Bricked Longse (Herospeed) camera

capstano · Jan 11, 2017

Hi all,
I've bricked a Longse (Herospeed) mini bullet camera 2.0Mpx loading a wrong firmware:
uploaded version s2l33m_imx322_ptz_x_5.1.48.4 instead of version s2l33m_imx322_x_5.1.48.4.
Camera is not working.
Tried to upload correct version using IP Search tool and through web browser (camera web server is online): both stuck at 81% and "update failed!".
Telnet connection with root access is still possible.

Anyone has some suggestion?

Thank you.

alastairstevenson · Jan 11, 2017

With telnet access it should be possible to fix up whatever the problem is - once the cause has been determined, if that's easily possible.
Do you get any useful info with 'dmesg' or has it been overwritten with routine messages?
I presume you've rebooted the camera.
From what I can see, the upgrade process may be 2-step
First the firmware file is downloaded and extracted and stored in flash memory, and an 'upgrade' flag set.
Then the camera reboots and processes the upgrade file, determining what type of update is being done.
One suggestion, without much foundation, but I don't think it would be very risky :
See if there is a file /hs/upgrade/upgrade_hs.tar.gzip or any others.
ls -al /hs/upgrade
If so, delete it
rm /hs/upgrade/upgrade_hs.tar.gzip
Reboot the camera and see if the normal update behaves better.

Just for interest, this is probably what you have under /usr/local/bin/upgrade.sh

Code:

#!/bin/sh

#####################################################################
## the default parameters of mtd script is A5s ipcam
## if the board type is different,
## customer must following the virtual status to modify it.
## if the MTD tool is diff, it must necessory to modify the update part.
#####################################################################
ORIGNAL_ROOTFS="lnx"
SECOND_ROOTFS="add"
KERNEL_MTD="pri"
USER_MTD="add"
KERNEL_START_ADDR="0xc0208000"
MTD_ERASE="flash_eraseall"
#MTD_WRITE="nandwrite"
MTD_WRITE="upgrade_partition"
MTD_CMDLINE_OPTION="cmd"

####################################################################
## the default image file path in current directory
####################################################################

IMAGE_DIR="/hs/upgrade/"
DEFAULT_KERNEL_IMAGE_PATH="${IMAGE_DIR}ubifs_kernel"
DEFAULT_ROOTFS_IMAGE_PATH="${IMAGE_DIR}ubifs_rootfs"
DEFAULT_USERFS_IMAGE_PATH="${IMAGE_DIR}ubifs_user"

GZIP_UPGRADE_FILE="/hs/upgrade/upgrade_hs.tar.gzip"
SECOND_IMAGE_DIR="/tmp/"
SECOND_KERNEL_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_kernel"
SECOND_ROOTFS_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_rootfs"
SECOND_USERFS_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_user"



##############################################
## check whether files exist
##############################################
check_kernel_file()
{
    if [ ! -r ${KERNEL_IMAGE_PATH} ] ; then
        echo "can't find Kernel image:${KERNEL_IMAGE_PATH}"
        return 1
    fi

#    /usr/bin/head ${KERNEL_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null
#    if [ 0 -ne $? ] ; then
#        echo "kernel image not ubifs:${KERNEL_IMAGE_PATH}"
#        return 1
#    fi
}

check_rootfs_file()
{
    if [ ! -r ${ROOTFS_IMAGE_PATH} ] ; then
        echo "can't find Rootfs image:${ROOTFS_IMAGE_PATH}"
        return 1
    fi

    /usr/bin/head ${ROOTFS_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null
    if [ 0 -ne $? ] ; then
        echo "rootfs image not ubifs:${ROOTFS_IMAGE_PATH}"
        return 1
    fi
}

check_userfs_file()
{
    if [ ! -r ${USERFS_IMAGE_PATH} ] ; then
        echo "can't find Rootfs image:${USERFS_IMAGE_PATH}"
        return 1
    fi

    /usr/bin/head ${USERFS_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null
    if [ 0 -ne $? ] ; then
        echo "user image not ubifs:${USERFS_IMAGE_PATH}"
        return 1
    fi
}


##############################################
## check rootfs size
##############################################
check_rootfs_size()
{
    MTD_CMD=`${MTD_WRITE} --show_fdt | grep bootargs`
    MTD_CMD=`echo ${MTD_CMD#*bootargs = }`
    ROOTFS_MTD=`echo ${MTD_CMD#*ubi.mtd=} | awk '{print $1}'`
    PREV_ROOTFS=${ROOTFS_MTD}
    if [ ${ROOTFS_MTD} == ${ORIGNAL_ROOTFS} ] ; then
        ROOTFS_MTD=${SECOND_ROOTFS}
    else
        ROOTFS_MTD=${ORIGNAL_ROOTFS}
    fi

    ROOTFS_MTD_NUM=`cat /proc/mtd | grep ${ROOTFS_MTD} | awk '{print $1}' | sed -e s/://`
    echo "${ROOTFS_MTD} is ${ROOTFS_MTD_NUM}"

    ROOTFS_SIZE=`cat /proc/mtd | grep ${ROOTFS_MTD} | awk '{print $2}'`
    echo $((ROOTFS_SIZE=0x${ROOTFS_SIZE}))
    ROOTFS_SIZE=`expr ${ROOTFS_SIZE} / 1024 / 1024`

    echo "${ROOTFS_MTD} size is ${ROOTFS_SIZE} M"

    ROOTFS_IMAGE_SIZE=`du -m ${ROOTFS_IMAGE_PATH} | awk '{print $1}'`
    echo "${ROOTFS_IMAGE_PATH} size is ${ROOTFS_IMAGE_SIZE} M"

    if [ ${ROOTFS_IMAGE_SIZE} -gt ${ROOTFS_SIZE} ] ; then
        echo "${ROOTFS_IMAGE_PATH} is larger than the partition size"
        exit 1
    fi
}

##############################################
##  check kernel size
##############################################
check_kernel_size()
{
    KERNEL_MTD_NUM=`cat /proc/mtd | grep ${KERNEL_MTD} | awk '{print $1}' | sed -e s/://`
    echo "${KERNEL_MTD} is ${KERNEL_MTD_NUM}"

    KERNEL_SIZE=`cat /proc/mtd | grep ${KERNEL_MTD} | awk '{print $2}'`
    echo $((KERNEL_SIZE=0x${KERNEL_SIZE}))
    KERNEL_SIZE=`expr ${KERNEL_SIZE} / 1024 / 1024`

    echo "${KERNEL_MTD} size is ${KERNEL_SIZE} M"

    KERNEL_IMAGE_SIZE=`du -m ${KERNEL_IMAGE_PATH} | awk '{print $1}'`
    echo "${KERNEL_IMAGE_PATH} size is ${KERNEL_IMAGE_SIZE} M"

    if [ ${KERNEL_IMAGE_SIZE} -gt ${KERNEL_SIZE} ] ; then
        echo "${KERNEL_IMAGE_PATH} is larger than the partition size"
        exit 1
    fi
}


##############################################
##  check user size
##############################################
check_userfs_size()
{
    USER_MTD_NUM=`cat /proc/mtd | grep ${USER_MTD} | awk '{print $1}' | sed -e s/://`
    echo "${USER_MTD} is ${USER_MTD_NUM}"

    USER_SIZE=`cat /proc/mtd | grep ${USER_MTD} | awk '{print $2}'`
    echo $((USER_SIZE=0x${USER_SIZE}))
    USER_SIZE=`expr ${USER_SIZE} / 1024 / 1024`

    echo "${USER_MTD} size is ${USER_SIZE} M"

    USER_IMAGE_SIZE=`du -m ${USERFS_IMAGE_PATH} | awk '{print $1}'`
    echo "${USERFS_IMAGE_PATH} size is ${USER_IMAGE_SIZE} M"

    if [ ${USER_IMAGE_SIZE} -gt ${USER_SIZE} ] ; then
        echo "${USERFS_IMAGE_PATH} is larger than the partition size"
        exit 1
    fi
}

##############################################
##  update user image
##############################################
update_userfs_image()
{
    echo "${MTD_ERASE} /dev/${USER_MTD_NUM}"
    ${MTD_ERASE} /dev/${USER_MTD_NUM}
    echo "${MTD_WRITE} -p --${USER_MTD} /dev/${USER_MTD_NUM} ${USERFS_IMAGE_PATH} -F 1"
    ${MTD_WRITE} -p --${USER_MTD} /dev/${USER_MTD_NUM} ${USERFS_IMAGE_PATH} -F 1
}

##############################################
##  update kernel image
##############################################
update_kernel_image()
{
    ${MTD_ERASE} /dev/${KERNEL_MTD_NUM}
    echo "${MTD_WRITE} -p --${KERNEL_MTD} -L ${KERNEL_START_ADDR} /dev/${KERNEL_MTD_NUM} ${KERNEL_IMAGE_PATH}"
    ${MTD_WRITE} -p --${KERNEL_MTD} -L ${KERNEL_START_ADDR} /dev/${KERNEL_MTD_NUM} ${KERNEL_IMAGE_PATH}
}

##############################################
## update rootfs image
##############################################
update_rootfs_image()
{
    if [ ${ROOTFS_MTD} == ${SECOND_ROOTFS} ] ; then
        echo "${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}"
        ${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}
        echo "${MTD_WRITE} -p --${SECOND_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1"
        ${MTD_WRITE} -p --${SECOND_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1
    else
        echo "${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}"
        ${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}
        echo "${MTD_WRITE} -p --${ORIGNAL_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1"
        ${MTD_WRITE} -p --${ORIGNAL_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1
    fi
}

##############################################
##     update cmdline
##############################################
update_cmdline()
{
    MTD_CMD=`echo ${MTD_CMD/${PREV_ROOTFS}/${ROOTFS_MTD}}`
    echo "${MTD_WRITE} --${MTD_CMDLINE_OPTION} ${MTD_CMD}"
    ${MTD_WRITE} --${MTD_CMDLINE_OPTION} "${MTD_CMD}"
}

##############################################
## update kernel function
##############################################
update_kernel()
{
#    check_kernel_file
    check_kernel_size
    update_kernel_image
}

##############################################
## update filesystem function
##############################################
update_rootfs()
{
#    check_rootfs_file
    check_rootfs_size
    update_rootfs_image
    update_cmdline
}

##############################################
## update user function
##############################################
update_userfs()
{
#    check_userfs_file
    check_userfs_size
    update_userfs_image
}

# return value:
# 0: userfs
# 1: failed
# 2: kernel
# 3: rootfs to add
# 4: rootfs to lnx
update_start()
{
    echo "update start....."
    if [ ! -r ${GZIP_UPGRADE_FILE} ] ; then
        echo "Not found ${GZIP_UPGRADE_FILE}"
#       exit 1
    else
        /usr/bin/head ${GZIP_UPGRADE_FILE} -c 4 | grep "UBI#" >> /dev/null
        if [ 0 -eq $? ] ; then
            # if the tar.gzip file is "UBI#" in head, then this file is ubifs_user.
            USERFS_IMAGE_PATH=${GZIP_UPGRADE_FILE}
            echo "####${GZIP_UPGRADE_FILE} is ubifs_user file."
        else
            KERNEL_IMAGE_PATH=${SECOND_KERNEL_IMAGE_PATH}
            ROOTFS_IMAGE_PATH=${SECOND_ROOTFS_IMAGE_PATH}
            USERFS_IMAGE_PATH=${SECOND_USERFS_IMAGE_PATH}

            tar -zxvf ${GZIP_UPGRADE_FILE} -C ${SECOND_IMAGE_DIR}
            if [ 0 -ne $? ] ; then
                echo "tar ${GZIP_UPGRADE_FILE} error."
                exit 1
            fi
        fi
    fi

        
    check_kernel_file
    if [ 0 -eq $? ] ; then
        update_kernel
        exit 2
    fi

    check_rootfs_file
    if [ 0 -eq $? ] ; then
        update_rootfs
        if [ ${ROOTFS_MTD} == ${SECOND_ROOTFS} ] ; then
            exit 3
        else
            exit 4
        fi
    fi

    check_userfs_file
    if [ 0 -eq $? ] ; then
        update_userfs
        exit 0
    fi

    exit 1
}

##############################################
## Load the image files
##############################################
if [ "$1" == "" ] ; then
    echo "usage:updateFW_test.sh [Kernel full image] [Rootfs image full path]"
    echo "example:"
    echo "    updateFW_test.sh /tmp/mmcblk0p1/Image /tmp/mmcblk0p1/ubifs"
    echo "    updateFW_test.sh --default    :Image and ubifs in the current directory"
    exit 1
else
    if [ "$1" == "--default" ] ; then
        KERNEL_IMAGE_PATH=${DEFAULT_KERNEL_IMAGE_PATH}
        ROOTFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}
        USERFS_IMAGE_PATH=${DEFAULT_USERFS_IMAGE_PATH}
    else
        KERNEL_IMAGE_PATH=${DEFAULT_KERNEL_IMAGE_PATH}
        ROOTFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}
        USERFS_IMAGE_PATH=$1
#        if [ "$2" != "" ] ; then
#            USERFS_IMAGE_PATH=$2
#        else
#            USERFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}
#        fi
    fi
fi


#####################################################################
## main function
##########################################################################
#update_kernel
#update_rootfs
#update_userfs
update_start

##############################################
## must reboot after finished update FW
##############################################
#reboot

capstano · Jan 11, 2017

Hi,
thank you for your reply.
Camera was rebooted (you're presuming right).
This is the output of dmesg command:

Code:

# dmesg

[ 0.000000] Booting Linux on physical CPU 0x0

[ 0.000000] Initializing cgroup subsys cpu

[ 0.000000] Linux version 3.10.73 (zucker@ubuntu) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #2 PREEMPT Mon Jun 15 21:05:42 CST 2015

[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d

[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instructio n cache

[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board

[ 0.000000] Memory policy: ECC disabled, Data cache writeback

[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0

[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0

[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9

[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0

[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0

[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0

[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0

[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000

[ 0.000000] On node 0 totalpages: 28160

[ 0.000000] free_area_init_node: node 0, pgdat 804af9d4, node_mem_map 804db00 0

[ 0.000000] Normal zone: 220 pages used for memmap

[ 0.000000] Normal zone: 0 pages reserved

[ 0.000000] Normal zone: 28160 pages, LIFO batch:7

[ 0.000000] CPU: All CPU(s) started in SVC mode.

[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768

[ 0.000000] pcpu-alloc: [0] 0

[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pag es: 27940

[ 0.000000] Kernel command line: console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs r w rootfstype=ubifs init=/linuxrc

[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)

[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

[ 0.000000] Memory: 110MB = 110MB total

[ 0.000000] Memory: 106600k/106600k available, 6040k reserved, 0K highmem

[ 0.000000] Virtual kernel memory layout:

vector : 0xffff0000 - 0xffff1000 ( 4 kB)

fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)

vmalloc : 0x87000000 - 0xff000000 (1920 MB)

lowmem : 0x80000000 - 0x86e00000 ( 110 MB)

modules : 0x7f000000 - 0x80000000 ( 16 MB)

.text : 0x80008000 - 0x8045eadc (4443 kB)

.init : 0x8045f000 - 0x80481f0c ( 140 kB)

.data : 0x80482000 - 0x804b66f8 ( 210 kB)

.bss : 0x804b66f8 - 0x804d658c ( 128 kB)

[ 0.000000] NR_IRQS:240

[ 0.000000] sched_clock: 32 bits at 36MHz, resolution 27ns, wraps every 11930 4ms

[ 0.000000] Console: colour dummy device 80x30

[ 0.000000] console [ttyS0] enabled

[ 0.232682] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)

[ 0.292605] pid_max: default: 32768 minimum: 301

[ 0.297294] Mount-cache hash table entries: 512

[ 0.304206] CPU: Testing write buffer coherency: ok

[ 0.309352] Setting up static identity map for 0x80342998 - 0x803429f8

[ 0.318140] devtmpfs: initialized

[ 0.322671] pinctrl core: initialized pinctrl subsystem

[ 0.328116] NET: Registered protocol family 16

[ 0.333327] DMA: preallocated 256 KiB pool for atomic coherent allocations

[ 0.340704] L310 cache controller enabled

[ 0.344704] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache siz e: 131072 B

[ 0.354266] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver regi stered

[ 0.362281] ambarella-gpio gpio.0: Ambarella GPIO driver registered

[ 0.372241] bio: create slab <bio-0> at 0

[ 0.377278] ambarella-dma e0005000.dma: Ambarella DMA Engine

[ 0.384380] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!

[ 9.389987] ambarella-i2c e8007000.i2c: No ACK from address 0xe8, 0:0!

[ 9.396503] pca953x 2-0074: failed reading register

[ 9.401392] pca953x: probe of 2-0074 failed with error -16

[ 9.406869] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!

[ 9.414251] Switching to clocksource ambarella-cs-timer

[ 9.425978] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000< ->0x06920000]

[ 9.434272] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000

[ 9.443143] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA

[ 9.519582] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz

[ 9.525581] NET: Registered protocol family 2

[ 9.533900] TCP established hash table entries: 1024 (order: 1, 8192 bytes)

[ 9.540996] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

[ 9.547372] TCP: Hash tables configured (established 1024 bind 1024)

[ 9.553802] TCP: reno registered

[ 9.557055] UDP hash table entries: 256 (order: 0, 4096 bytes)

[ 9.562923] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

[ 9.569353] NET: Registered protocol family 1

[ 9.574023] RPC: Registered named UNIX socket transport module.

[ 9.580011] RPC: Registered udp transport module.

[ 9.584723] RPC: Registered tcp transport module.

[ 9.589404] RPC: Registered tcp NFSv4.1 backchannel transport module.

[ 9.596208] ambarella-adc e801d000.adc: Ambarella ADC driver init

[ 9.604902] msgmni has been set to 208

[ 9.609988] NET: Registered protocol family 38

[ 9.614497] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2 52)

[ 9.622023] io scheduler noop registered

[ 9.625929] io scheduler deadline registered

[ 9.630227] io scheduler cfq registered (default)

[ 9.635565] ambarella-fb ambarella-fb.0: ambfb_probe: use prealloc.

[ 9.642129] ambarella-fb ambarella-fb.0: probe p[320x240] v[320x480] c[16] b[ 0] l[1280] @ [0x00100000:0x00100000]!

[ 9.652828] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart

[ 9.660624] brd: module loaded

[ 9.666210] loop: module loaded

[ 9.671967] ambarella-nand e0001000.nand: in ecc-[1]bit mode

[ 9.677611] ambarella_nand: Use On Flash BBT

[ 9.682012] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion N AND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64

[ 9.694698] Bad block table found at page 65472, version 0x01

[ 9.701678] Bad block table found at page 65408, version 0x01

[ 9.709693] 7 ofpart partitions found on MTD device amba_nand

[ 9.715448] Creating 7 MTD partitions on "amba_nand":

[ 9.720529] 0x000000000000-0x000000020000 : "bst"

[ 9.726054] 0x000000020000-0x000000160000 : "bld"

[ 9.731521] 0x000000160000-0x0000002a0000 : "ptb"

[ 9.736901] 0x0000002a0000-0x000000aa0000 : "pri"

[ 9.742359] 0x000000aa0000-0x000003ea0000 : "lnx"

[ 9.747727] 0x000003ea0000-0x0000058a0000 : "add"

[ 9.753139] 0x0000058a0000-0x000007ca0000 : "adc"

[ 9.760681] ambarella-spi e0020000.spi: cs1 >= max 1

[ 9.765638] spi_master spi0: spi_device register error /ahb@e0000000/spi@e002 0000/spidev@1

[ 9.774127] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[ 9.839510] libphy: Ambarella MII Bus: probed

[ 9.844383] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!

[ 9.854742] ambarella-eth e000e000.ethernet: MAC Address[00:00:1b:00:e8:8b].

[ 9.862119] mousedev: PS/2 mouse device common for all mice

[ 9.868029] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0

[ 9.875795] i2c /dev entries driver

[ 9.879996] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.

[ 9.887034] TCP: cubic registered

[ 9.890406] Initializing XFRM netlink socket

[ 9.894707] NET: Registered protocol family 17

[ 9.899234] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4

[ 9.906923] ThumbEE CPU extension supported.

[ 9.912299] UBI: attaching mtd4 to ubi0

[ 10.062092] UBI: scanning is finished

[ 10.071407] UBI: attached mtd4 (name "lnx", size 52 MiB) to ubi0

[ 10.077400] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 10.084219] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 10.090915] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 10.097764] UBI: good PEBs: 416, bad PEBs: 0, corrupted PEBs: 0

[ 10.103672] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128

[ 10.110796] UBI: max/mean erase counter: 11/1, WL threshold: 4096, image sequ ence number: 998301244

[ 10.119823] UBI: available PEBs: 0, total reserved PEBs: 416, PEBs reserved f or bad PEB handling: 20

[ 10.128933] UBI: background thread "ubi_bgt0d" started, PID 47

[ 10.134797] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06 :28:15 UTC (4294967295)

[ 10.145093] UBIFS: background thread "ubifs_bgt0_0" started, PID 48

[ 10.198347] UBIFS: mounted UBI device 0, volume 0, name "rootfs"

[ 10.204388] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes : 2048 bytes/2048 bytes

[ 10.213513] UBIFS: FS size: 48377856 bytes (46 MiB, 381 LEBs), journal size 9 023488 bytes (8 MiB, 72 LEBs)

[ 10.223147] UBIFS: reserved for root: 0 bytes (0 KiB)

[ 10.228183] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 9433F1E0-99F6- 4CA9-B9B3-6533EEA57425, small LPT model

[ 10.239956] VFS: Mounted root (ubifs filesystem) on device 0:12.

[ 10.246601] devtmpfs: mounted

[ 10.249755] Freeing unused kernel memory: 136K (8045f000 - 80481000)

[ 11.002503] systemd-udevd[186]: starting version 215

[ 11.821240] UBI: attaching mtd6 to ubi1

[ 12.082433] UBI: scanning is finished

[ 12.096913] UBI: attached mtd6 (name "adc", size 36 MiB) to ubi1

[ 12.102989] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 12.109775] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 12.116451] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 12.123313] UBI: good PEBs: 288, bad PEBs: 0, corrupted PEBs: 0

[ 12.129209] UBI: user volume: 2, internal volumes: 1, max. volumes count: 128

[ 12.136332] UBI: max/mean erase counter: 8202/5969, WL threshold: 4096, image sequence number: 528536732

[ 12.145793] UBI: available PEBs: 0, total reserved PEBs: 288, PEBs reserved f or bad PEB handling: 20

[ 12.154914] UBI: background thread "ubi_bgt1d" started, PID 229

[ 12.186824] UBIFS: background thread "ubifs_bgt1_1" started, PID 231

[ 12.235432] UBIFS: mounted UBI device 1, volume 1, name "upgrade"

[ 12.241551] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes : 2048 bytes/2048 bytes

[ 12.250677] UBIFS: FS size: 23744512 bytes (22 MiB, 187 LEBs), journal size 1 556480 bytes (1 MiB, 13 LEBs)

[ 12.260312] UBIFS: reserved for root: 0 bytes (0 KiB)

[ 12.265348] UBIFS: media format: w4/r0 (latest is w4/r0), UUID FC2832DE-A272- 4595-AD6B-3BACB46C5C57, small LPT model

[ 12.284231] UBIFS: background thread "ubifs_bgt1_0" started, PID 233

[ 12.338972] UBIFS: mounted UBI device 1, volume 0, name "param"

[ 12.344920] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes : 2048 bytes/2048 bytes

[ 12.354045] UBIFS: FS size: 7237632 bytes (6 MiB, 57 LEBs), journal size 1556 480 bytes (1 MiB, 13 LEBs)

[ 12.363421] UBIFS: reserved for root: 0 bytes (0 KiB)

[ 12.368458] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 62A2F0CC-C1B4- 4CCB-B7A2-3E8C325705CD, small LPT model

[ 12.393485] UBI: attaching mtd5 to ubi2

[ 12.469922] UBI: scanning is finished

[ 12.482477] UBI: attached mtd5 (name "add", size 26 MiB) to ubi2

[ 12.488472] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 12.495310] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 12.502007] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 12.508857] UBI: good PEBs: 208, bad PEBs: 0, corrupted PEBs: 0

[ 12.514766] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128

[ 12.521890] UBI: max/mean erase counter: 4288/2815, WL threshold: 4096, image sequence number: 2113237561

[ 12.531437] UBI: available PEBs: 0, total reserved PEBs: 208, PEBs reserved f or bad PEB handling: 20

[ 12.540559] UBI: background thread "ubi_bgt2d" started, PID 235

[ 12.570228] UBIFS: background thread "ubifs_bgt2_0" started, PID 237

[ 12.644589] UBIFS: mounted UBI device 2, volume 0, name "user"

[ 12.650453] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes : 2048 bytes/2048 bytes

[ 12.659578] UBIFS: FS size: 22093824 bytes (21 MiB, 174 LEBs), journal size 1 556480 bytes (1 MiB, 13 LEBs)

[ 12.669199] UBIFS: reserved for root: 0 bytes (0 KiB)

[ 12.674248] UBIFS: media format: w4/r0 (latest is w4/r0), UUID F8BC721E-922E- 4D8A-8860-815AFA5576B4, small LPT model

[ 12.767045] net eth0: adv: sym 0, asym: 0

[ 21.839514] ambarella-i2c e8003000.i2c: No ACK from address 0x25, 0:0!

[ 21.911646] dsp: module license 'Proprietary' taints kernel.

[ 21.917293] Disabling lock debugging due to kernel taint

[ 21.944269] img: IMG KERN VIRT: WR [0x87371000, 184 KB], RD [0x86060000, 36 K B].

[ 21.955493] Vout notice: vout0:0 probed!

[ 21.959820] Vout notice: vout1:1 probed!

[ 22.009232] hw_pts_init(103): HW timer for pts is enabled.

[ 22.009265] hw_pts_init(110): Audio clock freq: 12288000, HW timer clock freq : 90000!

[ 22.020545] VIN: vin0: probed!

[ 22.023792] VIN: vin1: probed!

[ 22.063442] Vout notice: CVBS:0@1 probed!

[ 22.112698] Vout notice: DBus-All:1@0 probed!

[ 22.117290] Vout notice: DBus-LCD:2@1 probed!

[ 22.158748] Vout error: ambhdmi_probe, 601

[ 22.229558] SYSCLK:SO[37125000]

[ 22.247453] VIN: IMX322-SPI init(parallel)

[ 22.275660] amba_debug_init 248:248.

[ 22.315744] dsplog dev init done, dev_id = 248:249.

[ 22.316877] dsplog_printk: DSP log by Timer New

Tried deleting upgrade_hs.tar.gzip, rebooted but no difference.
This is what is under /usr/local/bin/upgrade.sh
# cat /usr/local/bin/upgrade.sh

#!/bin/sh



#####################################################################

## the default parameters of mtd script is A5s ipcam

## if the board type is different,

## customer must following the virtual status to modify it.

## if the MTD tool is diff, it must necessory to modify the update part.

#####################################################################

ORIGNAL_ROOTFS="lnx"

SECOND_ROOTFS="add"

KERNEL_MTD="pri"

USER_MTD="add"

KERNEL_START_ADDR="0xc0208000"

MTD_ERASE="flash_eraseall"

#MTD_WRITE="nandwrite"

MTD_WRITE="upgrade_partition"

MTD_CMDLINE_OPTION="cmd"



####################################################################

## the default image file path in current directory

####################################################################



IMAGE_DIR="/hs/upgrade/"

DEFAULT_KERNEL_IMAGE_PATH="${IMAGE_DIR}ubifs_kernel"

DEFAULT_ROOTFS_IMAGE_PATH="${IMAGE_DIR}ubifs_rootfs"

DEFAULT_USERFS_IMAGE_PATH="${IMAGE_DIR}ubifs_user"



GZIP_UPGRADE_FILE="/hs/upgrade/upgrade_hs.tar.gzip"

SECOND_IMAGE_DIR="/tmp/"

SECOND_KERNEL_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_kernel"

SECOND_ROOTFS_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_rootfs"

SECOND_USERFS_IMAGE_PATH="${SECOND_IMAGE_DIR}ubifs_user"







##############################################

## check whether files exist

##############################################

check_kernel_file()

{

if [ ! -r ${KERNEL_IMAGE_PATH} ] ; then

echo "can't find Kernel image:${KERNEL_IMAGE_PATH}"

return 1

fi



# /usr/bin/head ${KERNEL_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null

# if [ 0 -ne $? ] ; then

# echo "kernel image not ubifs:${KERNEL_IMAGE_PATH}"

# return 1

# fi

}



check_rootfs_file()

{

if [ ! -r ${ROOTFS_IMAGE_PATH} ] ; then

echo "can't find Rootfs image:${ROOTFS_IMAGE_PATH}"

return 1

fi



/usr/bin/head ${ROOTFS_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null

if [ 0 -ne $? ] ; then

echo "rootfs image not ubifs:${ROOTFS_IMAGE_PATH}"

return 1

fi

}



check_userfs_file()

{

if [ ! -r ${USERFS_IMAGE_PATH} ] ; then

echo "can't find Rootfs image:${USERFS_IMAGE_PATH}"

return 1

fi



/usr/bin/head ${USERFS_IMAGE_PATH} -c 4 | grep "UBI#" >> /dev/null

if [ 0 -ne $? ] ; then

echo "user image not ubifs:${USERFS_IMAGE_PATH}"

return 1

fi

}





##############################################

## check rootfs size

##############################################

check_rootfs_size()

{

MTD_CMD=`${MTD_WRITE} --show_fdt | grep bootargs`

MTD_CMD=`echo ${MTD_CMD#*bootargs = }`

ROOTFS_MTD=`echo ${MTD_CMD#*ubi.mtd=} | awk '{print $1}'`

PREV_ROOTFS=${ROOTFS_MTD}

if [ ${ROOTFS_MTD} == ${ORIGNAL_ROOTFS} ] ; then

ROOTFS_MTD=${SECOND_ROOTFS}

else

ROOTFS_MTD=${ORIGNAL_ROOTFS}

fi



ROOTFS_MTD_NUM=`cat /proc/mtd | grep ${ROOTFS_MTD} | awk '{print $1}' | sed -e s/://`

echo "${ROOTFS_MTD} is ${ROOTFS_MTD_NUM}"



ROOTFS_SIZE=`cat /proc/mtd | grep ${ROOTFS_MTD} | awk '{print $2}'`

echo $((ROOTFS_SIZE=0x${ROOTFS_SIZE}))

ROOTFS_SIZE=`expr ${ROOTFS_SIZE} / 1024 / 1024`



echo "${ROOTFS_MTD} size is ${ROOTFS_SIZE} M"



ROOTFS_IMAGE_SIZE=`du -m ${ROOTFS_IMAGE_PATH} | awk '{print $1}'`

echo "${ROOTFS_IMAGE_PATH} size is ${ROOTFS_IMAGE_SIZE} M"



if [ ${ROOTFS_IMAGE_SIZE} -gt ${ROOTFS_SIZE} ] ; then

echo "${ROOTFS_IMAGE_PATH} is larger than the partition size"

exit 1

fi

}



##############################################

## check kernel size

##############################################

check_kernel_size()

{

KERNEL_MTD_NUM=`cat /proc/mtd | grep ${KERNEL_MTD} | awk '{print $1}' | sed -e s/://`

echo "${KERNEL_MTD} is ${KERNEL_MTD_NUM}"



KERNEL_SIZE=`cat /proc/mtd | grep ${KERNEL_MTD} | awk '{print $2}'`

echo $((KERNEL_SIZE=0x${KERNEL_SIZE}))

KERNEL_SIZE=`expr ${KERNEL_SIZE} / 1024 / 1024`



echo "${KERNEL_MTD} size is ${KERNEL_SIZE} M"



KERNEL_IMAGE_SIZE=`du -m ${KERNEL_IMAGE_PATH} | awk '{print $1}'`

echo "${KERNEL_IMAGE_PATH} size is ${KERNEL_IMAGE_SIZE} M"



if [ ${KERNEL_IMAGE_SIZE} -gt ${KERNEL_SIZE} ] ; then

echo "${KERNEL_IMAGE_PATH} is larger than the partition size"

exit 1

fi

}





##############################################

## check user size

##############################################

check_userfs_size()

{

USER_MTD_NUM=`cat /proc/mtd | grep ${USER_MTD} | awk '{print $1}' | sed -e s/://`

echo "${USER_MTD} is ${USER_MTD_NUM}"



USER_SIZE=`cat /proc/mtd | grep ${USER_MTD} | awk '{print $2}'`

echo $((USER_SIZE=0x${USER_SIZE}))

USER_SIZE=`expr ${USER_SIZE} / 1024 / 1024`



echo "${USER_MTD} size is ${USER_SIZE} M"



USER_IMAGE_SIZE=`du -m ${USERFS_IMAGE_PATH} | awk '{print $1}'`

echo "${USERFS_IMAGE_PATH} size is ${USER_IMAGE_SIZE} M"



if [ ${USER_IMAGE_SIZE} -gt ${USER_SIZE} ] ; then

echo "${USERFS_IMAGE_PATH} is larger than the partition size"

exit 1

fi

}



##############################################

## update user image

##############################################

update_userfs_image()

{

echo "${MTD_ERASE} /dev/${USER_MTD_NUM}"

${MTD_ERASE} /dev/${USER_MTD_NUM}

echo "${MTD_WRITE} -p --${USER_MTD} /dev/${USER_MTD_NUM} ${USERFS_IMAGE_PATH} -F 1"

${MTD_WRITE} -p --${USER_MTD} /dev/${USER_MTD_NUM} ${USERFS_IMAGE_PATH} -F 1

}



##############################################

## update kernel image

##############################################

update_kernel_image()

{

${MTD_ERASE} /dev/${KERNEL_MTD_NUM}

echo "${MTD_WRITE} -p --${KERNEL_MTD} -L ${KERNEL_START_ADDR} /dev/${KERNEL_MTD_NUM} ${KERNEL_IMAGE_PATH}"

${MTD_WRITE} -p --${KERNEL_MTD} -L ${KERNEL_START_ADDR} /dev/${KERNEL_MTD_NUM} ${KERNEL_IMAGE_PATH}

}



##############################################

## update rootfs image

##############################################

update_rootfs_image()

{

if [ ${ROOTFS_MTD} == ${SECOND_ROOTFS} ] ; then

echo "${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}"

${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}

echo "${MTD_WRITE} -p --${SECOND_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1"

${MTD_WRITE} -p --${SECOND_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1

else

echo "${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}"

${MTD_ERASE} /dev/${ROOTFS_MTD_NUM}

echo "${MTD_WRITE} -p --${ORIGNAL_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1"

${MTD_WRITE} -p --${ORIGNAL_ROOTFS} /dev/${ROOTFS_MTD_NUM} ${ROOTFS_IMAGE_PATH} -F 1

fi

}



##############################################

## update cmdline

##############################################

update_cmdline()

{

MTD_CMD=`echo ${MTD_CMD/${PREV_ROOTFS}/${ROOTFS_MTD}}`

echo "${MTD_WRITE} --${MTD_CMDLINE_OPTION} ${MTD_CMD}"

${MTD_WRITE} --${MTD_CMDLINE_OPTION} "${MTD_CMD}"

}



##############################################

## update kernel function

##############################################

update_kernel()

{

# check_kernel_file

check_kernel_size

update_kernel_image

}



##############################################

## update filesystem function

##############################################

update_rootfs()

{

# check_rootfs_file

check_rootfs_size

update_rootfs_image

update_cmdline

}



##############################################

## update user function

##############################################

update_userfs()

{

# check_userfs_file

check_userfs_size

update_userfs_image

}



# return value:

# 0: userfs

# 1: failed

# 2: kernel

# 3: rootfs to add

# 4: rootfs to lnx

update_start()

{

echo "update start....."

if [ ! -r ${GZIP_UPGRADE_FILE} ] ; then

echo "Not found ${GZIP_UPGRADE_FILE}"

# exit 1

else

/usr/bin/head ${GZIP_UPGRADE_FILE} -c 4 | grep "UBI#" >> /dev/null

if [ 0 -eq $? ] ; then

# if the tar.gzip file is "UBI#" in head, then this file is ubifs_user.

USERFS_IMAGE_PATH=${GZIP_UPGRADE_FILE}

echo "####${GZIP_UPGRADE_FILE} is ubifs_user file."

else

KERNEL_IMAGE_PATH=${SECOND_KERNEL_IMAGE_PATH}

ROOTFS_IMAGE_PATH=${SECOND_ROOTFS_IMAGE_PATH}

USERFS_IMAGE_PATH=${SECOND_USERFS_IMAGE_PATH}



tar -zxvf ${GZIP_UPGRADE_FILE} -C ${SECOND_IMAGE_DIR}

if [ 0 -ne $? ] ; then

echo "tar ${GZIP_UPGRADE_FILE} error."

exit 1

fi

fi

fi





check_kernel_file

if [ 0 -eq $? ] ; then

update_kernel

exit 2

fi



check_rootfs_file

if [ 0 -eq $? ] ; then

update_rootfs

if [ ${ROOTFS_MTD} == ${SECOND_ROOTFS} ] ; then

exit 3

else

exit 4

fi

fi



check_userfs_file

if [ 0 -eq $? ] ; then

update_userfs

exit 0

fi



exit 1

}



##############################################

## Load the image files

##############################################

if [ "$1" == "" ] ; then

echo "usage:updateFW_test.sh [Kernel full image] [Rootfs image full path]"

echo "example:"

echo " updateFW_test.sh /tmp/mmcblk0p1/Image /tmp/mmcblk0p1/ubifs"

echo " updateFW_test.sh --default :Image and ubifs in the current directory"

exit 1

else

if [ "$1" == "--default" ] ; then

KERNEL_IMAGE_PATH=${DEFAULT_KERNEL_IMAGE_PATH}

ROOTFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}

USERFS_IMAGE_PATH=${DEFAULT_USERFS_IMAGE_PATH}

else

KERNEL_IMAGE_PATH=${DEFAULT_KERNEL_IMAGE_PATH}

ROOTFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}

USERFS_IMAGE_PATH=$1

# if [ "$2" != "" ] ; then

# USERFS_IMAGE_PATH=$2

# else

# USERFS_IMAGE_PATH=${DEFAULT_ROOTFS_IMAGE_PATH}

# fi

fi

fi





#####################################################################

## main function

##########################################################################

#update_kernel

#update_rootfs

#update_userfs

update_start



##############################################

## must reboot after finished update FW

##############################################

#reboot

What's next?
Thank you.

alastairstevenson · Jan 11, 2017

Wow!
I (and the other readers) need to point you to the 'code' tags, the '+' sign when composing, to hold large amounts of code.
It's a pity the deletion of the extracted firmware contents didn't work - but it was a bit of a long shot.
I can see nothing wrong in the transcript above, but it's all about Linux and nothing about the camera application.

The camera presumably now has an inconsistency in the configuration - but I have to admit I'm not sure what the next step should be.
I have a vague recollection that Klasipca had a similar situation, and it was resolved, but I have been unable to find the posts that I think I remember.

capstano · Jan 12, 2017

Hi,
my fault now it's clear how to post code.
Googling I found something on a russian forum but module nandsim is not present on my camera.
Thank you.

Pow3r · Sep 10, 2019

Hi everyone! I just leave it here. Archive contains Ambarella tools and bin files of firmwares for s2l and a5s. It can help to recover Longse (Herospeed) IPC. Instructions included.
A200 USB burning tool.rar

ficu · Aug 29, 2022

Pow3r said:
Hi everyone! I just leave it here. Archive contains Ambarella tools and bin files of firmwares for s2l and a5s. It can help to recover Longse (Herospeed) IPC. Instructions included.
A200 USB burning tool.rar

Can anybody reupload this file?

Search

Bricked Longse (Herospeed) camera

capstano

n3wb

alastairstevenson

capstano

n3wb

alastairstevenson

capstano

n3wb

Pow3r

n3wb

ficu

n3wb