OpenWrt on hisilicon SOCs - hi35xxx

Community Builds, Projects & Packages
1

For info see wiki

Project: OpenIPC.org - open sources firmware for IPCam based on Hisilicon HI35xx SoC’s

successfully built images for smartfrog cam with Hi3518Cv100

deviceinfo: github

chaos calmer based toolchain: github

U-Boot 2010.06 (Jun 17 2015 - 13:04:57)

Check spi flash controller v350... Found
Spi(cs1) ID: 0x01 0x20 0x18 0x4D 0x01 0x80
Spi(cs1): Block:64KB Chip:16MB Name:"S25FL129P1"
MMC:   MID:0x3 RBlock:512 WBlock:512 Chip:31166976KB Name:"SL32G"
SD:   Ver:2.0 High Capacity Speed:25000000Hz Bus Width:4bit
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  1  0 
16384 KiB hi_sfc at 0:0 is now current device

## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   OpenIPC.org - Hisilicon Linux-3.
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1641828 Bytes = 1.6 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Linux version 3.0.8 (root@alladin-1000H) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 v15.05.1.101-25-gbb0ab9d537) ) #1 Thu Jul 25 00:01:39 CEST 2019
[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: hi3518
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] AXI bus clock 200000000.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 10160
[    0.000000] Kernel command line: totalmem=64M mem=40M sensor=ov9712 console=ttyAMA0,115200 root=/dev/mtdblock3 rootfstype=squashfs,jffs2 mtdparts=hi_sfc:512K(boot),64k(env),2M(kernel),5M(rootfs),-(rootfs_data)
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 40MB = 40MB total
[    0.000000] Memory: 36232k/36232k available, 4728k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
[    0.000000]     vmalloc : 0xc3000000 - 0xfe000000   ( 944 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc2800000   (  40 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc0029000   ( 132 kB)
[    0.000000]       .text : 0xc0029000 - 0xc03fe000   (3924 kB)
[    0.000000]       .data : 0xc03fe000 - 0xc041e4c0   ( 130 kB)
[    0.000000]        .bss : 0xc041e4e4 - 0xc0437508   ( 101 kB)
[    0.000000] SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128 nr_irqs:128 128
[    0.000000] sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
[    0.000065] Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
[    0.070077] pid_max: default: 32768 minimum: 301
[    0.070500] Mount-cache hash table entries: 512
[    0.071698] CPU: Testing write buffer coherency: ok
[    0.076548] NET: Registered protocol family 16
[    0.091632] Serial: AMBA PL011 UART driver
[    0.091962] uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
[    0.302640] console [ttyAMA0] enabled
[    0.307348] uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
[    0.372803] bio: create slab <bio-0> at 0
[    0.394669] SCSI subsystem initialized
[    0.402083] usbcore: registered new interface driver usbfs
[    0.408946] usbcore: registered new interface driver hub
[    0.415404] usbcore: registered new device driver usb
[    0.426656] Switching to clocksource timer1
[    0.439968] NET: Registered protocol family 2
[    0.444709] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.452498] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.459945] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.466563] TCP: Hash tables configured (established 2048 bind 2048)
[    0.472961] TCP reno registered
[    0.476134] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.482119] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.489232] NET: Registered protocol family 1
[    0.543790] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.551841] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.561336] fuse init (API version 7.16)
[    0.568278] msgmni has been set to 70
[    0.576582] io scheduler noop registered
[    0.580616] io scheduler deadline registered (default)
[    0.586087] io scheduler cfq registered
[    0.624027] brd: module loaded
[    0.633580] Spi id table Version 1.22
[    0.638928] Spi(cs1) ID: 0x01 0x20 0x18 0x4D 0x01 0x80
[    0.843605] SPI FLASH start_up_mode is 3 Bytes
[    0.848073] Spi(cs1): 
[    0.850303] Block:64KB 
[    0.852757] Chip:16MB 
[    0.855115] Name:"S25FL129P1"
[    0.858268] spi size: 16MB
[    0.861005] chip num: 1
[    0.863500] 5 cmdlinepart partitions found on MTD device hi_sfc
[    0.869426] Creating 5 MTD partitions on "hi_sfc":
[    0.874279] 0x000000000000-0x000000080000 : "boot"
[    0.883375] 0x000000080000-0x000000090000 : "env"
[    0.892433] 0x000000090000-0x000000290000 : "kernel"
[    0.901752] 0x000000290000-0x000000790000 : "rootfs"
[    0.911176] 0x000000790000-0x000001000000 : "rootfs_data"
[    0.938464] Fixed MDIO Bus: probed
[    1.363208] himii: probed
[    1.490860] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.497807] hiusb-ehci hiusb-ehci.0: HIUSB EHCI
[    1.503602] hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
[    1.511649] hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
[    1.530129] hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
[    1.538470] hub 1-0:1.0: USB hub found
[    1.542389] hub 1-0:1.0: 1 port detected
[    1.548346] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    1.555672] hiusb-ohci hiusb-ohci.0: HIUSB OHCI
[    1.561490] hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
[    1.569178] hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
[    1.636511] hub 2-0:1.0: USB hub found
[    1.640444] hub 2-0:1.0: 1 port detected
[    1.647519] usbcore: registered new interface driver cdc_acm
[    1.653281] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[    1.662177] usbcore: registered new interface driver cdc_wdm
[    1.667861] Initializing USB Mass Storage driver...
[    1.673842] usbcore: registered new interface driver usb-storage
[    1.679874] USB Mass Storage support registered.
[    1.685376] usbcore: registered new interface driver ums-alauda
[    1.692198] usbcore: registered new interface driver ums-datafab
[    1.698994] usbcore: registered new interface driver ums-freecom
[    1.705943] usbcore: registered new interface driver ums-isd200
[    1.712783] usbcore: registered new interface driver ums-jumpshot
[    1.719646] usbcore: registered new interface driver ums-sddr09
[    1.726499] usbcore: registered new interface driver ums-sddr55
[    1.733343] usbcore: registered new interface driver mdc800
[    1.738937] mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
[    1.751246] using rtc device, rtc-hi3518, for alarms
[    1.756131] platform rtc-hi3518: rtc core: registered rtc-hi3518 as rtc0
[    1.770914] Netfilter messages via NETLINK v0.30.
[    1.775785] nf_conntrack version 0.5.0 (566 buckets, 2264 max)
[    1.783516] ctnetlink v0.93: registering with nfnetlink.
[    1.789709] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.795667] TCP cubic registered
[    1.798914] Initializing XFRM netlink socket
[    1.821703] NET: Registered protocol family 10
[    1.830412] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.836253] IPv6 over IPv4 tunneling driver
[    1.843148] NET: Registered protocol family 17
[    1.848020] Bridge firewalling registered
[    1.852166] 802.1Q VLAN Support v1.8
[    1.855846] lib80211: common routines for IEEE802.11 drivers
[    1.861695] Registering the dns_resolver key type
[    1.867037] usb 1-1: new high speed USB device number 2 using hiusb-ehci
[    1.876499] registered taskstats version 1
[    1.880954] platform rtc-hi3518: setting system clock to 1970-01-01 00:00:00 UTC (0)
ø[    1.896358] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    1.903703] Freeing init memory: 132K
[    2.880853] init: Console is alive
[    4.940706] init: - preinit -
/etc/preinit: line 49: hi_chip_info: not found
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.060099] mmc0: error -110 whilst initialising SD card
[    9.877439] mount_root: switching to jffs2 overlay
[    9.928042] procd: - early -
[   11.341214] procd: - ubus -
Command failed: Not found
[   12.376120] procd: - init -
Please press Enter to activate this console.
[   16.420854] loop: module loaded
[   16.471777] usbcore: registered new interface driver dm9601
[   16.520596] usbcore: registered new interface driver usbserial
[   16.527580] USB Serial support registered for generic
[   16.540551] usbcore: registered new interface driver usbserial_generic
[   16.547104] usbserial: USB Serial Driver core
[   16.574574] USB Serial support registered for ch341-uart
[   16.590592] usbcore: registered new interface driver ch341
[   18.286825] overlayfs: ERROR - failed to whiteout '01_leds'
[   18.332057] overlayfs: ERROR - failed to whiteout '02_network'
[   18.415545] overlayfs: ERROR - failed to whiteout '10_migrate-shadow'
[   18.478180] overlayfs: ERROR - failed to whiteout '11_migrate-sysctl'
[   18.542287] overlayfs: ERROR - failed to whiteout '12_network-generate-ula'
[   18.605186] overlayfs: ERROR - failed to whiteout '20_migrate-feeds'
[   18.668567] overlayfs: ERROR - failed to whiteout 'odhcpd.defaults'
[   26.654463] 8188eu: module is from the staging directory, the quality is unknown, you have been warned.
[   26.740009] Chip Version Info: CHIP_8188E_Normal_Chip_TSMC_D_CUT_1T1R_RomVer(0)
[   26.787196] EEPROM ID = 0x8129
[   26.813150] usbcore: registered new interface driver r8188eu
[   27.774470] R8188EU: Firmware Version 11, SubVersion 1, Signature 0x88e1
[   28.190821] MAC Address = 04:5c:06:11:4d:89
[   28.201194] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   29.527229] R8188EU: INFO indicate disassoc
[   29.707208] R8188EU: INFO assoc success
[   29.712019] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   33.520487] Hisilicon Media Memory Zone Manager
[   33.545695] hi3518_base: module license 'Proprietary' taints kernel.
[   33.552189] Disabling lock debugging due to kernel taint
[   33.562754] Hisilicon UMAP device driver interface: v3.00
[   33.598317] pa:84000000, va:c3340000
[   33.602037] load sys.ko ...OK!
[   33.732282] load viu.ko ...OK!
[   33.759299] ISP Mod init!
[   33.801460] load vpss.ko ....OK!
[   33.889831] load vou.ko ....OK!
[   33.975961] load venc.ko ...OK!
[   34.007610] load group.ko ...OK!
[   34.034056] load chnl.ko ...OK!
[   34.072421] load h264e.ko ...OK!
[   34.099628] load jpege.ko ...OK!
[   34.138450] load rc.ko ...OK!
[   34.167551] load region.ko ....OK!
[   34.200005] load vda.ko ....OK!
[   34.293560] hi_i2c init is ok!
[   34.368497] Kernel: ssp initial ok!
[   34.394591] acodec inited!



BusyBox v1.23.2 (2019-07-24 23:22:26 CEST) built-in shell (ash)


root@OpenIPC_smartfrog:/#

20190723_hi3518cv100_smartfrog_banner

1 Like
2

hello ! very interesting info
Does this openwrt based firmware come with webgui or something to use the video features of the device?

3

@tmomas I would like to edit the below mentioned Wiki page, but do not have access. Could you please authorize me? Same username as for my GitHub.

4

hey guys, i am a fan of openwrt (using on routers at home).

I picked up one of these doorbell cameras
https://www.eken.com/Video_Doorbell_T5

According to the promo sheets on aliexpress it uses a Hi31518Ev200. Disappointed to discover that it does not support onvif/rtsp for use with zoneminder and definititely not happy about having to use cloud of the vendor.

Documentation for openIPC is not ready for idiots like me, I am afraid.

Can someone please guide me how I can get OpenIPC onto this device
will the ringer functionality, etc continue to work.

OpenIPC would be such a value add and bring so much more utility to the product, as the camera quality is great and the device is cheap.

cheers

5

You can get answers fast on the support group:

The CPU is supported by the OpenIPC but what the video sensor inside? It is not clear. It might not be supported...

In short the process is following:

  1. Get access to the original OS
  2. Upload the ipctool utility, run it to get the output about CPU and videochip.
  3. Check that both CPU and videochip are supported by OpenIPC.
  4. If supported configure TFTP server, connect camera using UART.
  5. Backup original firmware, write down original MAC address.
  6. Flash (via UART) OpenIPC firmware
  7. make post install steps.

Installation is described on the OpenIPC page. Some examples on the wiki page.

6

this is the problem;

  • no original factory firmware
  • no information on how to get access to the device.

there is an sdcard and based on the eken cameras, they update the firmware via sdcard.

there is wifi broadcast and the device needs to be paired.
no information on how to access via this for example.

but the aiwit cloud app, updates the firmware once it is connected.
it shows firmware 3.5.2 currently and mcu 1.6.8

7

You have a video doorbell. Thus some functions might not work as OpenIPC is more about IP cameras.
Yet, the flashing process is not a user friendly yet.
You need to open the camera an connect UART. This might be hard for you.

Still if you want to get access to the camera try with telnet.
Maybe it needs to be enabled in uBoot:

8

There is Luci web interface like in OpenWRT which can help you to configure network and system stuff.
But streaming related configuration is currently done in config files. There plans to make GUI interface for camera related stuff configuration but nothing is ready yet.

9

What's about PTZ then? I have a few Sricam SP015 cameras, and there is no support from the company for them, would like to ditch their software too.

I also see openhisiipcam.org and some of the same developers are on that - is that project no obsolete for this one? if so, there is some good material regarding the h/w , etc. wouldn't it make sense to incorporate that info with the openipc site.

10

OpenIPC supports not exact models of hardware (like your Sricam SP015), but SoC and sensors.
The thing is that one and the same model can have different sensors and SoC. Sometimes sellers do not know what is inside!
Thus it is important to run ipctool to get hardware information.
Yet please understand, that OpenIPC is in the early stages of development and is not yet convenient for ordinal users. PTZ might be supported with some code manipulation or with ONWIF. But there is no GUI support for PTZ as far as I know.

To get HW information you need:

11

Hi There,

So I found a guy who has done an extensive deep dive into the Sricam SP009 camera per below.

Further, from FCC ID:2AC6K-SP006, they confirm that all models SP006, Sp004, SP009. SP010, SP011, SP012,SP013,SP014,SP015,SP016,SP017,SP018,SP019,SP020,NVS001,NVS002,DB001,DB002,DB003,SM001,SM002 all have the same circuit and RF module

https://herrfeder.github.io/embeddedsec/2017/10/19/Hacking-A-IP-Camera-Part1.html
https://herrfeder.github.io/embeddedsec/2018/01/09/Hacking-A-IP-Camera-Part2.html

Are you able to confirm from this if OpenWrt will work on this device please?

Any ideas if the firmware could be written via the sdcard or tftp without having to use the uart port?

I have posted the sricam factory image burning tool, if this might help
https://ipcamtalk.com/attachments/sricam_tool_en-zip.87219/

and a selection of the factory image files if anyone can reverse engineer
https://ipcamtalk.com/attachments/firmware-zip.87220/