “Cont” inue button in DDD. Et voilà :

I hope this little tuto will help people looking for a nice AVR debuger for the AVR on Linux (or any OSS system). The AVR Dragon is definitively a must have for low budget user in AVR scene.

Enjoy bug ? :)

After a couple of month, I decided it was enough, I was sick of this dirty stripes on screen. I tested every ATI driver one after one … (ATI opensource drivers have too bad performances to be used on a every days desktop, could you live without google-earth ? ) .. so I decided to go to other side, and bought a Nvidia 8600GT from ASUS. This card perform quite as the ATI in 3D, and have a affordable price. So I switched from ATI to Nvidia.

ATI offers better opensource support, but Nvidia binary driver is really nice to use and have better support today from stuffs like Compiz and Co.. and NO MORE STRIPES !! :)

A couple of weeks ago, I upgraded my Ubuntu Gusty to Hardy. Everything was Ok, since I played with firefox. Some heavy loaded pages (like Amazon, or Gmail) was damn sloowwwww ! Playing with scroll was a source …… grrrrrr ….Firefox on Hardy is 3.0b5. This version has a major “feature” the use a Xrender for the page display. And this looks like Xrender is dawn slow on Nvidia cards .. In fact, Nvidia has already work on this kind of issue before. Without looking forward I decided to run a little benchmark, with the help of friends with Xrenderbenchmark. So here the results.

Benchmarks

Benchmarks was done by me and 2 firends, on Q6600 or E6600 Intel CPU running at 2.4Gh, with kernel 2.6.24.1. The graphs only show the Plain results (not Plains + Alpha, or Transformation) but the results are quite the same anyways.

Legend:

• 8600GT/nv : Nividia 8600GT / Xorg 1.4.1git 32 bits / Nvidia GPL driver
• 8600GT/nvidia : Nividia 8600GT / Xorg 1.4.1git 32 bits / Nvidia binary driver ver: 169.12
• 8600GT/nividia-64 : Nvidia 8600GT / Xorg 1.4.1git 64 bits / Nvidia binary driver ver: 169.12
• Intel GMA X300 : Intel GMA 3000 / Xorg 1.4.0.9 64 bits / Intel GPL driver
• ATI HD2600PRO : ATI HD 2600 Pro / Xorg 1.4.1git 64 bits / ATI GPL driver

I split the results into two graphs for convenience.

As you can see on this first part, numbers are really small, the Nvidia GPL driver is the worst : 5 times slower than any other one. Not a good news, and the binary one have some bad results on 2 tests. ATI HD and Nvidia drivers offer quite the same results, but remenber this is the GPL ATI driver ! … The Intel doesn’t have a lot of linearity on this part.

But the next graph give us absolutely different picture !

For every graph, Nvidia drivers (GPL, or binary, 32 or 64 bits) are at least 6 time slower. Intel perform very well, no surprise, this card are damn cool, perfect driver for linux.. but to slow in 3D to really rock. And ATI GPL driver is the clear winner of this benchmarks tests.

As my issue is the Nvidia one, I can comment the results, the GPL driver performs better than the binary one. This is not a big surprise cause, I can see it in Firefox, even it’s slow. There is difference between 64 bits and 32, but I guess this is more kernel related than the driver itself.

I’m not a video guru and only do that figure out what’s going on my computer. I publish in the hope it might help somebody else, and to find help.

Update : The numbers can be found here

Thanks to Ludo and Christian for their help !

Important update : Check the new driver results !!

This is an old trick, but udev added a little complexity, so let’s give it a try. First boot on a Ubunty CD, open a console and run:

(here my linux partition is sda2, second partition on a sata disk)

mkdir /media/mnt
mount /dev/sda2 /media/mnt/
mount -o bind /dev/ /media/mnt/dev
chroot /media/mnt

=> now you are on the destination disk, so you can install grub.
grub-install /dev/sda

Of course you can do a lot more stuff, like changing fstab etc etc .. but the trick is to mount + mount bind + chroot

I decided to look at this a little deeply, and decided to use /dev/rtc to do the trick. Here a little example of the stuff.

from  fcntl import ioctl
import os, time

# some linux kernel header
RTC_IRQP_SET = 1074032652
RTC_PIE_ON =  28677
RTC_PIE_OFF = 28678

# open the realtime clock
f = open ("/dev/rtc", "r")
fd = f.fileno()

# 2048 freq
ioctl(fd,RTC_IRQP_SET,2048)
ioctl(fd,RTC_PIE_ON,0)

t0 = time.time()
interupt = 0

# the read will block until the next interrupt.
while interupt < 1000 :
    os.read(fd,4)  # 4 = size of double
    interupt = interupt + 1

delta = time.time() - t0
print interupt / delta

# drop the scheduler
ioctl(fd,RTC_PIE_OFF,0)

This is quite accurate enought, the only issue is that I’m unable to call the sched_setscheduler() from Python right now. So, if the host isn’t loaded I get the 2048 interrupts.. but it can be less :(

Update:
The sched_setscheduler can be done w/ a simple pyrex extension:

cdef extern from "sched.h":
struct sched_param:
int sched_priority
int sched_setscheduler(int pid, int policy,sched_param  *p)

SCHED_FIFO = 1

def switchRTCPriority(nb):
cdef sched_param sp
sp.sched_priority = nb
sched_setscheduler (0,SCHED_FIFO , &sp);

After this quick Pyrex hack, I now have a accurate realtime interrupt in Python ;)

Here on my shuttle .. not working

aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: IXP [ATI IXP], device 0: ATI IXP AC97 [ATI IXP AC97]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 0: IXP [ATI IXP], device 1: ATI IXP IEC958 [ATI IXP IEC958 (AC97)]
Subdevices: 1/1
Subdevice #0: subdevice #0

Here on another box (VIA C3 based)

aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: V8235 [VIA 8235], device 0: VIA 8235 [VIA 8235]
Subdevices: 4/4
Subdevice #0: subdevice #0
Subdevice #1: subdevice #1
Subdevice #2: subdevice #2
Subdevice #3: subdevice #3
card 0: V8235 [VIA 8235], device 1: VIA 8235 [VIA 8235]
Subdevices: 1/1
Subdevice #0: subdevice #0

So yes the C3 can play 4 stream at the same time, while the AC97 doesn’t.

Another way to do this is to use software mixing

Update:

To use the software mix in Alsa: simply change the pcm.default to pcm.dmix

#pcm.default cards.pcm.default
pcm.default pcm.dmix