How to flash / interrupt Hi3518EV200

[oliv3r]

Hi all,

I have was donated a 'Hi Tone' doorbell featuring an HI3518EV200. I've taken it appart to just the bare PCB, but other then U-Boot logs, I'm not getting any boot information from the device any more.

Booting with the reset button pressed, I'm getting slightly more information, but still not enough to identify what to google for to interrupt the bootloader. Could be that it's completly locked, or that my TX line of the USB to UART adapter is not arriving properly at the RX of the board (the adapter itself works fine and was used more often, i can see letters echo'ed from the boot sequence, I think it's the BROM, though returning a different letter then what I pressed :/)

Here is the log when I keep the reset button pressed

���                         


System startup


U-Boot 2010.06 (Sep 14 2018 - 18:52:25)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x60 0x17
Block:64KB Chip:8MB Name:"GD25LQ64C"
SPI Nor total size: 8MB
MMC:   
EMMC/MMC/SD controller initialization.
MMC/SD Card:
    MID:         0x74
    Read Block:  512 Bytes
    Write Block: 512 Bytes
    Chip Size:   15343M Bytes (High Capacity)
    Name:        "USD  "
    Chip Type:   SD
    Version:     2.0
    Speed:       50000000Hz
    Bus Width:   4bit
    Boot Addr:   0 Bytes
In:    serial
Out:   serial
Err:   serial
uboot oled on
Interface:  MMC
  Device 0: Vendor: Man 744a60 Snr 65f112c8 Rev: 1.0 Prod: USD  
            Type: Removable Hard Disk
            Capacity: 15343.0 MB = 14.9 GB (31422464 x 512)
Partition 1: Filesystem: FAT32 "           "

14 file(s), 15 dir(s)

go to unlock falsh!
Get spi lock information
all blocks are unlocked.
unlock all block.
hifmc100_clear_cmp_level
  Read status reg2 CR:SR[0x20]

u-boot not found!

env not found!

liteosconf not found!

liteoslzm not found!

rootfs not found!

home not found!
USB:   scanning bus for devices... 1 USB Device(s) found
0 Storage Device(s) found
uboot-other-mipi-init
8192 KiB hi_fmc at 0:0 is now current device

uboot mirror:10 flip:00
... <wait a really long time)
uboot_get_init_exposure ==<adc=208 i=18 aec_h:50, aec_l:128 agc_h:0 agc_l:46>

While I'd be suprised if U-Boot had support for the camera module; I did remove all peripherials, e.g. buttons, speakers, camera etc.

Is this a known u-boot variant? Any clue's on what the interrupt sequence might be? Any tricks to trick u-boot into flashing something from the uSD/USB port? (I think the USB port is power only, as I do not see anything on dmesg on my host ...

[oliv3r]

Curious enough; 'liteosconf' seems to be related to 'Huawei Lite OS' making me think again that HiSilicon is tightly coupled to Huawai? :)

[oliv3r]

So after re-attaching the camera, things boot again! totally weird; AND i can access the U-Boot console via ctrl-c. I must say I find it exceptionally odd that U-Boot relies on the presence of the camera. Which is (I could append to the log)

=== UBoot OV9732 (MIPI) init success! ===

Full log below
[summary]

System startup


U-Boot 2010.06 (Sep 14 2018 - 18:52:25)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x60 0x17
Block:64KB Chip:8MB Name:"GD25LQ64C"
SPI Nor total size: 8MB
MMC:   
EMMC/MMC/SD controller initialization.
MMC/SD Card:
    MID:         0x74
    Read Block:  512 Bytes
    Write Block: 512 Bytes
    Chip Size:   15343M Bytes (High Capacity)
    Name:        "USD  "
    Chip Type:   SD
    Version:     2.0
    Speed:       50000000Hz
    Bus Width:   4bit
    Boot Addr:   0 Bytes
In:    serial
Out:   serial
Err:   serial
uboot-other-mipi-init
8192 KiB hi_fmc at 0:0 is now current device

uboot mirror:10 flip:00
uboot_get_init_exposure ==<adc=208 i=18 aec_h:50, aec_l:128 agc_h:0 agc_l:46>
=== UBoot OV9732 (MIPI) init success! ===
Press Ctrl+C to stop autoboot
8192 KiB hi_fmc at 0:0 is now current device

## Starting application at 0x80008000 ...
********hello Huawei LiteOS ARM926********

version : Huawei LiteOS V200R001C10B031
open-version : Huawei LiteOS 1.4.6
build data : Jun 21 2019 20:48:45

*******************
Huawei LiteOS # Spi Nor ID:0xC8 0x60 0x17 0xC8 0x60 0x17 0xC8 0x60 
Spi Nor Flash Info:
Name:"GD25LQ64C" Size:8MB Block:64KB

Calling lwIPRegSecSspCbk

********mmc host init ! ********
Date:Jul  3 2019. Time:17:01:18.
osal_proc_mkdir - parent is NULL! proc=0x809001b8 

[       38]ubia_wdg_feed_thread===>>
mem_start=0x80000000, MEM_OS_SIZE=33M, MEM_USB_SIZE=1M, mmz_start=0x82200000, mmz_size=30M
mmz param= anonymous,0,0x82200000,30M
<6>Hisilicon Media Memory Zone Manager
load sys.ko for Hi3518EV200...OK!
load tde.ko ...OK!
load region.ko for Hi3518EV200...OK!
load vgs.ko for Hi3518EV200...OK!
load viu.ko for Hi3518EV200...OK!
ISP Mod init!
load vpss.ko for Hi3518EV200...OK!
Load hifb.ko OK!
load rc.ko ...OK!
load venc.ko ...OK!
load chnl.ko for Hi3518EV200...OK!
load h264e.ko ...OK!
load jpege.ko ...OK!
load ai.ko OK!
load ao.ko OK!
load aenc.ko OK!
load adec.ko OK!
acodec [acodec_device_init ,1348]: misc addr:0x20120000, acodec addr:0x201200c4

acodec [acodec_device_init ,1366]: crg addr:0x20030000, acodec crg addr:0x2003008c


[      108][ULOG_INFO]ubia_hal_init[382] Ver:1.0.5.38

[      118][ULOG_INFO]ubia_rtc_get[116] 1970-01-01 0:17:47   utsec:1067

[      123][ULOG_INFO]ubia_get_local_mgmt[2112] local gUID:MQ PKG:31 ModelNum:108!

[      132][ULOG_INFO]ubiaGetUsr[529] invalid usr info!

[      134][ULOG_INFO]ubia_load_user_conf[1902] get dns0:00000000 dns1:00000000

[      141][ULOG_INFO]ubia_load_user_conf[1903] u8RecordMode=1 country=45 user_wifistatus=0, wifistatus=0

[      151][ULOG_INFO]ubia_load_user_conf[1938] u8Lock_key:[0:31] 1234 len=4

[      158][ULOG_INFO]ubia_load_user_conf[1942] load default lock_key: 1234 len=4

[      169][ULOG_INFO]ubia_load_user_conf[1980] local noValidAP:

[      175][ULOG_INFO]ubia_isp_get_sensor[1287] ubia_isp_get_sensor load sensor:13, pictSize:0
sdcard no detect VDD 

[      196]ubia_perip_init===>>

[      196]ubia_perip_init===<<

[      196][ULOG_INFO]ubia_perip_pusbbtn_flag[687] push flag:0

[      202][ULOG_INFO]ubia_perip_disk_init : register /dev/mmcblk0 ok!
wakeup_flag[675] wakeup flag:0
disk_add_part : register /dev/mmcblk0p0 ok!

[      215][ULOG_INFO]HI_HAL_MCUHOST_Init[623] mcu host init ok 

[      244][ULOG_INFO]USART_Receive_Data[246] receive buf: 7B  05  A1  01  21 

[      246][ULOG_INFO]Uart_CMD_Handle[463] POWER Supply: 1

[      253]hisi_mpp_init===>>

[      255][ULOG_INFO]ubia_video_init[663] ubia_video_init  p_ubia_video_mgmt inited

[      262]hisi_video_init===>>

[      265][ULOG_INFO]USART_Receive_Data[246] receive buf: 7B  0A  9D  00  28  06  8F  02  0F  BF 

[      274][ULOG_INFO]Uart_CMD_Handle[451] READY RESP:00 28 06 8f 02 mcu[0f 1010101]

[      282][ULOG_INFO]ubia_hal_set_readyResp[1013] Power up bit set, shall do wpa_supplicant

[      290][ULOG_INFO]ubia_hal_set_readyResp[1036] powerSupplying
CMD_SET_REG_WIDTH error!
-----------------cmos_get_ae_default
cmos_get_init_ae [302]==<adc:208 i:19 initexp:128 aemode:0>


--------sc1245 20171127 1280x720 30fps.

-----------------cmos_get_ae_default
cmos_get_init_ae [490]==<adc:208 i:19 initexp:128 aemode:0>
-----------------cmos_fps_set

[      764][ULOG_INFO]ubia_dofirst_mode[428] adc:208

[      764]ubia_isp_bin_load===>>

[      766]ubia_mount_home===>>

[      821][ULOG_INFO]ubia_mount_home[121] mount ok!
ubia_isp_bin_load ===load[/jffs/sc1245_day.bin]
u32OfstTableNum = 30
u32IspRegAddr    = 0x205a0000, size = 131071
u32IspExtRegAddr = 0x82b2d000, size = 65536
u32AeExtRegAddr  = 0x82b4a000, size = 4096
u32AwbExtRegAddr = 0x82b4b000, size = 4096

[      857]ubia_isp_bin_load===<<

[      857]ubia_set_saturation===>>

[      859]ubia_set_saturation===<<
-----------------cmos_fps_set
Not support Fps: 25.000000
---HI_MPI_ISP_SetGammaAttr g_stIspGamma_1st 0----

[      958][ULOG_INFO]ubia_ircult_change[148] Switch to Daymode

[      958]ubia_dofirst_mode===<<

[      961][ULOG_INFO]ubia_perip_sensorflip[949] real_mode = 0, pkg = 31

[      968][ULOG_INFO]hisi_video_init[368] chn:0 srcfps:15 dstfps:15

[      975][ULOG_INFO]hisi_video_init[404] chn:1 srcfps:15 dstfps:15

[      981][ULOG_INFO]UBIA_COMM_VENC_Start[1791] u32BitRate:512,fr32DstFrmRate:15, u32SrcFrmRate:15

[      990][ULOG_INFO]UBIA_COMM_VENC_Start[1791] u32BitRate:256,fr32DstFrmRate:15, u32SrcFrmRate:15

[     1000]audio_switch_off===>>

[     1002][ULOG_INFO]rmmAencChEnable[1887] 
rmmAencChEnable ==stAencAttr.u32PtNumPerFrm=480
[     1012]audio_switch_off===>>
RmmAudioOutSet: set ACODEC_SET_OUTPUT_VOL to -2db 80

[     1019]ubia_mount_home===>>

[     1021]ubia_wow_loadserver===>>

[     1025][ULOG_INFO]ubia_wow_loadserver[943] err magic: 00000000

[     1031][ULOG_INFO]ubia_wow_init[1005] default wow server[0]: 0x44494e78

[     1039][ULOG_INFO]ubia_wow_init[1005] default wow server[1]: 0x41cbbe76

[     1045][ULOG_INFO]ubia_wow_init[1005] default wow server[2]: 0x46fe592f

[     1052][ULOG_INFO]ubia_wow_init[1005] default wow server[3]: 0x5e87342f

[     1059][ULOG_INFO]ubia_hal_init[543] wakeup:0, wifistatus=0

[     1066]wifi_hi1131_init===>>
<3>start to register sdio modulesdio probe:pull up power on gpio

 ########save the first frame 1113 ms

[     1313][ULOG_INFO]himci_wifi_sdio_detect_trigger[516] DECTECT SDCARD
hisi sdio load sucuess, sdio enum done.
{oal_sdio_func_probe::shutdown wifi after init sdio.
}sdio probe:pull down power on gpio
oal_create_singlethread_workqueue::wlan_pm_wq single_workqueue
[firmware_get_cfg]ram_reg_test_cfg maybe not exist!
[plat_firmware_init]ram_reg_test_cfg maybe not exist, please check
plat_init:: platform_main_init finish!
liteos plat init ok!
hisi wifi hcc transfer thread enter
wiphy_register start.
wal_init_wlan_netdev wlan0.
wal_init_wlan_netdev p2p0.
[hmac_wow_set_host_state]{Hmac_wow::state[0]->[1]!}
[hmac_wow_init]{hmac_wow_init, time = 1346, ul_wow_event = [000001DF];g_auc_timer_debug[0] = 3, g_auc_timer_debug[1]:3}
host_main_init finish!
Hi1131_host_main_init finish!

[     1377]wifi_hi1131_init===<<

[     1384]ubia_perip_start===>>

[     1385]check_reset_btn===>>

[     1388]check_reset_btn===<<

[     1391][ULOG_INFO]ubia_hal_init[614] wpa_supplicant_start===>

[     1398]ubia_check_timer_cb===>>
Successfully initialized wpa_supplicant
wal_netdev_open,dev_name is:wlan0
[firmware_download_function]download firmware, count [1], current time [160000]us, max time [160000]us
get rates from device
[wlan_power_on]power on, count [1], current time [170000]us, max time [170000]us
hcc state off[0]=>on [1]
hisi_customize_wifi::ampdu_tx_max_num:64get rates from device
wal_cfg_vap_h2d_event succ 
[hmac_wow_set_dmac_cfg]hmac_wow_set_dmac_cfg, flag[0], wow_event[000001DF]
[hmac_wow_set_dmac_cfg]hmac_wow_set_dmac_cfg,ssid wakeup,uc_ssid_set_flag:0
wal_set_random_mac_to_mib,mac is:cc
wifi_event_cb,event:3
hsl_status=0 addiface
wpa_supplicant normal run!

[     3388][ULOG_INFO]ubia_hal_init[623] wpa_supplicant_start===<

[     3388][ULOG_INFO]ubia_network_start[1234] init netstatus=0
[     3395][ULOG_INFO]ubia_hal_init[764]  begin clip_rbuf_destroy

[     3402][ULOG_INFO]ubia_pair_handle[582] subOperation:UNET_PAIR_INIT
voiceRecog_start ====>>
voiceRecog_start =vr_setRecognizerListener===>>
voiceRecog_start <<====

 ###### start hisilink 

[     3419][ULOG_INFO]rmmAudioPlayTh[1377] option:5654
wal_netdev_stop,dev_name is:wlan0
[plat_pm]wlan_pm_close start!!
hcc state on [1]=>off[0]
Clear queue:1,total 1 hcc tx pkts!
real voice recognizer thread start:3
pvp_realProcess thread start work
[     3458][ULOG_INFO]UBIA_Store_main[239] mount sd card success!

[     3459][ULOG_INFO]rmmAudioPlayTh[1571] 
rmmAudioPlayTh===>READY_FOR_PAIR[3459]

[     3484][ULOG_INFO]wav_open[70] u32RiffSize:0x145b6

[     3484][ULOG_INFO]wav_open[93] u32FmtSize:0x10!

[     3488][ULOG_INFO]wav_open[107] u32SamplesPerSec:16000

[     3494][ULOG_INFO]wav_open[113] data.size:0x14570!

[     3499][ULOG_INFO]update_mcu_status[214] no mcu update file!
add 30k noise data to init recognizer

[     3508][ULOG_INFO]rmmAudioPlayTh[1775] rmmAudioPlayTh ----> fd[2154403020] start play[duration:0 prio:1]

[     3511][ULOG_INFO]ubiaConfigUpdate[1781] ------------------

[     3536]audio_switch_on===>>
fopen /sd0/update/ucam_vendor_spec_default.conf failed!

[     3541][ULOG_INFO]ubiaVendorConfigUpdate[1770] no vendor conf
fopen /sd0/update/ucam_user_spec.conf failed!

[     3552][ULOG_INFO]ubiaUserConfigUpdate[805] no file:/sd0/update/ucam_user_spec.conf!
signalDetector init:3.539490(take 311 ms)
RECORD_GetSysRecordFileInfo===>
ubia_record_db_load ====>>
ubia_record_db_load =====<(open /sd0/ubia_record.db fail)

[     3907][ULOG_INFO]RECORD_GetSysRecordFileInfo[261] ===load[-1]files

[     3913][ULOG_INFO]record_file_list_init[391] disk have -1 rec file 
UBIA_RECORD_CreateRecFileName+++++++>[0000000003_904__temp.mp4][0x817dd4c4][3][904]

 video record stream 0 

[     3980][ULOG_INFO]UBIA_Creat_tmpFile[557] MP4_RECORD_Start iRet=0  file[/sd0/video/0000000003_904__temp.mp4]
hsl_get_ap_params:ssid[Hisi_1003001C43A359119BF00000000],len[32]hsl_get_ap_params:pwd[QcV=']ZrcUPQ5nkkvJ~P<9pDi<I%V/TjF+LJ7-iw$Bj0CpDJ],len[48][firmware_download_function]download firmware, count [2], current time [140000]us, max time [160000]us
get rates from device
[wlan_power_on]power on, count [2], current time [160000]us, max time [170000]us
hcc state off[0]=>on [1]
get rates from device
[hmac_wow_set_dmac_cfg]hmac_wow_set_dmac_cfg, flag[0], wow_event[000001DF]
[hmac_wow_set_dmac_cfg]hmac_wow_set_dmac_cfg,ssid wakeup,uc_ssid_set_flag:0
wal_cfg80211_change_virtual_intf,dev_name is:wlan0
wal_set_random_mac_to_mib,mac is:cc
add 30k noise data to init recognizer
Using interface wlan0 with hwaddr cc and ssid "Hisi_1003"

[     5608][ULOG_INFO]ubia_read_wav_data[817] End of file!
[     5608][ULOG_INFO]playSpecialAudio[1113] End of file,frameNo=0

[     5614][ULOG_INFO]playSpecialAudio[1153] ====<Finish Count:0
wal_start_vap,dev_name is:wlan0
wal_cfg80211_start_ap::exit.
hostapd_event=0
hsl_status=2

[     6501]audio_switch_off===>>

[     6501][ULOG_INFO]rmmAudioInTh[669] 
[6] playing end

[    10005][ULOG_INFO]rmmAudioInTh[611] 
 -----Ready for Audio Recog------

[    34468][ULOG_INFO]rmmAudioPlayTh[1377] option:5654

[    34468][ULOG_INFO]rmmAudioPlayTh[1571] 
rmmAudioPlayTh===>READY_FOR_PAIR[34468]

[    34476][ULOG_INFO]wav_open[70] u32RiffSize:0x145b6

[    34480][ULOG_INFO]wav_open[93] u32FmtSize:0x10!

[    34485][ULOG_INFO]wav_open[107] u32SamplesPerSec:16000

[    34491][ULOG_INFO]wav_open[113] data.size:0x14570!

[    34499][ULOG_INFO]rmmAudioPlayTh[1775] rmmAudioPlayTh ----> fd[2154403020] start play[duration:0 prio:1]

[    34506]audio_switch_on===>>

[    36614][ULOG_INFO]ubia_read_wav_data[817] End of file!
[    36614][ULOG_INFO]playSpecialAudio[1113] End of file,frameNo=0

[    36620][ULOG_INFO]playSpecialAudio[1153] ====<Finish Count:0

[    37517]audio_switch_off===>>

[    37517][ULOG_INFO]rmmAudioInTh[669] 
[37] playing end

[/summary]

I might try at some point to remove the camera again, and let it sit there for an hour to see if it continues to boot without a camera at all ...

[oliv3r]

Sadly, I can't store the files on an SD card; all mmc writes (to different sizes of SD cards) fail with

...
MMC:   
EMMC/MMC/SD controller initialization.
MMC/SD Card:
    MID:         0x3
    Read Block:  512 Bytes
    Write Block: 512 Bytes
    Chip Size:   14804M Bytes (High Capacity)
    Name:        "SL16G"
    Chip Type:   SD
    Version:     2.0
    Speed:       50000000Hz
    Bus Width:   4bit
    Boot Addr:   0 Bytes
...
hisilicon # mw.b 0x82000000 0xff 0x800000
hisilicon # sf probe 0; sf read 0x82000000 0x0 0x800000
8192 KiB hi_fmc at 0:0 is now current device

hisilicon # mmc dev 0; mmc erase 0x10 0x4000; mmc write 0x82000000 0x10 0x4000
mmc - MMC sub system

mmc - MMC sub system

MMC Device -2113929216 not found

Stupidly though, as mentioned above, things do get probed from U-Boot. Copying files from LiteOS to the card also works just fine. Any thoughts?

Looks like, while some mmc commands do work, their ancient u-boot version got the others removed. mmc rescan, mmcinfo and mmc list do seem to work (but not mmc info ...), however reading/writing however still gives us an -1 error.

I thought I could ymodem files out; but that also doesn't work. Going to see what commands liteos has to dump something, otherwise, reading the serial flash externally might be the only way ...

edit: So the U-Boot of 2010 requires the dev to be passed into 'write'. https://github.com/u-boot/u-boot/blob/v2010.06/common/cmd_mmc.c#L233 or rather, following https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev200 doesn't work because of the ancient u-boot, which ommits the dev argument.