A transcript of what shows from power-on should help to understand what the underlying problem is.
Then in terms of possible useful commands - interrupt the bootloader and show the output of the 'help' command.
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
- Thread starter alastairstevenson
- Start date
Then in terms of possible useful commands - interrupt the bootloader and show the output of the 'help' command.
hinzinho
n3wb
- Jan 14, 2017
- 12
- 1
Below are outputs from the terminal. I ran as much commands that I think was useful. There is one command, "upf", that similar to update, but I don't know what this mImage file it is looking for.
Thanks again!
Code:
HKVS # help
The following commands are supported:
boot help bios diag
mtest dump erase go
exec ping r8 r16
r32 reset saveenv printenv
setenv show usbdl w8
w16 w32 tftpboot bootm
readoob killb crc format
update upf updateb ubi
bapi
Use 'help' to get help on a specific command
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=c4:2f:90:18:a4:c3
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS #
HKVS # show flash
RCT configured to NAND mode
main size: 2048
pages per block: 64
bst partition blocks: 0 - 1
ptb partition blocks: 1 - 9
bld partition blocks: 9 - 17
hal partition blocks: 17 - 25
ano_ptb partition blocks: 25 - 33
env partition blocks: 33 - 37
param partition blocks: 37 - 41
dpt partition blocks: 41 - 49
rcvy partition blocks: 49 - 129
krn_pri partition blocks: 129 - 193
krn_sec partition blocks: 193 - 257
rmd_pri partition blocks: 257 - 289
rmd_sec partition blocks: 289 - 321
app_pri partition blocks: 321 - 513
app_sec partition blocks: 513 - 705
cfg_pri partition blocks: 705 - 737
cfg_sec partition blocks: 737 - 769
dbg partition blocks: 769 - 897
HKVS #
HKVS # show ptb
bst: 0x4076e165 1.3 (2014/10/9) 0x00000000 0x00000001 (2048)
bld: 0x20fb27ea 1.3 (2015/3/20) 0xc0000000 0x00000000 (228716)
hal: 0x3407bf3c 5.1 (2015/3/20) 0xc00a0000 0x00000000 (59144)
S/N:
usbdl_mode: 0
auto_boot: 1
cmdline: "console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0"
HKVS #
HKVS # show bb
----- Late developed bad blocks -----
150 253 439 487 496
559 649 676 901 933
Total bad blocks: 10
HKVS #
HKVS # show meta
bst sblk: 0 nblk: 1 on: NAND
ptb sblk: 1 nblk: 8 on: NAND
bld sblk: 9 nblk: 8 on: NAND
hal sblk: 17 nblk: 8 on: NAND
ano_ptb sblk: 25 nblk: 8 on: NAND
env sblk: 33 nblk: 4 on: NAND
param sblk: 37 nblk: 4 on: NAND
dpt sblk: 41 nblk: 8 on: NAND
rcvy sblk: 49 nblk: 80 on: NAND
krn_pri sblk: 129 nblk: 64 on: NAND
krn_sec sblk: 193 nblk: 64 on: NAND
rmd_pri sblk: 257 nblk: 32 on: NAND
rmd_sec sblk: 289 nblk: 32 on: NAND
app_pri sblk: 321 nblk: 192 on: NAND
app_sec sblk: 513 nblk: 192 on: NAND
cfg_pri sblk: 705 nblk: 32 on: NAND
cfg_sec sblk: 737 nblk: 32 on: NAND
dbg sblk: 769 nblk: 128 on: NAND
sblk: 0 nblk: 0 on: DEFAULT
sblk: 0 nblk: 0 on: DEFAULT
sm_stg[0] sblk: 0 nblk: 0
sm_stg[1] sblk: 0 nblk: 0
model name:
crc32: 0x9d57e812
HKVS #
HKVS # show netboot
eth0_mac: 00:00:00:00:00:00
eth0_ip: 0.0.0.0
eth0_mask: 0.0.0.0
eth0_gw: 0.0.0.0
auto_dl: 0
tftpd: 0.0.0.0
pri_addr: 0x00000000
pri_file:
pri_comp: 0
rmd_addr: 0x00000000
rmd_file:
rmd_comp: 0
dsp_addr: 0x00000000
dsp_file:
dsp_comp: 0
HKVS # upf
***** UPDATE START *****
[ INFO][BLD]TFTP: MAC: c4:2f:90:18:a4:c3
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'mImage'
[ERROR][BLD]TFTP: do_tftp_load:bld_udp_recv RRQ failed!rval=-110
[ERROR][BLD]TFTP: do_tftp_load:bld_udp_recv RRQ failed!rval=-110
[ERROR][BLD]TFTP: do_tftp_load:transfer error
[ERROR][BLD]BURN: Download File [FAIL]! error: tftp.
[ERROR][BLD]BURN: update mini system [FAIL]!error: upf.
!!!!! UPDATE FAIL !!!!!OK, so no flash read/write commands in that bootloader.
That can be risky - and is best avoided if you are unsure of the purpose of the commands.
upf is the 'factory update' command. It installs the min-system recovery image and the main firmware.
But it would probably be useful to know what the current problem is.
Can you do a transcript of a normal power-on, with no interruptions?
hinzinho
n3wb
- Jan 14, 2017
- 12
- 1
I have provided 2 different scenarios. One with the network cable plugged in and another without. I checked with WireShark and SADP Tool and don't see any activities from the camera beside the initial tftp check from WireShark.
With the network cable plugged in. I left it on for about 20 minutes and no extra output from the terminal
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0Without the network cable. I also waited for a while and still nothing on the terminal
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|NUL eth|
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2016-05-23 16:23:55 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
UBI device number 1, total 189 LEBs (24385536 bytes, 23.3 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 30
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40331000
loading ./orccode.bin...addr = 0x40331000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40531000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x405d1000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini systemYour transcript suggests the camera is attempting to boot firmware version 5.4.5 Build 170123 and I'd speculate that it had been applied over a very early firmware version such as 5.1.6 that had not created valid data in mtdblock1. This partition holds info on number of reboot times, and whether the previous update was successful or not.
If the counts indicate the last update did not succeed, a reboot is triggered.
But it does not reboot properly into the min-system recovery environment.
That's a 'Catch-22 situation' as the min-system holds the system update code.
A suggestion to try :
With the tftp server running, and a digicap.dav file from an early firmware version such as the 5.2.0 from here :
DS-2CD2332-I - History
power on, interrupt the bootloader and try the 'update' command.
Post the full transcript here and we'll see what it says.
hinzinho
n3wb
- Jan 14, 2017
- 12
- 1
I have downloaded 5.2.0 firmware as suggested to my tfpt directory. When I issue the 'update' command, it just stay stuck in that mode. I don't see any activities in the tfpt log or in wireshark. I waited for at least 20 minutes before giving up. .
Code:
HKVS # updateI figured maybe it doesn't have a good image, so I typed 'tftpboot' and see see the camera grabbing the digicap.dav file from my tftp. I waited for about 10-15 minutes to see if it would do anything afterward. It did not, so I typed 'update'. Again this just hang at the terminal and does nothing that I can see.
Code:
HKVS # tftpboot
[ INFO][BLD]TFTP: MAC: c4:2f:90:18:a4:c3
[ INFO][BLD]TFTP: TFTP from server 192.0.0.128; our IP address is 192.0.0.64
[ INFO][BLD]TFTP: Filename: 'digicap.dav'
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ############################################################## ##################
[ INFO][BLD]TFTP: ##########################
[ INFO][BLD]TFTP: File size is 21160827 bytes (20664 KB)
HKVS # updateBTW, I tried a few different firmwares (5.2.0 and 5.4.41) to see if it would work, but no luck. That is my the file size in my output might be match to what you are expecting. Thanks again.
You've confirmed that the min-system recovery environment, that does the firmware update process, is not working.
It can be possible to work around this and recover the camera, but the process can be a bit messy if you are not used to working at a low level.
Here are a couple of pointers to how this has been done before, should you wish to try them :
ipcamtalk.com
ipcamtalk.com
It can be possible to work around this and recover the camera, but the process can be a bit messy if you are not used to working at a low level.
Here are a couple of pointers to how this has been done before, should you wish to try them :
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
I also made 1 NFS shared folder on my QNAP .. my shared NFS folder should look like this: nfs 192.168.2.155:/Public That's good. Unzip the attachment from here into the root of the NFS share. Power on the camera, and at the root shell # prompt, copy / paste these commands one at a time -...
R0 / DS-2CD2x32 BrickfixV2 brick recovery and full upgrade tool - enhanced.
I also made 1 NFS shared folder on my QNAP .. my shared NFS folder should look like this: nfs 192.168.2.155:/Public That's good. Unzip the attachment from here into the root of the NFS share. Power on the camera, and at the root shell # prompt, copy / paste these commands one at a time -...
hinzinho
n3wb
- Jan 14, 2017
- 12
- 1
I have followed the commands from the 2 posts. I spent most of my time trying to get the mount working. I ended up using this command 'mount -t cifs /192.0.0.128/temp /mnt/nfs00 -o username=myuser,password=mypassword'.
Toward the end, when flashing the mtdblocks, I got a lot of errors. Only one that worked without any errors are on mtdblock11 and mtdblock12.
lot of errors when running cat /mnt/nfs00/mtdblock8 > /dev/mtdblock8
some errors on cat /mnt/nfs00/mtdblock9 > /dev/mtdblock9
errors on cat /mnt/nfs00/mtdblock9 > /dev/mtdblock10
no error on cat /mnt/nfs00/mtdblock11 > /dev/mtdblock11
no error cat /mnt/nfs00/mtdblock11 > /dev/mtdblock12
errors on cat /mnt/nfs00/mtdblock13 > /dev/mtdblock13
I think this device is dead and it's time to get a new one. In the future, it something is working, don't do any firmware update.
Outputs of the log, just in case you see something.
Thanks for all your help!
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 2
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=c4:2f:90:18:a4:c3
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=
bootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0
bootdelay=2
HKVS # setenv bootargs console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single
HKVS # saveenv
Writing env to Nand... done
▒KVS # reset
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
booting from sec part...
load kernel...
load ramdisk...
[ 0.000000] Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[ 0.000000] #18 PREEMPT Thu Jan 21 17:27:08 CST 2016
[ 0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[ 0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[ 0.000000] Machine: Coconut
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
[ 0.000000] Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
[ 0.000000] Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
[ 0.000000] Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
[ 0.000000] On node 0 totalpages: 25344
[ 0.000000] free_area_init_node: node 0, pgdat c0563180, node_mem_map c0589000
[ 0.000000] Normal zone: 198 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 25146 pages, LIFO batch:7
[ 0.000000] bootmem_init: high_memory = 0xc8a00000
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
[ 0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=9 debug single KRN_PRT=sec RMD_PRT=sec reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 99MB = 99MB total
[ 0.000000] Memory: 90656k/90656k available, 10720k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
[ 0.000000] vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .init : 0xc0008000 - 0xc002d000 ( 148 kB)
[ 0.000000] .text : 0xc002d000 - 0xc052f000 (5128 kB)
[ 0.000000] .data : 0xc0530000 - 0xc0563820 ( 207 kB)
[ 0.000000] Preemptable hierarchical RCU implementation.
[ 0.000000] RCU-based detection of stalled CPUs is disabled.
[ 0.000000] Verbose stalled-CPUs detection is disabled.
[ 0.000000] NR_IRQS:224
[ 0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[ 0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[ 0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.274238] Calibrating delay loop... 527.56 BogoMIPS (lpj=2637824)
[ 0.522862] pid_max: default: 32768 minimum: 301
[ 0.527858] Mount-cache hash table entries: 512
[ 0.533173] CPU: Testing write buffer coherency: ok
[ 0.544612] NET: Registered protocol family 16
[ 0.559530] Ambarella Coconut:
[ 0.562829] chip id: 5100
[ 0.565637] board type: 3
[ 0.568433] board revision: 10
[ 0.571808] chip name: a5m
[ 0.574704] HAL version: 176869
[ 0.578023] reference clock: 24000000
[ 0.581853] system configuration: 0x177804ea
[ 0.586223] boot type: 0x00000002
[ 0.589712] hif type: 0x00000000
[ 0.618937] bio: create slab <bio-0> at 0
[ 0.625617] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[ 0.643077] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[ 0.653447] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[ 0.663654] i2c i2c-0: Added multiplexed i2c bus 2
[ 0.668470] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[ 0.678478] Advanced Linux Sound Architecture Driver Version 1.0.23.
[ 0.688525] cfg80211: Calling CRDA to update world regulatory domain
[ 0.696369] Switching to clocksource ambarella-cs-timer
[ 0.710181] Switched to NOHz mode on CPU #0
[ 0.766313] NET: Registered protocol family 2
[ 0.771003] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.779132] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.786556] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.793210] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.799581] TCP reno registered
[ 0.802825] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.808699] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.815656] NET: Registered protocol family 1
[ 0.820772] RPC: Registered udp transport module.
[ 0.825650] RPC: Registered tcp transport module.
[ 0.830371] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.837344] Trying to unpack rootfs image as initramfs...
[ 0.845172] rootfs image is not initramfs (no cpio magic); looks like an initrd
[ 0.885583] Freeing initrd memory: 4096K
[ 0.892423] [ kernel version: svn-174544 ]
[ 0.896690] mmc0 power register success!
[ 0.900634] mmc1 power register success!
[ 0.904935] reboot times :1
[ 0.933381] msgmni has been set to 185
[ 0.946026] alg: No test for stdrng (krng)
[ 0.950272] io scheduler noop registered
[ 0.954486] io scheduler deadline registered
[ 0.958929] io scheduler cfq registered (default)
[ 0.967297] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[ 0.979372] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[ 1.025191] brd: module loaded
[ 1.041893] loop: module loaded
[ 1.048365] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (MXIC NAND 128MiB 3,3V 8-bit)
[ 1.057085] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[ 1.063547] Bad block table found at page 65472, version 0x01
[ 1.069767] Bad block table found at page 65408, version 0x01
[ 1.075914] nand_read_bbt: Bad block at 0x0000009c0000
[ 1.081076] nand_read_bbt: Bad block at 0x0000012c0000
[ 1.086312] nand_read_bbt: Bad block at 0x000001fa0000
[ 1.091470] nand_read_bbt: Bad block at 0x0000036e0000
[ 1.096676] nand_read_bbt: Bad block at 0x000003ce0000
[ 1.101818] nand_read_bbt: Bad block at 0x000003e00000
[ 1.107015] nand_read_bbt: Bad block at 0x0000045e0000
[ 1.112210] nand_read_bbt: Bad block at 0x000005120000
[ 1.117359] nand_read_bbt: Bad block at 0x000005480000
[ 1.122552] nand_read_bbt: Bad block at 0x0000070a0000
[ 1.127698] nand_read_bbt: Bad block at 0x0000074a0000
[ 1.139191] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[ 1.147770] Creating 18 MTD partitions on "ambnand":
[ 1.152830] 0x000000000000-0x000000020000 : "bst"
[ 1.161342] 0x000000020000-0x000000120000 : "ptb"
[ 1.169763] 0x000000120000-0x000000220000 : "bld"
[ 1.178298] 0x000000220000-0x000000320000 : "hal"
[ 1.186865] 0x000000320000-0x000000420000 : "ano_ptb"
[ 1.195835] 0x000000420000-0x0000004a0000 : "env"
[ 1.204492] 0x0000004a0000-0x000000520000 : "param"
[ 1.213380] 0x000000520000-0x000000620000 : "dpt"
[ 1.221893] 0x000000620000-0x000001020000 : "rcvy"
[ 1.230849] 0x000001020000-0x000001820000 : "krn_pri"
[ 1.239812] 0x000001820000-0x000002020000 : "krn_sec"
[ 1.248829] 0x000002020000-0x000002420000 : "rmd_pri"
[ 1.257851] 0x000002420000-0x000002820000 : "rmd_sec"
[ 1.266941] 0x000002820000-0x000004020000 : "app_pri"
[ 1.276096] 0x000004020000-0x000005820000 : "app_sec"
[ 1.285285] 0x000005820000-0x000005c20000 : "cfg_pri"
[ 1.294439] 0x000005c20000-0x000006020000 : "cfg_sec"
[ 1.303760] 0x000006020000-0x000007020000 : "dbg"
[ 1.319075] PPP generic driver version 2.4.2
[ 1.324872] PPP Deflate Compression module registered
[ 1.329944] PPP BSD Compression module registered
[ 1.528652] Ambarella MII Bus: probed
[ 1.534003] ambarella-eth ambarella-eth.0: MAC Address[c4:2f:90:18:a4:c3].
[ 1.541611] console [netcon0] enabled
[ 1.545455] netconsole: network logging started
[ 1.551505] mousedev: PS/2 mouse device common for all mice
[ 1.558237] input: AmbInput as /devices/virtual/input/input0
[ 1.565026] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[ 1.570975] ambarella-input ambarella-input: AmbInput probed!
[ 1.577836] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[ 1.587230] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[ 1.595594] i2c /dev entries driver
[ 1.603834] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[ 1.619220] ALSA device list:
[ 1.622446] No soundcards found.
[ 1.626025] Netfilter messages via NETLINK v0.30.
[ 1.630895] nf_conntrack version 0.5.0 (1480 buckets, 5920 max)
[ 1.637678] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 1.643283] TCP cubic registered
[ 1.646917] NET: Registered protocol family 10
[ 1.653922] Mobile IPv6
[ 1.656494] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 1.662246] IPv6 over IPv4 tunneling driver
[ 1.670043] NET: Registered protocol family 17
[ 1.675398] sctp: Hash tables configured (established 4096 bind 8192)
[ 1.682313] sctp: sctp_init_sock(sk: c58d5b20)
[ 1.686875] lib80211: common routines for IEEE802.11 drivers
[ 1.692661] lib80211_crypt: registered algorithm 'NULL'
[ 1.701751] ambarella-rtc ambarella-rtc: setting system clock to 2020-09-16 21:17:00 UTC (1600291020)
[ 1.711956] RAMDISK: gzip image found at block 0
[ 2.540527] EXT2-fs (ram0): warning: maximal mount count reached, running e2fsck is recommended
[ 2.549506] VFS: Mounted root (ext2 filesystem) on device 1:0.
[ 2.555670] Freeing init memory: 148K
init started: BusyBox v1.19.3 (2014-07-11 11:25:54 CST)
starting pid 378, tty '': '-/bin/sh'
BusyBox v1.19.3 (2014-07-11 11:25:54 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
awk: /proc/mounts: No such file or directory
==================== INITRAM_FS ====================
# mount -t proc proc /proc
# mount -t sysfs sysfs /sys
# mount -t ramfs ramfs /home
# /etc/S_udev
Starting udev: [ OK ]
# ifconfig eth0 192.0.0.64 up
[ 99.536242] net eth0: Could not find default PHY in 9.
[ 99.541411] net eth0: Try PHY[3] whose id is 0x001cc816!
[ 99.550368] ADDRCONF(NETDEV_UP): eth0: link is not ready
# [ 101.542466] PHY: 0:03 - Link is Up - 100/Full
[ 101.547016] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
#
# [ 111.872142] eth0: no IPv6 routers present
# mount -t cifs /192.0.0.128/temp /mnt/nfs00 -o username=myuser,password=mypassword
# ls -al /mnt/nfs00/mtdblock*
-rwxr-xr-x 0 root root 4194304 Sep 17 2020 /mnt/nfs00/mtdblock11
-rwxr-xr-x 0 root root 25165824 Sep 17 2020 /mnt/nfs00/mtdblock13
-rwxr-xr-x 0 root root 10485760 Sep 17 2020 /mnt/nfs00/mtdblock8
-rwxr-xr-x 0 root root 8388608 Sep 17 2020 /mnt/nfs00/mtdblock9
#After the reboot, sometimes it goes into mini system and hang there. If I power cycle the camera, it would into busybox but without an ip. If I set the ip, I can ping it but doesn't see anything with SADP or the web interface.
Code:
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system
U-Boot 1.3.4-113988 (Mar 20 2015 - 17:36:32)
ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
booting from sec part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2014-07-11 11:25:54 CST)
starting pid 378, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
starting pid 609, tty '': '/sbin/iptables -A INPUT -p tcp --dport 23 -j DROP'
starting pid 610, tty '': '/sbin/iptables -A INPUT -p tcp --dport 22 -j DROP'
starting pid 611, tty '': '/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP'
starting pid 612, tty '': '/sbin/inetd -f -e /etc/inetd.conf'
starting pid 613, tty '': '-/bin/sh'Yes, that's a good alternate to using NFS when a handy NAS isn't available.
That's the partition that holds the min-system recovery environment.
I think you're right.
It seems to be riddled with flash failures, lots of bad blocks.
These would only get worse, and exceed the reserve in the file system to deal with them.
You've had a pretty good go at exploring the problem, and try to deal with it.
But sometimes a fix just isn't possible.
Yes, those responses would come from the davinci main app if it was running, but the boot-up has been limited to just get to a shell prompt.
Despite the errors in re-flashing the critical partitions - did you check what happened when the bootargs variable in the bootloader was put back to its original value as opposed to the one that drops the boot-up into a shell prompt?
hinzinho
n3wb
- Jan 14, 2017
- 12
- 1
Alastairstevenson, I got my hikvision cam up and running today!
Today, I have some spare time and thought I would give it another "good old college try". I ran your commands again but it was still giving me a lot of bad block errors. With nothing else to lose, since this camera is a goner, I took a bit more risk and cleared the bad blocks table (don't remember the exact command, but it was under diag). I then went and follow your postings for reflashing the /dev/mtdblocks. To my surprise, I was able to flash mtdblock8 without any errors. The other mtdblocks that gave me errors still doing the same. Upon reboot, I noticed I was no longer stuck at the mini system. From there, I followed the debrick process and got the cam flashed with firmware 5.2.0. It is up and running now, but not with the latest firmware. I can live with 5.2.0 firmware, as I don't want to go thought this mess again.
Let me know how I can buy you some beers for all your help.
Thank you for all your help again!
That's a brilliant and unexpected result! Good to hear.
That brings back the 'upgrade' programs that handles the firmware updates.
A virtual beer will do very nicely, many thanks!
Thank you so much alastairstevenson!!!!
Just upgraded my DS-2CD2432F-IW
With your enhanced mtd hack.
Working fine.
Was on v5.2.5 English Hack FW with Chinese Cameras.
All I did, was hack mtd6 according to instructions once per camera. Then just use ivms4200 remote config to perform upgrade.
Works fine.
Just upgraded my DS-2CD2432F-IW
With your enhanced mtd hack.
Working fine.
Was on v5.2.5 English Hack FW with Chinese Cameras.
All I did, was hack mtd6 according to instructions once per camera. Then just use ivms4200 remote config to perform upgrade.
Works fine.
Hi,
I still have to fully read this thread so many messages.
I got two cams for china menu's in English so I suspect hacked firmware because serial has CN
Model: DS-2CD2145F-IWS
sn: DS-2CD2145F-IWS20160701AACH6192xxxxxx
fw version: V5.4.0 build 160401
Model: DS-2CD2145F-IS
sn
S-2CD2145F-IS20161111BBCH6737xxxxxx
fw version:V5.4.23 build 161020
Can those be upgraded ? I think they're G1 cams but on the hikvision site in EU I dont find the 2145 ipcam.
If anyone here has succesfully upgraded these cams let me know I can use some help.
I still have to fully read this thread so many messages.
I got two cams for china menu's in English so I suspect hacked firmware because serial has CN
Model: DS-2CD2145F-IWS
sn: DS-2CD2145F-IWS20160701AACH6192xxxxxx
fw version: V5.4.0 build 160401
Model: DS-2CD2145F-IS
sn
S-2CD2145F-IS20161111BBCH6737xxxxxxfw version:V5.4.23 build 161020
Can those be upgraded ? I think they're G1 cams but on the hikvision site in EU I dont find the 2145 ipcam.
If anyone here has succesfully upgraded these cams let me know I can use some help.
Hi.
I have this camera in picture..i flash the bios from another same camera,so there are two mac address appear
i need to log on the shell of camera to get the dev.type value but the ssh or telnet is not connected
this camera R0 or R6 series ??
any idea ??
Attachments
devType is not relevant for the MAC address definition.
Suggestion :
Search the MAC address in the flash image and edit it, re-flash the camera.
This is mac address. i need the mac address in the web page of camera to appear on SADP tool??
