I got new Hi3518 IP Camera modules

I got two new IP Camera modules and found its serial pins:

IP Camera Hi3518

U-Boot 2010.06 (Aug 06 2013 - 11:53:06)                                      
DRAM:  256 MiB                                                               
NAND:  Special Nand id table Version 1.35                   
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00            
No NAND device found!!!                                     
0 MiB                                                       
Check spi flash controller v350... Found                    
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00                  
Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B"
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0 
16384 KiB hi_sfc at 0:0 is now current device

## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.0.8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2724796 Bytes = 2.6 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (root@johhnny-desktop) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+ea3
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 200000000.
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 18796
Kernel command line: mem=74M console=ttyAMA0,115200 root=/dev/mtdblock3 rootfstype=cramfs mtdparts=hi_sfc:1)
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 74MB = 74MB total
Memory: 69892k/69892k available, 5884k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc5000000 - 0xfe000000   ( 912 MB)
    lowmem  : 0xc0000000 - 0xc4a00000   (  74 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0028000   ( 128 kB)
      .text : 0xc0028000 - 0xc04c9000   (4740 kB)
      .data : 0xc04ca000 - 0xc04e97c0   ( 126 kB)
       .bss : 0xc04e97e4 - 0xc0504e80   ( 110 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab  at 0
SCSI subsystem initialized
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) �© 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 136
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
TS82 driver for HI3518C
Pass authentication ... ... 
brd: module loaded
loop: module loaded
Spi id table Version 1.22
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
SPI FLASH start_up_mode is 3 Bytes
spi size: 0x16777216
chip num: 1
4 cmdlinepart partitions found on MTD device hi_sfc
Creating 4 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000400000 : "kernel"
0x000000400000-0x000000480000 : "dataBlock"
0x000000480000-0x000001000000 : "rootfs"
Fixed MDIO Bus: probed
himii: probed
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
mousedev: PS/2 mouse device common for all mice
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
�VFS: Mounted root (cramfs filesystem) readonly on device 31:3.
Freeing init memory: 128K

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (463): /proc/463/oom_adj is deprecated, please use /proc/463/oom_score_adj instead.
CMEMK module: built on Mar  6 2013 at 16:34:50
  Reference Linux version 3.0.8
  File /AppData/his/sdk/Hi3518_SDK_V1.0.3.0/drv_test/cmem/src/module/cmemk.c
allocated heap buffer 0xc6000000 of size 0xe00000
cmemk initialized
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0008: 0x00000000 --> 0x00000001 
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0018: 0x00000000 --> 0x00000001 
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f001c: 0x00000000 --> 0x00000001 
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0124: 0x00000000 --> 0x00000000 
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140400: 0x00000038 --> 0x00000002 
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x201403fc: 0x00000034 --> 0x00000002 
ADC_CH0 driver ADC detect
Set IR-CUT default
1111, set ircut to night mod
2222, set ircut to day mod
3333, ircut init
Current ADC. Vol. 92
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=30 sec (nowayout= 0, nodeamon= 1)
hi_i2c init is ok!
(none) login: *** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20030030: 0x00000000 --> 0x00000001 
reset sensor ov9712 finish ...
*** Board tools : ver0.0.1_20120501  *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20030030: 0x00000001 --> 0x00000005 
reset sensor ar0130 finish ...
hi3518_detect_sensor_type():  hi3518c_detect_sensor_type(): get ar0130 sensor, GPIO0_7=0
detected sensor type is 3
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:84a00000, va:c5200000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
ISP Mod init!
load vpss.ko ....OK!
load vou.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
Kernel: ssp initial ok!
acodec inited!
insert audio
==== Your input Sensor type is ar0130 ====
sys_montor enter main loop...
tcp_mon start main loop...
encode_mon enter main loop...
sys_daemon mount /dev/mtdblock2 success
sys_daemon disable console
ADDRCONF(NETDEV_UP): eth0: link is not ready
Set IR-CUT default
get cmd to enable adc printk
i=1, curVol=0x1e, tmpVOL=0x153, ircutMode=1, ircutStatus=0
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

Login timed out after 60 seconds
IPNC login: 

11 thoughts on “I got new Hi3518 IP Camera modules

  1. Is it actually possible to stop the Hi3518 u-boot bootloader from booting and manipulate it from there?
    “Hit any key to stop autoboot:” does not work for me, nor
    hitting Enter
    hitting ~
    or something else.

    Another things that are still bugging me:
    – how do i download the firmware to my pc with tftp?
    – how do i compile a module for own hardware drivers or a ssh shell?

  2. Hi Daniel,
    Yes, I get access to U-Boot prompt. Maybe your U-Boot is configured to ignore key pressed, same issue I faced here: https://acassis.wordpress.com/2012/10/21/how-to-transfer-files-to-a-linux-embedded-system-over-serial/
    About tftp, I suppose you are running Linux, then just install a tftp server in your Linux and put your image inside the default tftpd directory. Search for tftpd in this blog. I suggest you learn how to compile a common module for Linux before trying to compile a module for your driver. You will find many sites explaining how to do that.
    You need to climb the learning curve of Linux embedded system development. []’s, Alan

    1. Hi,

      I got the another variant of the Hi3518, but the root password is not null. I tried some default passwords but had no luck.

      Is it possible to upload the firmware to the PC using tftp and U-Boot? Then it might be possible to hex find the password…


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s