HIKVISION mtd Brick Recovery Guide

[alastairstevenson]

The camera I had was the ds-2cd2232-i5 and it was from China so the multi language version.

Just to add - I have a chinese one, 5.2.5 was the firmware on it and for some reason I upgraded to a 5.4.0 which killed it.

This has a firmware anti-rollback feature, even if not successful.
Normally, if it originally had 5.2.5, the whoslooking 5.3.0 to 5.2.5 downgrader would bring it back to life.
There is a CN and EN header version here - Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
If that doesn't work, I have a brick-fix tool.

 

[IMF]

This has a firmware anti-rollback feature, even if not successful.
Normally, if it originally had 5.2.5, the whoslooking 5.3.0 to 5.2.5 downgrader would bring it back to life.
There is a CN and EN header version here - Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
If that doesn't work, I have a brick-fix tool.

Tried those firmwares - got nowhere with them. What's this tool you speak of?

 

[alastairstevenson]

Brick-fix post here : Hik brick-fix and downgrader tool - R0 / DS-2CD2x32 IP cameras.
I'll sent you some instructions via 'Conversations'.
I'm away just now, so will need to dig a bit for them.

 

[alastairstevenson]

OK, instructions, quite wordy, sent via Conversations.
This tool will remove the anti-rollback feature in the tftp upgrade method, and allow installation of the 5.3.0 to 5.2.5 downgrader to recover the camera.
This provides a starting point to then modify the mtdblock6 to give a fully upgradeable camera.

 

[IMF]

OK, instructions, quite wordy, sent via Conversations.
This tool will remove the anti-rollback feature in the tftp upgrade method, and allow installation of the 5.3.0 to 5.2.5 downgrader to recover the camera.
This provides a starting point to then modify the mtdblock6 to give a fully upgradeable camera.

Thanks! Re modifying the mtdblock6 - is this the best instructions for that as I have no access to my original files? Hikvision 5.2.5 & 5.2.8 Full English (INC DAYS OF WEEK) mtd Hack

Also - the link you send in the conversation came through as plain text so would appreciate if you could send just the link again

Thanks!

 

[alastairstevenson]

There are new (unpublished on here) ways beyond the 'mtd hack' to modify the mtdblock6 which allow full updates to 5.4.5
We don't really need the original file.
Don't worry about that for now.
If the camera can be back working, even with CN menus (would that work for you?) further changes can be done after you come back.

 

[IMF]

There are new (unpublished on here) ways beyond the 'mtd hack' to modify the mtdblock6 which allow full updates to 5.4.5
We don't really need the original file.
Don't worry about that for now.
If the camera can be back working, even with CN menus (would that work for you?) further changes can be done after you come back.

Would my NVR accept it being chinese?

Your file was the first success flash I got! After 10 mins it did pop up in SADP as the min system. Tried flashing "CH downngrade_digicap.dav" and currently stuck at "Completed" but haven't lost ping yet at least! How long does it normally take before I give up and try a different downgrade file?

 

[IMF]

Would my NVR accept it being chinese?

Your file was the first success flash I got! After 10 mins it did pop up in SADP as the min system. Tried flashing "CH downngrade_digicap.dav" and currently stuck at "Completed" but haven't lost ping yet at least! How long does it normally take before I give up and try a different downgrade file?

"EN downgrade_digicap.dav" worked for me!

My camera is back live!!! You are an absolute legend. Now to figure out how to get back to English so my NVR will be able to play with it!!

 

[jesd03]

I have a quick question which might not be possible.

I messed up my camera doing an upgrade and now it is stuck on recovery. It still has the static IP which i had assigned to the camera and i am able to access it via telnet and also login using 'root' and '12345'.

Is there anyway to recover this (push firmware) by other means over the network as it does not see the tftp i am running, does the tftp IP need to be on 192.0.*.* network?

The reason is, the camera is in a difficult place and cabling to NVR is also in a difficult place hence looking to see there was another solution. I can also run FTP to camera if there a way to recover via that.

Thanks

 

[alastairstevenson]

I messed up my camera doing an upgrade and now it is stuck on recovery. It still has the static IP which i had assigned to the camera and i am able to access it via telnet and also login using 'root' and '12345'.

Is there anyway to recover this (push firmware) by other means over the network as it does not see the tftp i am running, does the tftp IP need to be on 192.0.*.* network?

If you have a telnet root shell, you should be able to do something like this:
As you can use telnet, the camera and PC are on the same network address range, so no problems there.
You need a normal tftp server on the PC. In my experience, this one works well : TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server
Ensure the fixed up mtdblock6 (or any other files you want to transfer such as a firmware update) is in the same folder as the tftp server.


Here is a worked example, that may also be of use to others, showing how the 'min-system' recovery mode can provide some useful capabilities.
This 'recovery mode' is the one that has been applied with the 'brick-fix' tool. The newer version, from firmware 5.4.0 or later, no longer has these facilities.
Yet another obstacle Hikvision have put in the way of people trying to make best use of the cameras they have purchased.

I started with a working system, but rebooted into the min-system mode just for demonstration.
In this case, for convenience, I changed the IP address to match the address the tftp server was running on.
Also - I didn't make any changes to the camera, it's just to demonstrate what can be done.

In your case, you'd transfer in your modified mtdblock6 and apply it to the camera and reboot.
What's also interesting is that you can also transfer in a digicap.dav firmware file, and apply it to the camera using the 'upgrade' command.

#
#
#
# prtHardInfo
Start at 2017-10-06 10:41:25
Serial NO :DS-2CD2232-I520151218CCCH564451008
V5.4.5 build 170123
NetProcess Version: 1.6.1 [17:24:18-Jan 13 2017]
Db Encrypt Version: 65537
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
encodeChans             = 1
decodeChans             = 1
alarmInNums             = 0
alarmOutNums            = 0
ataCtrlNums             = 0
flashChipNums           = 0
ramSize                 = 0x4000000
networksNums            = 1
language                        = 1
devType                 = 0x9807
net reboot count        = 0
Path: .
Working Copy Root Path: /usr/local/jenkins/workspace/Frontend_BaseLine_Publish_Build_InterfaceII/2539
URL: https://192.0.0.140/Camera/Platform/Branches/branches_frontend_software_platform/IPC_develop_branch/ipc_5.4.0_R0
Repository Root: https://192.0.0.140/Camera
Repository UUID: df2d70c3-7593-7941-af1e-571b313c0946
Revision: 253120
Node Kind: directory
Schedule: normal
Last Changed Author: liudan9
Last Changed Rev: 253065
Last Changed Date: 2017-01-23 17:45:28 +0800 (Mon, 23 Jan 2017)

#
# set_sysflag -m 1
[  122.056164] set_minisys_en_flag, en:1
[  122.059876] use default reserved area information!
[  122.065428] reboot times :3
# reboot
The system is going down NOW!
[10-06 10:42:48][pid:863][STRM_ANLS][ERROR]Client close fd break
Sent SIGTERM to all processes
Terminated
# shared mem deleted

Deinit........Yes!
[10-06 10:42:49][pid:843][STRM_A[  131.598781] ambarella-wdt ambarella-wdt: Not stopping watchdog, V first!
NLS][ERROR]Client close fd break
Sent SIGKILL to all processes
Requesting system reboot
[  133.435905] Restarting system.


U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
begin to enter mini system

# ifconfig
eth0      Link encap:Ethernet  HWaddr 28:57:BE:5C:F5:5F
          inet addr:192.0.0.64  Bcast:192.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1459 (1.4 KiB)  TX bytes:1248 (1.2 KiB)
          Interrupt:27

# ifconfig eth0 192.168.1.64 up
#
# tftp -g -r mtd6_orig 192.168.1.99
[ INFO][MIN]TFTP: #####################
# ls -al
drwxrwxrwx    2         0 Mar 28  2014 lib
drwxrwxrwx    2         0 Mar 28  2014 sbin
drwxr-xr-x    2       448 Oct  6 10:42 davinci
drwxrwxrwx    3         0 Mar 28  2014 usr
drwxr-xr-x    2         0 Oct  6 10:42 home
drwxr-xr-x    2       256 Oct  6 10:42 config
drwxrwxrwx    2         0 Mar 28  2014 bin
drwxr-xr-x    2      2496 Sep 29 20:41 dav
drwxr-xr-x    2      2288 Jul  5 21:45 dav_sec
drwxrwxrwx    3         0 Mar 28  2014 etc
drwxr-xr-x   11         0 Oct  6 10:42 sys
-rwxrwxrwx    1         6 Mar 28  2014 VERSION
drwxrwxrwx    2         0 Mar 28  2014 tmp
drwxrwxrwt    3      3120 Oct  6 10:42 dev
dr-xr-xr-x   57         0 Jan  1  1970 proc
lrwxrwxrwx    1         9 Mar 28  2014 init -> sbin/init
-rw-r--r--    1    524288 Oct  6 10:44 mtd6_orig
drwxrwxrwx   16         0 Oct  6 10:44 ..
drwxrwxrwx   16         0 Oct  6 10:44 .
#
# cat /dev/mtd6 > mtd6_test
# ls -al
drwxrwxrwx    2         0 Mar 28  2014 lib
drwxrwxrwx    2         0 Mar 28  2014 sbin
drwxr-xr-x    2       448 Oct  6 10:42 davinci
drwxrwxrwx    3         0 Mar 28  2014 usr
drwxr-xr-x    2         0 Oct  6 10:42 home
drwxr-xr-x    2       256 Oct  6 10:42 config
drwxrwxrwx    2         0 Mar 28  2014 bin
drwxr-xr-x    2      2496 Sep 29 20:41 dav
drwxr-xr-x    2      2288 Jul  5 21:45 dav_sec
drwxrwxrwx    3         0 Mar 28  2014 etc
drwxr-xr-x   11         0 Oct  6 10:42 sys
-rwxrwxrwx    1         6 Mar 28  2014 VERSION
drwxrwxrwx    2         0 Mar 28  2014 tmp
drwxrwxrwt    3      3120 Oct  6 10:42 dev
dr-xr-xr-x   57         0 Jan  1  1970 proc
lrwxrwxrwx    1         9 Mar 28  2014 init -> sbin/init
-rw-r--r--    1    524288 Oct  6 10:44 mtd6_orig
-rw-r--r--    1    524288 Oct  6 10:44 mtd6_test
drwxrwxrwx   16         0 Oct  6 10:44 ..
drwxrwxrwx   16         0 Oct  6 10:44 .
#
# tftp -p -l mtd6_test 192.168.1.99
[ INFO][MIN]TFTP: #####################
#
#
# # End of example!
#

 

[jesd03]

Thanks for the info.

So just to confirm once i have transferred the custom_mtdblock6 file i ran the below command and rebooted.

cat mtd6_temp > /dev/mtdblock6

just trying the upgrade method now to see if it recovers

Thanks

 

[jesd03]

Excellent i am all back up and running. Thanks Alastairstevenson saved me some time

 

[alastairstevenson]

Brilliant result!
Well done indeed.

*edit*
So you used tftp when in a telnet root shell in the min-system recovery kernel?
That could be an interesting route for others to take.
The brick-fix tool if applied and left for 10 mins for the watchdog to reboot gets the camera into that mode.
Another path, and quite easy in fact.

 

[jesd03]

Yep used the tftp when in a telnet root shell in the min-system.

Transferred the firmware and as you suggested the "upgrade" command did the trick.

 

[plattfisk]

I am also looking for the 525 digicap.dav as im trying to restore my cam after a failed attemt to do the mtdblock6 hack. Is it still around someware?

 

[alastairstevenson]

I am also looking for the 525 digicap.dav as im trying to restore my cam after a failed attemt to do the mtdblock6 hack. Is it still around someware?

The '5.3.0 to 5.2.5 downgrader' can be found via the second link in the first post here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

What went wrong with your mtdblock6 changes?

 

[plattfisk]

The '5.3.0 to 5.2.5 downgrader' can be found via the second link in the first post here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

What went wrong with your mtdblock6 changes?

I Dont know, I did the hex editing thing and replaced mtdblock6 in the camera, upgraded to 5.4.5 via the webinterface. and after that its not coming back. It boots and responds to ping at 192.0.0.64, all a bit different depending on what firmware version i am trying.

 

[plattfisk]

The '5.3.0 to 5.2.5 downgrader' can be found via the second link in the first post here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English

What went wrong with your mtdblock6 changes?

Thanx for the fw link. It did not work unfortunately. I did never save the mtdblock5 so I guess its lost.

 

[alastairstevenson]

upgraded to 5.4.5 via the webinterface.

You need to update through the major versions, not a single big jump.
Check the status with SADP. If the firmware shows as 4.0.8 then it's in 'min-system' recovery mode.

I did the hex editing thing and replaced mtdblock6 in the camera,

How confident are you that it was correct?

Suggestion, as 5.4.5 has been attempted, so the 'downgrade block' will be in effect:

Use the 'brick-fix tool' to fix the downgrade block.
Downgrade to 5.2.5 with the '5.3.0 to 5.2.5 downgrader'.
Re-evaluate the mtdblock6 values for correctness.
Check mtdblock1 locations 0x0C and 0x8000C and if 0, change to 2.
Guides in here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

 

[almemento]

Hi, I have 2CD-2532F-IS camera. I try to do mtd hack, but i have mistake in mtdblock6.
now my camera is on 192.0.0.64 - 2CD-Min-System - from brick-fix tool.
i try to tftp 5.30 Downgrade, 525.zip ... server is my pc 192.0.0.128 but i can't connect by tftp ;/
i can telnet to 192.0.0.64 - min-system. but tftp not.

here is log: cat/proc/kmsg:

(none) login: root
Password:
login: can't chdir to home directory '/root/'
# cat /proc/kmsg
<5>Linux version 2.6.38.8 (wangqian@ipcteam2) (gcc version 4.6.1 (Sourcery CodeB ench Lite 2011.09-70) )
<5>#42 PREEMPT Thu Apr 3 13:10:04 CST 2014
<4>CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
<4>CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
<4>Machine: Coconut
<4>Ignoring unrecognised tag 0x44000426
<4>Memory policy: ECC disabled, Data cache writeback
<6>Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
<6>Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
<6>Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
<6>Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
<6>Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
<6>Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
<7>On node 0 totalpages: 25344
<7>free_area_init_node: node 0, pgdat c0493be8, node_mem_map c04b3000
<7> Normal zone: 198 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 25146 pages, LIFO batch:7
<4>bootmem_init: high_memory = 0xc8a00000
<7>pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>pcpu-alloc: [0] 0
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
<5>Kernel command line: console=ttyS0 dbg=0 IP=192.168.1.64 MASK=255.255.255.0 G W=0.0.0.0 SERVER=192.168.1.128 video=amb0fb:720x480,720x480,1,0
<6>PID hash table entries: 512 (order: -1, 2048 bytes)
<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 99MB = 99MB total
<5>Memory: 91512k/91512k available, 9864k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5> vector : 0xffff0000 - 0xffff1000 ( 4 kB)
<5> fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
<5> DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
<5> vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
<5> lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
<5> modules : 0xbf000000 - 0xc0000000 ( 16 MB)
<5> .init : 0xc0008000 - 0xc022c000 (2192 kB)
<5> .text : 0xc022c000 - 0xc0476000 (2344 kB)
<5> .data : 0xc0476000 - 0xc04942a0 ( 121 kB)
<6>Preemptable hierarchical RCU implementation.
<6> RCU-based detection of stalled CPUs is disabled.
<6> Verbose stalled-CPUs detection is disabled.
<6>NR_IRQS:224
<6>sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
<2>sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>2 8
<2>sched_clock: fix multiply/shift to avoid scheduler hiccups
<4>Console: colour dummy device 80x30
<6>console [ttyS0] enabled
<6>Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
<6>pid_max: default: 32768 minimum: 301
<4>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>NET: Registered protocol family 16
<6>Ambarella Coconut:
<6> chip id: 5100
<6> board type: 3
<6> board revision: 10
<6> chip name: a5m
<6> HAL version: 176869
<6> reference clock: 24000000
<6> system configuration: 0x177804ea
<6> boot type: 0x00000002
<6> hif type: 0x00000000
<4>bio: create slab <bio-0> at 0
<6>ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
<5>ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] p robed!
<5>ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] p robed!
<6>i2c i2c-0: Added multiplexed i2c bus 2
<6>ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
<6>Switching to clocksource ambarella-cs-timer
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<6>TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 4096 bind 4096)
<6>TCP reno registered
<6>UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>Unpacking initramfs...
<0>Initramfs unpacking failed: junk in compressed archive
<6>Freeing initrd memory: 4096K
<0>[ kernel version: svn-69900 ]
<4>mmc0 power register success!
<4>mmc1 power register success!
<1>use default reserved area information!
<6>reboot times :2
<6>msgmni has been set to 186
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
<6>NAND device: Manufacturer ID: 0x98, Chip ID: 0xd1 (Toshiba NAND 128MiB 3,3V 8 -bit)
<4>ambarella_nand_config_flash: 0x02e00140, 0x02c00140
<7>Bad block table found at page 65472, version 0x01
<7>Bad block table found at page 65408, version 0x01
<6>ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation fou nd!
<5>Creating 18 MTD partitions on "ambnand":
<5>0x000000000000-0x000000020000 : "bst"
<5>0x000000020000-0x000000120000 : "ptb"
<5>0x000000120000-0x000000220000 : "bld"
<5>0x000000220000-0x000000320000 : "hal"
<5>0x000000320000-0x000000420000 : "ano_ptb"
<5>0x000000420000-0x0000004a0000 : "env"
<5>0x0000004a0000-0x000000520000 : "param"
<5>0x000000520000-0x000000620000 : "dpt"
<5>0x000000620000-0x000001020000 : "rcvy"
<5>0x000001020000-0x000001820000 : "krn_pri"
<5>0x000001820000-0x000002020000 : "krn_sec"
<5>0x000002020000-0x000002420000 : "rmd_pri"
<5>0x000002420000-0x000002820000 : "rmd_sec"
<5>0x000002820000-0x000004020000 : "app_pri"
<5>0x000004020000-0x000005820000 : "app_sec"
<5>0x000005820000-0x000005c20000 : "cfg_pri"
<5>0x000005c20000-0x000006020000 : "cfg_sec"
<5>0x000006020000-0x000007020000 : "dbg"
<6>Ambarella MII Bus: probed
<5>ambarella-eth ambarella-eth.0: MAC Address[c4:2f:91:6b:d1:1f].
<6>mousedev: PS/2 mouse device common for all mice
<6>ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
<6>i2c /dev entries driver
<5>ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambare lla-wdt].
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<6>ambarella-rtc ambarella-rtc: setting system clock to 2017-10-10 20:38:34 UTC (1507667914)
<6>Freeing init memory: 2192K
<5>net eth0: Could not find default PHY in 9.
<5>net eth0: Try PHY[3] whose id is 0x001cc816!
<5>UBI: attaching mtd13 to ubi1
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 175
<5>UBI: attached mtd13 to ubi1
<5>UBI: MTD device name: "app_pri"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 76/48
<5>UBI: image sequence number: 168376761
<5>UBI: background thread "ubi_bgt1d" started, PID 322
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 1, volume 0, name "app_pri"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd14 to ubi2
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 146
<5>UBI: attached mtd14 to ubi2
<5>UBI: MTD device name: "app_sec"
<5>UBI: MTD device size: 24 MiB
<5>UBI: number of good PEBs: 192
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 192
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 73/40
<5>UBI: image sequence number: 2027796861
<5>UBI: background thread "ubi_bgt2d" started, PID 333
<6>PHY: 0:03 - Link is Up - 100/Full
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 2, volume 0, name "app_sec"
<5>UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
<5>UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 1078659 bytes (1053 KiB)
<5>UBI: attaching mtd15 to ubi3
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 115
<5>UBI: attached mtd15 to ubi3
<5>UBI: MTD device name: "cfg_pri"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 108/105
<5>UBI: image sequence number: 1442792204
<5>UBI: background thread "ubi_bgt3d" started, PID 344
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)
<5>UBI: attaching mtd16 to ubi4
<5>UBI: physical eraseblock size: 131072 bytes (128 KiB)
<5>UBI: logical eraseblock size: 129024 bytes
<5>UBI: smallest flash I/O unit: 2048
<5>UBI: sub-page size: 512
<5>UBI: VID header offset: 512 (aligned 512)
<5>UBI: data offset: 2048
<5>UBI: max. sequence number: 114
<5>UBI: attached mtd16 to ubi4
<5>UBI: MTD device name: "cfg_sec"
<5>UBI: MTD device size: 4 MiB
<5>UBI: number of good PEBs: 32
<5>UBI: number of bad PEBs: 0
<5>UBI: number of corrupted PEBs: 0
<5>UBI: max. allowed volumes: 128
<5>UBI: wear-leveling threshold: 4096
<5>UBI: number of internal volumes: 1
<5>UBI: number of user volumes: 1
<5>UBI: available PEBs: 0
<5>UBI: total number of reserved PEBs: 32
<5>UBI: number of PEBs reserved for bad PEB handling: 2
<5>UBI: max/mean erase counter: 112/109
<5>UBI: image sequence number: 1198415260
<5>UBI: background thread "ubi_bgt4d" started, PID 355
<5>UBIFS: recovery needed
<5>UBIFS: recovery completed
<5>UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
<5>UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
<5>UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
<5>UBIFS: media format: w4/r0 (latest is w4/r0)
<5>UBIFS: default compressor: lzo
<5>UBIFS: reserved for root: 103599 bytes (101 KiB)