I've bricked my DS-2CD2032F-I :-(

G

gav28uk

n3wb
Dec 12, 2015
13
2
I think my DS-2CD2032F-I is terminal, in a total moment of madness I applied the 5.4.5_170123 EN upgrade to my IP cam. And now it won't fully boot.

The sticker on the back of the unit says it was running v5.3.0_150513, however I can't be 100% sure that was actually the running version. I have looked at the "HIKVISION mtd Brick Recovery Guide", nothing I try works.

All attempts to update via TFTP appear to start well, the digicap.dav file is copied across, however like so many others, it never shows as an "update completed" within the TFTP window. I power cycle the IP cam, it never appears within SADCP, so I am now at a total loss as to what to do to try to recover it?

I can ping the unit whilst the TFTP transfer is under way, but when it finishes, ping stops responding. I am unable to telnet or SSH to the unit at all, that doesn't work at anytime!

Could the reason for the problems be that because 5.4.5_170123 has been "partially" applied, I say partially because the IP Cam isn't working(!) and this version doesn't allow "downgrades" of firmware according to the release notes. I guess the "Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English" wont work either as I am starting from the wrong firmware version. In any case, I did try it and it didn't work either, the TFTP server failed to show "update completed".

Any suggestions, apart from binning it!!
 
I've had the 5.4.5 firmware on a 2032-I with no problems.
What does SADP V3.x show for the camera?
If it shows firmware 4.0.8 then the camera is in the 'min-system' recovery mode. This is a basic kernel, with no web services, that's entered when incompatible firmware has been applied.

To downgrade, this should work OK with the tftp updater : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
But if your camera was originally CN region, you may need to change the digicap.dav header to lang=1 with Hiktools : Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware
For sure the camera will be recoverable - but it depends on what effort you think it's worth spending on it.
And if you really do decide to bin it, you could bin it my way!

*edit* you may need to change the digicap.dav header to lang=2
 
Last edited:
  • Like
Reactions: fenderman
I really want to resurrect this IP cam, but head is getting sore from constantly hitting walls! lol!

OK, so the IP Cam never appears in SADP no matter what version of software I am using :-(

I have just this second managed to get a TFTP update to complete successfully, but still can't get the IP Cam to appear within SADP! I have applied the digicap.dav file from "IPC_R0_EN_STD_5.4.5_170123.zip". I then used HikTools05R1 to set the language to 2 and that allowed the update to complete. If it was set to 1 then then updated never completed.

[2017-02-28 09:43:17] TFTP server[192.0.0.128] initialized
[2017-02-28 09:43:22] Device[192.0.0.64] test tftpserver
[2017-02-28 09:43:32] Connect client[192.0.0.64] success
[2017-02-28 09:43:32] Start file[C:\Junk\Kits\HikVision\TFTP Server\TFTP\digicap.dav] transmitting
[2017-02-28 09:44:05] Completed file[C:\Junk\Kits\HikVision\TFTP Server\TFTP\digicap.dav] transmit
[2017-02-28 09:44:32] Device[192.0.0.64] system update completed!

I noticed that the IP cam didn't automatically reboot following the update. I left it 5 mins or so then had to power cycle it.

So now I have a completed update, but I am unable to see the IP cam in SADP. It doesn't reply to pings on 192.0.0.64, in fact, it looks like it is boot looping. If I do a ping -t 192.0.0.64 I can see it appear for a few seconds then vanish again.

I hav previously tried the 5.3.0 downgrader, both 1 and 4 line options. I have tied both of them with language set to 1 or 2, neither option completes on TFTP update :-(

Any other options?
 
The 'Downgrader' has had a good success rate with bricked R0 series cameras, so it's disappointing that didn't work for you.
As a long shot, you could try the native CN firmware from here, section 06 : 海康威视是以视频为核心的物联网解决方案和数据运营服务提供商，面向全球提供安防、可视化管理与大数据服务。
If that works but gives CN menus, the 'Downgrader' would be the next step.

The next level in a recovery would be connecting to the on-board serial console, but that's a fair bit of extra work.
It would certainly give info on why the camera won't fully boot.
Can you confirm there had been no 'MTD hack' on this camera?

gav28uk said:
I noticed that the IP cam didn't automatically reboot following the update.
Click to expand...
It can be the case that it sits quietly on the 192.0.0.64 address with telnetd and ftpd active.
If so, the 'upgrade' program could be invoked and progress and errors observed.
 
I can confirm there has definitely been no "MTD" hack on the cam.

After the TFTP upgrade (without power-cycling the cam), I can neither telnet, SSH or FTP onto the cam, indeed it also stops responding to pings when the "Update complete" message appears.

I have also tried that native Chinese firmware, no joy, the TFTP update doesn't complete. I addition I have also tried it with setting the language to 1 and 2, TFTP update still refuses to complete.

I think I'll have a look at what is involved with the serial console option.
 
gav28uk said:
I think I'll have a look at what is involved with the serial console option.
Click to expand...
It's not too hard, but all these things do take time. But they can be interesting. And there are quite a few posts on the topic.

You'll need a couple of things, from your favourite on-line electronics outlet:
USB to TTL serial convertor, PL2303HX for Arduino is very common and cheap.
Micro ZH 4-pin 1.5mm JST connector with wires. Even cheaper!

*edit* Just in case - have you tested with a different power supply?
 
Well, my opinions on Hikvision have just taken a huge step downwards, have just opened up the camera to discover that it doesn't even have the serial console connectors wired in!! FFS, talk about cheap-skates.

Looking at this URL Manual: Create console/serial access to Hikvision DS-2CD2032F-I I can see where the serial connector should be. However, looking in my camera, no connector exists, instead just the holes, so I'd need to solder in the cables....thanks a bunch HikVision!

ipcam2.jpg
 
gav28uk said:
my opinions on Hikvision have just taken a huge step downwards,
Click to expand...

Where is this camera from?

While I don't like the games HIK plays with region locks/controls/etc you can't blame them if you turned to AE/Ebay/Amazon for a hacked camera. Many of these cameras are different as they are designed to be to be sold in a different region. That is why when you spend less and get china models etc some times you end up in plastic housings etc. Not to mention, if that is what you did (not sure) then you sure as hell should have known the risks of upgrading firmware.

My main point - don't blame HIK if you purchased hacked hardware to save money and applied firmware you didn't really need/shouldn't have applied.
 
I bought it from Amazon, at the time a naive Hikvision customer, unaware that the grey market exists. Now for sure, you can say buyer-beware, but I bought this in good faith. Prior to the firmware upgrade I was not even aware firmware upgrades would cause a problem, I put faith in the manufacturer having software processes in place that would prevent an end-user from bricking their unit by such a simple process. Would you expect your iphone to brick just because you bought it from the US instead of the UK when you carried out a software update? I certainly wouldn't have expected the manufacturer to allow a firmware upgrade to take place that would render the unit inoperative without some form of warning!

I think it is short sighted of Hikvision to allow this scenario to occur, yes it turns out this is a grey unit, but hey it's still a Hikvision and they are receiving revenue. All they are doing is alienating customers with this approach.
 
  • Like
Reactions: alastairstevenson
gav28uk said:
All they are doing is alienating customers with this approach.
Click to expand...
My sentiments exactly.
This anti-customer firmware update strategy just catches out those who do not know about it, and who naturally expect updates to provide fixes and improvements and to be good to do.

On the connector - if the cabled plugs come with the corresponding socket, you may well be able to put the socket into the hole without soldering and make a usable connection, if they are not a loose fit.
 
alastairstevenson said:
On the connector - if the cabled plugs come with the corresponding socket, you may well be able to put the socket into the hole without soldering and make a usable connection, if they are not a loose fit.
Click to expand...

The cabled plugs arrived, but no corresponding socket, which is a drag, not to worry. With judicious use of blu-tak holding the wires in place, I may have a solution :-) I now need to wait for the TTL/UART adapter to arrive to test it all out, if you see a puff of black smoke on the horizon you know it didn't work! lol!!!
 
Right, so all the bits and pieces arrived and I now have console access!! :)

To recap, the *only* firmware that appears to write successfully and complete is 5.4.5_170123 with the lang = 2, all other attempts fail, even the 5.3 downgrade 1 and 4 line files! I am guessing there is something in the 5.4.5 update that has applied that is now preventing in downgrade from taking place :-(

Here is a console log of the 5.4.5 update and following boot:-

Code: 
5.4.5 Language = 2

U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ...................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ####################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 23458645 bytes (22908 KB)
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][435]:i=1,szFileName=_cfgUpgClass,iFirmOffset=0x1004
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][479]:####### iFirmVers=0x5040005, sys firm version check ok #######
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_upgrade][626]:####### iFirmVers=0x5040005,iDevsVers=0x5040005,iBase=0x0,iMask=0xffff0000 #######
[ INFO][MIN]BURN: Writing Flash
[ INFO][MIN]BURN: ..............................................................
[ INFO][MIN]BURN: Write Flash [OK]
***** UPDATE COMPLETE *****

# reset
The system is going down NOW!
Sent SIGTERM to all processes
Terminated
Sent SIGKILL to all processes
Requesting system reboot


U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
|RCV UDP pack timeout|
Unknown command:null
booting from pri part...
load kernel...
load ramdisk...
init started: BusyBox v1.19.3 (2017-01-13 20:51:32 CST)
starting pid 376, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x1, sec_iUpgSuccCnt:0x1
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 31 LEBs (3999744 bytes, 3.8 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
diagnose_way = 10, repair_way = 1, interval = 60
route: ioctl 0x890c failed: No such process
mount: mounting none on /proc/bus/usb failed: No such file or directory
/dav
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40338000
loading ./orccode.bin...addr = 0x40338000, size = 0x1a0a91
loading ./orcme.bin...addr = 0x40538000, size = 0x3a4fc
loading ./default_binary.bin...addr = 0x405d8000, size = 0x40000
===============================
u_code version = 2016/4/6 3.0
===============================
ln: /dev/rtc: File exists
=====check_config start=====
===db file doesn't exist===
===db file doesn't exist===
==== both config files are broken====
FSP_network_protocol_5.3.5_net_1.6.1 netprocess version: 1.6.1 [17:24:18-Jan 13 2017].
No need to recover kernel pri partition.
No need to recover ramdisk pri partition.
[03-08 14:08:17][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:17][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:17][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:17][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
infd read End
Unix bus   0 .
[03-08 14:08:18][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:18][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:18][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:18][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:19][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:19][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:19][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:19][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:20][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:20][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:20][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:20][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
IEfile uncompressed.
[03-08 14:08:21][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:21][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:21][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:21][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:22][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:22][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:22][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:22][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:23][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:23][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:23][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:23][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:24][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:24][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:24][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:24][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:25][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:25][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:25][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:25][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:26][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[03-08 14:08:26][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:26][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:26][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:27][pid:846][STRM_ANLS][ERROR] from daemon ack, dst not work  len 0 , load_type is [10012]
[03-08 14:08:27][pid:846][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[03-08 14:08:27][pid:846][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[03-08 14:08:27][pid:842][STRM_ANLS][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
Unix bus  End
insmod: can't insert 'uart232.ko': File exists
[03-08 14:08:28][pid:862][OTHER][ERROR]db /davinci/ipc_db does not exist
[03-08 14:08:28][pid:862][OTHER][ERROR]db /config/ipc_db_backup does not exist
powerLineFrequencyMode = 0
@@@motion PAL!!!!!!!!!!!!!!!!!
[03-08 14:08:28][pid:862][UNI_IF][ERROR]stream request out range 3(2)
sqlite3_get_table:1, no such table: db_version
sqlite3_get_table:1, no such table: sec_lock_auth_db_info
[03-08 14:08:28][pid:862][OTHER][ERROR]db_query_open_v2 error: 1
sqlite3_get_table:1, no such table: netconfig_table
sqlite3_get_table:1, no such table: wep_encrypt_info
[03-08 14:08:28][pid:862][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: wep_key_list
[03-08 14:08:28][pid:862][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: ipaddr_list
[03-08 14:08:28][pid:862][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: local_port_list
[03-08 14:08:28][pid:862][OTHER][ERROR] db_query_open_v2 err
sqlite3_get_table:1, no such table: pppoe_config_info
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

starting pid 873, tty '': '-/bin/psh'
BusyBox v1.2.1-171136 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

===maxEnchan: 1
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[03-08 14:08:36][pid:862][OTHER][ERROR]can not open file /config/ipc_db_backup
[03-08 14:08:36][pid:862][OTHER][ERROR]ipc_db_backup need backup.
<init_run>3902:p_devcfg->ccdPara[1].capture_mode [0]
<MEGA_DSP>Platform Value:
<MEGA_DSP>Main mux type [0x4].
<MEGA_DSP>Sub   mux type [0x4].
<MEGA_DSP>Thi  mux type [0x2].
<MEGA_DSP>audio enc type[0x2].
<MEGA_DSP>voicetalk type[0x2].
<MEGA_DSP>Need PS SysHdr[0].
[03-08 14:08:36][pid:862][HW_IF][ERROR]<INIT485>:x=9,maxBaudIdx=15,/dev/uart1
[03-08 14:08:36][pid:862][HW_IF][ERROR]<INIT485>set...baudrate=9600,data=3,stop=0,parity=0,flowcontrol=0
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

<DSP> DBG:init_dsp_lib() begin
<DSP> DBG:init_dsp_lib() end
[03-08 14:08:41][pid:862][DSP][ERROR][2]g_pdsp->audioTBShare.frameLen=80, g_pdsp->audioTBShare.totalFrame=128..
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

mknod: /dev/snd/controlC0: File exists
mknod: /dev/snd/pcmC0D0c: File exists
mknod: /dev/snd/pcmC0D0p: File exists
dsp_init: Unsupported viType=0
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[03-08 14:08:51][pid:862][SYSINIT][ERROR]hwif_dsp_init error force sys reboot,ret=-12!!!!
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param



U-Boot 1.3.4-121219 (Apr  8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 1
HKVS #
HKVS #

And here is the info from dmesg

Code: 
# dmesg
Linux version 2.6.38.8 (chenyuanming@Cpl-Frt-BSP) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) )
#2 PREEMPT Wed Apr 8 14:56:41 CST 2015
CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Coconut
Ignoring unrecognised tag 0x44000426
Memory policy: ECC disabled, Data cache writeback
Ambarella: AHB  = 0x60000000[0xf0000000],0x01000000 0
Ambarella: APB  = 0x70000000[0xf1000000],0x01000000 0
Ambarella: PPM  = 0xc0000000[0xe0000000],0x00200000 9
Ambarella: BSB  = 0xc8c00000[0xe8c00000],0x00400000 9
Ambarella: DSP  = 0xc9000000[0xe9000000],0x07000000 9
Ambarella: HAL  = 0xc00a0000[0xfee00000],0x0000e708 9
On node 0 totalpages: 25344
free_area_init_node: node 0, pgdat c0579df0, node_mem_map c059a000
  Normal zone: 198 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 25146 pages, LIFO batch:7
bootmem_init: high_memory = 0xc8a00000
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 25146
Kernel command line: console=ttyS0 dbg=0 IP=192.0.0.64 MASK=255.255.255.0 GW=0.0.0.0 SERVER=192.0.0.128 MS_ACTION=auto_update video=amb0fb:720x480,720x480,1,0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 99MB = 99MB total
Memory: 90588k/90588k available, 10788k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
    vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
    lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0315000   (3124 kB)
      .text : 0xc0315000 - 0xc055b000   (2328 kB)
      .data : 0xc055c000 - 0xc057a4a0   ( 122 kB)
Preemptable hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:224
sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
sched_clock: fix multiply/shift to avoid scheduler hiccups
Console: colour dummy device 80x30
console [ttyS0] enabled
Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Ambarella Coconut:
        chip id:                5100
        board type:             3
        board revision:         10
        chip name:              a5m
        HAL version:            176869
        reference clock:        24000000
        system configuration:   0x173804ea
        boot type:              0x00000002
        hif type:               0x00000000
bio: create slab <bio-0> at 0
ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
i2c i2c-0: Added multiplexed i2c bus 2
ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
Switching to clocksource ambarella-cs-timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Unpacking initramfs...
Initramfs unpacking failed: junk in compressed archive
Freeing initrd memory: 4096K
[ kernel version:  svn-121243 ]
mmc0 power register success!
mmc1 power register success!
use default reserved area information!
reboot times :13
msgmni has been set to 184
io scheduler noop registered
io scheduler deadline registered (default)
ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit)
ambarella_nand_config_flash: 0x02e00140, 0x02c00140
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x000006000000
ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
Creating 18 MTD partitions on "ambnand":
0x000000000000-0x000000020000 : "bst"
0x000000020000-0x000000120000 : "ptb"
0x000000120000-0x000000220000 : "bld"
0x000000220000-0x000000320000 : "hal"
0x000000320000-0x000000420000 : "ano_ptb"
0x000000420000-0x0000004a0000 : "env"
0x0000004a0000-0x000000520000 : "param"
0x000000520000-0x000000620000 : "dpt"
0x000000620000-0x000001020000 : "rcvy"
0x000001020000-0x000001820000 : "krn_pri"
0x000001820000-0x000002020000 : "krn_sec"
0x000002020000-0x000002420000 : "rmd_pri"
0x000002420000-0x000002820000 : "rmd_sec"
0x000002820000-0x000004020000 : "app_pri"
0x000004020000-0x000005820000 : "app_sec"
0x000005820000-0x000005c20000 : "cfg_pri"
0x000005c20000-0x000006020000 : "cfg_sec"
0x000006020000-0x000007020000 : "dbg"
Ambarella MII Bus: probed
ambarella-eth ambarella-eth.0: MAC Address[28:57:be:09:b7:53].
mousedev: PS/2 mouse device common for all mice
ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
i2c /dev entries driver
ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
TCP cubic registered
NET: Registered protocol family 17
ambarella-rtc ambarella-rtc: setting system clock to 2017-03-08 14:20:41 UTC (1488982841)
Freeing init memory: 3124K
net eth0: Could not find default PHY in 9.
net eth0: Try PHY[3] whose id is 0x001cc816!
UBI: attaching mtd13 to ubi1
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
UBI: attached mtd13 to ubi1
UBI: MTD device name:            "app_pri"
UBI: MTD device size:            24 MiB
UBI: number of good PEBs:        192
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     0
UBI: available PEBs:             186
UBI: total number of reserved PEBs: 6
UBI: number of PEBs reserved for bad PEB handling: 2
UBI: max/mean erase counter: 105/60
UBI: image sequence number:  2076122482
UBI: background thread "ubi_bgt1d" started, PID 319
UBIFS: default file-system created
UBIFS: mounted UBI device 1, volume 0, name "app_pri"
UBIFS: file system size:   22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
UBIFS: journal size:       1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  103599 bytes (101 KiB)

Can anybody see from the above why my Hikvision is in a boot loop and fails to appear within SADP?

I have the logs from the 5.3.5 install and you can clearly see the firmware upgrade being blocked by a version mismatch check!

digicap.cn-5.30.150513dav
=========================

U-Boot 1.3.4-121219 (Apr 8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 1
HKVS #
HKVS #
úKVS # reset

U-Boot 1.3.4-121219 (Apr 8 2015 - 14:34:29)

ARM Clock: 480MHz
DDR Clock: 336MHz
Hit Ctrl+u to stop autoboot: 0
[ INFO][MIN]FORMAT: Formatting Flash
[ INFO][MIN]FORMAT: ...................................
[ INFO][MIN]FORMAT: Format Flash [OK]
[ INFO][MIN]TFTP: TFTP from server 192.0.0.128
[ INFO][MIN]TFTP: Filename: 'digicap.dav'
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ################################################################################
[ INFO][MIN]TFTP: ###########################################################################
[ INFO][MIN]TFTP: Download File [OK]
[ INFO][MIN]BURN: File size is 20360391 bytes (19883 KB)
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][435]:i=1,szFileName=_cfgUpgClass,iFirmOffset=0xe9c
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_check][479]:####### iFirmVers=0x5030000, sys firm version check ok #######
[UPG][DEBUG_NOTICE][ext/sys_firm_version.c][firm_version_upgrade][626]:####### iFirmVers=0x5030000,iDevsVers=0x5040005,iBase=0x0,iMask=0xffff0000 #######
[UPG][RT_ERROR][ext/sys_firm_version.c][firm_version_upgrade][628]:[UPG_ASSERT] (unsigned int)(iFirmVers) >= (iDevsVers & pVerInfo->iMask) fail to eRetVal -1=0xffffffff!
[ INFO][MIN]BURN: digicap package error!!!

[ INFO][MIN]BURN: Write Flash [FAIL] error: write flash.
!!!!! UPDATE FAIL !!!!!

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

#



If you look at the line :-

[UPG][RT_ERROR][ext/sys_firm_version.c][firm_version_upgrade][628]:[UPG_ASSERT] (unsigned int)(iFirmVers) >= (iDevsVers & pVerInfo->iMask) fail to eRetVal -1=0xffffffff!

....it appears to be checking to see which version you are looking to upgrade to, ensuring it is greater than I am guessing the existing version?

Any thoughts gratefully received :-)
 
The serial console log for that version does look quite disconcerting with all those soft errors - but that's normal for that part of the initialisation.
It does look, though, like the firmware is not able to communicate with the DSP, or is not compatible with the DSP.
For reasons not clear.
I think this fragment is significant:
Code: 
<DSP> DBG:init_dsp_lib() begin
<DSP> DBG:init_dsp_lib() end
[03-08 14:08:41][pid:862][DSP][ERROR][2]g_pdsp->audioTBShare.frameLen=80, g_pdsp->audioTBShare.totalFrame=128..
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
[03-08 14:08:41][pid:862][SYSINIT][ERROR]max_fps=0...
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

mknod: /dev/snd/controlC0: File exists
mknod: /dev/snd/pcmC0D0c: File exists
mknod: /dev/snd/pcmC0D0p: File exists
dsp_init: Unsupported viType=0
davinci receive cmd_query_davinci_param


This is broadly the equivalent from the 5.4.5 firmware update.
Code: 
<DSP> DBG:init_dsp_lib() begin
<DSP> DBG:init_dsp_lib() end
[02-14 11:47:18][pid:863][DSP][ERROR][2]g_pdsp->audioTBShare.frameLen=80, g_pdsp->audioTBShare.totalFrame=128..
mknod: /dev/snd/controlC0: File exists
mknod: /dev/snd/pcmC0D0c: File exists
mknod: /dev/snd/pcmC0D0p: File exists
[02-14 11:47:18][pid:863][HW_IF][ERROR]<read_fixed_noise_info_from_flash> (CFG_MAGIC != read.magicNumber(ffffffff)
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param
<DSP> DBG:setup_dsp() begin
<DSP> DBG:init_cmem_module:cached_size=33030144(31M),noncached_size=6815744(6M)
init_cmem_module:CMEM_cmdline=insmod /dav/cmemk.ko phys_start=0xc6600000 phys_end=0xc8c00000 pools=1x33030144,1x6815744
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param
gdma Init Successful
b_fd=0,b_smd=1,b_scd=0,device_type=8,enableswaec=0
channel 1 is not 1 or 2<DSP> DBG:DSP start with Vout:Disabled,Audio:Disabled,VT:Disabled,MD:Enabled, vsync_guard:Enabled,vout_osd: Disabled, oversampling:Disabled, roi: Enabled, primacy: Disabled . hdr mode Disabled qr Disabled
<DSP> DBG:dsp_object.device_mode 0
<DSP> DBG:enc channel cnt 2, delay mode 0
Use CMEM buffer!
goto_idle done


I think I recall a warning in the release notes not to skip intermediate updates for the newer versions of firmware.
I'm wondering if there is now a 'catch-22' where the skipping updates has caused a problem (maybe an earlier version updates part of the hardware device tree) and now the 5.4.5 downgrade prevention stops the ability to go back and re-run the versions.

I'm not sure what to suggest though.
I've taken a 2032 and 2332 up and down versions from 5.3.0 to 5.4.0 to 5.4.5 via tftp with no apparent problems - but I suspect that may be because the update program / associated 'min-system' kernel that was flashed during manufacture is older and with fewer checks and obstacles.
I am speculating that these programs are contained within /dev/mtdblock8 - the 'rcvy' partition.

I wonder if there is any way to transplant that /dev/mtdblock8 ?
I did notice that when using the actual 'update' program at the bootloader command line (not the automated Hikvision tftp updater) with a normal tftp server (eg TFTPD32 : an opensource IPv6 ready TFTP server/service for windows : TFTP server) that after the firmware write there is not an automatic reboot, and there is an older kernel command-line left running, which has tftp *edit* telnet and ftp capability.
I've never tried updating any mtdblocks in that state though, so I don't know if it would be blocked.

Just guessing a bit really.
 
Thanks for looking, I must admit I am wondering if because I jumped from 5.3 (possibily 5.2) straight to 5.4.5 this has caused an irreversible error! I can't downgrade from 5.4 to 5.2 so am stuck in limbo! :-(

I've just seen a post from @Enabler Unbricking DS-2CD2432F-IW help, no luck with 5.30 downgrader where he/she posted and downgrade tool from 5.4 to 5.3 but this was pulled. I may ask within that post if @Enabler will share the digicap.dav file as I've nothing to lose here!!
 
Just out of curiosity - can you try a firmware version or 2 from the Hikvision Europe portal DOWNLOAD PORTAL
with the command-line 'update' command and a normal tftp server, and see if the device doesn't do an auto-reboot after flash write.
Then the next step would be to determine if the running kernel would allow /dev/mtdblock8 to be over-written.
In the, admittedly unlikely, event that it was possible, attached is a copy of mtdblock8 from a 2032 I have (had - it's out on loan just now).
Definitely a long shot - but it's something I'd try in the circumstances. I know it's not a cost-effective use of time - but sometimes it's just for the curiosity and satisfaction.
The command, after transfer in, would be
cat mtd8copy > /dev/mtdblock8
Then a firmware downgrade to, say, 5.3.0
 

Attachments

Thanks again for the help. Any version less than 5.4 fails to load each and every time with the following error message:-

[UPG][RT_ERROR][ext/sys_firm_version.c][firm_version_upgrade][628]:[UPG_ASSERT] (unsigned int)(iFirmVers) >= (iDevsVers & pVerInfo->iMask) fail to eRetVal -1=0xffffffff!
[ INFO][MIN]BURN: digicap package error!!!

[ INFO][MIN]BURN: Write Flash [FAIL] error: write flash.
!!!!! UPDATE FAIL !!!!!

So the anti-rollback feature introduced by Hikvision has well and truly screwed me over, and I guess will affect others over time. Unless I can get hold of the 5.4 to 5.3 rollback kit that was mentioned on the other threads I'm stuck. Oh well, I guess it's time to admit defeat, bin it and buy a cam from a company that doesn't want to pi$$ off it's customers.
 
Bummer.
gav28uk said:
buy a cam from a company that doesn't want to pi$$ off it's customers.
Click to expand...
It does seem the wrong way to enhance the brand - but I suppose they believe they are supporting the margins of the authorised distributors against the onslaught of the on-line resellers.
gav28uk said:
I guess it's time to admit defeat, bin it
Click to expand...
If you mean that literally, bin it my way. I've lent out my spare Hiks to someone to find out what IP security cameras are about, so none to play with just now.
 
Just to add a little bit to this saga -
I've been taking a look at the camera firmware and have some ideas to try out around tweaking the 'backdoor fixed' firmware for CN 'hacked to English' cameras.
As I've loaned out my spare Hikvision cameras I don't have any for testing.
By the time I enquired about this one it had been sold on eBay.
But a little while later it popped up again - the buyer hadn't managed to fix it either!
I bid for it but not high enough. (stingy Scots person).
So now I'm waiting for it to pop up again. We'll see.

Despite some looking, I haven't found any used or bricked or not working, for spares Hikvision cameras in the usual on-line places.
WTB - Bricked Hikvision R0 series (DS-2CD2xx2) IP camera.
 
I have a non-functional camera that went through this exact process. I can't seem to get it working at all. The closest I can get is a TFPT upgrade success message using 5.4.5_170123 converted to Chinese language, but then the camera is still unreachable. I'd be happy to send it you, alastair, but it may take a while if you're in Scotland.
 
You must log in or register to reply here.
Top Bottom