Ambarella S2L board AB86 de-brick

mauzer

n3wb
Joined
Apr 2, 2016
Messages
20
Reaction score
2
Hello,

I bricked a Ambarella S2L AB86 board because due firmware upgrade PoE board has failed. Now I can not to ping a camera and via IPCSearch it is not seen.
Does somebody know how to fix it? Please advice.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,973
Reaction score
6,797
Location
Scotland
due firmware upgrade PoE board has failed
How do you know the PoE board has failed?
Are you able to power the board directly instead of via PoE?
The documentation may show where to apply 12v power.
 

mauzer

n3wb
Joined
Apr 2, 2016
Messages
20
Reaction score
2
At first the camera was unstable (random reboots), especially at nights, when IR were on. The seller recommend to upgrade the firmware, because a newer were released. But upgrade has failed.
Had to open enclosure and surprised - the capasitor was dropped from PoE board (lack of solder lead).
I have another PoE board, but S2L not works with PoE or 12V.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,973
Reaction score
6,797
Location
Scotland
How do you know the PoE board has failed?
the capasitor was dropped from PoE board (lack of solder lead).
Well, that sounds like a valid reason!
The seller recommend to upgrade the firmware, because a newer were released. But upgrade has failed.
It sounds like the seller needs to replace the board for you, on 2 counts.
 

mauzer

n3wb
Joined
Apr 2, 2016
Messages
20
Reaction score
2
I managed to connect via serial. The output:

Code:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.07.22 17:39:23 =~=~=~=~=~=~=~=~=~=~=~=
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.50 (root@liuyuqiang-H81M-DS2) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #10 PREEMŠT Mon Feb 29 14:32:03 CST 2016
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10g53c7d
[    0.000000] CPu: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2L Hawthorn Board
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x16000000[          ],0x0a000000
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: mem=256M console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 256MB = 256MB total
[    0.000000] Memory: 255076k/255076k available, 7068k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x90800000 - 0xff000000   (1768 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x90000000   ( 256 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x8041fc08   (4192 kB)
[    0.000000]       .init : 0x80420000 - 0x80441f44   ( 136 kB)
[    0.000000]       .data : 0x80442000 - 0x804759c0   ( 207 kB)
[    0.000000]        .bss : 0x804759c0 - 0x80495934   ( 128 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 108MHz, resolution 9ns, wraps every 39768ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.234624] Calibrating delay loop... 1001.88 BogoMIPS (lpj=5009408)
[    0.272737] pid_max: default: 32768 minimum: 301
[    0.277394] Mount-cache hash table entries: 512
[    0.283405] CPU: Testing write buffer coherency: ok
[    0.288447] Setting up static identity map for 0x80311918 - 0x80311978
[    0.296480] devtmpfs: initialized
[    0.300606] pinctrl core: initialized pinctrl subsystem
[    0.305964] NET: Registered protocol family 16
[    0.310875] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.318047] L310 cache controller enabled
[    0.322064] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    0.331096] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    0.338938] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    0.347527] bio: create slab <bio-0> at 0
[    0.352197] ambarella-dma e0005000.dma: Ambarella DMA Engine 
[    0.358942] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    0.365811] ambarella-i2c e8001000.i2c: Ambarella I2C adapter[1] probed!
[    0.372852] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[    0.380221] Switching to clocksource ambarella-cs-timer
[    0.389391] NET: Registered protocol family 2
[    0.394168] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.401286] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.407647] TCP: Hash tables configured (established 2048 bind 2048)
[    0.414010] TCP: reno registered
[    0.417233] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.423049] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.429410] NET: Registered protocol family 1
[    0.433916] RPC: Registered named UNIX socket transport module.
[    0.439847] RPC: Registered udp transport module.
[    0.444526] RPC: Registered tcp transport module.
[    0.449217] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.455872] ambarella-adc e801d000.adc: Ambarella ADC driver init
[    0.462661] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.468677] jffs2: version 2.2. (NAND) (SUMMARY)  Ā© 2001-2006 Red Hat, Inc.
[    0.475839] msgmni has been set to 498
[    0.480344] NET: Registered protocol family 38
[    0.484821] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.492273] io scheduler noop registered
[    0.496197] io scheduler deadline registered
[    0.500455] io scheduler cfq registered (default)
[    0.505351] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    0.512470] ambarella-uart e0032000.uart: Serial[1] use txdma
[    0.518218] ambarella-uart e0032000.uart: Serial[1] use rxdma
[    0.523945] e0032000.uart: ttyS1 at MMIO 0xe0032000 (irq = 25) is a ambuart
[    0.531125] IRLED driver for Amba v1.0
[    5.607923] CRY driver v1.1
[    5.912868] Read CRY count 0
[    5.915938] VIN reset driver for Amba and IO INPUT OUT v1.0
[    5.921904] brd: module loaded
[    5.926585] loop: module loaded
[    5.929868] Ambarella read-only mtdblock
[    5.935984] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    5.941621] ambarella_nand: Use On Flash BBT
[    5.945937] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    5.958168] Bad block table found at page 65472, version 0x0F
[    5.964024] Bad block table found at page 65408, version 0x0F
[    5.969893] nand_read_bbt: bad block at 0x0000022e0000
[    5.975006] nand_read_bbt: bad block at 0x000003520000
[    5.980172] 8 ofpart partitions found on MTD device amba_nand
[    5.985903] Creating 8 MTD partitions on "amba_nand":
[    5.990931] 0x000000000000-0x000000020000 : "bst"
[    5.996099] 0x000000020000-0x000000120000 : "bld"
[    6.001176] 0x000000120000-0x000000200000 : "ptb"
[    6.006324] 0x000000200000-0x000000600000 : "spl"
[    6.011422] 0x000000600000-0x000001600000 : "pri"
[    6.016590] 0x000001600000-0x000002600000 : "sec"
[    6.021706] 0x000002600000-0x000003600000 : "rmd"
[    6.026867] 0x000003600000-0x000007000000 : "lnx"
[    6.085467] libphy: Ambarella MII Bus: probed
[    6.090135] ambarella-eth e000e000.ethernet: Ethernet PHY[3]: 0x00221560!
[    6.097348] ambarella-eth e000e000.ethernet: MAC Address[9a:20:bc:e8:6d:8c].
[    6.104648] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    6.112540] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    6.119418] TCP: cubic registered
[    6.122712] Initializing XFRM netlink socket
[    6.126988] NET: Registered protocol family 17
[    6.131455] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    6.139094] ThumbEE CPU extension supported.
[    6.144057] UBI: attaching mtd7 to ubi0
[    6.264446] UBI: scanning is finished
[    6.271963] UBI: attached mtd7 (name "lnx", size 58 MiB) to ubi0
[    6.277981] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.284740] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.291424] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.298275] UBI: good PEBs: 464, bad PEBs: 0, corrupted PEBs: 0
[    6.304166] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.311282] UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 64670772
[    6.320127] UBI: available PEBs: 0, total reserved PEBs: 464, PEBs reserved for bad PEB handling: 20
[    6.329236] UBI: background thread "ubi_bgt0d" started, PID 43
[    6.335068] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)
[    6.344975] UBIFS: background thread "ubifs_bgt0_0" started, PID 44
[    6.367005] UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 9)
[    6.374725] UBIFS error (pid 1): ubifs_read_node: bad node at LEB 235:6936, LEB mapping status 0
[    6.383501] Not a node, first 24 bytes:
[    6.387153] 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff                          ........................
[    6.400162] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.50 #10
[    6.406089] [<8001334c>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[    6.414679] [<80011a14>] (show_stack+0x10/0x14) from [<8014fae8>] (ubifs_read_node+0x29c/0x304)
[    6.423365] [<8014fae8>] (ubifs_read_node+0x29c/0x304) from [<8015acfc>] (dbg_old_index_check_init+0x68/0xd8)
[    6.433259] [<8015acfc>] (dbg_old_index_check_init+0x68/0xd8) from [<80149884>] (mount_ubifs+0x848/0x1800)
[    6.442890] [<80149884>] (mount_ubifs+0x848/0x1800) from [<8014b49c>] (ubifs_mount+0x3d0/0x704)
[    6.451574] [<8014b49c>] (ubifs_mount+0x3d0/0x704) from [<800a4d94>] (mount_fs+0x14/0xcc)
[    6.459737] [<800a4d94>] (mount_fs+0x14/0xcc) from [<800bd698>] (vfs_kern_mount+0x4c/0xcc)
[    6.467985] [<800bd698>] (vfs_kern_mount+0x4c/0xcc) from [<800bf8a0>] (do_mount+0x194/0x858)
[    6.476404] [<800bf8a0>] (do_mount+0x194/0x858) from [<800bffe8>] (SyS_mount+0x84/0xb8)
[    6.484384] [<800bffe8>] (SyS_mount+0x84/0xb8) from [<80420e7c>] (mount_block_root+0x144/0x2e4)
[    6.493061] [<80420e7c>] (mount_block_root+0x144/0x2e4) from [<8042123c>] (prepare_namespace+0xa8/0x1d4)
[    6.502525] [<8042123c>] (prepare_namespace+0xa8/0x1d4) from [<80420c1c>] (kernel_init_freeable+0x1b0/0x1c0)
[    6.512337] [<80420c1c>] (kernel_init_freeable+0x1b0/0x1c0) from [<8030b340>] (kernel_init+0xc/0x154)
[    6.521539] [<8030b340>] (kernel_init+0xc/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[    6.529965] UBIFS: background thread "ubifs_bgt0_0" stops
[    6.535559] List of all partitions:
[    6.539040] 1f00             128 mtdblock0  (driver?)
[    6.544068] 1f01            1024 mtdblock1  (driver?)
[    6.549116] 1f02             896 mtdblock2  (driver?)
[    6.554142] 1f03            4096 mtdblock3  (driver?)
[    6.559173] 1f04           16384 mtdblock4  (driver?)
[    6.564198] 1f05           16384 mtdblock5  (driver?)
[    6.569226] 1f06           16384 mtdblock6  (driver?)
[    6.574252] 1f07           59392 mtdblock7  (driver?)
[    6.579277] No filesystem could mount root, tried:  ubifs
[    6.584653] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    6.592887] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.50 #10
[    6.598798] [<8001334c>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[    6.607388] [<80011a14>] (show_stack+0x10/0x14) from [<8030c2ec>] (panic+0xa4/0x1e0)
[    6.615107] [<8030c2ec>] (panic+0xa4/0x1e0) from [<80421010>] (mount_block_root+0x2d8/0x2e4)
[    6.623517] [<80421010>] (mount_block_root+0x2d8/0x2e4) from [<8042123c>] (prepare_namespace+0xa8/0x1d4)
[    6.632970] [<8042123c>] (prepare_namespace+0xa8/0x1d4) from [<80420c1c>] (kernel_init_freeable+0x1b0/0x1c0)
[    6.642767] [<80420c1c>] (kernel_init_freeable+0x1b0/0x1c0) from [<8030b340>] (kernel_init+0xc/0x154)
[    6.651960] [<8030b340>] (kernel_init+0xc/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
What next?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,973
Reaction score
6,797
Location
Scotland
It looks like the file system is broken. It may be physical, or logical. Maybe logical if due to a wrong firmware update.
Do you have a copy of the firmware that was last working in the camera?

As an experiment, you could see how far you get by changing the kernel startup parameters.
But this
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
suggests you may not get far.
To try this:
Keep <return> pressed on the PC keyboard when using the serial TTL convertor as you power on the camera.
Hopefully you will get into the Amboot bootloader.
Use this command as an alternate, temporary boot:
boot mem=256M console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/bin/sh
And see if you get to a working root shell prompt.

Also - see if the Amboot bootloader has any built-in firmware update routines.
If it has - this would be the best way to recover, given access to a firmware file and suitable media or communications to transfer it in.
Use the 'help' command to explore.
 

mauzer

n3wb
Joined
Apr 2, 2016
Messages
20
Reaction score
2
It looks like the file system is broken. It may be physical, or logical. Maybe logical if due to a wrong firmware update.
Do you have a copy of the firmware that was last working in the camera?

As an experiment, you could see how far you get by changing the kernel startup parameters.
But this

suggests you may not get far.
To try this:
Keep <return> pressed on the PC keyboard when using the serial TTL convertor as you power on the camera.
Hopefully you will get into the Amboot bootloader.
Use this command as an alternate, temporary boot:
boot mem=256M console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/bin/sh
And see if you get to a working root shell prompt.

Also - see if the Amboot bootloader has any built-in firmware update routines.
If it has - this would be the best way to recover, given access to a firmware file and suitable media or communications to transfer it in.
Use the 'help' command to explore.
I got the Amboot, but with the command "boot mem=256M console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/bin/sh" the kernel panics also.

But now I think I totally bricked my camera with the command "setenv auto_boot 1" :(. Now camera writes nothing via serial at all...
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,973
Reaction score
6,797
Location
Scotland
It looks like the rootfs is broken or not accessible with a kernel panic. Presumably it complains about that just before.
I don't think your setenv auto_boot command will brick it.
 
Top