MayGion MIPS IPCam

Revision as of 20:43, 27 April 2013 by Malvineous (Talk | contribs) (Add pictures and serial port info)

Jump to: navigation, search
Typical MayGion camera

The MayGion MIPS IPCam is a generic ethernet connected webcam.


Top of PCB
PCB underside
  • 360MHz MIPS processor (Ralink RT5350 SoC)
  • 4MB flash (MX25L3205D 32Mb SPI)
  • 27MB RAM
  • SoC provides one USB port, connected to an onboard USB hub (058f:6254), with these attached devices:
  • SoC provides 5-port ethernet switch:
    • One port is used for external LAN port
    • One port may be connected to the 802.11b/g/n wi-fi interface
  • Wolfson Microelectronics WM8988 Low Power CODEC with Headphone Driver provides speaker output and microphone input
  • ULN2803AG Octal High Voltage, High Current Darlington Transistor Array - presumably allowing GPIO control of the 5V PTZ motors
  • Fitipower FR9886D 23V, 2A, 380KHz Synchronous Step-Down DC/DC Converter


  • The stock firmware provides an unrestricted telnet interface to BusyBox
  • Files can be uploaded/downloaded from the Linux system via FTP (username "MayGion" password "")
  • Uploading mipsel executables via FTP can be launched via telnet without problem
  • At the time of writing (2013-03-16) one version can be purchased through DealExtreme SKU 169625
  • The firmware developer has said the UART is accessible on the PCB, but he doesn't know where. The purpose of J10 is unknown but does not appear to be a serial port.

Serial console / bootloader access

There does not appear to be any way of accessing a serial port on the PCB, despite the kernel sending output to the SoC's serial port.

The bootloader is U-Boot 1.1, and it appears to be set to boot over TFTP from within five seconds after power on (according to the U-Boot environment variables in /dev/mtdblock1), although obviously this doesn't happen. The device does not emit any ARP queries or other network traffic until the Linux kernel has loaded.


This was obtained from the stock firmware by uploading a fully featured busybox binary and using it to run dmesg.

 (root@localhost) (gcc version 3.4.2) 

 The CPU feqenuce set to 360 MHz
CPU revision is: 0001964c (MIPS 24Kc)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
On node 0 totalpages: 8192
free_area_init_node: node 0, pgdat 80457ae0, node_mem_map 81000000
  Normal zone: 64 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 8128 pages, LIFO batch:0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00009c61
Readback ErrCtl register=00009c61
Memory: 27212k/32768k available (3752k kernel code, 5556k reserved, 695k data, 608k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Console: colour dummy device 80x25
console [ttyS1] enabled
Calibrating delay loop... 239.61 BogoMIPS (lpj=479232)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
JFFS2 version 2.2 (NAND) (LZMA) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
GDMA IP Version=2
i2cdrv_major = 218
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
brd: module loaded
loop: module loaded
deice id : c2 20 16 c2 20 (2016c220)
MX25L3205D(c2 2016c220) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (0M) .erasesize = 0x00000004 (0K) .numeraseregions = 65536
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000400000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000220000 : "Kernel2"
0x000000220000-0x000000400000 : "MTD5"
MAC_ADRH -- : 0x00000408
MAC_ADRL -- : 0x0f055892
MAC_ADRH -- : 0x00000408
MAC_ADRL -- : 0x0f055892
MAC_ADRH -- : 0x00000408
MAC_ADRL -- : 0x0f055892
HDLC support module revision 1.22

=== pAd = c0153000, size = 536440 ===

<-- RTMPAllocAdapterBlock, Status=0
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
i8042.c: i8042 controller self test timeout.
Trying to free nonexistent resource <0000000000000060-000000000000006f>
mice: PS/2 mouse device common for all mice
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v0.1.0)
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
lib80211_crypt: registered algorithm 'WEP'
lib80211_crypt: registered algorithm 'CCMP'
lib80211_crypt: registered algorithm 'TKIP'
Freeing unused kernel memory: 608k freed
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 1-1.1: new high speed USB device using rt3xxx-ehci and address 3
uvcvideo: Found UVC 1.00 device USB 2.0 Camera (0c45:6360)
input: USB 2.0 Camera as /devices/platform/rt3xxx-ehci/usb1/1-1/1-1.1/1-1.1:1.0/input/input0
usb 1-1.4: new high speed USB device using rt3xxx-ehci and address 4
scsi0 : usb-storage 1-1.4:1.0
scsi 0:0:0:0: Direct-Access     Multi    Flash Reader     1.00 PQ: 0 ANSI: 0
sd 0:0:0:0: [sda] Attached SCSI removable disk

phy_tx_ring = 0x015b7000, tx_ring = 0xa15b7000

phy_rx_ring0 = 0x015d4000, rx_ring0 = 0xa15d4000
Link Status Changed
RX DESC a15ee000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
uvcvideo: Failed to query (133) UVC control 8 (unit 3) : -32 (exp. 2).