MayGion MIPS IPCam

The MayGion MIPS IPCam is a generic ethernet connected webcam.

Specifications

 * 360MHz MIPS processor (Ralink RT5350 SoC)
 * 4MB flash (MX25L3205D 32Mb SPI)
 * 27MB RAM
 * SoC provides one USB port, connected to an onboard USB hub (058f:6254), with these attached devices:
 * 0c45:6360 Webcam
 * 058f:6366 Multi-flash reader (with only SD card connector)
 * Hub and card reader are provided by Alcor Micro AU6350 single chip integrated USB2.0 hub and multimedia card reader controller
 * SoC provides 5-port ethernet switch:
 * One port is used for external LAN port
 * One port may be connected to the 802.11b/g/n wi-fi interface
 * Wolfson Microelectronics WM8988 Low Power CODEC with Headphone Driver provides speaker output and microphone input
 * ULN2803AG Octal High Voltage, High Current Darlington Transistor Array - presumably allowing GPIO control of the 5V PTZ motors
 * Fitipower FR9886D 23V, 2A, 380KHz Synchronous Step-Down DC/DC Converter

Serial console / bootloader access
There does not appear to be any way of accessing a serial port on the PCB, despite the kernel sending output to the SoC's serial port.

The bootloader is U-Boot 1.1, and it appears to be set to boot over TFTP from 192.168.1.23 within five seconds after power on (according to the U-Boot environment variables in /dev/mtdblock1), although obviously this doesn't happen. The device does not emit any ARP queries or other network traffic until the Linux kernel has loaded.

dmesg
This was obtained from the stock firmware by uploading a fully featured busybox binary and using it to run dmesg.

(root@localhost) (gcc version 3.4.2)

The CPU feqenuce set to 360 MHz CPU revision is: 0001964c (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal  0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 On node 0 totalpages: 8192 free_area_init_node: node 0, pgdat 80457ae0, node_mem_map 81000000 Normal zone: 64 pages used for memmap Normal zone: 0 pages reserved Normal zone: 8128 pages, LIFO batch:0 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2 PID hash table entries: 128 (order: -3, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes Writing ErrCtl register=00009c61 Readback ErrCtl register=00009c61 Memory: 27212k/32768k available (3752k kernel code, 5556k reserved, 695k data, 608k init, 0k highmem) SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:128 Console: colour dummy device 80x25 console [ttyS1] enabled Calibrating delay loop... 239.61 BogoMIPS (lpj=479232) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 bio: create slab  at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb cfg80211: Calling CRDA to update world regulatory domain Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RT3xxx EHCI/OHCI init. JFFS2 version 2.2 (NAND) (LZMA) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) GDMA IP Version=2 i2cdrv_major = 218 Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A brd: module loaded loop: module loaded deice id : c2 20 16 c2 20 (2016c220) MX25L3205D(c2 2016c220) (4096 Kbytes) mtd .name = raspi, .size = 0x00400000 (0M) .erasesize = 0x00000004 (0K) .numeraseregions = 65536 Creating 6 MTD partitions on "raspi": 0x000000000000-0x000000400000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000220000 : "Kernel2" 0x000000220000-0x000000400000 : "MTD5" MAC_ADRH -- : 0x00000408 MAC_ADRL -- : 0x0f055892 MAC_ADRH -- : 0x00000408 MAC_ADRL -- : 0x0f055892 MAC_ADRH -- : 0x00000408 MAC_ADRL -- : 0x0f055892 PROC INIT OK! HDLC support module revision 1.22

pAd = c0153000, size = 536440
<-- RTMPAllocAdapterBlock, Status=0 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver rt3xxx-ehci rt3xxx-ehci: EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. i8042.c: i8042 controller self test timeout. Trying to free nonexistent resource <0000000000000060-000000000000006f> mice: PS/2 mouse device common for all mice Linux video capture interface: v2.00 usbcore: registered new interface driver uvcvideo USB Video Class driver (v0.1.0) TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  lib80211: common routines for IEEE802.11 drivers lib80211_crypt: registered algorithm 'NULL' lib80211_crypt: registered algorithm 'WEP' lib80211_crypt: registered algorithm 'CCMP' lib80211_crypt: registered algorithm 'TKIP' Freeing unused kernel memory: 608k freed Algorithmics/MIPS FPU Emulator v1.5 devpts: called with bogus options usb 1-1: new high speed USB device using rt3xxx-ehci and address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 4 ports detected usb 1-1.1: new high speed USB device using rt3xxx-ehci and address 3 uvcvideo: Found UVC 1.00 device USB 2.0 Camera (0c45:6360) input: USB 2.0 Camera as /devices/platform/rt3xxx-ehci/usb1/1-1/1-1.1/1-1.1:1.0/input/input0 usb 1-1.4: new high speed USB device using rt3xxx-ehci and address 4 scsi0 : usb-storage 1-1.4:1.0 scsi 0:0:0:0: Direct-Access    Multi    Flash Reader     1.00 PQ: 0 ANSI: 0 sd 0:0:0:0: [sda] Attached SCSI removable disk

phy_tx_ring = 0x015b7000, tx_ring = 0xa15b7000

phy_rx_ring0 = 0x015d4000, rx_ring0 = 0xa15d4000 Link Status Changed RX DESC a15ee000 size = 2048 <-- RTMPAllocTxRxRingMemory, Status=0 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 MCS Set = ff 00 00 00 01 <==== rt28xx_init, Status=0 0x1300 = 00064300 uvcvideo: Failed to query (133) UVC control 8 (unit 3) : -32 (exp. 2).