Hikvision - Clearing Passwords and/or Loading Firmware via TTL Serial

[mwoo68]

I can telnet into it

(none) login: root
Password:
login: can't chdir to home directory '/root/'
# help
Built-in commands:
------------------
        . : [ [[ bg break cd chdir command continue echo eval exec exit
        export false fg getopts hash help jobs kill let local pwd read
        readonly return set shift source test times trap true type ulimit
        umask unset wait

SADP now displays a camera. The firmware is no longer 5.1.6 as when originally purchased. See attachment.

I don't mind trying a few more things, as there does seem a glimmer of hope...

Well, that's an interesting result.
It confirms there is a problem with the flash memory of the camera.
But block 69 is into the unused space after the working part of the min-system recovery partition, so that specific failure isn't fatal in this case.


And it has brought the update facility back to life - it's working normally.

However - when the downloaded firmware is being written to the flash memory, there is another write flash failure.
This is in a different location from that used by the min-system recovery area.

So - what to do now, apart from trash the camera?
It depends on whether you want to spend any more time on exploration.

A simple and quick thing to try, though, would be to see what the bootup looks like now.
There is some resilience built in to the partitions needed for normal operation.
The kernel, root file system, application and configuration partitions are all duplicated with a primary and secondary area.
There are basic checks on bootup that switch between primary and secondary.
Try booting normally and see how it looks.

 

[alastairstevenson]

SADP now displays a camera. The firmware is no longer 5.1.6 as when originally purchased.

That's the 'min-system recovery environment', as shown in SADP, now working OK after your nandwrite command use.
It will provide more facilities to do things than the bootloader.
Did the camera boot straight in to it, or did it get there from another startup eg 'start to enter min system'?
Usually the flag that triggers a min-system reboot is automatically reset such that a subsequent boot doesn't try to go there.

There are various possible ways forward, though the problem with the failing flash may get in the way, depending on how widespread it is.
But there is a need to know more about the current status - we (or at least I) don't know what was last stored in the flash memory.
The last update process looked like it aborted.

So - I suggest taking advantage of the running min-system to grab some data that needs checked.
You will need the non-Hikvision tftp server running on the PC.
The PC IP address can be left as normal, no need to disturb it.
Lets assume for this example that the PC IP address is 192.168.1.100 - adjust below as needed.

Using the serial console, set the camera IP address to match the range that your PC is using.
Adjust the IP address to suit. This isn't a permanent change.
First see what is currently in use
ifconfig
Then change as needed, for example :
ifconfig eth0 192.168.1.200

Grab a copy of mtdblock6 and mtdblock1
To run firmware of 5.3.0 or over, the contents need to be correct or the camera will go to a bricked state.
cat /dev/mtd6ro > mtd6ro
tftp -p -l mtd6ro 192.168.1.100
rm mtd6ro
cat /dev/mtd1ro > mtd1ro
tftp -p -l mtd1ro 192.168.1.100
rm mtd1ro

Grab a copy of the app partition, to get an idea of the latest firmware loaded.
cat /dev/mtd13ro > mtd13ro
tftp -p -l mtd13ro 192.168.1.100
rm mtd13ro

If you could zip them up and attach here, I'll take a look at them and see if mtd6 and mtd1 need changes.

The next steps could be directly copying images of the kernel, root file system and app partitions to the camera primary and secondary areas.
How successful that will be depends on whether there are any flash problems in the associated locations.

 

[mwoo68]

See attached zip file and Putty results

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 30
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40301000
loading ./orccode.bin...addr = 0x40301000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40501000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x405a1000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system

# help
Built-in commands:
------------------
        . : [ [[ bg break cd chdir command continue echo eval exec exit
        export false fg getopts hash help jobs kill let local pwd read
        readonly return set shift source test times trap true type ulimit
        umask unset wait

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bst"
mtd1: 00100000 00020000 "ptb"
mtd2: 00100000 00020000 "bld"
mtd3: 00100000 00020000 "hal"
mtd4: 00100000 00020000 "ano_ptb"
mtd5: 00080000 00020000 "env"
mtd6: 00080000 00020000 "param"
mtd7: 00100000 00020000 "dpt"
mtd8: 00a00000 00020000 "rcvy"
mtd9: 00800000 00020000 "krn_pri"
mtd10: 00800000 00020000 "krn_sec"
mtd11: 00400000 00020000 "rmd_pri"
mtd12: 00400000 00020000 "rmd_sec"
mtd13: 01800000 00020000 "app_pri"
mtd14: 01800000 00020000 "app_sec"
mtd15: 00400000 00020000 "cfg_pri"
mtd16: 00400000 00020000 "cfg_sec"
mtd17: 01000000 00020000 "dbg"
# cat /dev/mtd6ro > mtd6ro
# tftp -p -l mtd6ro 192.0.0.128
[ INFO][MIN]TFTP: #####################
# rm mtd6ro
# cat /dev/mtd1ro > mtd1ro
# tftp -p -l mtd1ro 192.0.0.128
[ INFO][MIN]TFTP: ##########################################
# rm mtd1ro
# cat /dev/mtd13ro > mtd13ro
# tftp -p -l mtd13ro 192.0.0.128
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ########################
# rm mtd13ro
#

That's the 'min-system recovery environment', as shown in SADP, now working OK after your nandwrite command use.
It will provide more facilities to do things than the bootloader.
Did the camera boot straight in to it, or did it get there from another startup eg 'start to enter min system'?
Usually the flag that triggers a min-system reboot is automatically reset such that a subsequent boot doesn't try to go there.

There are various possible ways forward, though the problem with the failing flash may get in the way, depending on how widespread it is.
But there is a need to know more about the current status - we (or at least I) don't know what was last stored in the flash memory.
The last update process looked like it aborted.

So - I suggest taking advantage of the running min-system to grab some data that needs checked.
You will need the non-Hikvision tftp server running on the PC.
The PC IP address can be left as normal, no need to disturb it.
Lets assume for this example that the PC IP address is 192.168.1.100 - adjust below as needed.

Using the serial console, set the camera IP address to match the range that your PC is using.
Adjust the IP address to suit. This isn't a permanent change.
First see what is currently in use
ifconfig
Then change as needed, for example :
ifconfig eth0 192.168.1.200

Grab a copy of mtdblock6 and mtdblock1
To run firmware of 5.3.0 or over, the contents need to be correct or the camera will go to a bricked state.
cat /dev/mtd6ro > mtd6ro
tftp -p -l mtd6ro 192.168.1.100
rm mtd6ro
cat /dev/mtd1ro > mtd1ro
tftp -p -l mtd1ro 192.168.1.100
rm mtd1ro

Grab a copy of the app partition, to get an idea of the latest firmware loaded.
cat /dev/mtd13ro > mtd13ro
tftp -p -l mtd13ro 192.168.1.100
rm mtd13ro

If you could zip them up and attach here, I'll take a look at them and see if mtd6 and mtd1 need changes.

The next steps could be directly copying images of the kernel, root file system and app partitions to the camera primary and secondary areas.
How successful that will be depends on whether there are any flash problems in the associated locations.

 

[alastairstevenson]

See attached zip file and Putty results

That's good.
So that's a Chinese DS-2CD2532F-IWS mini-dome, with the brickfixV2 firmware installed, and a valid template in mtdblock1.
mtdblock6 needs the language byte changed and the checksum altered. The modded file is attached.

If you're up for it, we could try writing the needed partitions directly.
What's very likely, from what we've already seen, is to hit some flash failures, which may well mean the device cannot be recovered.
But not all the flash is used, and there is some resilience with the pri and sec copies.
I don't think there is much to lose in trying this, however, it's your choice whether to.

Here are the commands needed, and the files are attached here.
Lets assume the PC running the tftp server is on 192.168.1.100 and you can adjust the values below to suit your actual PC IP address.

Using the serial console, at the min-system shell prompt, set the camera IP address to match the range that your PC is using.
Adjust the IP address to suit. This isn't a permanent change.
First see what is currently in use
ifconfig
Then change as needed, for example :
ifconfig eth0 192.168.1.200

tftp -g -r mtd6ro_mod 192.168.1.100
cat mtd6ro_mod > /dev/mtdblock6
rm mtd6ro_mod

tftp -g -r mtd9ro 192.168.1.100
cat mtd9ro > /dev/mtdblock9
cat mtd9ro > /dev/mtdblock10
rm mtd9ro

tftp -g -r mtd11ro 192.168.1.100
cat mtd11ro > /dev/mtdblock11
cat mtd11ro > /dev/mtdblock12
rm mtd11ro

tftp -g -r mtd13ro 192.168.1.100
cat mtd13ro > /dev/mtdblock13
cat mtd13ro > /dev/mtdblock14
rm mtd13ro

reboot

 

[mwoo68]

I've been using camera 192.0.0.64 and PC as 192.0.0.128

I do not think there was any errors, but, there is a big but, after I entered 'reboot', it now just keeps rebooting continuously. I stopped it by entering ^U

My worry was should I have stopped it or let it keep rebooting???

# reboot
The system is going down NOW!
Sent SIGTERM to all processes
Terminated
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
ubiattach: error!: cannot attach mtd13
           error 22 (Invalid argument)
ubiattach -m 13 -d 1 /dev/ubi_ctrl failed!
run shell script fail, script exit code: 1
mount app0 is failed, now go to reboot!
ubiformat: mtd13 (nand), size 25165824 bytes (24.0 MiB), 192 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 191 -- 100 % complete
ubiformat: 191 eraseblocks have valid erase counter, mean value is 112
ubiformat: 1 bad eraseblocks found, numbers: 15
ubiformat: formatting eraseblock 191 -- 100 % complete
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 185 LEBs (23869440 bytes, 22.8 MiB), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1.
Set volume size to 23869440
Volume ID 0, size 185 LEBs (23869440 bytes, 22.8 MiB), LEB size 129024 bytes (126.0 KiB), dynamic, name "app_pri", alignment 1
waiting for /dev/ubi1_0.
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x1
Recovering ker from sec to pri partition ...
recover_mtd_partition: /dev/mtd10 -> /dev/mtd9
Reading image header from src mtd /dev/mtd10 ... Done.
crc32=0x32a461c7
img_len=5592644
mem_addr=0xc0208000
magic=0x4b45524e
Reading image from src mtd /dev/mtd10 ... Done.
Writing image to dst mtd /dev/mtd9 ... Done.
Recovering rmd from sec to pri partition ...
recover_mtd_partition: /dev/mtd12 -> /dev/mtd11
Reading image header from src mtd /dev/mtd12 ... Done.
crc32=0x39c15359
img_len=3052751
mem_addr=0xc0a00000
magic=0x524d444b
Reading image from src mtd /dev/mtd12 ... Done.
Writing image to dst mtd /dev/mtd11 ... Done.
Recovering app from sec to pri partition ...
ubiattach: error!: cannot attach mtd14
           error 22 (Invalid argument)
ubiattach -m 14 -d 2 /dev/ubi_ctrl failed!
run shell script fail, script exit code: 1
mount app1 is failed, now go to reboot!
ubiformat: mtd14 (nand), size 25165824 bytes (24.0 MiB), 192 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 191 -- 100 % complete
ubiformat: 191 eraseblocks have valid erase counter, mean value is 112
ubiformat: 1 bad eraseblocks found, numbers: 108
ubiformat: formatting eraseblock 191 -- 100 % complete
UBI device number 2, total 191 LEBs (24643584 bytes, 23.5 MiB), available 185 LEBs (23869440 bytes, 22.8 MiB), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi2.
Set volume size to 23869440
Volume ID 0, size 185 LEBs (23869440 bytes, 22.8 MiB), LEB size 129024 bytes (126.0 KiB), dynamic, name "app_sec", alignment 1
waiting for /dev/ubi2_0.
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
set_minisys_flag failure!
cat: read error: Invalid argument
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS #

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 30
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40275000
loading ./orccode.bin...addr = 0x40275000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40475000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x40515000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system


#
#
# tftp -g -r mtd6ro_mod 192.0.0.128
[ INFO][MIN]TFTP: #####################
# cat mtd6ro_mod > /dev/mtdblock6
# rm mtd6ro_mod
# tftp -g -r mtd9ro 192.0.0.128
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ########
# cat mtd9ro > /dev/mtdblock9
# cat mtd9ro > /dev/mtdblock10
# rm mtd9ro
# tftp -g -r mtd11ro 192.0.0.128
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ####
# cat mtd11ro > /dev/mtdblock11
# cat mtd11ro > /dev/mtdblock12
# rm mtd11ro
# tftp -g -r mtd13ro 192.0.0.128
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ########################
# cat mtd13ro > /dev/mtdblock13
# cat mtd13ro > /dev/mtdblock14
# rm mtd13ro
#

That's good.
So that's a Chinese DS-2CD2532F-IWS mini-dome, with the brickfixV2 firmware installed, and a valid template in mtdblock1.
mtdblock6 needs the language byte changed and the checksum altered. The modded file is attached.

If you're up for it, we could try writing the needed partitions directly.
What's very likely, from what we've already seen, is to hit some flash failures, which may well mean the device cannot be recovered.
But not all the flash is used, and there is some resilience with the pri and sec copies.
I don't think there is much to lose in trying this, however, it's your choice whether to.

Here are the commands needed, and the files are attached here.
Lets assume the PC running the tftp server is on 192.168.1.100 and you can adjust the values below to suit your actual PC IP address.

Using the serial console, at the min-system shell prompt, set the camera IP address to match the range that your PC is using.
Adjust the IP address to suit. This isn't a permanent change.
First see what is currently in use
ifconfig
Then change as needed, for example :
ifconfig eth0 192.168.1.200

tftp -g -r mtd6ro_mod 192.168.1.100
cat mtd6ro_mod > /dev/mtdblock6
rm mtd6ro_mod

tftp -g -r mtd9ro 192.168.1.100
cat mtd9ro > /dev/mtdblock9
cat mtd9ro > /dev/mtdblock10
rm mtd9ro

tftp -g -r mtd11ro 192.168.1.100
cat mtd11ro > /dev/mtdblock11
cat mtd11ro > /dev/mtdblock12
rm mtd11ro

tftp -g -r mtd13ro 192.168.1.100
cat mtd13ro > /dev/mtdblock13
cat mtd13ro > /dev/mtdblock14
rm mtd13ro

reboot

 

[alastairstevenson]

I do not think there was any errors,

No, the write of the flash partitions looked good, better than I'd expected.

My worry was should I have stopped it or let it keep rebooting???

Stopping was the correct thing to do.
That last reboot loop was permanent - it's the type of complaint when EN firmware is applied to a CN camera.
Which should not happen with the modded mtdblock6, so the underlying cause will be something else.
It looks like it thinks that the last attempted update failed.
That's a trigger to go into min-system mode.
I wonder if it's complaining due to mtdblock1 contents?

What was interesting was the bad block recovery and format process being done by the UBIFS file system.
That seems to have worked OK.
Then at the end of that it decides that an update has failed.

I think the next step could be a re-write using a donor of an mtdblock1 that has a record of the same version of firmware being successfully applied.
This can be done via the bootloader.

Leave it with me for now while I take a look at that.

 

[alastairstevenson]

I think the next step could be a re-write using a donor of an mtdblock1 that has a record of the same version of firmware being successfully applied.
This can be done via the bootloader.

OK - can you try this, at the bootloader, in the same way as you managed to recover the min-system environment, using the IP addresses set as required for the PC and the camera.
The needed file is attached.

tftpboot 0xc2000000 mtd1ro_donor
nandwrite 0xc2000000 1 0x100000
reset

And I'm keeping my fingers crossed that this will keep it happy.

 

[mwoo68]

Looping Stopped! See Putty. I don't want to jinx it. Await your next steps. I think you know, my end goal is to get it up and running with 5.4.5.....

HKVS # tftpboot 0xc2000000 mtd1ro_donor
[ INFO][BLD]TFTP: MAC: 44:19:b6:30:02:23
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'mtd1ro_donor'
[ INFO][BLD]TFTP: ##############
[ INFO][BLD]TFTP: File size is 1048576 bytes (1024 KB)
HKVS # nandwrite 0xc2000000 1 0x100000

start to program blocks
progress: 100%
done!
▒KVS # reset

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x2, sec_iUpgSuccCnt:0x2
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
starting pid 654, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

When I unplug the ethernet and plug it back in, this is what boots up: and when I enter Help, it shows a different set of commands???

As an FYI, I opened a DOS prompt to ping 192.0.0.64, and it is not reachable..

Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x2, sec_iUpgSuccCnt:0x2
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
starting pid 654, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
#
# help
Support Commands:
taskShow                        printPart                       prtHardInfo    
getPreviewStatus                setIp                           setV6ip        
setGateway                      dspStatus                       outputClose    
outputOpen                      getDebug                        setDebug      
debugLog                        getIrstate                      getMtu        
camCmd                          getCamVer                       getIrstate    
getLux                          getMcuInfo                      getMotion      
getRawdata                      setIrcmd                        setRectFrame  
updateCamera                    setLaserMode                    getLaserMode  
setIrMode                       getIrMode                       setBaiguangMode
getBaiguangMode                 setYTLock                       InquireFanSwitch
StartLaser                      CloseLaser                      LaserMotReset  
EnlargeCur                      ReduceCur                       SetCur        
LaserMotDirect                  LaserTeleOffset                 LaserWideOffset
InqSwitch                       InqCurrent                      InqCurMotDirect
getMcuStateInfo                 setFastFocus                    getTrackStatus
getSelfcheckResult              setLdcMode                      getLdcMode    
getPreviewStatus                appCmd                          camCmd        
ezoomlens_start_t2_test         prtLensCurve                    getLensCurve  
getIp                           gdbcfg                          {Test1}        
{Test2}                         {Test3}                         {Test4}        
{TestN}                         {TestY}                         getIsp        
getISP                          getisp                          setIsp        
setISP                          setisp                          regread        
regwrite                        setAgingMode                    getAgingMode  
setAgingTime                    getAgingTime                    setLensZoomPos
getLensZoomPos                  dm365                           ss            
showKey                         showServer                      showUpnp      
showStatus                      showDefence                     setLBS        
setAlarm                        cloudService                    t1            
ifconfig                        netstat                         ping          
ping6                           top                             iostat        
mpstat                          ps                              reset          
dmesg                           iwpriv                          exit          
getDateInfo                     diagnose                        help          
zhimakaimen
#

 

[alastairstevenson]

starting pid 654, tty '': '-/bin/psh' BusyBox v1.2.1-171136 Protect Shell (psh) Enter 'help' for a list of davinci system commands.

That's better!
'psh' is the 'protected shell', introduced in firmware 5.3.0 and later if I remember correctly, to stop people being able to do 'useful' things at the Linux shell.

The mtd1ro I supplied was a valid template - but as it had not been used over an update process it didn't have a record of successful updates in it.
So the camera firmware determined that the last update was not successful and attempted a reboot into the min-system recovery mode.
My mistake.

I'm speculating (hoping) that the current status of dropping in to the psh shell is because 'init=/bin/sh' is still a parameter in bootargs.
With any luck these next steps will yield a good result.

With the serial console, interrupt the bootloader.
Use printenv to list the current environment variables.
Hopefully bootargs will still include init=/bin/sh - so we need to put it back to how it started with that removed.
You should have a record of the initial settings, it probably looks like this, but check :
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
At this point, it would also be a good idea to put the IP address definitions back to normal, so the commands would be :

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
setenv ipaddr 192.0.0.64
setenv serverip 192.0.0.128
saveenv
reset

And hopefully get a good result.
If so, after bootup has completed, press return a few times to confirm there is a psh '#' prompt, and use the command
prtHardInfo
to see the firmware version and other info.

I'm keeping my fingers crossed!

 

[mwoo68]

The init=/bin/sh was removed when you told me to put it back. I did note that my original settings files did not have the dbg=0. Frankly I tried it both ways and result is same. Is this OK??

I do not know where to enter the command prtHardInfo.

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=44:19:b6:30:02:23
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=null
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS #
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram
HKVS # setenv ipaddr 192.0.0.64
HKVS # setenv serverip 192.0.0.128
HKVS # saveenv
Writing env to Nand... done
HKVS # reset

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x2, sec_iUpgSuccCnt:0x2
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
starting pid 654, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

#
#

That's better!
'psh' is the 'protected shell', introduced in firmware 5.3.0 and later if I remember correctly, to stop people being able to do 'useful' things at the Linux shell.

The mtd1ro I supplied was a valid template - but as it had not been used over an update process it didn't have a record of successful updates in it.
So the camera firmware determined that the last update was not successful and attempted a reboot into the min-system recovery mode.
My mistake.

I'm speculating (hoping) that the current status of dropping in to the psh shell is because 'init=/bin/sh' is still a parameter in bootargs.
With any luck these next steps will yield a good result.

With the serial console, interrupt the bootloader.
Use printenv to list the current environment variables.
Hopefully bootargs will still include init=/bin/sh - so we need to put it back to how it started with that removed.
You should have a record of the initial settings, it probably looks like this, but check :
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
At this point, it would also be a good idea to put the IP address definitions back to normal, so the commands would be :

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
setenv ipaddr 192.0.0.64
setenv serverip 192.0.0.128
saveenv
reset

And hopefully get a good result.
If so, after bootup has completed, press return a few times to confirm there is a psh '#' prompt, and use the command
prtHardInfo
to see the firmware version and other info.

I'm keeping my fingers crossed!

 

[alastairstevenson]

The init=/bin/sh was removed when you told me to put it back.

Oh, OK.
That's a pity then as it would have been the reason that the system boots up to psh but doesn't start up davinci, which is the main app, despite this looking perfectly normal.
starting pid 376, tty '': '/etc/init.d/rcS'
I was really hoping that was still there and if removed it would burst into full life.
But it hasn't, yet.

The command prtHardInfo would normally be used at the '#' prompt at the end of your serial console transcript, but without davinci running it won't give anything useful.

So, there are no errors, but it looks like some of the firmware is missing as it's not started up the main app.
To give some more information, can you try the 'dmesg' command?
There should be quite a lot of info, which should give some clues as to what's going on.

 

[mwoo68]

OK. Here it is

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x2, sec_iUpgSuccCnt:0x2
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
starting pid 656, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                        printPart                       prtHardInfo   
getPreviewStatus                setIp                           setV6ip       
setGateway                      dspStatus                       outputClose   
outputOpen                      getDebug                        setDebug     
debugLog                        getIrstate                      getMtu       
camCmd                          getCamVer                       getIrstate   
getLux                          getMcuInfo                      getMotion     
getRawdata                      setIrcmd                        setRectFrame 
updateCamera                    setLaserMode                    getLaserMode 
setIrMode                       getIrMode                       setBaiguangMode
getBaiguangMode                 setYTLock                       InquireFanSwitch
StartLaser                      CloseLaser                      LaserMotReset 
EnlargeCur                      ReduceCur                       SetCur       
LaserMotDirect                  LaserTeleOffset                 LaserWideOffset
InqSwitch                       InqCurrent                      InqCurMotDirect
getMcuStateInfo                 setFastFocus                    getTrackStatus
getSelfcheckResult              setLdcMode                      getLdcMode   
getPreviewStatus                appCmd                          camCmd       
ezoomlens_start_t2_test         prtLensCurve                    getLensCurve 
getIp                           gdbcfg                          {Test1}       
{Test2}                         {Test3}                         {Test4}       
{TestN}                         {TestY}                         getIsp       
getISP                          getisp                          setIsp       
setISP                          setisp                          regread       
regwrite                        setAgingMode                    getAgingMode 
setAgingTime                    getAgingTime                    setLensZoomPos
getLensZoomPos                  dm365                           ss           
showKey                         showServer                      showUpnp     
showStatus                      showDefence                     setLBS       
setAlarm                        cloudService                    t1           
ifconfig                        netstat                         ping         
ping6                           top                             iostat       
mpstat                          ps                              reset         
dmesg                           iwpriv                          exit         
getDateInfo                     diagnose                        help         
zhimakaimen
# dmesg
[    0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[    0.000000] #1 PREEMPT Fri Jan 13 20:56:52 CST 2017
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB   = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB   = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM   = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB   = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP   = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL   = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] On node 0 totalpages: 25344
[    0.000000] free_area_init_node: node 0, pgdat c055cf68, node_mem_map c0583000
[    0.000000]   Normal zone: 198 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 25146 pages, LIFO batch:7
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
[    0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0 KRN_PRT=pri RMD_PRT=pri reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99MB = 99MB total
[    0.000000] Memory: 90680k/90680k available, 10696k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002d000   ( 148 kB)
[    0.000000]       .text : 0xc002d000 - 0xc052a000   (5108 kB)
[    0.000000]       .data : 0xc052a000 - 0xc055d620   ( 206 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[    0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[    0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.000588] Calibrating delay loop... 525.92 BogoMIPS (lpj=2629632)
[    0.260131] pid_max: default: 32768 minimum: 301
[    0.260533] Mount-cache hash table entries: 512
[    0.261293] CPU: Testing write buffer coherency: ok
[    0.267737] NET: Registered protocol family 16
[    0.278247] Ambarella Coconut:
[    0.278283]  chip id:                5100
[    0.278296]  board type:             3
[    0.278308]  board revision:         10
[    0.278321]  chip name:              a5m
[    0.278333]  HAL version:            176869
[    0.278348]  reference clock:        24000000
[    0.278365]  system configuration:   0x177804ea
[    0.278382]  boot type:              0x00000002
[    0.278398]  hif type:               0x00000000
[    0.304674] bio: create slab <bio-0> at 0
[    0.307074] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[    0.317369] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[    0.318830] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[    0.320288] i2c i2c-0: Added multiplexed i2c bus 2
[    0.320328] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[    0.323080] Advanced Linux Sound Architecture Driver Version 1.0.23.
[    0.326650] cfg80211: Calling CRDA to update world regulatory domain
[    0.328266] Switching to clocksource ambarella-cs-timer
[    0.330182] Switched to NOHz mode on CPU #0
[    0.389062] NET: Registered protocol family 2
[    0.389403] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.390284] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.390479] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.390595] TCP: Hash tables configured (established 4096 bind 4096)
[    0.390616] TCP reno registered
[    0.390643] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.390704] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.391310] NET: Registered protocol family 1
[    0.392197] RPC: Registered udp transport module.
[    0.392235] RPC: Registered tcp transport module.
[    0.392256] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.392724] Trying to unpack rootfs image as initramfs...
[    0.395050] rootfs image is not initramfs (no cpio magic); looks like an initrd
[    0.428167] Freeing initrd memory: 4096K
[    0.441092] msgmni has been set to 185
[    0.450012] alg: No test for stdrng (krng)
[    0.450166] io scheduler noop registered
[    0.450199] io scheduler deadline registered
[    0.450369] io scheduler cfq registered (default)
[    0.453990] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[    0.455765] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[    0.491397] brd: module loaded
[    0.505002] loop: module loaded
[    0.508093] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
[    0.508141] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[    0.508708] Bad block table found at page 65472, version 0x01
[    0.509224] Bad block table found at page 65408, version 0x01
[    0.509509] nand_read_bbt: Bad block at 0x0000008a0000
[    0.509554] nand_read_bbt: Bad block at 0x000002a00000
[    0.509588] nand_read_bbt: Bad block at 0x000004da0000
[    0.509616] nand_read_bbt: Bad block at 0x000006960000
[    0.514602] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[    0.514673] Creating 18 MTD partitions on "ambnand":
[    0.514711] 0x000000000000-0x000000020000 : "bst"
[    0.518753] 0x000000020000-0x000000120000 : "ptb"
[    0.522367] 0x000000120000-0x000000220000 : "bld"
[    0.526017] 0x000000220000-0x000000320000 : "hal"
[    0.529878] 0x000000320000-0x000000420000 : "ano_ptb"
[    0.533582] 0x000000420000-0x0000004a0000 : "env"
[    0.537392] 0x0000004a0000-0x000000520000 : "param"
[    0.541448] 0x000000520000-0x000000620000 : "dpt"
[    0.545305] 0x000000620000-0x000001020000 : "rcvy"
[    0.549501] 0x000001020000-0x000001820000 : "krn_pri"
[    0.553267] 0x000001820000-0x000002020000 : "krn_sec"
[    0.556982] 0x000002020000-0x000002420000 : "rmd_pri"
[    0.561043] 0x000002420000-0x000002820000 : "rmd_sec"
[    0.564853] 0x000002820000-0x000004020000 : "app_pri"
[    0.568981] 0x000004020000-0x000005820000 : "app_sec"
[    0.572997] 0x000005820000-0x000005c20000 : "cfg_pri"
[    0.576933] 0x000005c20000-0x000006020000 : "cfg_sec"
[    0.581191] 0x000006020000-0x000007020000 : "dbg"
[    0.591885] PPP generic driver version 2.4.2
[    0.593273] PPP Deflate Compression module registered
[    0.593312] PPP BSD Compression module registered
[    0.784855] Ambarella MII Bus: probed
[    0.786454] ambarella-eth ambarella-eth.0: MAC Address[44:19:b6:30:02:23].
[    0.787144] console [netcon0] enabled
[    0.787176] netconsole: network logging started
[    0.788835] mousedev: PS/2 mouse device common for all mice
[    0.789872] input: AmbInput as /devices/virtual/input/input0
[    0.790855] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[    0.790898] ambarella-input ambarella-input: AmbInput probed!
[    0.791861] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[    0.793470] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[    0.794026] i2c /dev entries driver
[    0.798801] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[    0.805061] ALSA device list:
[    0.805094]   No soundcards found.
[    0.805265] Netfilter messages via NETLINK v0.30.
[    0.805439] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[    0.806115] ip_tables: (C) 2000-2006 Netfilter Core Team
[    0.806289] TCP cubic registered
[    0.806696] NET: Registered protocol family 10
[    0.809562] Mobile IPv6
[    0.809695] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    0.809954] IPv6 over IPv4 tunneling driver
[    0.813570] NET: Registered protocol family 17
[    0.814287] sctp: Hash tables configured (established 4096 bind 8192)
[    0.814627] sctp: sctp_init_sock(sk: c5953b20)
[    0.814769] lib80211: common routines for IEEE802.11 drivers
[    0.814803] lib80211_crypt: registered algorithm 'NULL'
[    0.818972] ambarella-rtc ambarella-rtc: setting system clock to 2004-01-15 03:12:26 UTC (1074136346)
[    0.819850] RAMDISK: gzip image found at block 0
[    1.686212] VFS: Mounted root (ext2 filesystem) on device 1:0.
[    1.686433] Freeing init memory: 148K
[    3.637371] UBI: attaching mtd13 to ubi1
[    3.637409] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    3.637428] UBI: logical eraseblock size:    129024 bytes
[    3.637444] UBI: smallest flash I/O unit:    2048
[    3.637457] UBI: sub-page size:              512
[    3.637474] UBI: VID header offset:          512 (aligned 512)
[    3.637490] UBI: data offset:                2048
[    3.690558] UBI: max. sequence number:       3661
[    3.708497] UBI: attached mtd13 to ubi1
[    3.708530] UBI: MTD device name:            "app_pri"
[    3.708550] UBI: MTD device size:            24 MiB
[    3.708565] UBI: number of good PEBs:        191
[    3.708579] UBI: number of bad PEBs:         1
[    3.708593] UBI: number of corrupted PEBs:   0
[    3.708607] UBI: max. allowed volumes:       128
[    3.708621] UBI: wear-leveling threshold:    4096
[    3.708634] UBI: number of internal volumes: 1
[    3.708648] UBI: number of user volumes:     1
[    3.708662] UBI: available PEBs:             0
[    3.708676] UBI: total number of reserved PEBs: 191
[    3.708691] UBI: number of PEBs reserved for bad PEB handling: 2
[    3.708710] UBI: max/mean erase counter: 153/132
[    3.708724] UBI: image sequence number:  536022130
[    3.716485] UBI: background thread "ubi_bgt1d" started, PID 627
[    3.793388] UBIFS: recovery needed
[    3.814250] UBIFS: recovery completed
[    3.814296] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    3.814324] UBIFS: file system size:   22708224 bytes (22176 KiB, 21 MiB, 176 LEBs)
[    3.814349] UBIFS: journal size:       1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
[    3.814372] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    3.814389] UBIFS: default compressor: lzo
[    3.814406] UBIFS: reserved for root:  1072565 bytes (1047 KiB)
[    3.849387] UBI: attaching mtd15 to ubi3
[    3.849425] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    3.849446] UBI: logical eraseblock size:    129024 bytes
[    3.849462] UBI: smallest flash I/O unit:    2048
[    3.849476] UBI: sub-page size:              512
[    3.849493] UBI: VID header offset:          512 (aligned 512)
[    3.849510] UBI: data offset:                2048
[    3.857422] UBI: max. sequence number:       1013
[    3.879750] UBI: attached mtd15 to ubi3
[    3.879784] UBI: MTD device name:            "cfg_pri"
[    3.879804] UBI: MTD device size:            4 MiB
[    3.879819] UBI: number of good PEBs:        32
[    3.879833] UBI: number of bad PEBs:         0
[    3.879847] UBI: number of corrupted PEBs:   0
[    3.879861] UBI: max. allowed volumes:       128
[    3.879876] UBI: wear-leveling threshold:    4096
[    3.879890] UBI: number of internal volumes: 1
[    3.879904] UBI: number of user volumes:     1
[    3.879917] UBI: available PEBs:             0
[    3.879931] UBI: total number of reserved PEBs: 32
[    3.879945] UBI: number of PEBs reserved for bad PEB handling: 2
[    3.879963] UBI: max/mean erase counter: 102/95
[    3.879977] UBI: image sequence number:  164414979
[    3.887758] UBI: background thread "ubi_bgt3d" started, PID 636
[    3.957409] UBIFS: recovery needed
[    3.976707] UBIFS: recovery completed
[    3.976755] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    3.976785] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[    3.976811] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[    3.976834] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    3.976853] UBIFS: default compressor: lzo
[    3.976870] UBIFS: reserved for root:  103599 bytes (101 KiB)
[    4.021965] UBI: attaching mtd16 to ubi4
[    4.022002] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    4.022024] UBI: logical eraseblock size:    129024 bytes
[    4.022041] UBI: smallest flash I/O unit:    2048
[    4.022055] UBI: sub-page size:              512
[    4.022072] UBI: VID header offset:          512 (aligned 512)
[    4.022089] UBI: data offset:                2048
[    4.030074] UBI: max. sequence number:       1013
[    4.048699] UBI: attached mtd16 to ubi4
[    4.048733] UBI: MTD device name:            "cfg_sec"
[    4.048754] UBI: MTD device size:            4 MiB
[    4.048769] UBI: number of good PEBs:        32
[    4.048783] UBI: number of bad PEBs:         0
[    4.048796] UBI: number of corrupted PEBs:   0
[    4.048811] UBI: max. allowed volumes:       128
[    4.048825] UBI: wear-leveling threshold:    4096
[    4.048839] UBI: number of internal volumes: 1
[    4.048853] UBI: number of user volumes:     1
[    4.048867] UBI: available PEBs:             0
[    4.048880] UBI: total number of reserved PEBs: 32
[    4.048895] UBI: number of PEBs reserved for bad PEB handling: 2
[    4.048912] UBI: max/mean erase counter: 102/95
[    4.048928] UBI: image sequence number:  1096207250
[    4.056643] UBI: background thread "ubi_bgt4d" started, PID 646
[    5.156011] UBIFS: recovery needed
[    5.175122] UBIFS: recovery completed
[    5.175169] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    5.175200] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[    5.175225] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[    5.175249] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    5.175267] UBIFS: default compressor: lzo
[    5.175286] UBIFS: reserved for root:  103599 bytes (101 KiB)
#

Oh, OK.
That's a pity then as it would have been the reason that the system boots up to psh but doesn't start up davinci, which is the main app, despite this looking perfectly normal.
starting pid 376, tty '': '/etc/init.d/rcS'
I was really hoping that was still there and if removed it would burst into full life.
But it hasn't, yet.

The command prtHardInfo would normally be used at the '#' prompt at the end of your serial console transcript, but without davinci running it won't give anything useful.

So, there are no errors, but it looks like some of the firmware is missing as it's not started up the main app.
To give some more information, can you try the 'dmesg' command?
There should be quite a lot of info, which should give some clues as to what's going on.

 

[alastairstevenson]

OK. Here it is

Well, as far as it goes, that's absolutely fine, normal and no errors.
So the question is - why does it not continue on to do the rest of the startup process where the main application davinci amongst others is started?
We need to take a look at what's in the file system and spot what's missing.

I'm conscious of the fact that you've already spent quite a bit of time with this to-and-fro activity over the forum.
No-one would argue that its a cost-effective way to get back to a working camera - it would be cheaper to just buy new.
But sometimes we do things just for the interest and because we can - with the effort to get to the end-point not much counted.

So, before consuming more of your time on what's arguably a fairly inefficient process of trial and error, I need to ask your views on whether you want to continue?
I'm quite game for it - I quite like the puzzling and learning that is the result.

 

[mwoo68]

Frankly, I'm quiet astonished at your enthusiasm to help others. It's truly the exception, not the norm.

I myself had the same thoughts, but it was more directed at the concern that I've already consumed your time more than should be alloted to a forum user...

While I am by no means following what you are doing, but merely being the "inputter" to your thoughts in the hope of resurrecting this camera, I will respect your decision when you feel its time to let this camera go in peace.

I did glance over the results and figured you might comment on these bad blocks. Does this mean anything?

Early on during your help, there was a goal once to execute the "update" command to load digiccap.dav??

   0.508708] Bad block table found at page 65472, version 0x01
[    0.509224] Bad block table found at page 65408, version 0x01
[    0.509509] nand_read_bbt: Bad block at 0x0000008a0000
[    0.509554] nand_read_bbt: Bad block at 0x000002a00000
[    0.509588] nand_read_bbt: Bad block at 0x000004da0000
[    0.509616] nand_read_bbt: Bad block at 0x000006960000

Well, as far as it goes, that's absolutely fine, normal and no errors.
So the question is - why does it not continue on to do the rest of the startup process where the main application davinci amongst others is started?
We need to take a look at what's in the file system and spot what's missing.

I'm conscious of the fact that you've already spent quite a bit of time with this to-and-fro activity over the forum.
No-one would argue that its a cost-effective way to get back to a working camera - it would be cheaper to just buy new.
But sometimes we do things just for the interest and because we can - with the effort to get to the end-point not much counted.

So, before consuming more of your time on what's arguably a fairly inefficient process of trial and error, I need to ask your views on whether you want to continue?
I'm quite game for it - I quite like the puzzling and learning that is the result.

 

[alastairstevenson]

I did glance over the results and figured you might comment on these bad blocks. Does this mean anything?

The newer flash memory handles bad blocks in the hardware - but for older hardware some of the file systems handle bad blocks at a software level, as you saw in the UBIFS file system in your serial console transcripts. But not all the partitions are protected by using UBIFS, as you saw from the min-system problem.
From what I've seen, most camera flash doesn't have bad blocks, but some do. It's OK as long as it doesn't 'grow bad blocks' and add more.

Early on during your help, there was a goal once to execute the "update" command to load digiccap.dav??

Yes, this thought has occurred to me, as the min-system facility is back working, the 'update' command (would need the 5.4.5 digicap.dav as that's what's now installed) might do a full refresh of all that's needed.
It would be a bit of an 'all or nothing' approach.

But before that - maybe a couple of things to find out more of what's still not quite right.
There is another trick that's been out in public just a little, that Hikvision have closed off in later versions, that should allow your camera to boot to a full root shell and sidestep psh.

If the current bootargs looks like this
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
change it to this, ie add debug single

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
saveenv
reset

Then, if a root shell is successfully reached, have a look at the root file system (they are all a lower-case L)

ls -al /etc
ls -al /etc/init.d

Then issue the command to complete the bootup

/etc/init.d/rcS

 

[alastairstevenson]

And I forgot - assuming that /etc/rcS doesn't do all that it should, check the contents of the 'app' folder with

ls -al /dav
ls -al /home

The main file to look for is initrun.sh

 

[mwoo68]

I've exectued every line you suggested. Results attached:

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
HKVS # saveenv
Writing env to Nand... done
HKVS # reset

U-Boot 1.3.4-71557 (Apr  3 2014 - 13:08:34)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
nand booting ...
load kernel...
load ramdisk...
[    0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[    0.000000] #1 PREEMPT Fri Jan 13 20:56:52 CST 2017
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB   = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB   = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM   = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB   = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP   = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL   = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] On node 0 totalpages: 25344
[    0.000000] free_area_init_node: node 0, pgdat c055cf68, node_mem_map c0583000
[    0.000000]   Normal zone: 198 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 25146 pages, LIFO batch:7
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
[    0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single KRN_PRT=pri RMD_PRT=pri reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 99MB = 99MB total
[    0.000000] Memory: 90680k/90680k available, 10696k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002d000   ( 148 kB)
[    0.000000]       .text : 0xc002d000 - 0xc052a000   (5108 kB)
[    0.000000]       .data : 0xc052a000 - 0xc055d620   ( 206 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]  RCU-based detection of stalled CPUs is disabled.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[    0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[    0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.274159] Calibrating delay loop... 525.92 BogoMIPS (lpj=2629632)
[    0.532817] pid_max: default: 32768 minimum: 301
[    0.537830] Mount-cache hash table entries: 512
[    0.543165] CPU: Testing write buffer coherency: ok
[    0.554536] NET: Registered protocol family 16
[    0.569457] Ambarella Coconut:
[    0.572767]  chip id:                5100
[    0.575577]  board type:             3
[    0.578373]  board revision:         10
[    0.581754]  chip name:              a5m
[    0.584652]  HAL version:            176869
[    0.587971]  reference clock:        24000000
[    0.591801]  system configuration:   0x177804ea
[    0.596173]  boot type:              0x00000002
[    0.599662]  hif type:               0x00000000
[    0.628991] bio: create slab <bio-0> at 0
[    0.635685] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[    0.653193] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[    0.663561] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[    0.673771] i2c i2c-0: Added multiplexed i2c bus 2
[    0.678591] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[    0.688620] Advanced Linux Sound Architecture Driver Version 1.0.23.
[    0.698702] cfg80211: Calling CRDA to update world regulatory domain
[    0.706555] Switching to clocksource ambarella-cs-timer
[    0.720186] Switched to NOHz mode on CPU #0
[    0.776847] NET: Registered protocol family 2
[    0.781533] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.789666] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.797096] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.803754] TCP: Hash tables configured (established 4096 bind 4096)
[    0.810118] TCP reno registered
[    0.813368] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.819239] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.826200] NET: Registered protocol family 1
[    0.831315] RPC: Registered udp transport module.
[    0.836198] RPC: Registered tcp transport module.
[    0.840918] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.847890] Trying to unpack rootfs image as initramfs...
[    0.855668] rootfs image is not initramfs (no cpio magic); looks like an initrd
[    0.895893] Freeing initrd memory: 4096K
[    0.912726] msgmni has been set to 185
[    0.925389] alg: No test for stdrng (krng)
[    0.929631] io scheduler noop registered
[    0.933866] io scheduler deadline registered
[    0.938312] io scheduler cfq registered (default)
[    0.946692] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[    0.958790] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[    1.005385] brd: module loaded
[    1.022078] loop: module loaded
[    1.028518] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
[    1.037138] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[    1.043593] Bad block table found at page 65472, version 0x01
[    1.049810] Bad block table found at page 65408, version 0x01
[    1.055954] nand_read_bbt: Bad block at 0x0000008a0000
[    1.061127] nand_read_bbt: Bad block at 0x000002a00000
[    1.066374] nand_read_bbt: Bad block at 0x000004da0000
[    1.071532] nand_read_bbt: Bad block at 0x000006960000
[    1.083222] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[    1.091716] Creating 18 MTD partitions on "ambnand":
[    1.096791] 0x000000000000-0x000000020000 : "bst"
[    1.105385] 0x000000020000-0x000000120000 : "ptb"
[    1.113802] 0x000000120000-0x000000220000 : "bld"
[    1.122164] 0x000000220000-0x000000320000 : "hal"
[    1.130736] 0x000000320000-0x000000420000 : "ano_ptb"
[    1.139719] 0x000000420000-0x0000004a0000 : "env"
[    1.148397] 0x0000004a0000-0x000000520000 : "param"
[    1.157259] 0x000000520000-0x000000620000 : "dpt"
[    1.166034] 0x000000620000-0x000001020000 : "rcvy"
[    1.174900] 0x000001020000-0x000001820000 : "krn_pri"
[    1.183894] 0x000001820000-0x000002020000 : "krn_sec"
[    1.192823] 0x000002020000-0x000002420000 : "rmd_pri"
[    1.201651] 0x000002420000-0x000002820000 : "rmd_sec"
[    1.210744] 0x000002820000-0x000004020000 : "app_pri"
[    1.219900] 0x000004020000-0x000005820000 : "app_sec"
[    1.229150] 0x000005820000-0x000005c20000 : "cfg_pri"
[    1.238333] 0x000005c20000-0x000006020000 : "cfg_sec"
[    1.247641] 0x000006020000-0x000007020000 : "dbg"
[    1.263222] PPP generic driver version 2.4.2
[    1.268868] PPP Deflate Compression module registered
[    1.274280] PPP BSD Compression module registered
[    1.468830] Ambarella MII Bus: probed
[    1.474177] ambarella-eth ambarella-eth.0: MAC Address[44:19:b6:30:02:23].
[    1.481797] console [netcon0] enabled
[    1.485645] netconsole: network logging started
[    1.491654] mousedev: PS/2 mouse device common for all mice
[    1.498436] input: AmbInput as /devices/virtual/input/input0
[    1.505221] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[    1.511165] ambarella-input ambarella-input: AmbInput probed!
[    1.518032] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[    1.527423] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[    1.535789] i2c /dev entries driver
[    1.543976] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[    1.559393] ALSA device list:
[    1.562627]   No soundcards found.
[    1.566206] Netfilter messages via NETLINK v0.30.
[    1.571075] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[    1.577882] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.583505] TCP cubic registered
[    1.587138] NET: Registered protocol family 10
[    1.594130] Mobile IPv6
[    1.596705] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.602474] IPv6 over IPv4 tunneling driver
[    1.610269] NET: Registered protocol family 17
[    1.615635] sctp: Hash tables configured (established 4096 bind 8192)
[    1.622559] sctp: sctp_init_sock(sk: c58b2b20)
[    1.627134] lib80211: common routines for IEEE802.11 drivers
[    1.632926] lib80211_crypt: registered algorithm 'NULL'
[    1.642035] ambarella-rtc ambarella-rtc: setting system clock to 2004-01-15 10:08:19 UTC (1074161299)
[    1.652509] RAMDISK: gzip image found at block 0
[    2.522811] VFS: Mounted root (ext2 filesystem) on device 1:0.
[    2.528849] Freeing init memory: 148K
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '-/bin/sh'


BusyBox v1.19.3 (2017-01-13 20:51:32 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ls -al /etc
drwxrwxrwx    6 root     root          1024 Jan 13  2017 .
drwxr-xr-x   20 root     root          1024 Jan 15 10:08 ..
-rwxrwxr-x    1 root     root          2874 Jan 13  2017 S_udev
drwxrwxr-x    3 root     root          1024 Jan 13  2017 Wireless
-rwxrwxr-x    1 root     root          2318 Jan 13  2017 app
drwxrwxr-x    2 root     root          1024 Jan 13  2017 dropbear
-rwxrwxr-x    1 root     root            56 Jan 13  2017 env
-rwxrwxr-x    1 root     root            35 Jan 13  2017 group
drwxrwxr-x    2 root     root          1024 Jan 13  2017 init.d
-rwxrwxr-x    1 root     root           117 Jan 13  2017 inittab
-rwxrwxr-x    1 root     root          1288 Jan 13  2017 mdev.conf
-rwxrwxr-x    1 root     root            35 Jan 13  2017 nsswitch.conf
-rwxrwxr-x    1 root     root            44 Jan 13  2017 passwd
-rwxrwxr-x    1 root     root            90 Jan 13  2017 profile
-rwxrwxr-x    1 root     root             0 Jan 13  2017 resolv.conf
-rwxrwxr-x    1 root     root           393 Jan 13  2017 services
-rwxrwxr-x    1 root     root            11 Jan 13  2017 sh_tmo
-rwxrwxr-x    1 root     root            26 Jan 13  2017 shells
-rwxrwxr-x    1 root     root            14 Jan 13  2017 ssh_config
-rwxrwxr-x    1 root     root           703 Jan 13  2017 static_dev_nodes
drwxrwxr-x    3 root     root          1024 Jan 13  2017 udev
# ls -al /etc/init.d
drwxrwxr-x    2 root     root          1024 Jan 13  2017 .
drwxrwxrwx    6 root     root          1024 Jan 13  2017 ..
-rwxrwxr-x    1 root     root           395 Jan 13  2017 rcS
# /etc/init.d/rcS
Starting udev:      [ OK ]
[   48.199430] UBI: attaching mtd13 to ubi1
[   48.203498] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[   48.209771] UBI: logical eraseblock size:    129024 bytes
[   48.215242] UBI: smallest flash I/O unit:    2048
[   48.219953] UBI: sub-page size:              512
[   48.224630] UBI: VID header offset:          512 (aligned 512)
[   48.230467] UBI: data offset:                2048
[   48.290933] UBI: max. sequence number:       3979
[   48.320174] UBI: attached mtd13 to ubi1
[   48.332415] UBI: MTD device name:            "app_pri"
[   48.337583] UBI: MTD device size:            24 MiB
[   48.342635] UBI: number of good PEBs:        191
[   48.347267] UBI: number of bad PEBs:         1
[   48.351709] UBI: number of corrupted PEBs:   0
[   48.356285] UBI: max. allowed volumes:       128
[   48.360918] UBI: wear-leveling threshold:    4096
[   48.365700] UBI: number of internal volumes: 1
[   48.370156] UBI: number of user volumes:     1
[   48.374718] UBI: available PEBs:             0
[   48.379169] UBI: total number of reserved PEBs: 191
[   48.384109] UBI: number of PEBs reserved for bad PEB handling: 2
[   48.390126] UBI: max/mean erase counter: 153/134
[   48.394790] UBI: image sequence number:  536022130
[   48.399627] UBI: background thread "ubi_bgt1d" started, PID 631
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
[   48.474746] UBIFS: recovery needed
[   48.499346] UBIFS: recovery completed
[   48.503332] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[   48.509546] UBIFS: file system size:   22708224 bytes (22176 KiB, 21 MiB, 176 LEBs)
[   48.517302] UBIFS: journal size:       1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
[   48.524607] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   48.530447] UBIFS: default compressor: lzo
[   48.534613] UBIFS: reserved for root:  1072565 bytes (1047 KiB)
pri_iUpgSuccCnt:0x2, sec_iUpgSuccCnt:0x2
[   48.574637] UBI: attaching mtd15 to ubi3
[   48.578590] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[   48.584987] UBI: logical eraseblock size:    129024 bytes
[   48.590395] UBI: smallest flash I/O unit:    2048
[   48.595243] UBI: sub-page size:              512
[   48.599877] UBI: VID header offset:          512 (aligned 512)
[   48.605790] UBI: data offset:                2048
[   48.620227] UBI: max. sequence number:       1334
[   48.642466] UBI: attached mtd15 to ubi3
[   48.646324] UBI: MTD device name:            "cfg_pri"
[   48.651465] UBI: MTD device size:            4 MiB
[   48.670500] UBI: number of good PEBs:        32
[   48.675197] UBI: number of bad PEBs:         0
[   48.679651] UBI: number of corrupted PEBs:   0
[   48.684204] UBI: max. allowed volumes:       128
[   48.688830] UBI: wear-leveling threshold:    4096
[   48.693602] UBI: number of internal volumes: 1
[   48.698060] UBI: number of user volumes:     1
[   48.702565] UBI: available PEBs:             0
[   48.707012] UBI: total number of reserved PEBs: 32
[   48.711801] UBI: number of PEBs reserved for bad PEB handling: 2
[   48.717863] UBI: max/mean erase counter: 113/105
[   48.722535] UBI: image sequence number:  164414979
[   48.727377] UBI: background thread "ubi_bgt3d" started, PID 640
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
[   48.802636] UBIFS: recovery needed
[   48.826713] UBIFS: recovery completed
[   48.830597] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[   48.836897] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[   48.844296] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[   48.851531] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   48.857435] UBIFS: default compressor: lzo
[   48.861551] UBIFS: reserved for root:  103599 bytes (101 KiB)
Check dir /davinci ok! (0)
[   48.911454] UBI: attaching mtd16 to ubi4
[   48.915507] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[   48.921782] UBI: logical eraseblock size:    129024 bytes
[   48.927260] UBI: smallest flash I/O unit:    2048
[   48.931973] UBI: sub-page size:              512
[   48.936650] UBI: VID header offset:          512 (aligned 512)
[   48.942532] UBI: data offset:                2048
[   48.956969] UBI: max. sequence number:       1334
[   48.982490] UBI: attached mtd16 to ubi4
[   48.986353] UBI: MTD device name:            "cfg_sec"
[   48.991493] UBI: MTD device size:            4 MiB
[   49.007297] UBI: number of good PEBs:        32
[   49.011846] UBI: number of bad PEBs:         0
[   49.016490] UBI: number of corrupted PEBs:   0
[   49.020946] UBI: max. allowed volumes:       128
[   49.025681] UBI: wear-leveling threshold:    4096
[   49.030400] UBI: number of internal volumes: 1
[   49.034980] UBI: number of user volumes:     1
[   49.039439] UBI: available PEBs:             0
[   49.043964] UBI: total number of reserved PEBs: 32
[   49.048764] UBI: number of PEBs reserved for bad PEB handling: 2
[   49.054828] UBI: max/mean erase counter: 114/105
[   49.059450] UBI: image sequence number:  1096207250
[   49.064415] UBI: background thread "ubi_bgt4d" started, PID 650
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
[   49.139525] UBIFS: recovery needed
[   49.165130] UBIFS: recovery completed
[   49.169016] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[   49.175322] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[   49.182730] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[   49.189968] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   49.195864] UBIFS: default compressor: lzo
[   49.199977] UBIFS: reserved for root:  103599 bytes (101 KiB)
Check dir /config ok! (0)
# ls -al /dav
drwxr-xr-x    2 root     root           160 Jan 14 10:01 .
drwxr-xr-x   20 root     root          1024 Jan 15 10:08 ..
# ls -al /home
drwxr-xr-x    2 root     root             0 Jan 15 10:09 .
drwxr-xr-x   20 root     root          1024 Jan 15 10:08 ..
#

And I forgot - assuming that /etc/rcS doesn't do all that it should, check the contents of the 'app' folder with

ls -al /dav
ls -al /home

The main file to look for is initrun.sh

 

[mwoo68]

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single

I copied this line, but, was wondering should dbg=9???

The newer flash memory handles bad blocks in the hardware - but for older hardware some of the file systems handle bad blocks at a software level, as you saw in the UBIFS file system in your serial console transcripts. But not all the partitions are protected by using UBIFS, as you saw from the min-system problem.
From what I've seen, most camera flash doesn't have bad blocks, but some do. It's OK as long as it doesn't 'grow bad blocks' and add more.


Yes, this thought has occurred to me, as the min-system facility is back working, the 'update' command (would need the 5.4.5 digicap.dav as that's what's now installed) might do a full refresh of all that's needed.
It would be a bit of an 'all or nothing' approach.

But before that - maybe a couple of things to find out more of what's still not quite right.
There is another trick that's been out in public just a little, that Hikvision have closed off in later versions, that should allow your camera to boot to a full root shell and sidestep psh.

If the current bootargs looks like this
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
change it to this, ie add debug single

setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
saveenv
reset

Then, if a root shell is successfully reached, have a look at the root file system (they are all a lower-case L)

ls -al /etc
ls -al /etc/init.d

Then issue the command to complete the bootup

/etc/init.d/rcS

 

[alastairstevenson]

Ok, that's good.
Despite the app partition being mounted, there are no files in it.
/dav is empty.
That's the problem.
dbg=9 gives a lot more detail in the serial console.

I wonder if the secondary partition has files? If so voting then over should fix it.
Let me see what the commands would be for that.

 

[alastairstevenson]

Let me see what the commands would be for that.

OK - here we go.
At the root shell where you last entered those commands :

mkdir /dav2
/usr/sbin/ubiattach -m 14 -d 2 /dev/ubi_ctrl
/bin/mount -t ubifs /dev/ubi2_0 /dav2
ls -al /dav2

And if that last command lists a couple of dozen files, they can be copied over to the primary partition -

cp /dav2/* /dav
/bin/umount /dav2
/usr/sbin/ubidetach /dev/ubi_ctrl -d 2

reboot