Herospeed Ambarella S2L33M, trying TFTP boot

M

milek7

n3wb
Jun 12, 2020
9
3
Earth
Hello.
I have dozens of broken S2L33M_IMX322_V1.4 board and Herospeed firmware. It turns out there is crappy flash there, or crappy firmware writing something in loop burning through write cycles, but result is that every few months camera is dead, UBIFS read errors spew out. I fixed that previously by logging in through UART and flashing valid images again, but it's broken again after few months so this is not solution..

I also had previous revision of these boards, and I managed to reconfigure it to TFTP booting, with all necessary files in initramfs. That solved flaky flash problem once and forever.
Code: 
             ___  ___  _________                _   
            / _ \ |  \/  || ___ \              | | 
           / /_\ \| .  . || |_/ /  ___    ___  | |_
           |  _  || |\/| || ___ \ / _ \  / _ \ | __|
           | | | || |  | || |_/ /| (_) || (_) || |_
           \_| |_/\_|  |_/\____/  \___/  \___/  \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2007
BST (176869), HAL (176869)
SYS (040004ea)
Arm freq: 480000000
iDSP freq: 120000000
Core freq: 120000000
Dram freq: 336000000
AHB freq: 120000000
APB freq: 60000000
UART freq: 24000000
SD freq: 48000000
amboot>
amboot>
amboot>
amboot>
amboot>
amboot>
amboot> show netboot
eth0_mac: 00:00:11:06:10:37
eth0_ip: 192.168.1.108
eth0_mask: 255.255.255.0
eth0_gw: 192.168.1.250
auto_dl: 1
tftpd: 192.168.1.250
pri_addr: 0xc0208000
pri_file: kern
pri_comp: 0
rmd_addr: 0x00000000
rmd_file:
rmd_comp: 0
dsp_addr: 0x00000000
dsp_file:
dsp_comp: 0
amboot>
auto-boot from network
[    0.000000] Linux version 2.6.38.8 (zucker@ubuntu) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) ) #31 PREEMPT Sat Mar 14 10:19:58 CST 2015
[    0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Coconut
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella: AHB    = 0x60000000[0xf0000000],0x01000000 0
[    0.000000] Ambarella: APB    = 0x70000000[0xf1000000],0x01000000 0
[    0.000000] Ambarella: PPM    = 0xc0000000[0xe0000000],0x00200000 9
[    0.000000] Ambarella: BSB    = 0xc8c00000[0xe8c00000],0x00400000 9
[    0.000000] Ambarella: DSP    = 0xc9000000[0xe9000000],0x07000000 9
[    0.000000] Ambarella: HAL    = 0xc00a0000[0xfee00000],0x0000e708 9
[    0.000000] bootmem_init: high_memory = 0xc8a00000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 35052
[    0.000000] Kernel command line: console=ttyS0 initrd=0xC0A08000,0x1800000
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 138MB = 138MB total
[    0.000000] Memory: 110784k/110784k available, 30528k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xfe600000 - 0xfee00000   (   8 MB)
[    0.000000]     vmalloc : 0xc9000000 - 0xe0000000   ( 368 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8a00000   ( 138 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc002a000   ( 136 kB)
[    0.000000]       .text : 0xc002a000 - 0xc0434000   (4136 kB)
[    0.000000]       .data : 0xc0434000 - 0xc045c970   ( 163 kB)
[    0.000000] Preemptable hierarchical RCU implementation.
[    0.000000]     RCU-based detection of stalled CPUs is disabled.
[    0.000000]     Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:224
[    0.000000] sched_clock: 32 bits at 60MHz, resolution 16ns, wraps every 71582ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.221203] Calibrating delay loop... 478.41 BogoMIPS (lpj=2392064)
[    0.472907] pid_max: default: 32768 minimum: 301
[    0.478127] Mount-cache hash table entries: 512
[    0.483687] CPU: Testing write buffer coherency: ok
[    0.495594] NET: Registered protocol family 16
[    0.506874] Ambarella Coconut:
[    0.510050]     chip id:        5100
[    0.513165]     board type:        3
[    0.516080]     board revision:        17
[    0.519433]     chip name:        a5m
[    0.522616]     HAL version:        176869
[    0.526061]     reference clock:    24000000
[    0.529956]     system configuration:    0x040004ea
[    0.534561]     boot type:        0x00000002
[    0.538181]     hif type:        0x00000000
(side note: TFTP implementation is bonkers and doesn't ACK duplicated data packets, so if ACK gets lost in transit then transfer is broken. I patched TFTP server to continue transfer anyway, even when it doesn't receive ACK to retransmitted packets. Camera TFTP client also have trouble with initramfs download, so I simply concatenate it with kernel image)

However, on these new revisions things aren't working so nicely. Here's part of bootlog of working camera:
Code: 
             ___  ___  _________                _   
            / _ \ |  \/  || ___ \              | | 
           / /_\ \| .  . || |_/ /  ___    ___  | |_
           |  _  || |\/| || ___ \ / _ \  / _ \ | __|
           | | | || |  | || |_/ /| (_) || (_) || |_
           \_| |_/\_|  |_/\____/  \___/  \___/  \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2014
Boot From: NAND 2048 RC
SYS_CONFIG: 0x100600DB POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
amboot>
amboot>


[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73 (zucker@ubuntu) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #2 PREEMPT Thu Jan 7 22:36:41 CST 2016
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 106348k/106348k available, 6292k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80491bbc   (4647 kB)
[    0.000000]       .init : 0x80492000 - 0x804b5534   ( 142 kB)
[    0.000000]       .data : 0x804b6000 - 0x804f5408   ( 254 kB)
[    0.000000]        .bss : 0x804f5408 - 0x805155f8   ( 129 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.232515] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.292610] pid_max: default: 32768 minimum: 301
[    0.297303] Mount-cache hash table entries: 512
[    0.304285] CPU: Testing write buffer coherency: ok
[    0.309426] Setting up static identity map for 0x8036e2c8 - 0x8036e338
[    0.318270] devtmpfs: initialized
[    0.322820] pinctrl core: initialized pinctrl subsystem
[    0.328260] NET: Registered protocol family 16
[    0.333470] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.340858] L310 cache controller enabled
[    0.344858] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    0.354392] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    0.362396] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    0.372389] bio: create slab <bio-0> at 0
[    0.377437] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    0.384843] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!

And there's how I tried to configure TFTP:
Code: 
auto-boot from network

             ___  ___  _________                _   
            / _ \ |  \/  || ___ \              | | 
           / /_\ \| .  . || |_/ /  ___    ___  | |_
           |  _  || |\/| || ___ \ / _ \  / _ \ | __|
           | | | || |  | || |_/ /| (_) || (_) || |_
           \_| |_/\_|  |_/\____/  \___/  \___/  \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2014
Boot From: NAND 2048 RC
SYS_CONFIG: 0x100600DB POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
amboot>
amboot> show netboot
eth0_mac: 00:00:1b:08:54:c6
eth0_ip: 192.168.1.122
eth0_mask: 255.255.255.0
eth0_gw: 192.168.1.250
eth1_mac: 00:00:00:00:00:00
eth1_ip: 0.0.0.0
eth1_mask: 0.0.0.0
eth1_gw: 0.0.0.0
auto_dl: 1
tftpd: 192.168.1.250
pri_addr: 0x00208000
pri_file: kern2
pri_comp: 0
rmd_addr: 0x00000000
rmd_file:
rmd_comp: 0
dsp_addr: 0x00000000
dsp_file:
dsp_comp: 0
amboot>
amboot>
First problem is, that even though auto_dl is 1, it doesn't even try to download image after boot! It just prints "auto-boot from network" and promptly aborts and proceed to AMBoot prompt.

Trying manually makes it at least try, but it only gets so far:
Code: 
amboot> tftp boot console=ttyS0
downloading [kern2]:
................................. got 8650752 bytes
Jumping to 0x00208000
cmdline: console=ttyS0
cpux_jump: 0x00000000
initrd2_start: 0x00000000 initrd2_size: 0x00000000
kernelp: 0x00200000 kernels: 0x06E00000
idspp: 0x07000000 idsps: 0x09000000
And silence after that. I'm not sure pri_addr is correct, I tried 0x00208000 because with 0xc0208000 (correct for older board revision) it complained about invalid address and doesn't download image from TFTP at all. But I'm running out of ideas what to change.

Any ideas?
 
Well, I'm dumb. Incorrect kernel dump, I accidentally made it including OOB data.
Problem with not working autoboot still remaining, though.
 
Hello!
I'm sorry for interrupting, I wanted to ask.
milek7
What file or data do you leave on the TFTP server to upload the camera over the network? I mean, what is in kern2? Is this mtdblock of some kind? or is it an upgrade_hs.tar.gzip file?
I also want to try it with these cameras. I have a lot of them and I'm tired of restoring them one by one.
Thanks!
 
kern2 is kernel image. You can dump it from 'pri' partition (in this case mtd3) from working camera with nanddump tool. You also need to prepare initramfs containing system image ('lnx' mtd4, but needs modifications also) and /hs application directory (and that is supplied in firmware update files).

If you're interested I can post my files for S2L33M_IMX322_V1.4 (herospeed firmware) cameras


edit: here's my current work: You need pri (kernel, from mtd3) and rmd (initramfs, created from modified mtd4) on TFTP server.
You also need to export /srv/hs on NFS server, containing camera application (adapted from firmware upgrade image): place files from hs.tar there
Then amboot configuration (replace tftpd address with your own):

Code: 
setenv auto_boot 0
setenv auto_dl 1
setenv pri_addr 0x00208000
setenv pri_file pri
setenv rmd_addr 0x00A08000
setenv rmd_file rmd
setenv eth 0 ip 192.168.1.110
setenv eth 0 mask 255.255.255.0
setenv eth 0 gw 192.168.1.250
setenv tftpd 192.168.1.250
fdt cmdline console=ttyS0

Sadly, I still can't get auto tftp boot to work correctly. Type 'tftp boot' to trigger booting.
 
Last edited:
Thank you very much!
I'll try. I have a revision of the Board S2L33M_IMX322_V1.2 (attach a photo). There is a dump of the mtdblock0-6 camera, there is a user folder from the / hs directory
I didn't understand only the essence of the NFS server and how to register it on the camera? Understood.
And another question-rmd_addr 0x00A08000 why did you take it? I don't find any mention of this in the download log.
One more thing ... Why don't your "pri" and "rmd" files have the same size?
Code: 
 [9.819078] Создание 7 разделов MTD в "amba_nand":
[9.824142] 0x000000000000-0x000000020000: "bst"
[9.829638] 0x000000020000-0x000000160000: "bld"
[9.834965] 0x000000160000-0x0000002a0000: "ptb"
[9.840365] 0x0000002a0000-0x000000aa0000: "pri"
[9.845689] 0x000000aa0000-0x000003ea0000: "lnx"
[9.851110] 0x000003ea0000-0x0000058a0000: «добавить»
[9.856456] 0x0000058a0000-0x000007ca0000: "adc" [/ CODE]

Dump did this (mtd4 example)
cat /dev/mtdblock4| nc 192.168.2.100 3333
Because nanddump can only scan 44 pages at a time, and then it needs to be " stitched"
 

Attachments

  • IMG_20200619_085032.jpg
    IMG_20200619_085032.jpg
    2.8 MB · Views: 16
Last edited:
0x00A08000 is just kernel load address 0x00208000 + 8MB.
pri and rmd are two different files, one contains kernel and one is initramfs, so there's no reason for it to be same size.
pri in my files is dump from mtd3 which is cut off to actual kernel size. (you can left it at 8MB and it will still work)
rmd is initramfs created from mtd4 contents, with modified init scripts, setting up networking IP same as in amboot config, and mounting /hs/user directory from NFS. (because whole system is too big to fit in RAM, so some part of system has to be NFS mounted)
By nanddump I meant /usr/bin/nanddump utility, but I guess mtdblock could work too.
 
I understand You.
mtdblock is really working. You can do this: cat /dev/mtdblock0 > / tmp/mtd0. But there is not enough space in RAM for the larger mtd4 and mtd6, so I did through netkat.
Unfortunately, I don't have a working NFS server, so I probably won't get this idea with tftr loading yet, but I'm very interested in it and I'll try it.
I attach my dump files and the contents of the /hs folder that was in the camera.
Unfortunately, I don't have enough knowledge in this area to be able to accept this data on my own :)
dump
(This is a dump from the old firmware, respectively, the core there is also old. Maybe this will help somehow.)
 
Last edited:
(for reference, you can extract UBIFS images with nandsim on linux, or this tool nlitsme/ubidump)
Your dump has older kernel (Mon Jun 15 21:05:42 CST 2015 vs Thu Jan 7 22:36:41 CST 2016), but I think hardware is similiar enough and you could try booting with my files.
My previous image ran of RAM occasionaly, so I moved some more files from initramfs to NFS mount: It seems to work fine now.
Without NFS it'll stop after initializing network, with shell on serial port. You can easily setup NFS server on any device with Linux.
If you attempt this, I would be curious if auto_dl (starting TFTP boot without command on serial port) works for you or not :)
 
The problem is that I don't have a Linux device, but I will try it on Monday on my laptop.
I'm very bad at this... I had to learn a little when these cameras started to break down one by one. I have about 25 of them at my facility.
I really liked Your idea with loading on TFTP, because this equipment is very unreliable and I'm tired of resuscitating it every time, installing a ladder :)
...........
No, something is not loading automatically. When rebooting, it automatically goes to Amboot. My TFTP auto-upload doesn't work correctly. "tftp boot" to start the download...
I attach the log file.
............
After these manipulations, we had to restore the camera-core panic. I do this through the USB port.
 

Attachments

Last edited:
So no surprise with auto_dl :(

Code: 
[   10.576410] Freeing unused kernel memory: 140K (80492000 - 804b5000)
ip: RTNETLINK answers: File exists
[   10.768381] net eth0: adv: sym 0, asym: 0
ip: RTNETLINK answers: Network is unreachable
What happened there? It rebooted? Around this point it should launch shell on serial port. (and try to mount NFS directory)

After these manipulations, we had to restore the camera-core panic. I do this through the USB port.
Click to expand...
Huh, USB port in this camera? Anyway, I don't think anything was corrupted, to boot from flash again you just need to restore cmdline, probably this:
Code: 
fdt cmdline console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc

Meanwhile, I had resorted to adding microcontroller to trigger booting at start..
 
1. Yes, this camera has USB.
2. auto_dl 0 or auto_dl 1-no difference.
3. the Core is panicking because the camera loads data via TFTP and overwrites the NAND.
4. Why Do you need a microcontroller in this circuit? Can't upload data from the network automatically?
 

Attachments

  • UART_USB.jpg
    UART_USB.jpg
    385.2 KB · Views: 26
3. the Core is panicking because the camera loads data via TFTP and overwrites the NAND.
Click to expand...
tftp boot only loads into RAM, it doesn't write to NAND

4. Why Do you need a microcontroller in this circuit? Can't upload data from the network automatically?
Click to expand...
The problem is, I cannot get auto_dl to work. So I need microcontroller to send 'tftp boot' command at start.
 
I finally resolved auto_dl problem. Timeout programmed in bootloader was too low and it resigned before Ethernet linked up.
I changed two timeouts from 0x7d0 to 0x3000


I replaced 7D 0E to 03 0A (flexible operand of CMP instruction) on offsets 122284 and 122932 on mtd1, but that will likely vary for specific amboot versions.

So I can throw that extra MCU kludge out and cameras boot completely automatically from network.
 
  • Like
Reactions: KRYNIN, maks1978 and alastairstevenson
Hi I know this is old thread but I have 5 of these cams. How do you stop it from booting from nand? I have tried DEL and ESC in putty(mentioned on other forums) and it still boots from nand.
 
alastairstevenson said:
Keep the Return or Space key pressed such that autorepeat occurs, then power on the camera.
Also - check that your TX from the serial TTL to USB convertor is properly connected.
Click to expand...
Thanks it really worked with Return key. I have managed it to boot from tftp but im running the server on OpenWrt so srv catalog is in flash and it wont fit hs file. How can I edit NFS file location to move it to "/mnt/extstorage/tftp" which is my USB storage connected to router??
EDIT. Managed to mount extstorage to srv/hs and it works.
Thanks everyone who made it happen

PS.Anyone know telnet login/pass?
 
Last edited:
You must log in or register to reply here.
Top Bottom