IP Cameras

Fligg(?) acquired a cheap Chinese IP camera for testing. If we can get it to behave, the plan is to acquire more and deploy them around the space.

IP address is hard-coded at 192.168.1.10. telnetd is running on port 23, root password is "xmhdipc".

Language is hard-coded as Chinese. Only a single byte to change, but awkward as it's on a cramfs filesystem on a native MTD device with presumably very limited write cycles. Big 5Mb binary /usr/bin/Sofia does everything: streams rtsp, runs web server. Tries to connect to secu100.net for evil.

Moar data

Chipset is Hi3518 (datasheet). It has an ARM926EJ-S and 40Mb RAM.

Contents of the included CD (160Mb).

Someone else playing with such a camera. Includes SDK, local mirror (600Mb).

Software

The camera has 8 megabytes of NOR flash (64K pagesize), split into six partitions. These are accessible as /dev/mtdblock{0,1,2,3,4,5}.

• /dev/mtdblock1 on / type cramfs (ro,relatime)
• /dev/mtdblock2 on /usr type squashfs (ro,relatime)
• /dev/mtdblock3 on /mnt/web type cramfs (ro,relatime)
• /dev/mtdblock4 on /mnt/custom type cramfs (ro,relatime)
• /dev/mtdblock5 on /mnt/mtd type jffs2 (rw,relatime)

U-Boot config (located at flash offset 0x30004, preceded by CRC32):

   bootcmd=fload;bootm 0x82000000
   bootdelay=1
   baudrate=115200
   bootfile="uImage"
   da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
   du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
   dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
   dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
   dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
   up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite
   ua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwrite
   tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 uImage; bootm 0x82000000
   dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
   ipaddr=192.168.1.10
   serverip=192.168.1.107
   netmask=255.255.255.0
   bootargs=mem=40M console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=cramfs mtdparts=hi_sfc:256K(boot),3520K(romfs),2560K(user),1280K(web),256K(custom),320K(mtd)
   stdin=serial
   stdout=serial
   stderr=serial
   verify=n
   ver=U-Boot 2010.06 (Apr 07 2012 - 17:11:2)
   ethaddr=00:12:12:43:ed:32
   HWID=8043420004048425
   appSystemLanguage=SimpChinese
   appVideoStandard=PAL

Kernel:

    Linux LocalHost 3.0.8 #96 Sat May 17 13:27:56 CST 2014 armv5tejl GNU/Linux

Network:

   Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
   tcp        0      0 0.0.0.0:34561           0.0.0.0:*               LISTEN      700/upgraded
   tcp        0      0 0.0.0.0:8899            0.0.0.0:*               LISTEN      721/Sofia
   tcp        0      0 0.0.0.0:34599           0.0.0.0:*               LISTEN      721/Sofia
   tcp        0      0 0.0.0.0:34567           0.0.0.0:*               LISTEN      721/Sofia
   tcp        0      0 0.0.0.0:554             0.0.0.0:*               LISTEN      721/Sofia
   tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      721/Sofia
   tcp        0      0 0.0.0.0:9527            0.0.0.0:*               LISTEN      709/dvrHelper
   tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      708/telnetd
   udp        0      0 0.0.0.0:34568           0.0.0.0:*                           721/Sofia
   udp        0      0 255.255.255.255:34569   0.0.0.0:*                           703/searchIp
   udp        0      0 0.0.0.0:3702            0.0.0.0:*                           721/Sofia
   udp        0      0 0.0.0.0:712             0.0.0.0:*                           -
   udp        0      0 0.0.0.0:35804           0.0.0.0:*                           721/Sofia

(Would be really nice to dispense with some of these.)

Output

The following will save camera output to a file.

  gst-launch-1.0 rtspsrc location='rtsp://192.168.1.10:554/user=admin&password=&channel=1&stream=0.sdp?real_stream--rtp-caching=100' ! queue ! rtph264depay ! h264parse ! matroskamux ! filesink location=cam.mkv

The result isn't seekable but the following makes it so:

  mkvmerge -o cam-seekable.mkv cam.mkv

I've heard reports that UDP streaming is less reliable than TCP. More testing needed.

Streams:

• 0.sdp is 1280x720, 11fps, H.264, ~1Mbit/sec
• 1.sdp is 352x288, 12.5fps, H.264

(However the sensor claims 25fps.)

Things to do

On the camera:

• Get nfs mounting to work, get access to sane userland.
• Get DHCP client installed.
• Get NTP client installed.
• (Optional) Make a real rootfs with OE or embdebian or similar, boot it over NFS.

Elsewhere:

• Logging infrastructure. Storing the output of one camera stream should take about 15GB/day.
• JPEG output for web page display
• (Optional) Transcoding of the stream for viewing in web browsers that lack H.264 support