Dahua "IPC-HFW1220SP" BOOTLOOP??

rapsodi1 · Mar 29, 2021

The last 3 Dahua cameras that came to my service have the same problem. I can not understand it.

While the "Cat6" cable is plugged in, it is constantly trying to update via "TFTP". When I place the update files on "TFTP", it stays in this loop all the time. "Start-update-done-start-update-done"

When the "Cat6" cable is disconnected, it goes into a loop like this.

Code:

System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
fail to load partition.txt
fail to load partition file
fail to init partinfo
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Try again use backup_serverip
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Failed to get info.txt
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Fail to get partinfo
Fail get partition from backup.
Fail to get bakpartinfo
fail to get partinfo
resetting ...
                       


System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
fail to load partition.txt
fail to load partition file
fail to init partinfo
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Try again use backup_serverip
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Failed to get info.txt
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Fail to get partinfo
Fail get partition from backup.
Fail to get bakpartinfo
fail to get partinfo
resetting ...
                       


System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
fail to load partition.txt
fail to load partition file
fail to init partinfo
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Try again use backup_serverip
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Failed to get info.txt
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
Up/Down PHY not link.
Fail to get partinfo
Fail get partition from backup.
Fail to get bakpartinfo
fail to get partinfo
resetting ...

Anyone have any idea about the problem?

alastairstevenson · Mar 29, 2021

rapsodi1 said:
Anyone have any idea about the problem?

Some / all of the needed flash partitions have been erased or written with garbage.

Suggestion :
Interrupt the bootloader, and confirm with the 'partition' command.
Re-install the firmware.

rapsodi1 · Mar 30, 2021

alastairstevenson said:
Some / all of the needed flash partitions have been erased or written with garbage.

Suggestion :
Interrupt the bootloader, and confirm with the 'partition' command.
Re-install the firmware.

Thanku for answer

What is the exact code I need to write after disconnecting the bootloader.

alastairstevenson · Mar 30, 2021

rapsodi1 said:
What is the exact code I need to write after disconnecting the bootloader.

First use the
help
command to see what commands are available.
Then use
partition
to check the status of the partition information.
Then use
printenv
to check the pre-defined variables used to re-write the flash partitions from the firmware files that you've extracted and placed in the root folder of the tftp server.
Use
setenv ipaddress <camera_IP_address>
and
setenv serverip <tftp_server_IP_address>
to set the IP addresses as needed to connect to the tftp server on the PC.
Then use
run <xx>
for each of the firmware files you want to apply, ideally avoiding the bootloader.
For example (these will vary depending on the model of camera) :
run dk
run dp
run du
run dr
run dw
run dc
run pd
run sr
run sk

rapsodi1 · Mar 31, 2021

alastairstevenson said:
First use the
help
command to see what commands are available.
Then use
partition
to check the status of the partition information.
Then use
printenv
to check the pre-defined variables used to re-write the flash partitions from the firmware files that you've extracted and placed in the root folder of the tftp server.
Use
setenv ipaddress <camera_IP_address>
and
setenv serverip <tftp_server_IP_address>
to set the IP addresses as needed to connect to the tftp server on the PC.
Then use
run <xx>
for each of the firmware files you want to apply, ideally avoiding the bootloader.
For example (these will vary depending on the model of camera) :
run dk
run dp
run du
run dr
run dw
run dc
run pd
run sr
run sk

I can't stop whatever key I press. rx tx connections are correct. I can understand this as it gives the command "abort" because I pressed the CTRL+C key when it entered the load loop. but always trying to download from tftp. I have to stop this loop to be able to enter commands to this.

Do you know any other way I can stop the loop?

I can stop loading with the CTRL+C keys. but I can't stop the cycle. The video is attached .. can you review?

alastairstevenson · Mar 31, 2021

rapsodi1 said:
Do you know any other way I can stop the loop?

Suggestion :
Try keeping the * key (Shift 8) pressed so it autorepeats, and then power up the camera.

rapsodi1 · Mar 31, 2021

alastairstevenson said:
Suggestion :
Try keeping the * key (Shift 8) pressed so it autorepeats, and then power up the camera.

Here are putty's answers to me

Code:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.03.31 16:35:28 =~=~=~=~=~=~=~=~=~=~=~=
s partition
fail to load partition.txt
fail to load partition file
partition isn't exist
> printenv
bootargs=mem=47M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
bootcmd=kload 0x82000000; bootm 0x82000000
bootdelay=1
baudrate=115200
ethaddr=00:13:34:56:78:9A
ipaddr=192.168.1.108
serverip=192.168.1.1
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
wifiaddr=00:12:34:56:78:91
ID=000000000000000000
da=tftp 0x82000000 dhboot.bin.img;     flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x82000000 kernel.img; flwrite
du=tftp 0x82000000 user-x.squashfs.img; flwrite
dw=tftp 0x82000000 web-x.squashfs.img; flwrite
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite
up=tftp 0x82000000 update.img; flwrite
tk=tftp 0x82000000 uImage; bootm
dh_keyboard=1
appauto=1
loglevel=4
pd=tftp 0x82000000 pd-x.squashfs.img; flwrite
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)

Environment size: 946/262140 bytes
> setenv ipadr  ddr    dress 192.168.1.108
> setenv serverip 192.168.1.1
> run dk
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.1; our IP address is 192.168.1.108
Download Filename 'kernel.img'.
Download to address: 0x82000000
Downloading: *T T
Abort
> p setenv serverip 192.168.254.254
> run dk
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'kernel.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 1558640 (17c870 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   kernel
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1558576 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 4%
write : 8%
write : 12%
write : 16%
write : 20%
write : 25%
write : 29%
write : 33%
write : 37%
write : 41%
write : 45%
write : 50%
write : 54%
write : 58%
write : 62%
write : 66%
write : 70%
write : 75%
write : 79%
write : 83%
write : 87%
write : 91%
write : 95%
write : 100%
done
> run pd  dp
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'partition-x.cramfs.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   partition
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 000e0000
   Entry Point:  000f0000
   Verifying Checksum ... OK
Programing start at: 0x000e0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 100%
done
> run du
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'user-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *##############################len bad 50 < 1500
###################
done
Bytes transferred = 8290368 (7e8040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   user
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    8290304 Bytes = 7.9 MiB
   Load Address: 005d0000
   Entry Point:  00e00000
   Verifying Checksum ... OK
Programing start at: 0x005d0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 0%
write : 1%
write : 2%
write : 3%
write : 3%
write : 4%
write : 5%
write : 6%
write : 7%
write : 7%
write : 8%
write : 9%
write : 10%
write : 11%
write : 11%
write : 12%
write : 13%
write : 14%
write : 14%
write : 15%
write : 16%
write : 17%
write : 18%
write : 18%
write : 19%
write : 20%
write : 21%
write : 22%
write : 22%
write : 23%
write : 24%
write : 25%
write : 25%
write : 26%
write : 27%
write : 28%
write : 29%
write : 29%
write : 30%
write : 31%
write : 32%
write : 33%
write : 33%
write : 34%
write : 35%
write : 36%
write : 37%
write : 37%
write : 38%
write : 39%
write : 40%
write : 40%
write : 41%
write : 42%
write : 43%
write : 44%
write : 44%
write : 45%
write : 46%
write : 47%
write : 48%
write : 48%
write : 49%
write : 50%
write : 51%
write : 51%
write : 52%
write : 53%
write : 54%
write : 55%
write : 55%
write : 56%
write : 57%
write : 58%
write : 59%
write : 59%
write : 60%
write : 61%
write : 62%
write : 62%
write : 63%
write : 64%
write : 65%
write : 66%
write : 66%
write : 67%
write : 68%
write : 69%
write : 70%
write : 70%
write : 71%
write : 72%
write : 73%
write : 74%
write : 74%
write : 75%
write : 76%
write : 77%
write : 77%
write : 78%
write : 79%
write : 80%
write : 81%
write : 81%
write : 82%
write : 83%
write : 84%
write : 85%
write : 85%
write : 86%
write : 87%
write : 88%
write : 88%
write : 89%
write : 90%
write : 91%
write : 92%
write : 92%
write : 93%
write : 94%
write : 95%
write : 96%
write : 96%
write : 97%
write : 98%
write : 99%
write : 100%
done
> run dr
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 1364032 (14d040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   romfs
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1363968 Bytes = 1.3 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 4%
write : 9%
write : 14%
write : 19%
write : 23%
write : 28%
write : 33%
write : 38%
write : 42%
write : 47%
write : 52%
write : 57%
write : 61%
write : 66%
write : 71%
write : 76%
write : 80%
write : 85%
write : 90%
write : 95%
write : 100%
done
> run dw
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'web-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 2121792 (206040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   web
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    2121728 Bytes = 2 MiB
   Load Address: 003c0000
   Entry Point:  005d0000
   Verifying Checksum ... OK
Programing start at: 0x003c0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 3%
write : 6%
write : 9%
write : 12%
write : 15%
write : 18%
write : 21%
write : 24%
write : 27%
write : 30%
write : 33%
write : 36%
write : 39%
write : 42%
write : 45%
write : 48%
write : 51%
write : 54%
write : 57%
write : 60%
write : 63%
write : 66%
write : 69%
write : 72%
write : 75%
write : 78%
write : 81%
write : 84%
write : 87%
write : 90%
write : 93%
write : 96%
write : 100%
done
> run dc
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'custom-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 45120 (b040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   custom
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    45056 Bytes = 44 KiB
   Load Address: 00eb0000
   Entry Point:  00ed0000
   Verifying Checksum ... OK
Programing start at: 0x00eb0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 100%
done
> run pd
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'pd-x.squashfs.img'.
Download to address: 0x82000000
Downloading: *#################################################
done
Bytes transferred = 61504 (f040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   pd
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    61440 Bytes = 60 KiB
   Load Address: 00ea0000
   Entry Point:  00eb0000
   Verifying Checksum ... OK
Programing start at: 0x00ea0000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device

write : 0%
write : 0%
write : 100%
done
> run sr
## Error: "sr" not defined
> run sk
## Error: "sk" not defined
>

rapsodi1 · Mar 31, 2021

I get the following responses to the "partition" command

fail to load partition.txt
fail to load partition file
partition isn't exist

alastairstevenson · Mar 31, 2021

I'd have expected those partition installs too have brought it back to life.
As an all or nothing last try could maybe try the full update.

But before that -
I'd have expected to see the HWID environment variable - it seems to be missing.
That holds an important value that the firmware user - the model number.
You could pull out the needed value from the partition.txt files and add it to the bootloader variables.

Are you sure you're using the right firmware for the device?
Also check the contents of the Install.img file to confirm there hasn't been an install missed. Apart from the dh-boot which is usually best left alone.

rapsodi1 · Mar 31, 2021

alastairstevenson said:
As an all or nothing last try could maybe try the full update.

how do i do this??

alastairstevenson said:
But before that -
You could pull out the needed value from the partition.txt files and add it to the bootloader variables.

How can I access the partition.txt file? and how can I add it to the botloader?

alastairstevenson said:
Are you sure you're using the right firmware for the device?

yep I'm sure I'm using the right software

alastairstevenson said:
Also check the contents of the Install.img file to confirm there hasn't been an install missed. Apart from the dh-boot which is usually best left alone.

I have not done this before. Can you help me on how I can do this?

I'm sorry .. I'm taking your time. but thanks to you I am learning a lot. I hope you help

alastairstevenson · Mar 31, 2021

rapsodi1 said:
how do i do this??

Using the update.img and the 'run up' command in the bootloader.
See below.
But only as a last resort.

Code:

da=tftp 0x82000000 dhboot.bin.img;     flwrite;tftp dhboot-min.bin.img;flwrite
dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite
dk=tftp 0x82000000 kernel.img; flwrite
du=tftp 0x82000000 user-x.squashfs.img; flwrite
dw=tftp 0x82000000 web-x.squashfs.img; flwrite
dp=tftp 0x82000000 partition-x.cramfs.img;flwrite
dc=tftp 0x82000000 custom-x.squashfs.img; flwrite
up=tftp 0x82000000 update.img; flwrite
tk=tftp 0x82000000 uImage; bootm

rapsodi1 said:
How can I access the partition.txt file? and how can I add it to the botloader?

It's in the partition-x.cramfs.img and hwid extracts of the firmware.
If this is the correct firmware for your cameras (it does match the model number you've quoted), see the attached files.

Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide

Dahua Technology

www.dahuasecurity.com

rapsodi1 said:
yep I'm sure I'm using the right software

Is that the same firmware, above ?

then the image file holds this - but it does not hold quite the same model number :

Code:

#每行参数以\结束 每行以回车结束
#bootargs参数放在""中
#hwid     bootargs参数
IPC-HFW2120M:01:02:02:38:1D:00:01:00:00:00:00:21C:00:00:00:00:00:00:00:00:40\     "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HDBW1020E-S3:01:02:05:49:1D:00:01:00:00:00:00:21C:00:00:00:00:00:00:00:00:40\     "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HFW2220M:01:02:02:4F:1E:00:01:00:00:00:00:258:00:00:00:00:00:01:00:00:100\     "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HFW2220M-S:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100\     "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HFW2220M-AS:01:02:02:4F:1E:00:01:0A:01:01:04:258:03:00:00:00:00:01:00:00:100\     "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HFW2220M:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100\     "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"
IPC-HDW2120C-A:01:02:05:38:1D:00:01:10:01:00:00:21C:00:00:00:00:00:00:00:00:40\    "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs"

"bootargsParameter.text file end"

rapsodi1 said:
how can I add it to the botloader?

If you can find the correct value for the missing HWID from the right firmware, the way to add it would be as follows, taking the values from the bootargs file in the partition.img:

Code:

setenv HWID IPC-HFW2220M-S:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100
saveenv

To erase the added HWID value, use
setenv HWID
saveenv

rapsodi1 · Apr 1, 2021

alastairstevenson said:
Using the update.img and the 'run up' command in the bootloader.
See below.
But only as a last resort.

Code:

da=tftp 0x82000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwrite dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite dk=tftp 0x82000000 kernel.img; flwrite du=tftp 0x82000000 user-x.squashfs.img; flwrite dw=tftp 0x82000000 web-x.squashfs.img; flwrite dp=tftp 0x82000000 partition-x.cramfs.img;flwrite dc=tftp 0x82000000 custom-x.squashfs.img; flwrite up=tftp 0x82000000 update.img; flwrite tk=tftp 0x82000000 uImage; bootm

It's in the partition-x.cramfs.img and hwid extracts of the firmware.
If this is the correct firmware for your cameras (it does match the model number you've quoted), see the attached files.

Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide

Dahua Technology

www.dahuasecurity.com

Is that the same firmware, above ?

then the image file holds this - but it does not hold quite the same model number :

Code:

#每行参数以\结束每行以回车结束 #bootargs参数放在""中 #hwid bootargs参数 IPC-HFW2120M:01:02:02:38:1D:00:01:00:00:00:00:21C:00:00:00:00:00:00:00:00:40\ "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HDBW1020E-S3:01:02:05:49:1D:00:01:00:00:00:00:21C:00:00:00:00:00:00:00:00:40\ "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HFW2220M:01:02:02:4F:1E:00:01:00:00:00:00:258:00:00:00:00:00:01:00:00:100\ "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HFW2220M-S:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100\ "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HFW2220M-AS:01:02:02:4F:1E:00:01:0A:01:01:04:258:03:00:00:00:00:01:00:00:100\ "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HFW2220M:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100\ "mem=128M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" IPC-HDW2120C-A:01:02:05:38:1D:00:01:10:01:00:00:21C:00:00:00:00:00:00:00:00:40\ "mem=44M console=ttyS0,115200 root=/dev/mtdblock4 rootfstype=squashfs" "bootargsParameter.text file end"

If you can find the correct value for the missing HWID from the right firmware, the way to add it would be as follows, taking the values from the bootargs file in the partition.img:

Code:

setenv HWID IPC-HFW2220M-S:01:02:02:4F:1E:00:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100 saveenv

To erase the added HWID value, use
setenv HWID
saveenv

I think we got the partition files taken care of. does not bootloop anymore.

but I can't run the "run up" command. because I can't find the "update.img" file.

Where can I find this file?

Code:

System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
partition file version 2
rootfstype squashfs root /dev/mtdblock6
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: #################################################
done
Bytes transferred = 244 (f4 hex)
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'romfs-x.squashfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 7315520 (6fa040 hex)

## Checking Image at 82000000 ...
   Legacy image found
   Image Name:   romfs
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    7315456 Bytes = 7 MiB
   Load Address: 00520000
   Entry Point:  00d60000
   Verifying Checksum ... OK
Programing start at: 0x00520000
SPI probe: 16384 KiB hi_fmc at 0:0 is now current device
write : 100%
done
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
Up/Down PHY not link.
cmd Failed run dk!
partition file version 2
rootfstype squashfs root /dev/mtdblock6
fail to parse HWID
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=47M console=ttyS0,115200 root=/dev/mtdblock6 rootfstype=squashfs
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
TFTP error: (1)'File not found'
Not retrying...
All Node has released
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1069120 Bytes = 1 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock6
fail to parse HWID
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=47M console=ttyS0,115200 root=/dev/mtdblock6 rootfstype=squashfs

Starting kernel ...
Uncompressing Linux... done, booting the kernel.

alastairstevenson · Apr 1, 2021

What did you do to fix the bootloop?
Is the camera working normally now?

The update.img file isn't in all the firmware versions, only in some of them.
It looks like you don't need it now.

rapsodi1 · Apr 1, 2021

alastairstevenson said:
What did you do to fix the bootloop?
Is the camera working normally now?

The update.img file isn't in all the firmware versions, only in some of them.
It looks like you don't need it now.

actually I haven't done much.

I copied all the files you provided to the "dahua tft server / root" folder. I updated it again. There were missing firmware files you threw. I guess this is due to the incompatibility of the firmware of the camera. I moved the missing file from my other firmware to the root folder. I restarted. Completed. and the partition file seems to have been repaired.

the camera does not receive ip. There are many peket without ip address in Wireshark.

currently the only error is HWID. It will work if we can figure it out.

how can i find a hwid file for this camera?

rapsodi1 · Apr 1, 2021

Code:

partition file version 2
rootfstype squashfs root /dev/mtdblock6
fail to parse HWID
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=47M console=ttyS0,115200 root=/dev/mtdblock6 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

The"partition-x.cramfs.img" in the file you posted , worked

we just need to fix HWID problem. everything looks healthy

---

this is partition command

Code:

> partition
            name    cs   offset             size               flag   fs_flags                                                                                                                                                                   fs_type
          U-Boot    0 0x0000000000080000 0x0000000000040000 0x00000000 0x0000000                                                                                                                                                             0 0x00000000
            hwid    0 0x00000000000c0000 0x0000000000040000 0x00000000 0x0000000                                                                                                                                                             0 0x00000000
       partition    0 0x0000000000100000 0x0000000000040000 0x00000000 0x0000000                                                                                                                                                             1 0x00000001
         product    0 0x0000000000140000 0x0000000000040000 0x00000000 0x0000000                                                                                                                                                             1 0x00000002
          Kernel    0 0x0000000000180000 0x0000000000160000 0x00000000 0x0000000                                                                                                                                                             0 0x00000000
             web    0 0x00000000002e0000 0x0000000000240000 0x00000000 0x0000000                                                                                                                                                             1 0x00000002
           romfs    0 0x0000000000520000 0x0000000000840000 0x00000000 0x0000000                                                                                                                                                             1 0x00000002
             fpn    0 0x0000000000d60000 0x0000000000180000 0x00000000 0x0000000                                                                                                                                                             3 0x00000004
          syslog    0 0x0000000000ee0000 0x0000000000060000 0x00000000 0x0000000                                                                                                                                                             3 0x00000004
          config    0 0x0000000000f40000 0x0000000000060000 0x00000000 0x0000000                                                                                                                                                             3 0x00000004
          backup    0 0x0000000000fa0000 0x0000000000060000 0x00000000 0x0000000                                                                                                                                                             3 0x00000004
          U-Boot mountcmd:
            hwid mountcmd:
       partition mountcmd:
         product mountcmd:mount /dev/mtdblock3 /mnt/pd/
          Kernel mountcmd:
             web mountcmd:mount /dev/mtdblock5 /mnt/web/
           romfs mountcmd:
             fpn mountcmd:mnt_jffs2 /dev/mtdblock7  /mnt/fpn jffs2
          syslog mountcmd:mnt_jffs2 /dev/mtdblock8  /mnt/syslog jffs2
          config mountcmd:mnt_jffs2 /dev/mtdblock9 /mnt/mtd jffs2
          backup mountcmd:mnt_jffs2 /dev/mtdblock10 /mnt/backup jffs2

rapsodi1 · Apr 1, 2021

I updated it with a different update file now. this is the result. the camera does not receive ip. I can't reach camera web interface

Code:

System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
Fail to get uboot hd.
partition file version 2
rootfstype squashfs root /dev/mtdblock7
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
Retry count exceeded; starting again
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.0.8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1320172 Bytes = 1.3 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=47M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.

alastairstevenson · Apr 1, 2021

If you want to see the detail after the kernel starts, use

Code:

setenv dh_keyboard 0
saveenv

at the bootloader.
It may show the IP address that's been configured.

rapsodi1 said:
I can't reach camera web interface

Have you tried using the Dahua 'config tool' to find the camera on the network?
Also - if there is a
cfgRestore
command in the bootloader, the IP address will go to the default value of 192.168.1.108

rapsodi1 · Apr 1, 2021

alastairstevenson said:
If you want to see the detail after the kernel starts, use

Code:

setenv dh_keyboard 0 saveenv

at the bootloader.
It may show the IP address that's been configured.

Have you tried using the Dahua 'config tool' to find the camera on the network?
Also - if there is a
cfgRestore
command in the bootloader, the IP address will go to the default value of 192.168.1.108

I did these now I am getting this answer.

I cannot ping the camera. While trying to connect to tftp at boot, it pings for 1 second. no ping after power on

Code:

System startup


U-Boot 2010.06-svn3105 (Mar 11 2017 - 10:27:44)
DRAM:  64 MiB
gBootLogPtr:80b80008.
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc8 0x40 0x18
Block:64KB Chip:16MB Name:"GD25Q128"
SPI Nor total size: 16MB
hifmc100_get_erasesize:10000.
Fail to get uboot hd.
partition file version 2
rootfstype squashfs root /dev/mtdblock6
In:    serial
Out:   serial
Err:   serial
TEXT_BASE:81000000
fail to get updateflag partition info
fail to get updateflag partition info
Fail get partition from backup.
get backup part info failedfail to get backup updateflag partition info
fail to get updateflag offset and size
Hisilicon ETH net controler
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'upgrade_info_7db780a713a4.txt'.
Download to address: 0x84000000
Downloading: *
Retry count exceeded; starting again
Try again use backup_serverip
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
*** ERROR: `serverip' not set
Failed to get info.txt
Fail to get info file!
Init error!
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC:   00-13-34-56-78-9A
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1
Download Filename 'failed.txt'.
Download to address: 0x82000000
Downloading: *
Retry count exceeded; starting again
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1069120 Bytes = 1 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ...OK
OK
partition file version 2
rootfstype squashfs root /dev/mtdblock6
fail to parse HWID
fail to parse bootargsParameters.text info
get bootargs info failed
cmdLine mem=47M console=ttyS0,115200 root=/dev/mtdblock6 rootfstype=squashfs
crashflasg:1, logmagic:54410011.

Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
gLogRamRes: start=0x82eb7000;size=0x47000
mem_relimitAddr:0x82efe000
console [ttyS0] enabled

alastairstevenson · Apr 1, 2021

rapsodi1 said:
I did these now I am getting this answer.

The camera is not booting.
Maybe the wrong firmware, maybe not correct HWID.

rapsodi1 · Apr 1, 2021

I guess the only problem is it is not hwid ..

The camera will be garbage until I find the proper hwid .. what a pity ..

you are a perfect man thanks for your help

Search

Dahua "IPC-HFW1220SP" BOOTLOOP??

rapsodi1

Young grasshopper

alastairstevenson

rapsodi1

Young grasshopper

alastairstevenson

rapsodi1

Young grasshopper

Attachments

alastairstevenson

rapsodi1

Young grasshopper

rapsodi1

Young grasshopper

alastairstevenson

rapsodi1

Young grasshopper

alastairstevenson

Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide

Attachments

rapsodi1

Young grasshopper

Dahua Technology - World-leading Video-centric AIoT Solution and Service Provide

alastairstevenson

rapsodi1

Young grasshopper

rapsodi1

Young grasshopper

rapsodi1

Young grasshopper

alastairstevenson

rapsodi1

Young grasshopper

alastairstevenson

rapsodi1

Young grasshopper