TFTP Hassles with DS-7604N-E1/4P

[cozzmo]

I have got a DS-7604N-E1/4P which had v3.0.5 140508, i updated via USB stick to v3.0.8 140825 no issues. I didn't want to go whack straight up to a high firmware number, so i thought safer to step through upgrades. I went to load v3.0.10, v3.3.2, v3.3.4 and none will load now i get mismatch error. Even trying to load v3.0.5 back on i get mismatch...

I figure, no harm done, i'll use Hikvision TFTP to force v3.0.5 back onto it.

[2015-09-02 18:08:58] TFTP server[192.0.0.128] initialized
[2015-09-02 18:09:11] Device[192.0.0.64] test tftpserver
[2015-09-02 18:09:12] Connect client[192.0.0.64] success
[2015-09-02 18:09:12] Start file[D:\TFTP\digicap.dav] transmitting
[2015-09-02 18:09:20] Completed file[D:\TFTP\digicap.dav] transmit
[2015-09-02 18:09:37] Connect client[192.0.0.64] success
[2015-09-02 18:09:37] Open file[D:\TFTP\econt_Vision-AV2000
meout] failure


The NVR just boots up normally and doesn't actually load the firmware. I'm trying to reload v3.0.5 back onto it. Even tried to load other upgraded versions, same result.

I have tried different computers. Different firmware files. Direct crossover, through a standalone switch (as currently setup). Laptop is running winxp but also tried with my Win7 desktop with firewall disabled, same result.

I see so many threads where people had problems then suddenly it just worked for them. I must have power cycled and software rebooted the NVR dozens of times. I've tried having the NVR with different IP as well and manually setting it to 192.0.0.64 (as set now) and all result is the same. Tried different folders for the TFTP software to run from.

Next step, please ?

 

[alastairstevenson]

none will load now i get mismatch error.

Does it say 'firmware mismatch' or 'language mismatch' or none of these?
If it's 'language mismatch' you can swap the language in the firmware header with Hiktools: http://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware
Also - as it's still booting - and a fairly early version of firmware - you should still be able to activate telnet and log in, and maybe get more info as to what's happening by checking the kernel log, at a command prompt:
cat /proc/kmsg
then Control-C to return.

 

[cozzmo]

Thanks for your reply.


"Upgrading fails, firmware mismatches"

So does this mean the firmware is not meant for this unit ? I downloaded all the firmwares from the same folder, but i cannot recall the site i downloaded them all from. The v3.0.5 that i'm trying to load back on is the exact same version and build as what was on there originally.


Telnet stuff:

"<6>Booting Linux on physical CPU 0
<5>Linux version 3.4.35_hi3535 (root@debian) (gcc version 4.4.1 (Hisilicon_v100(                                              gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #35 SMP Mon May 26 10:07:16 CST                                               2014
<4>CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
<4>CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
<4>Machine: hi3535
<4>Memory policy: ECC disabled, Data cache writealloc
<7>On node 0 totalpages: 45312
<7>free_area_init_node: node 0, pgdat c0754d80, node_mem_map c079f000
<7>  Normal zone: 354 pages used for memmap
<7>  Normal zone: 0 pages reserved
<7>  Normal zone: 44958 pages, LIFO batch:7
<6>PERCPU: Embedded 7 pages/cpu @c090a000 s5248 r8192 d15232 u32768
<7>pcpu-alloc: s5248 r8192 d15232 u32768 alloc=8*4096
<7>pcpu-alloc: [0] 0 [0] 1
<4>Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 44958
<5>Kernel command line: mem=177M console=ttyS0,115200n8 noinitrd ip=192.0.0.64:1                                              92.0.0.128:192.0.0.1:255.255.255.0:Hik-eth:eth1:none
<6>PID hash table entries: 1024 (order: 0, 4096 bytes)
<6>Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
<6>Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Memory: 177MB = 177MB total
<5>Memory: 171724k/171724k available, 9524k reserved, 0K highmem
<5>Virtual kernel memory layout:
<5>    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
<5>    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
<5>    vmalloc : 0xcb800000 - 0xff000000   ( 824 MB)
<5>    lowmem  : 0xc0000000 - 0xcb100000   ( 177 MB)
<5>    modules : 0xbf000000 - 0xc0000000   (  16 MB)
<5>      .text : 0xc0008000 - 0xc04aa000   (4744 kB)
<5>      .init : 0xc04aa000 - 0xc0729480   (2558 kB)
<5>      .data : 0xc072a000 - 0xc0755520   ( 174 kB)
<5>       .bss : 0xc0755544 - 0xc079e808   ( 293 kB)
<6>SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
<6>Hierarchical RCU implementation.
<6>NR_IRQS:128
<6>sched_clock: 32 bits at 62MHz, resolution 16ns, wraps every 68719ms
<6>Console: colour dummy device 80x30
<6>Calibrating delay loop... 1987.37 BogoMIPS (lpj=9936896)
<6>pid_max: default: 32768 minimum: 301
<6>Mount-cache hash table entries: 512
<6>CPU: Testing write buffer coherency: ok
<6>CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
<6>Setting up static identity map for 0x803aa9f8 - 0x803aaa2c
<6>L310 cache controller enabled
<6>l2x0: 16 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x72430001, Cache size: 262144 B
<4>CPU1: Booted secondary processor
<6>CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
<6>Brought up 2 CPUs
<6>SMP: Total of 2 processors activated (3981.31 BogoMIPS).
<6>NET: Registered protocol family 16
<6>Serial: AMBA PL011 UART driver
<6>uart:0: ttyS0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
<6>console [ttyS0] enabled
<6>uart:1: ttyS1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
<6>uart:2: ttyS2 at MMIO 0x200a0000 (irq = 42) is a PL011 rev2
<6>uart:3: ttyS3 at MMIO 0x200b0000 (irq = 43) is a PL011 rev2
<6>bio: create slab <bio-0> at 0
<5>SCSI subsystem initialized
<7>libata version 3.00 loaded.
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<6>Switching to clocksource timer0
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
<6>TCP established hash table entries: 8192 (order: 4, 65536 bytes)
<6>TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
<6>TCP: Hash tables configured (established 8192 bind 8192)
<6>TCP: reno registered
<6>UDP hash table entries: 128 (order: 0, 4096 bytes)
<6>UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
<6>NET: Registered protocol family 1
<6>RPC: Registered named UNIX socket transport module.
<6>RPC: Registered udp transport module.
<6>RPC: Registered tcp transport module.
<6>RPC: Registered tcp NFSv4.1 backchannel transport module.
<7>hik_inner_rtc_init()
<6>hik_rtc hik_rtc.0: rtc core: registered hik_rtc as rtc0
<0>rtc: [2015-09-02 19:29:00],week is 3
<7>hik_rtc_init()
<6>HISI_IRDA-MF @Hi3520v100R001_C_0_2_0 2011-04-29 14:05:20
<4>hiir: init ok. ver=Apr 30 2014, 10:25:52.
<6>NTFS driver 2.1.30 [Flags: R/W].
<6>fuse init (API version 7.18)
<6>msgmni has been set to 335
<6>Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
<6>io scheduler noop registered (default)
<6>Loading iSCSI transport class v2.0-870.
<5>iscsi: registered transport (tcp)
<7>NCQ is supported.
<6>ahci: SSS flag set, parallel bus scan disabled
<6>ahci ahci.0: AHCI 0001.0300 32 slots 3 ports 6 Gbps 0x7 impl platform mode
<6>ahci ahci.0: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs b                                              oh
<6>scsi0 : ahci_platform
<6>scsi1 : ahci_platform
<6>ata1: SATA max UDMA/133 mmio [mem 0x12010000-0x1201ffff] port 0x100 irq 63
<6>ata2: SATA max UDMA/133 mmio [mem 0x12010000-0x1201ffff] port 0x180 irq 63
<6>Spi id table Version 1.22
<7>Hisfc350 Device Driver, Version 1.10
<6>Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
<6>SPI FLASH start_up_mode is 3 Bytes
<6>Spi(cs1):
<6>Block:64KB
<6>Chip:16MB
<6>Name:"W25Q128B"
<6>spi size: 0x16777216
<6>chip num: 1
<5>Creating 3 MTD partitions on "hi_sfc":
<5>0x000000000000-0x000000030000 : "mtdblock0"
<5>0x000000030000-0x000000050000 : "mtdblock1"
<5>0x000000050000-0x000001000000 : "mtdblock2"
<6>Fixed MDIO Bus: probed
<6>STMMAC driver:
<6>     platform registration...
<6>     done!
<6>Set system config register 0x200300ec with value 0x003f003f
<6>     done!
<6>     DWMAC1000 - user ID: 0x10, Synopsys ID: 0x36
<6>     Enhanced descriptor structure
<6>MACADDR in get is 0:0:0:0:0:0
<6>     eth0 - (dev. name: stmmaceth - id: 0, IRQ #59
<6>     IO base addr: 0xfe0a0000)
<4>GPIO MII Bus-1
<6>GPIO MII Bus: probed
<6>eth0: PHY ID 001cc852 at 0 IRQ 0 (GPIO MII Bus-1:00)
<6>eth0: PHY ID 001cc852 at 1 IRQ 0 (GPIO MII Bus-1:01)
<6>eth0: PHY ID 001cc852 at 2 IRQ 0 (GPIO MII Bus-1:02)
<6>eth0: PHY ID 001cc852 at 3 IRQ 0 (GPIO MII Bus-1:03)
<6>eth0: PHY ID 001cc852 at 4 IRQ 0 (GPIO MII Bus-1:04)
<6>eth0: PHY ID 001cc852 at 5 IRQ 0 (GPIO MII Bus-1:05)
<6>eth0: PHY ID 13148306 at 6 IRQ -6 (GPIO MII Bus-1:06) active
<6>     DWMAC1000 - user ID: 0x10, Synopsys ID: 0x36
<6>     Enhanced descriptor structure
<6>MACADDR in get is 0:0:0:0:0:0
<6>     eth1 - (dev. name: stmmaceth - id: 0, IRQ #59
<6>     IO base addr: 0xfe0a4000)
<6>STMMAC MII Bus: probed
<6>eth1: PHY ID 001cc915 at 0 IRQ 0 (STMMAC MII Bus-1:00)
<6>eth1: PHY ID 001cc915 at 7 IRQ -6 (STMMAC MII Bus-1:07) active
<6>stmmac_reset: RESET COMPLETE!
<6>
<6>**************************************************
<6>*  TNK driver built on May 22 2014 at 11:41:37
<6>*  TNK driver mode is TOE
<6>**************************************************
<6>stmmac: Rx Checksum Offload Engine supported
<6>stmmac: Rx Checksum Offload Engine supported
<6>PPP generic driver version 2.4.2
<6>PPP BSD Compression module registered
<6>PPP Deflate Compression module registered
<6>PPP MPPE Compression module registered
<6>NET: Registered protocol family 24
<6>ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
<6>hiusb-ehci hiusb-ehci.0: HIUSB EHCI
<6>hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
<6>hiusb-ehci hiusb-ehci.0: irq 54, io mem 0x10040000
<6>hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 2 ports detected
<6>ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
<6>hiusb-ohci hiusb-ohci.0: HIUSB OHCI
<6>hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
<6>hiusb-ohci hiusb-ohci.0: irq 53, io mem 0x10030000
<6>hub 2-0:1.0: USB hub found
<6>hub 2-0:1.0: 2 ports detected
<6>xhci-hcd hiusb3.0: xHCI Host Controller
<6>xhci-hcd hiusb3.0: new USB bus registered, assigned bus number 3
<6>xhci-hcd hiusb3.0: irq 64, io mem 0x12000000
<7>xHCI xhci_add_endpoint called for root hub
<7>xHCI xhci_check_bandwidth called for root hub
<6>hub 3-0:1.0: USB hub found
<6>hub 3-0:1.0: 1 port detected
<6>xhci-hcd hiusb3.0: xHCI Host Controller
<6>xhci-hcd hiusb3.0: new USB bus registered, assigned bus number 4
<7>xHCI xhci_add_endpoint called for root hub
<7>xHCI xhci_check_bandwidth called for root hub
<6>hub 4-0:1.0: USB hub found
<6>hub 4-0:1.0: 1 port detected
<6>Initializing USB Mass Storage driver...
<6>usbcore: registered new interface driver usb-storage
<6>USB Mass Storage support registered.
<6>mousedev: PS/2 mouse device common for all mice
<6>Hisilicon Watchdog Timer: 0.01 initialized. default_margin=15 sec (nowayout=                                               0, nodeamon= 1)
<6>usbcore: registered new interface driver usbhid
<6>usbhid: USB HID core driver
<6>TCP: cubic registered
<6>NET: Registered protocol family 10
<6>IPv6 over IPv4 tunneling driver
<6>NET: Registered protocol family 17
<6>hik_rtc hik_rtc.0: setting system clock to 2015-09-02 19:29:01 UTC (144122214                                              1)
<6>MACADDR in set is c0:56:e3:7:fd:9a
<6>ADDRCONF(NETDEV_UP): eth1: link is not ready
<6>usb 3-1: new low-speed USB device number 2 using xhci-hcd
<4>usb 3-1: ep 0x81 - rounding interval to 64 microframes, ep desc says 80 micro                                              frames
<6>input: PixArt USB Optical Mouse as /devices/platform/hiusb3.0/usb3/3-1/3-1:1.                                              0/input/input0
<6>generic-usb 0003:093A:2510.0001: input: USB HID v1.11 Mouse [PixArt USB Optic                                              al Mouse] on usb-hiusb3.0-1/input0
<6>ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
<6>ata1.00: HPA detected: current 390719855, native 390721968
<6>ata1.00: ATA-6: ST3200822AS, 3.01, max UDMA/133
<6>ata1.00: 390719855 sectors, multi 0: LBA48
<6>ata1.00: configured for UDMA/133
<5>scsi 0:0:0:0: Direct-Access     ATA      ST3200822AS      3.01 PQ: 0 ANSI: 5
<5>sd 0:0:0:0: [sda] 390719855 512-byte logical blocks: (200 GB/186 GiB)
<5>sd 0:0:0:0: [sda] Write Protect is off
<7>sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
<5>sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support                                               DPO or FUA
<6> sda: unknown partition table
<5>sd 0:0:0:0: [sda] Attached SCSI disk
<6>ata2: SATA link down (SStatus 0 SControl 300)
<6>IP-Config: Complete:
<6>     device=eth1, addr=192.0.0.64, mask=255.255.255.0, gw=192.0.0.1
<6>     host=Hik-eth, domain=, nis-domain=(none)
<6>     bootserver=192.0.0.128, rootserver=192.0.0.128, rootpath=
<6>Freeing init memory: 2556K
<6>PHY: STMMAC MII Bus-1:07 - Link is Up - 100/Full
<6>ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
<6>Hisilicon Media Memory Zone Manager
<4>hi3535_base: module license 'Proprietary' taints kernel.
<4>Disabling lock debugging due to kernel taint
<6>Hisilicon UMAP device driver interface: v3.00
<4>load sys.ko for Hi3535...OK!
<4>Load tde.ko ...OK!
<4>load vgs.ko for Hi3535...OK!
<4>load venc.ko for Hi3535...OK!
<4>load chnl.ko for Hi3535...OK!
<4>load h264e.ko for Hi3535...OK!
<4>load rc.ko for Hi3535...OK!
<4>load jpege.ko for Hi3535...OK!
<6>load vou.ko ....OK!
<6>load vpss.ko ....OK!
<6>load vda.ko ....OK!
<6>load region.ko ....OK!
<6>load vdec.ko ....OK
<6>load vhd firmware.ko OK
<6>load hdmi.ko ....OK!
<4>Load hi3535_jpegd.ko success.                (SDK_VERSION:[jpeg6bv1.0] Build                                               Time:[Feb 27 2014, 20:11:08])
<4>Load hi_cipher.ko success.
<4>acodec inited!
<6>vca encrypt ready!vca_encrypt_major = 252
<4>iscsid (887): /proc/887/oom_adj is deprecated, please use /proc/887/oom_score                                              _adj instead.
<6>MACADDR in set is c0:56:e3:7:fd:9a
<6>ADDRCONF(NETDEV_UP): eth1: link is not ready
<4>rtl830x mdio bus configed
<6>MACADDR in set is c0:56:e3:7:fd:9a
<6>ADDRCONF(NETDEV_UP): eth0: link is not ready
<4>hik_switch_device already init
<6>MACADDR in set is c0:56:e3:7:fd:9b
<6>ADDRCONF(NETDEV_UP): eth0: link is not ready
<6>org:bootargs=mem=96M console=ttyS0,115200n8bootcmd=tftp 0x80400000 $(bootfile                                              );bootm 0x80400000;default=cramfsload 0x80400000 uImage;sec=tftp 0x80400000 uIma                                              ge_sec;bootm 0x80400000;phyaddr1=2verify=nbootdelay=1baudrate=115200mdio_intf=rg                                              miiethaddr=00:50:a3:34:45:66ipaddr=192.0.0.64serverip=192.0.0.128gatewayip=192.0                                              .0.1netmask=255.255.255.0bootfile=uImage
<4>after:bootargs=mem=96M console=ttyS0,115200n8bootcmd=tftp 0x80400000 $(bootfi                                              le);bootm 0x80400000;default=cramfsload 0x80400000 uImage;sec=tftp 0x80400000 uI                                              mage_sec;bootm 0x80400000;phyaddr1=2verify=nbootdelay=1baudrate=115200mdio_intf=                                              rgmiiethaddr=00:50:a3:34:45:66ipaddr=192.0.0.64serverip=192.0.0.128gatewayip=192                                              .0.0.1netmask=255.255.255.0bootfile=uImage
<6>PHY: GPIO MII Bus-1:06 - Link is Up - 100/Full
<6>ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
<5>[hikio_fops_write, 1054]: write cfg file input size 3ceba6 result ff96
<5>
<6>PHY: STMMAC MII Bus-1:07 - Link is Up - 100/Full
<6>ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
<7>eth0: no IPv6 routers present
<7>eth1: no IPv6 routers present
<5>[hikio_fops_write, 1054]: write cfg file input size 3ceb59 result ff98
<5>

 

[whoslooking]

You will have to tftp back down, I would recommend staying with 3.08 unless you want to hack your camera's too.

 

[cozzmo]

You will have to tftp back down, I would recommend staying with 3.08 unless you want to hack your camera's too.

yeh i'd like to TFTP back down to v3.0.5, but as you can see from my first post, its not working.

I was hoping to update the NVR to a later stable firmware as i may be looking to sell this 4channel NVR and wanted to do so knowing it was up-to-date.

 

[alastairstevenson]

That log looks normal enough.
Also use 'getHardInfo' to see something about the hardware.
As you've got telnet access, it would be good to grab a copy of mtdblock2 while you can. This can be used to create a usable firmware to put it back the way it was later, along with a copy of the device configuration.
You will need a non-Hikvision tftp server running, such as this: http://tftpd32.jounin.net/tftpd32_download.html
Steps at a command prompt somewhat as follows:
To see / confirm that mtdblock2 is mounted on /home/hik
mount
umount /dev/mtdblock2
cat /dev/mtdblock2 > mtd2_save
mount /dev/mtdblock2 /home/hik
tftp -p -l mtd2_save IP_address_of_tftp_server

Then you could try the various firmware versions from here http://www.hikvisioneurope.com/portal/index.php?dir=Product Firmware/Recorder/DS-7600NI-E1(E2) 7700NI-E4/
which on the face of it should work OK with your NVR.

 

[cozzmo]

Excellent instructions, thankyou.

mtdblock2 file successfully downloaded. I wish i knew about that before i did the upgrade in the first place...

Start at 2015-09-02 20:08:26
Serial NO :0420140904AARR478______WCVU
V3.0.8 build 140825
KernelVersion: V1.0.0 build 140512
dspSoftVersion: V5.0 build 140816
codecVersion: V5.0 build 080808
hardwareVersion = 0xb300
encodeChans = 0
decodeChans = 4
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 1
flashsize = 0x10
ramSize = 0x200
networksNums = 2
language = 2
devType:DS-7604N-E1/4P
bootPartition = 2
randomCode =

That link to the firmwares turns out is the exact link i downloaded from before, all the files in the folder i have with various firmware versions are those identical files.

 

[whoslooking]

Ok your NVR is Chinese Region, I take it you have used HIK tools to changed the region flag.
If not then using the Euro fw won't do anything.

 

[cozzmo]

Ok your NVR is Chinese Region, I take it you have used HIK tools to changed the region flag.
If not then using the Euro fw won't do anything.

I haven't used any tools to change any options. This was the first firmware update I have done since buying the unit over 12 months ago. I'll have to do some more research on how to sort that out now, thanks.

 

[alastairstevenson]

It's the 'lang' option in Hiktools here http://www.ipcamtalk.com/showthread.php/2733-Hikvision-FIRMWARE-TOOLS-change-language-extract-files-and-create-own-firmware that can be used to switch the language flag in the header of the firmware file to avoid rejection by the firmware update process due to region mismatch.

 

[cozzmo]

OK excellent stuff, thanks so much for your help both of you guys. I modified a v3.0.5 file and it updated (rolled back) off USB stick no problems.

Still curious why the TFTP stuff didn't work, probably related to the language flag too i imagine. I might play around to ensure that i do have a working process for that just in case something goes badly in future.