R6 DS-2CD2542FWD-IS BootLoop

[DrGEM]

Hi. I hawe 2 camera R6 DS-2CD2542FWD-IS with similar defect - bootloop. What happened to them before is unknown. Log is identical.

Spoiler: Log

U-Boot 3.1.6-195297 (May 25 2016-11:39:03)
boards:195277
Boot From: NAND 2048 RC
SYS_CONFIG: 0x30060059 POC: 100
Cortex freq: 600000000
ENET freq: 50000000
iDSP freq: 216000000
Dram freq: 564000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000

dev_modelS-2CD2542FWD-IS

*** Warning - bad CRC, using default environment
crc=0xC1CD2D34,env.crc=0xFFFFFFFF
|NUL eth|
cmd 'null' is not supported.
nand booting ...
booting from pri part...
load kernel...

init started: BusyBox v1.19.3 (2019-08-26 15:55:19 CST)
starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 60
route: ioctl 0x890c failed: No such process
Default method to init without VIN drivers...
Cat this file to find out what VIN can be supported.
Default init without lens driver
Use default settings
/home/script/init.sh: line 553: which: not found
/
[ 19.925251] [ kernel version: svn-594950 ]
map_size = 0x400000, nr_item = 3
addr_offset = 0x00000000, filename = orccode.bin
addr_offset = 0x00300000, filename = orcme.bin
addr_offset = 0x003a0000, filename = default_binary.bin
mmap returns 0x76ab0000
loading /home/firmware/orccode.bin...addr = 0x76ab0000, size = 0x171cca
loading /home/firmware/orcme.bin...addr = 0x76db0000, size = 0x51644
loading /home/firmware/default_binary.bin...addr = 0x76e50000, size = 0x40000

===============================================

ucode (S2L) version = 2017/5/25 271820.271498

===============================================

ln: prtLensCurve: File exists

ln: /dev/ttyS1: File exists

ln: /bin/t1: File exists

cp: can't stat '/dav/libutils.so': No such file or directory

chmod: /lib/libutils.so: No such file or directory

ln: /dev/rtc: File exists

=====check_config start=====

===db file doesn't exist===

===db file doesn't exist===

==== both config files are broken====

infd read End

Unix bus 0 .

Enter DB_main-------------------

shared memory address is: 0x76bbf000, sizeof(DEVICECONFIG) = 1159944

netprocess Infomation:

version: 8.11.3 [14:45:39-Jun 22 2018]

Path: /Camera/Platform/Trunk/FSP_network_protocol

Last Changed Rev: 404021

Last Changed Date: 2018-06-22 14:14:20 +0800 (Fri, 22 Jun 2018)

.

wait davinci set default...

[04-09 13:15:03][pid:572][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1

[04-09 13:15:03][pid:579][STRM_ANLS] [ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]

[04-09 13:15:03][pid:579][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.

[04-09 13:15:03][pid:579][UNI_IF][ERROR]communicaite_to_davinci failed!!!

copy default.cls ok.

[04-09 13:15:04][pid:572][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1

[04-09 13:15:04][pid:579][STRM_ANLS] [ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]

[04-09 13:15:04][pid:579][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.

[04-09 13:15:04][pid:579][UNI_IF][ERROR]communicaite_to_davinci failed!!!

[04-09 13:15:05][pid:572][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1

[04-09 13:15:05][pid:579][STRM_ANLS] [ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]

[04-09 13:15:05][pid:579][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.

[04-09 13:15:05][pid:579][UNI_IF][ERROR]communicaite_to_davinci failed!!!

Unix bus End

shared memory address is: 0x769bb000, sizeof(DEV_CAPABILITY) = 464336

[04-09 13:15:05][pid:593][HW_IF][ERROR]sec info get inval!!!

[04-09 13:15:05][pid:593][SYSINIT][ERROR]hwif_getsecinfo failed.

[04-09 13:15:05][pid:593][SYSINIT][ERROR]sys app init failed to reboot!

[04-09 13:15:06][pid:572][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1

[04-09 13:15:06][pid:579][STRM_ANLS] [ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]

[04-09 13:15:06][pid:579][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.

[04-09 13:15:06][pid:579][UNI_IF][ERROR]communicaite_to_davinci failed!!!

[04-09 13:15:07][pid:572][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1

[04-09 13:15:07][pid:579][STRM_ANLS] [ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]

[04-09 13:15:07][pid:579][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.

[04-09 13:15:07][pid:579][UNI_IF][ERROR]communicaite_to_davinci failed!!!

[ 30.831013] Restarting system.

Both cameras have labels written V 5.4.3_160902 .
I flash firmware :
IPC_R6_EN_STD_5.3.8_151224 - digicap package error!!!ret=-1
IPC_R6_EN_STD_5.4.0_160401 - digicap package error!!!ret=-1
IPC_R6_EN_STD_5.5.0_170725 - Ok
IPC_R6_EN_STD_5.5.82_190220 - Ok

Result - BOOTLOOP

Spoiler: Firmware flash log

U-Boot 3.1.6-195297 (May 25 2016-11:39:03)

boards:195277

Boot From: NAND 2048 RC

SYS_CONFIG: 0x30060059 POC: 100

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_modelS-2CD2542FWD-IS

*** Warning - bad CRC, using default environment

crc=0xC1CD2D34,env.crc=0xFFFFFFFF

Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

Formatting ............................................................................................................................................................................................................ done!

[ INFO][MIN]TFTP: TFTP from server 192.168.1.128

[ INFO][MIN]TFTP: Filename: 'digicap.dav'

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: ################################################################################

[ INFO][MIN]TFTP: #####################

[ INFO][MIN]TFTP: Download File

[OK][ INFO][MIN]BURN: File size is 33322648 bytes (32541 KB)

[ INFO][MIN]BURN: Writing Flash

[ INFO][MIN]BURN: ..............................................................................................................

[ INFO][MIN]BURN: Write Flash

[OK] UPDATE COMPLETE

BusyBox v1.2.1 Protect Shell (psh)

Enter 'help' for a list of davinci system commands.

# help

Support Commands:

taskShow printPart prtHardInfo

getPreviewStatus setIp setV6ip

setGateway dspStatus outputClose

outputOpen getDebug setDebug

debugLog getIrstate getMtu

camCmd getCamVer getIrstate

getLux getMcuInfo getMotion

getRawdata setIrcmd setRectFrame

updateCamera setLaserMode getLaserMode

setIrMode getIrMode setBaiguangMode

getBaiguangMode setYTLock InquireFanSwitch

StartLaser CloseLaser LaserMotReset

EnlargeCur ReduceCur SetCur

LaserMotDirect LaserTeleOffset LaserWideOffset

InqSwitch InqCurrent InqCurMotDirect

getMcuStateInfo setFastFocus getTrackStatus

getSelfcheckResult setLdcMode getLdcMode

getPreviewStatus appCmd camCmd

ezoomlens_start_t2_test prtLensCurve getLensCurve

getIp gdbcfg {Test1}

{Test2} {Test3} {Test4}

{TestN} {TestY} getIsp

getISP getisp setIsp

setISP setisp regread

regwrite setAgingMode getAgingMode

setAgingTime getAgingTime setLensZoomPos

getLensZoomPos dm365 ss

showKey showServer showUpnp

showStatus showDefence setLBS

setAlarm cloudService t1

ifconfig netstat ping

ping6 top iostat

mpstat ps reset

dmesg exit getDateInfo

diagnose help

i try command in terminal setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Spoiler: LOG

U-Boot 3.1.6-195297 (May 25 2016-11:39:03)
boards:195277
Boot From: NAND 2048 RC
SYS_CONFIG: 0x30060059 POC: 100
Cortex freq: 600000000
ENET freq: 50000000
iDSP freq: 216000000
Dram freq: 564000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
dev_modelS-2CD2542FWD-IS
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
cmd 'null' is not supported.
nand booting ...
booting from pri part...
load kernel...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.10.73+ (zhangjianzhong@Cpl-Frt-BSP) (gcc ?? 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #12 PREEMPT Thu Jul 20 11:10:40 CST 2017
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[ 0.000000] dev type:0x2218
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9
[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0
[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000
[ 0.000000] Ambarella: FBMEM = 0x06800000[ ],0x00000000
[ 0.000000] On node 0 totalpages: 28160
[ 0.000000] free_area_init_node: node 0, pgdat 807d48f8, node_mem_map 80805000
[ 0.000000] Normal zone: 220 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 28160 pages, LIFO batch:7
[ 0.000000] CPU: All CPU(s) started in SVC mode.
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940
[ 0.000000] Kernel command line: console=ttyS0 debug=9 KRN_PRT=pri KRN_PRT=pri
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 110MB = 110MB total
[ 0.000000] Memory: 103360k/103360k available, 9280k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 k
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 k
[ 0.000000] vmalloc : 0x87000000 - 0xff000000 (1920 M
[ 0.000000] lowmem : 0x80000000 - 0x86e00000 ( 110 M
[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 M
[ 0.000000] .text : 0x80008000 - 0x80502750 (5098 k
[ 0.000000] .init : 0x80503000 - 0x80793bd4 (2627 k
[ 0.000000] .data : 0x80794000 - 0x807dc690 ( 290 k
[ 0.000000] .bss : 0x807dc690 - 0x808002b0 ( 144 k
[ 0.000000] NR_IRQS:240
[ 0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.273236] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[ 0.332603] pid_max: default: 32768 minimum: 301
[ 11.131854] Mount-cache hash table entries: 512
[ 11.138813] CPU: Testing write buffer coherency: ok
[ 11.143981] Setting up static identity map for 0x803cbe08 - 0x803cbe78
[ 11.153914] devtmpfs: initialized
[ 11.158414] pinctrl core: initialized pinctrl subsystem
[ 11.163956] NET: Registered protocol family 16
[ 11.169132] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 11.176521] L310 cache controller enabled
[ 11.180556] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[ 11.189946] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[ 11.197958] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[ 11.205761] read dev-tree[misc_ctrl_pin] pro [rst_time] error!
[ 11.211600] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!
[ 11.220033] bio: create slab <bio-0> at 0
[ 11.225099] ambarella-dma e0005000.dma: Ambarella DMA Engine
[ 11.232755] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[ 11.239733] Advanced Linux Sound Architecture Driver Initialized.
[ 11.246570] Switching to clocksource ambarella-cs-timer
[ 11.258309] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[ 11.266623] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 11.275495] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[ 11.351907] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[ 11.357884] NET: Registered protocol family 2
[ 11.363138] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 11.370104] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 11.377577] TCP: Hash tables configured (established 1024 bind 1024)
[ 11.384001] TCP: reno registered
[ 11.387219] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 11.393067] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 11.399494] NET: Registered protocol family 1
[ 11.404157] RPC: Registered named UNIX socket transport module.
[ 11.410060] RPC: Registered udp transport module.
[ 11.414801] RPC: Registered tcp transport module.
[ 11.419484] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 11.624254] msgmni has been set to 201
[ 11.629318] NET: Registered protocol family 38
[ 11.633930] io scheduler noop registered
[ 11.637836] io scheduler deadline registered
[ 11.642144] io scheduler cfq registered (default)
[ 11.647677] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[ 11.655453] brd: module loaded
[ 11.661103] loop: module loaded
[ 11.667010] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[ 11.672698] ambarella_nand: Use On Flash BBT
[ 11.677020] NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[ 11.689248] Bad block table found at page 65472, version 0x03
[ 11.695168] Bad block table found at page 65408, version 0x03
[ 11.701059] nand_read_bbt: bad block at 0x0000002e0000
[ 11.706205] nand_read_bbt: bad block at 0x000004040000
[ 11.711407] 16 ofpart partitions found on MTD device amba_nand
[ 11.717239] Creating 16 MTD partitions on "amba_nand":
[ 11.722404] 0x000000000000-0x000000020000 : "bst"
[ 11.727868] 0x000000020000-0x000000120000 : "bld"
[ 11.733285] 0x000000120000-0x000000200000 : "ptb"
[ 11.738590] 0x000000200000-0x000000280000 : "env"
[ 11.743984] 0x000000280000-0x000000380000 : "sysflg"
[ 11.749600] 0x000000380000-0x000000400000 : "param"
[ 11.755204] 0x000000400000-0x000000500000 : "dpt"
[ 11.760555] 0x000000500000-0x000000f00000 : "rcvy"
[ 11.766080] 0x000000f00000-0x000001700000 : "krn_pri"
[ 11.771793] 0x000001700000-0x000001f00000 : "krn_sec"
[ 11.777603] 0x000001f00000-0x000004100000 : "app_pri"
[ 11.783449] 0x000004100000-0x000006300000 : "app_sec"
[ 11.789169] 0x000006300000-0x000006900000 : "cfg_pri"
[ 11.794912] 0x000006900000-0x000006f00000 : "cfg_sec"
[ 11.800590] 0x000006f00000-0x000007700000 : "dbg"
[ 11.806012] 0x000007700000-0x000007f00000 : "syslog"
[ 11.812159] ambarella-spi e0020000.spi: SPI[0] uses DMA
[ 11.817520] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.
[ 11.824723] tun: Universal TUN/TAP device driver, 1.6
[ 11.829755] tun: © 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 11.891852] libphy: Ambarella MII Bus: probed
[ 11.896206] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[ 11.905337] mdio_bus e000e000.etherne: scan phy phy at address 0
[ 11.912832] mdio_bus e000e000.etherne: registered phy phy at address 0
[ 11.919353] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[ 11.926655] ambarella-eth e000e000.ethernet: MAC Address[a4:14:37:5c:7a:bb].
[ 11.933800] PPP generic driver version 2.4.2
[ 11.938246] PPP BSD Compression module registered
[ 11.942969] PPP Deflate Compression module registered
[ 11.948172] mousedev: PS/2 mouse device common for all mice
[ 14.951864] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[ 14.958734] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[ 14.966419] pcf85163 is not exist.
[ 14.969801] i2c /dev entries driver
[ 14.973823] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[ 14.981150] Netfilter messages via NETLINK v0.30.
[ 14.985971] nf_conntrack version 0.5.0 (1615 buckets, 6460 max)
[ 14.992258] ip_tables: © 2000-2006 Netfilter Core Team
[ 14.997597] TCP: cubic registered
[ 15.000925] NET: Registered protocol family 10
[ 15.006290] ip6_tables: © 2000-2006 Netfilter Core Team
[ 15.011716] sit: IPv6 over IPv4 tunneling driver
[ 15.016978] NET: Registered protocol family 17
[ 15.021483] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 15.029158] ThumbEE CPU extension supported.
[ 15.034590] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)
[ 15.043828] ALSA device list:
[ 15.046780] No soundcards found.
[ 15.052888] Freeing unused kernel memory: 2624K (80503000 - 80793000)
init started: BusyBox v1.19.3 (2017-07-20 11:10:26 CST)
starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev: [ OK ]
[ 15.646644] UBI: attaching mtd10 to ubi1
[ 15.736836] UBI: scanning is finished
[ 15.751056] UBI: attached mtd10 (name "app_pri", size 34 Mi to ubi1
[ 15.760284] UBI: PEB size: 131072 bytes (128 Ki, LEB size: 126976 bytes
[ 15.767135] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 15.773839] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 15.780689] UBI: good PEBs: 271, bad PEBs: 1, corrupted PEBs: 0
[ 15.786598] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 15.793721] UBI: max/mean erase counter: 841/222, WL threshold: 4096, image sequence number: 871084521
[ 15.803009] UBI: available PEBs: 0, total reserved PEBs: 271, PEBs reserved for bad PEB handling: 9
[ 15.812052] UBI: background thread "ubi_bgt1d" started, PID 271
UBI device number 1, total 271 LEBs (34410496 bytes, 32.8 Mi, available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 Ki
waiting for /dev/ubi1_0.
[ 15.833586] UBIFS: background thread "ubifs_bgt1_0" started, PID 276
[ 15.859857] UBIFS: recovery needed
[ 15.912672] UBIFS: recovery completed
[ 15.916526] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[ 15.922677] UBIFS: LEB size: 126976 bytes (124 Ki, min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 15.931785] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[ 15.941429] UBIFS: reserved for root: 1487352 bytes (1452 Ki
[ 15.947262] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 7E5D4477-3FA9-4CAA-8A56-AF37F226493F, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[ 15.970368] UBI: attaching mtd12 to ubi3
[ 15.989785] UBI: scanning is finished
[ 16.003569] UBI: attached mtd12 (name "cfg_pri", size 6 Mi to ubi3
[ 16.009909] UBI: PEB size: 131072 bytes (128 Ki, LEB size: 126976 bytes
[ 16.019443] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 16.026209] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 16.033085] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[ 16.038893] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 16.046018] UBI: max/mean erase counter: 7542/5942, WL threshold: 4096, image sequence number: 1159182107
[ 16.055567] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[ 16.064611] UBI: background thread "ubi_bgt3d" started, PID 280
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 Mi, available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 Ki
waiting for /dev/ubi3_0.
[ 16.086115] UBIFS: background thread "ubifs_bgt3_0" started, PID 285
[ 16.112668] UBIFS: recovery needed
[ 16.129970] UBIFS: recovery completed
[ 16.133875] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[ 16.139995] UBIFS: LEB size: 126976 bytes (124 Ki, min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 16.149132] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[ 16.158425] UBIFS: reserved for root: 143937 bytes (140 Ki
[ 16.164080] UBIFS: media format: w4/r0 (latest is w4/r0), UUID D703E8B0-C688-43A6-9DF7-BC0102AC4A13, small LPT model
Check dir /davinci ok! (0)
[ 16.189822] UBI: attaching mtd13 to ubi4
[ 16.209212] UBI: scanning is finished
[ 16.212882] probe_rst_pin exceed
[ 16.226382] UBI: attached mtd13 (name "cfg_sec", size 6 Mi to ubi4
[ 16.235491] UBI: PEB size: 131072 bytes (128 Ki, LEB size: 126976 bytes
[ 16.242336] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 16.249013] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 16.255882] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[ 16.261690] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 16.268811] UBI: max/mean erase counter: 2704/1632, WL threshold: 4096, image sequence number: 2001898068
[ 16.278358] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[ 16.287398] UBI: background thread "ubi_bgt4d" started, PID 290
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 Mi, available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 Ki
waiting for /dev/ubi4_0.
[ 16.308855] UBIFS: background thread "ubifs_bgt4_0" started, PID 295
[ 16.336151] UBIFS: recovery needed
[ 16.354071] UBIFS: recovery completed
[ 16.357926] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[ 16.364082] UBIFS: LEB size: 126976 bytes (124 Ki, min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 16.373208] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[ 16.382497] UBIFS: reserved for root: 143937 bytes (140 Ki
[ 16.388139] UBIFS: media format: w4/r0 (latest is w4/r0), UUID ACFAF1FC-D283-4D13-AF3F-903A6CB6F424, small LPT model
Check dir /config ok! (0)
diagnose_way = 15, repair_way = 1, interval = 60
[ 16.453068] net eth0: adv: sym 1, asym: 1
[ 16.457239] net eth0: lp: sym: 0, asym: 0
[ 16.461299] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
route: ioctl 0x890c failed: No such process
[ 18.451629] dsp: module license 'Proprietary' taints kernel.
[ 18.457596] net eth0: lp: sym: 1, asym: 1
[ 18.461592] libphy: e000e000.etherne:00 - Link is Up - 100/Full
[ 18.469685] Disabling lock debugging due to kernel taint
[ 18.475088] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 18.515461] img: IMG KERN VIRT: WR [0x87329000, 184 KB], RD [0x84750000, 36 KB].
Default method to init without VIN drivers...
Cat this file to find out what VIN can be supported.
Default init without lens driver
[ 18.624619] amba_debug_init 248:248.
Use default settings
/home/script/init.sh: line 553: which: not found
/
[ 18.842188] base module init.
[ 18.857870] [ kernel version: svn-300837 ]
[ 18.866805] mmc0 power register success!
[ 18.870755] mmc1 power register success!
[ 18.874740] request sd[mmc1] power ctrl pin error!
[ 18.879511] usb0 power register success!
[ 18.899359] usbcore: registered new interface driver usbfs
[ 18.912914] usbcore: registered new interface driver hub
[ 18.921674] usbcore: registered new device driver usb
[ 18.932535] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 18.945260] ehci-ambarella: AMBARELLA-EHCI Host Controller driver
[ 18.951533] ambarella-ehci e0018000.ehci: EHCI Host Controller
[ 18.957514] ambarella-ehci e0018000.ehci: new USB bus registered, assigned bus number 1
[ 18.965738] ambarella-ehci e0018000.ehci: irq 39, io mem 0xe0018000
[ 18.993516] ambarella-ehci e0018000.ehci: USB 2.0 started, EHCI 1.00
[ 18.999938] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 19.006892] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 19.014119] usb usb1: Product: EHCI Host Controller
[ 19.018977] usb usb1: Manufacturer: Linux 3.10.73+ ehci_hcd
[ 19.024541] usb usb1: SerialNumber: AmbUSB
[ 19.031349] hub 1-0:1.0: USB hub found
[ 19.040446] hub 1-0:1.0: 2 ports detected
map_size = 0x400000, nr_item = 3
addr_offset = 0x00000000, filename = orccode.bin
addr_offset = 0x00300000, filename = orcme.bin
addr_offset = 0x003a0000, filename = default_binary.bin
mmap returns 0x76a45000
loading /home/firmware/orccode.bin...addr = 0x76a45000, size = 0x171cca
loading /home/firmware/orcme.bin...addr = 0x76d45000, size = 0x51644
loading /home/firmware/default_binary.bin...addr = 0x76de5000, size = 0x40000
===============================================
ucode (S2L) version = 2017/5/25 271820.271498
===============================================
ln: prtLensCurve: File exists
ln: /dev/ttyS1: File exists
ln: /bin/t1: File exists
cp: can't stat '/dav/libutils.so': No such file or directory
chmod: /lib/libutils.so: No such file or directory
ln: /dev/rtc: File exists
=====check_config start=====
===db file doesn't exist===
===db file doesn't exist===
==== both config files are broken====
infd read End
Unix bus 0 .

netprocess Infomation:
version: 5.10.2 [20:30:33-Jul 18 2017]
Path: /Camera/Platform/Trunk/FSP_network_protocol
Last Changed Rev: 299284
Last Changed Date: 2017-07-14 17:00:38 +0800 (Fri, 14 Jul 2017)
.

Enter DB_main-------------------
shared memory address is: 0x76c5a000, sizeof(DEVICECONFIG) = 959848
wait davinci set default...
[01-01 00:00:24][pid:546][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 00:00:24][pid:553] [IPC][ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 00:00:24][pid:553][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 00:00:24][pid:553][UNI_IF][ERROR]communicaite_to_davinci failed!!!
copy default.cls ok.
[01-01 00:00:25][pid:546][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 00:00:25][pid:553] [IPC][ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 00:00:25][pid:553][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 00:00:25][pid:553][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-01 00:00:26][pid:546][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 00:00:26][pid:553] [IPC][ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 00:00:26][pid:553][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 00:00:26][pid:553][UNI_IF][ERROR]communicaite_to_davinci failed!!!
Unix bus End
shared memory address is: 0x76934000, sizeof(DEV_CAPABILITY) = 258664
[01-01 00:00:27][pid:567][HW_IF][ERROR]sec info get inval!!!
[01-01 00:00:27][pid:567][SYSINIT][ERROR]hwif_getsecinfo failed.
[01-01 00:00:27][pid:567][SYSINIT][ERROR]sys app init failed to reboot!
[01-01 00:00:27][pid:546][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 00:00:27][pid:553] [IPC][ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 00:00:27][pid:553][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 00:00:27][pid:553][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[01-01 00:00:28][pid:546][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[01-01 00:00:28][pid:553] [IPC][ERROR]from daemon ack, dst not work len 0 , load_type is [0x10012]
[01-01 00:00:28][pid:553][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[01-01 00:00:28][pid:553][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[ 29.731041] ambarella-wdt e800c000.wdt: ambarella_wdt_shutdown @ 4.
[ 29.737339] Restarting system.

on dmesg camera response

Spoiler: dmesg

# dmesg

Booting Linux on physical CPU 0x0

Initializing cgroup subsys cpu

Linux version 3.10.73+ (zhangjianzhong@Cpl-Frt-BSP) (gcc ?? 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #1 PREEMPT Wed May 25 11:46:31 CST 2016

CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d

CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache

Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board

dev type:0x2218

Memory policy: ECC disabled, Data cache writeback

Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0

Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0

Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9

Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0

Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0

Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0

Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0

Ambarella: IAVMEM = 0x06800000[ ],0x09800000

Ambarella: FBMEM = 0x06800000[ ],0x00000000

On node 0 totalpages: 26112

free_area_init_node: node 0, pgdat 805d19e8, node_mem_map 805f3000

Normal zone: 204 pages used for memmap

Normal zone: 0 pages reserved

Normal zone: 26112 pages, LIFO batch:7

CPU: All CPU(s) started in SVC mode.

pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768

pcpu-alloc: [0] 0

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25908

Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 MS_ACTION=auto_update

PID hash table entries: 512 (order: -1, 2048 bytes)

Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

Memory: 102MB = 102MB total

Memory: 97352k/97352k available, 7096k reserved, 0K highmem

Virtual kernel memory layout:

vector : 0xffff0000 - 0xffff1000 ( 4 kB)

fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)

vmalloc : 0x86800000 - 0xff000000 (1928 MB)

lowmem : 0x80000000 - 0x86600000 ( 102 MB)

modules : 0x7f000000 - 0x80000000 ( 16 MB)

.text : 0x80008000 - 0x80381cc4 (3560 kB)

.init : 0x80382000 - 0x8059ce54 (2156 kB)

.data : 0x8059e000 - 0x805d20c0 ( 209 kB)

.bss : 0x805d20c0 - 0x805ee9e0 ( 115 kB)

NR_IRQS:240

sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms

Console: colour dummy device 80x30

console [ttyS0] enabled

Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)

pid_max: default: 32768 minimum: 301

Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

Setting up static identity map for 0x802a1608 - 0x802a1678

devtmpfs: initialized

pinctrl core: initialized pinctrl subsystem

NET: Registered protocol family 16

DMA: preallocated 256 KiB pool for atomic coherent allocations

L310 cache controller enabled

l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B

ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered

ambarella-gpio gpio.0: Ambarella GPIO driver registered

read dev-tree[misc_ctrl_pin] pro [rst_time] error!

read dev-tree[misc_ctrl_pin] pro [rst_delay] error!

bio: create slab <bio-0> at 0

ambarella-dma e0005000.dma: Ambarella DMA Engine

Switching to clocksource ambarella-cs-timer

cfg80211: Calling CRDA to update world regulatory domain

NET: Registered protocol family 2

TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)

TCP: reno registered

UDP hash table entries: 256 (order: 0, 4096 bytes)

UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

NET: Registered protocol family 1

msgmni has been set to 190

alg: No test for stdrng (krng)

io scheduler noop registered

io scheduler deadline registered

io scheduler cfq registered (default)

e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart

ambarella-nand e0001000.nand: in ecc-[1]bit mode

ambarella_nand: Use On Flash BBT

NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64

Bad block table found at page 65472, version 0x03

Bad block table found at page 65408, version 0x03

nand_read_bbt: bad block at 0x0000002e0000

nand_read_bbt: bad block at 0x000004040000

16 ofpart partitions found on MTD device amba_nand

Creating 16 MTD partitions on "amba_nand":

0x000000000000-0x000000020000 : "bst"

0x000000020000-0x000000120000 : "bld"

0x000000120000-0x000000200000 : "ptb"

0x000000200000-0x000000280000 : "env"

0x000000280000-0x000000380000 : "sysflg"

0x000000380000-0x000000400000 : "param"

0x000000400000-0x000000500000 : "dpt"

0x000000500000-0x000000f00000 : "rcvy"

0x000000f00000-0x000001700000 : "krn_pri"

0x000001700000-0x000001f00000 : "krn_sec"

0x000001f00000-0x000004100000 : "app_pri"

0x000004100000-0x000006300000 : "app_sec"

0x000006300000-0x000006900000 : "cfg_pri"

0x000006900000-0x000006f00000 : "cfg_sec"

0x000006f00000-0x000007700000 : "dbg"

0x000007700000-0x000007f00000 : "syslog"

libphy: Ambarella MII Bus: probed

mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address

mdio_bus e000e000.etherne: scan phy phy at address 0

mdio_bus e000e000.etherne: registered phy phy at address 0

ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!

ambarella-eth e000e000.ethernet: MAC Address[a4:14:37:5c:7a:bb].

mousedev: PS/2 mouse device common for all mice

ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0

ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.

TCP: cubic registered

NET: Registered protocol family 17

VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4

ThumbEE CPU extension supported.

ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)

Freeing unused kernel memory: 2152K (80382000 - 8059c000)

net eth0: adv: sym 1, asym: 1

net eth0: lp: sym: 0, asym: 0

base module init.

hikio: module license 'Proprietary' taints kernel.

Disabling lock debugging due to kernel taint

init hikio.

UBI: attaching mtd10 to ubi1

UBI: scanning is finished

UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1

UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

UBI: good PEBs: 271, bad PEBs: 1, corrupted PEBs: 0

UBI: user volume: 0, internal volumes: 1, max. volumes count: 128

UBI: max/mean erase counter: 846/225, WL threshold: 4096, image sequence number: 1527447547

UBI: available PEBs: 258, total reserved PEBs: 13, PEBs reserved for bad PEB handling: 9

UBI: background thread "ubi_bgt1d" started, PID 54

UBIFS: default file-system created

UBIFS: background thread "ubifs_bgt1_0" started, PID 61

UBIFS: mounted UBI device 1, volume 0, name "app_pri"

UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)

UBIFS: reserved for root: 1487352 bytes (1452 KiB)

UBIFS: media format: w4/r0 (latest is w4/r0), UUID E586DDEF-42A9-49A9-9573-D2FA3785C156, small LPT model

UBI: attaching mtd11 to ubi2

UBI: scanning is finished

UBI: attached mtd11 (name "app_sec", size 34 MiB) to ubi2

UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0

UBI: user volume: 0, internal volumes: 1, max. volumes count: 128

UBI: max/mean erase counter: 46/29, WL threshold: 4096, image sequence number: 538709095

UBI: available PEBs: 258, total reserved PEBs: 14, PEBs reserved for bad PEB handling: 10

UBI: background thread "ubi_bgt2d" started, PID 67

UBIFS: default file-system created

UBIFS: background thread "ubifs_bgt2_0" started, PID 74

UBIFS: mounted UBI device 2, volume 0, name "app_sec"

UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 b

I'm not good at Linux, but soldering and reading or writing nand is not a problem for me. I read 128Mb nand if need i hawe dump. Camera need only in local network without cloud. Can someone help with advice on how to launch cameras . Thank you and sorry for my english.

 

[alastairstevenson]

[01-01 00:00:27][pid:567][HW_IF][ERROR]sec info get inval!!!
[01-01 00:00:27][pid:567][SYSINIT][ERROR]hwif_getsecinfo failed.

I'd speculate that the bootpara data in the security chip is corrupt.
The 'magic number' "SWKH" is not found.
Perhaps someone has been attempting to modify it and triggered the in-built protection.
This is a fatal error, causing a reboot.

text:0012C722 loc_12C722                              ; CODE XREF: hwif_getsecinfo+42?j
.text:0012C722                 LDR             R3, [SP,#0x120+s] ; We read the data into SP offset up by 0x10
.text:0012C724                 LDR             R2, =0x484B5753 ; "SWKH"
.text:0012C726                 CMP             R3, R2
.text:0012C728                 BEQ             loc_12C73C ; So far, so good. Magic number OK.
.text:0012C72A                 LDR             R3, =aHwif_getseci_0 ; "hwif_getsecinfo"
.text:0012C72C                 MOVS            R0, #2
.text:0012C72E                 MOVS            R1, #0x26
.text:0012C730                 LDR             R2, =aHardwareifR_10 ; "hardwareif/r6_s2lm/core/coreinfo.c"
.text:0012C732                 STR             R3, [SP,#0x120+var_120]
.text:0012C734                 LDR             R3, =aSecInfoGetInva ; "sec info get inval!!!\n"
.text:0012C736                 STR             R3, [SP,#0x120+var_11C]
.text:0012C738                 MOVS            R3, #0xCD
.text:0012C73A                 B               loc_12C75A

I hawe 2 camera R6 DS-2CD2542FWD-IS with similar defect - bootloop. What happened to them before is unknown.

Did you buy them as 'previously used' ?

 

[DrGEM]

I bought them as non-working. I connected the analyzer with the ISO7816 plugin to IC marked as VS16 and didn’t understand anything from the communication protocol, if it helps I can write Saleae session and send it. It is possible to run them ?

 

[alastairstevenson]

IC marked as VS16

Is that this chip?

Watchdata EMV chips in R6, G0 and other cameras

So... It turns out that, unlike DVRs and older cameras, newer hikvision cams, including R6 and G0, store its configuration settings in smartcard chips. The chips are made by Watchdata and they run TimeCOS. Basically, your cameras have the same chip as you VISA credit card. That chip stores...

ipcamtalk.com

It is possible to run them ?

From what I understand, they have an in-built erase function when tampered with.

didn’t understand anything from the communication protocol, if it helps I can write Saleae session and send it

It's not something I have any knowledge of.

 

[DrGEM]

Is that this chip?

- Yes

From what I understand, they have an in-built erase function when tampered with.

I only connect analyzer i do not write on chip
It is possible to somehow get around this problem , and start camera, may be custom firmware or other solution?

 

[alastairstevenson]

I only connect analyzer i do not write on chip

Maybe the previous owner was trying that.

It is possible to somehow get around this problem

I don't know.
There may be some clues in what @JAFO or @montecrypto showed in the linked post.

 

[DrGEM]

Maybe the previous owner was trying that.

Maybe

 

[watchful_ip]

- Yes
I only connect analyzer i do not write on chip
It is possible to somehow get around this problem , and start camera, may be custom firmware or other solution?

If it is the EMV chip - it is possible. But it's a pain and you'll need a fair bit of knowledge about how these cameras work from a software perspective.

I think you said you don't know much linux. How are you on software reversing?

I have a G0 camera the EMV chip has been security tripped. Still works but a fair amount of work is required to bypass it. Though in G0 cameras case the kernel will reboot before davinci ever runs if it is not happy about the EMV chip. Your logs show it's davinci rebooting the camera which makes me wonder if it's the related mtd partition data instead.

 

[alastairstevenson]

EMV chip has been security tripped.

What was done to it - or was it someone else?

Still works

Works normally?
So have you hard-coded the missing data somewhere?

 

[watchful_ip]

Yes it me when playing around with it.

Yes works normally.

I had a copy of the encrypted data provided from the EMV > Kernel > hikcomm.ko so I patched the kernel to not talk to the EMV chip at all (which would cause a reboot), and simply return the expected encrypted data to hikcomm.ko when it asks.

 

[alastairstevenson]

That does sound quite fiddly.
But a bit of a challenge.
It sounds like you have a working repack for the kernel. I've never quite managed that. Yet.

 

[watchful_ip]

Well I had a spare camera to play with back in Feb 2016 (the 24th according to my notes!) and wanted to figure out how it was all working before it was publicly known. I knew there was some risk if I prodded it enough but I was OK with that

Just made a fun little challenge to get it working again but was already looking at that part of the security so didn't take long to fix.

But for someone not already familiar with linux, reversing, kernel etc it would be very hard with a steep learning curve I would expect.

 

[watchful_ip]

I can't see "Card authentication succeeded" in the dmesg posted.

I've recently replaced my R6 with a G3 camera and don't have stock R6 dmesg to hand.

Does someone with an R6 want to check dmesg to see if it is supposed to be there? If yes then this appears to confirm an EMV chip issue. Perhaps R6 responds differently to an EMV chip failure or does it at a later stage (triggered by davinci).

I am too lazy to decompile the related files to check.

 

[watchful_ip]

I think it should be after I quickly checked the kernel.

Plus this is a BIG delay in the posted dmesg:

[ 0.332603] pid_max: default: 32768 minimum: 301
[ 11.131854] Mount-cache hash table entries: 512

Pretty sure this should have "Card authentication succeeded" during that time which is presumably silently failing and unlike G0 kernel doesn't immediately cause a reboot.

 

[alastairstevenson]

Does someone with an R6 want to check dmesg to see if it is supposed to be there?

This from a DS-2CD2T42WD which is also a Kiwi board :

.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x0
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x06800000[          ],0x09800000
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25908
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 102MB = 102MB total
[    0.000000] Memory: 95392k/95392k available, 9056k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x86800000 - 0xff000000   (1928 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86600000   ( 102 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x804fb2cc   (5069 kB)
[    0.000000]       .init : 0x804fc000 - 0x8077b71c   (2558 kB)
[    0.000000]       .data : 0x8077c000 - 0x807b69a0   ( 235 kB)
[    0.000000]        .bss : 0x807b69a0 - 0x807d94a8   ( 139 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.230913] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.292603] pid_max: default: 32768 minimum: 301
[    1.755116] Card authentication succeeded
[    1.759180] Mount-cache hash table entries: 512
[    1.765882] CPU: Testing write buffer coherency: ok
[    1.771057] Setting up static identity map for 0x803c20c0 - 0x803c2118

 

[watchful_ip]

Yes as I thought - should take about 1.45 seconds to communicate to the EMV chip to get the encrypted params. This doesn't happen successfully in OPs dmesg and why it doesn't work (and takes almost 11 seconds to fail).

OP did send me the mtd dump of the camera and the params mtd partition looks correct.

 

[DrGEM]

Ok i connect ic to smart card reader and is responding in Smart Card ToolSet PRO Demo

Spoiler: LOG

SMART CARD
TYPE NAME .................... ISO-7816 Smart Card


ICC STATE
ATR STRING ................... 3B 6D 00 00 68 6B 00 08 20 0A 19 24 33 07 54 00 74
ICC PRESENCE ................. 2
ICC INTERFACE STATUS ......... 255
ICC TYPE PER ATR ............. 1
CURRENT IO STATE ............. < no info >

PROTOCOL
DEFAULT DATA RATE ............ 10753
MAX DATA RATE ................ 344086
ASYNC PROTOCOL TYPES ......... 3
DEFAULT CLK .................. 4000
MAX CLK ...................... 4000
MAX IFSD ..................... 254
SYNC PROTOCOL TYPES .......... < no info >

IFD PROTOCOL
CURRENT PROTOCOL TYPE ........ 1
CURRENT CLK .................. 4000
CURRENT F .................... 372
CURRENT D .................... 1
CURRENT N .................... 0
CURRENT W .................... 10
CURRENT IFSC ................. 0
CURRENT IFSD ................. 254
CURRENT BWT .................. 0
CURRENT CWT .................. 0
CURRENT EBC ENCODING ......... 0
EXTENDED BWT ................. < no info >

How to interrogate a chip to find out if it answers correctly, what software need?

 

[watchful_ip]

Well you can use available tools to decrypt the firmware, then unpack the kernel, then decompile it to find the communication protocol keys and methods. The link already posted above might have the correct keys, or maybe not I never checked on my R6.

Just bear in mind the kernel running on the camera is already doing that and failing. Perhaps there was a hardware error that resoldering and checking the traces would resolve but if it is an EMV chip problem then you are likely out of luck. I'm not aware anyone outside Hikvision has written to these chips.

Given you have 2 of these cameras with the same fault (and from same source?) then it sounds like someone was messing around with them implying this is not a hardware fault. In that case patching the camera software seems the only remaining option.

 

[DrGEM]

That is log without EMV Chip (I desolder it)

Spoiler: Log Without EMV

U-Boot 3.1.6-195297 (May 25 2016-11:39:03)

boards:195277

Boot From: NAND 2048 RC


SYS_CONFIG: 0x30060059 POC: 100


Cortex freq: 600000000


ENET freq: 50000000


iDSP freq: 216000000


Dram freq: 564000000


Core freq: 216000000


AHB freq: 108000000


APB freq: 54000000


UART freq: 24000000


SD freq: 50000000


SDIO freq: 50000000


SDXC freq: 60000000


dev_modelS-2CD2542FWD-IS

Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0


|NUL eth|


cmd 'null' is not supported.


nand booting ...


booting from pri part...

load kernel...


[ 0.000000] Booting Linux on physical CPU 0x0

[ 0.000000] Initializing cgroup subsys cpu

[ 0.000000] Linux version 3.10.73+ (zhangjianzhong@Cpl-Frt-BSP) (gcc ?? 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #12 PREEMPT Thu Jul 20 11:10:40 CST 2017

[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d

[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache

[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board

[ 0.000000] dev type:0x2218

[ 0.000000] Memory policy: ECC disabled, Data cache writeback

[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0

[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0

[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9

[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0

[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0

[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0

[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0

[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000

[ 0.000000] Ambarella: FBMEM = 0x06800000[ ],0x00000000

[ 0.000000] On node 0 totalpages: 28160

[ 0.000000] free_area_init_node: node 0, pgdat 807d48f8, node_mem_map 80805000

[ 0.000000] Normal zone: 220 pages used for memmap

[ 0.000000] Normal zone: 0 pages reserved

[ 0.000000] Normal zone: 28160 pages, LIFO batch:7

[ 0.000000] CPU: All CPU(s) started in SVC mode.

[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768

[ 0.000000] pcpu-alloc: [0] 0

[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940

[ 0.000000] Kernel command line: console=ttyS0 debug=9 KRN_PRT=pri KRN_PRT=pri

[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)

[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

[ 0.000000] Memory: 110MB = 110MB total

[ 0.000000] Memory: 103360k/103360k available, 9280k reserved, 0K highmem

[ 0.000000] Virtual kernel memory layout:

[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)

[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)

[ 0.000000] vmalloc : 0x87000000 - 0xff000000 (1920 MB)

[ 0.000000] lowmem : 0x80000000 - 0x86e00000 ( 110 MB)

[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 MB)

[ 0.000000] .text : 0x80008000 - 0x80502750 (5098 kB)

[ 0.000000] .init : 0x80503000 - 0x80793bd4 (2627 kB)

[ 0.000000] .data : 0x80794000 - 0x807dc690 ( 290 kB)

[ 0.000000] .bss : 0x807dc690 - 0x808002b0 ( 144 kB)

[ 0.000000] NR_IRQS:240

[ 0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms

[ 0.000000] Console: colour dummy device 80x30

[ 0.000000] console [ttyS0] enabled

[ 0.273250] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)

[ 0.332603] pid_max: default: 32768 minimum: 301

[ 14.700456] Mount-cache hash table entries: 512

[ 14.707407] CPU: Testing write buffer coherency: ok

[ 14.712576] Setting up static identity map for 0x803cbe08 - 0x803cbe78

[ 14.722526] devtmpfs: initialized

[ 14.727025] pinctrl core: initialized pinctrl subsystem

[ 14.732562] NET: Registered protocol family 16

[ 14.737738] DMA: preallocated 256 KiB pool for atomic coherent allocations

[ 14.745132] L310 cache controller enabled

[ 14.749132] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B

[ 14.758555] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered

[ 14.766569] ambarella-gpio gpio.0: Ambarella GPIO driver registered

[ 14.774366] read dev-tree[misc_ctrl_pin] pro [rst_time] error!

[ 14.780204] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!

[ 14.788596] bio: create slab <bio-0> at 0

[ 14.793705] ambarella-dma e0005000.dma: Ambarella DMA Engine

[ 14.801333] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!

[ 14.808314] Advanced Linux Sound Architecture Driver Initialized.

[ 14.815152] Switching to clocksource ambarella-cs-timer

[ 14.826855] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]

[ 14.835173] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000

[ 14.844043] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA

[ 14.920487] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz

[ 14.926466] NET: Registered protocol family 2

[ 14.931727] TCP established hash table entries: 1024 (order: 1, 8192 bytes)

[ 14.938693] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

[ 14.946167] TCP: Hash tables configured (established 1024 bind 1024)

[ 14.952588] TCP: reno registered

[ 14.955806] UDP hash table entries: 256 (order: 0, 4096 bytes)

[ 14.961654] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

[ 14.968089] NET: Registered protocol family 1

[ 14.972750] RPC: Registered named UNIX socket transport module.

[ 14.978651] RPC: Registered udp transport module.

[ 14.983390] RPC: Registered tcp transport module.

[ 14.988073] RPC: Registered tcp NFSv4.1 backchannel transport module.

[ 15.191161] msgmni has been set to 201

[ 15.196223] NET: Registered protocol family 38

[ 15.200821] io scheduler noop registered

[ 15.204727] io scheduler deadline registered

[ 15.208989] io scheduler cfq registered (default)

[ 15.214562] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart

[ 15.222350] brd: module loaded

[ 15.227988] loop: module loaded

[ 15.233892] ambarella-nand e0001000.nand: in ecc-[1]bit mode

[ 15.239537] ambarella_nand: Use On Flash BBT

[ 15.243898] NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64

[ 15.256130] Bad block table found at page 65472, version 0x03

[ 15.262051] Bad block table found at page 65408, version 0x03

[ 15.267941] nand_read_bbt: bad block at 0x0000002e0000

[ 15.273088] nand_read_bbt: bad block at 0x000004040000

[ 15.278290] 16 ofpart partitions found on MTD device amba_nand

[ 15.284143] Creating 16 MTD partitions on "amba_nand":

[ 15.289273] 0x000000000000-0x000000020000 : "bst"

[ 15.294761] 0x000000020000-0x000000120000 : "bld"

[ 15.300106] 0x000000120000-0x000000200000 : "ptb"

[ 15.305480] 0x000000200000-0x000000280000 : "env"

[ 15.310867] 0x000000280000-0x000000380000 : "sysflg"

[ 15.316477] 0x000000380000-0x000000400000 : "param"

[ 15.322083] 0x000000400000-0x000000500000 : "dpt"

[ 15.327438] 0x000000500000-0x000000f00000 : "rcvy"

[ 15.332959] 0x000000f00000-0x000001700000 : "krn_pri"

[ 15.338672] 0x000001700000-0x000001f00000 : "krn_sec"

[ 15.344476] 0x000001f00000-0x000004100000 : "app_pri"

[ 15.350253] 0x000004100000-0x000006300000 : "app_sec"

[ 15.356043] 0x000006300000-0x000006900000 : "cfg_pri"

[ 15.361775] 0x000006900000-0x000006f00000 : "cfg_sec"

[ 15.367451] 0x000006f00000-0x000007700000 : "dbg"

[ 15.372867] 0x000007700000-0x000007f00000 : "syslog"

[ 15.378965] ambarella-spi e0020000.spi: SPI[0] uses DMA

[ 15.384392] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.


[ 15.391564] tun: Universal TUN/TAP device driver, 1.6

[ 15.396594] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>

[ 15.460432] libphy: Ambarella MII Bus: probed

[ 15.464786] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address

[ 15.473918] mdio_bus e000e000.etherne: scan phy phy at address 0

[ 15.481409] mdio_bus e000e000.etherne: registered phy phy at address 0

[ 15.487930] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!

[ 15.495233] ambarella-eth e000e000.ethernet: MAC Address[a4:14:37:5c:7a:bb].

[ 15.502377] PPP generic driver version 2.4.2

[ 15.506825] PPP BSD Compression module registered

[ 15.511548] PPP Deflate Compression module registered

[ 15.516757] mousedev: PS/2 mouse device common for all mice

[ 18.520444] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!

[ 18.527314] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0

[ 18.534998] pcf85163 is not exist.

[ 18.538380] i2c /dev entries driver

[ 18.542398] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.

[ 18.549724] Netfilter messages via NETLINK v0.30.

[ 18.554545] nf_conntrack version 0.5.0 (1615 buckets, 6460 max)

[ 18.560837] ip_tables: (C) 2000-2006 Netfilter Core Team

[ 18.566178] TCP: cubic registered

[ 18.569506] NET: Registered protocol family 10

[ 18.574867] ip6_tables: (C) 2000-2006 Netfilter Core Team

[ 18.580293] sit: IPv6 over IPv4 tunneling driver

[ 18.585561] NET: Registered protocol family 17

[ 18.590067] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4

[ 18.597743] ThumbEE CPU extension supported.

[ 18.603175] ambarella-rtc e8015000.rtc: setting system clock to 1970-01-01 00:06:05 UTC (365)

[ 18.611796] ALSA device list:

[ 18.614747] No soundcards found.

[ 18.620856] Freeing unused kernel memory: 2624K (80503000 - 80793000)


init started: BusyBox v1.19.3 (2017-07-20 11:10:26 CST)


starting pid 46, tty '': '/etc/init.d/rcS'

Starting udev: [ OK ]

[ 19.216289] UBI: attaching mtd10 to ubi1

[ 19.306319] UBI: scanning is finished

[ 19.320604] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1

[ 19.327030] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 19.336547] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 19.343315] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 19.350166] UBI: good PEBs: 271, bad PEBs: 1, corrupted PEBs: 0

[ 19.356085] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128

[ 19.363212] UBI: max/mean erase counter: 847/225, WL threshold: 4096, image sequence number: 1527447547

[ 19.372587] UBI: available PEBs: 0, total reserved PEBs: 271, PEBs reserved for bad PEB handling: 9

[ 19.381631] UBI: background thread "ubi_bgt1d" started, PID 271

UBI device number 1, total 271 LEBs (34410496 bytes, 32.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

waiting for /dev/ubi1_0.

[ 19.403217] UBIFS: background thread "ubifs_bgt1_0" started, PID 276

[ 19.429615] UBIFS: recovery needed

[ 19.446874] UBIFS: recovery completed

[ 19.450778] UBIFS: mounted UBI device 1, volume 0, name "app_pri"

[ 19.456901] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 19.466039] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)

[ 19.475680] UBIFS: reserved for root: 1487352 bytes (1452 KiB)

[ 19.481509] UBIFS: media format: w4/r0 (latest is w4/r0), UUID E586DDEF-42A9-49A9-9573-D2FA3785C156, small LPT model

pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1

[ 19.504681] UBI: attaching mtd12 to ubi3

[ 19.523995] UBI: scanning is finished

[ 19.537670] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3

[ 19.546792] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 19.553644] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 19.560323] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 19.567194] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0

[ 19.573016] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128

[ 19.580126] UBI: max/mean erase counter: 7548/5945, WL threshold: 4096, image sequence number: 1414869433

[ 19.589675] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10

[ 19.598719] UBI: background thread "ubi_bgt3d" started, PID 280

UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

waiting for /dev/ubi3_0.

[ 19.620198] UBIFS: background thread "ubifs_bgt3_0" started, PID 285

[ 19.646789] UBIFS: recovery needed

[ 19.664070] UBIFS: recovery completed

[ 19.667930] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"

[ 19.674093] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 19.683223] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)

[ 19.692512] UBIFS: reserved for root: 143937 bytes (140 KiB)

[ 19.698154] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 8821894F-0E84-416B-986C-2E5ED4BB3460, small LPT model

Check dir /davinci ok! (0)

[ 19.724027] UBI: attaching mtd13 to ubi4

[ 19.743393] UBI: scanning is finished

[ 19.757098] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4

[ 19.766225] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

[ 19.773075] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

[ 19.779753] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096

[ 19.786617] probe_rst_pin exceed

[ 19.789833] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0

[ 19.795655] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128

[ 19.802775] UBI: max/mean erase counter: 2710/1636, WL threshold: 4096, image sequence number: 716144162

[ 19.812234] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10

[ 19.821275] UBI: background thread "ubi_bgt4d" started, PID 290

UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

waiting for /dev/ubi4_0.

[ 19.842866] UBIFS: background thread "ubifs_bgt4_0" started, PID 295

[ 19.869814] UBIFS: recovery needed

[ 19.887601] UBIFS: recovery completed

[ 19.891494] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"

[ 19.897612] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes

[ 19.906744] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)

[ 19.916033] UBIFS: reserved for root: 143937 bytes (140 KiB)

[ 19.921684] UBIFS: media format: w4/r0 (latest is w4/r0), UUID B93366D6-35F0-4110-A497-72412EDE5D14, small LPT model

Check dir /config ok! (0)


starting pid 298, tty '': '-/bin/psh'

BusyBox v1.2.1-171136 Protect Shell (psh)

Enter 'help' for a list of davinci system commands.



#

 

[alastairstevenson]

Interesting!
No EMV chip - no reboot.
But it's never going to work without the bootpara data the chip provides, without some clever hacking to provide by a patched method.
I'm wondering if it's booted into recovery.
Though it looks a bit complete for recovery - though I've not seen an R6 series recovery anyway so I'm not sure.
(By the way - it's easier for us to read if you enclose the logs in the CODE tags - and for something big you can then also enclose them in the SPOILER tags as you have been doing.)

IPC_R6_EN_STD_5.5.0_170725 - Ok
IPC_R6_EN_STD_5.5.82_190220 - Ok

I was thinking you could try the MCR modded 5.4.5 that skips psh, but I suspect you'd get caught by the rollback block, even with the update command at the bootloader, as the 5.5.82 has been loaded.
Attached anyway.
It would give more chances to experiment.