Bricked xmtech Hi3615CV300 upon installing. Any recourse?

[packlet]

Apologies if this isn't the right place for such a report...

Had serial connection to working camera. Tried using IPCTool, but it didn't seem to run, tho output indicated SoC to be Hi3516Cv300, so I followed instructions at https://openipc.org/cameras/vendors/hisilicon/socs/hi3516cv300 but after reset, camera is now bricked.

Have backup, but no signs of life on network (no link) or serial at all. Any recourse? TIA.

tried IPCTool:

xmtech # tftp ipctool
Hisilicon ETH net controler
MAC: 00-12-14-0A-34-9B
eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.0.11; our IP address is 192.168.0.10
Download Filename 'ipctool'.
Download to address: 0x80008000
Downloading: #################################################
done
Bytes transferred = 163548 (27edc hex)

xmtech # go 0x80008000

Starting application at 0x80008000 ...

undefined instruction
pc : [<80008008>] lr : [<8840cd2c>]
sp : 883bf568 ip : 00000030 fp : 00000002
r10: 8840ccdc r9 : 88435900 r8 : 883bffe0
r7 : 883bf60d r6 : 00000002 r5 : 80008000 r4 : 883bf580
r3 : 80008000 r2 : 883bf580 r1 : 883bf580 r0 : 00000001
Flags: nZCv IRQs off FIQs off Mode SVC_32
Resetting CPU ...

resetting ...

hi3516cv300 System startup

Uncompress.......Ok

hi3516cv300 System startup

U-Boot 2010.06-svn965 (Mar 29 2018 - 11:09:51)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0x20 0x70 0x18
Block:64KB Chip:16MB Name:"XM25QH128AHIG"
CONFIG_CLOSE_SPI_8PIN_4IO = y.
at hifmc100_setTB() mid:0x20,chipsize:0x1000000 .
unlock all.
SPI Nor total size: 16MB
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In: serial
Out: serial
Err: serial
Press Ctrl+C to stop autoboot
16384 KiB hi_fmc at 0:0 is now current device

srcAddr 0x83000000, dstAddr 0x82000000
created_inode 0x883d0200
find_squashfs_file: name bin, start_block 0, offset 2490, type 1
find_squashfs_file: name boot, start_block 0, offset 2590, type 1
read inode: name boot, sb 0, of 2590, type 1
find_squashfs_file: name uImage, start_block 0, offset 2522, type 2
read inode: name uImage, sb 0, of 2522, type 2
write_file: regular file, blocks 9
len 2221979

FS load complete: 2221979 bytes loaded to 0x82000000

Booting kernel from Legacy Image at 82000000 ...

Image Name: Linux-3.18.20
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2221915 Bytes = 2.1 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK

Starting kernel ...

tftp'd image and reset:

xmtech #
xmtech #
xmtech # printenv
bootargs=init=linuxrc mem=${osmem} console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:0x3000 0(boot),0x550000(romfs),0x740000(user),0x180000(web),0x80000(custom),0x140000(mtd)
bootcmd=setenv setargs setenv bootargs ${bootargs};run setargs;sf probe 0;sf read 83000000 30000 550000;squashfsload;boo tm 0x82000000
bootdelay=1
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
da=tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
du=tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
dr=tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
dw=tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
dl=tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
dc=tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
up=tftp 0x82000000 update.img;sf probe 0;flwrite
ua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwrite
tk=tftp 0x82000000 uImage;setenv setargs setenv bootargs ${bootargs};run setargs;bootm 0x82000000
dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
ethaddr=00:12:14:0a:34:9b
NID=0x0001
muxctl0=0x12040064
muxval0=0x0
gpio0=0x77
gpioval0=0x00
muxctl1=0x12040104
muxval1=0x00
gpio1=0x82
gpioval1=0x04
osmem=56M
appSystemLanguage=English
appVideoStandard=NTSC
appNetIP=0x3900A8C00x00FFFFFF0x0100A8C0
ipaddr=192.168.0.10
serverip=192.168.0.11
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn965 (Mar 29 2018 - 11:09:51)

Environment size: 1441/65532 bytes
xmtech #
xmtech #
xmtech # mw.b 0x82000000 0xff 0x1000000
xmtech # sf probe 0; sf read 0x82000000 0x0 0x1000000
16384 KiB hi_fmc at 0:0 is now current device

xmtech # tftpput 0x82000000 0x1000000 backup-hi3516cv300-nor16m.bin
Unknown command 'tftpput' - try 'help'
xmtech # tftp 0x82000000 backup-hi3516cv300-nor16m.bin 0x1000000
Hisilicon ETH net controler
MAC: 00-12-14-0A-34-9B
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP to server 192.168.0.11; our IP address is 192.168.0.10
Upload Filename 'backup-hi3516cv300-nor16m.bin'.
Upload from address: 0x82000000, 16.000 MB to be send ...
Uploading: # [ Connected ]
################################ [ 2.888 MB]
################################ [ 5.752 MB]
################################ [ 8.616 MB]
################################ [11.480 MB]
############################%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# [14.344 MB]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%
16.000 MB upload ok.
xmtech # mw.b 0x82000000 0xff 0x1000000
xmtech # sf probe 0; sf lock 0;
16384 KiB hi_fmc at 0:0 is now current device
unlock all block.
xmtech # tftpboot 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin && sf erase 0x0 0x1000000 && sf write 0x82000000 0x0 ${filesize}
Unknown command 'tftpboot' - try 'help'
xmtech # tftp 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin && sf erase 0x0 0x1000000 && sf write 0x82000000 0x0 ${filesize}
tftp - tftp - download or upload image via network using TFTP protocol

xmtech # tftp 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin
Hisilicon ETH net controler
MAC: 00-12-14-0A-34-9B
eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.0.11; our IP address is 192.168.0.10
Download Filename 'openipc-hi3516cv300-nor-ultimate-16mb.bin'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 16777216 (1000000 hex)
xmtech # sf write 0x82000000 0x0 ${filesize}
Writing at 0x1000000 -- 100% complete.
xmtech # reset
resetting ...

[openipc-ai]

Not bricked in the permanent sense — but the flash really is destroyed, and here's exactly why.

The relevant three lines in your log are:

xmtech # tftp 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin && sf erase 0x0 0x1000000 && sf write 0x82000000 0x0 ${filesize}
tftp - tftp - download or upload image via network using TFTP protocol      <- usage text: nothing ran

xmtech # tftp 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin
Bytes transferred = 16777216 (1000000 hex)                                  <- transfer, OK

xmtech # sf write 0x82000000 0x0 ${filesize}
Writing at 0x1000000 -- 100% complete.                                      <- write, OK

Your XM U-Boot (2010.06-svn965) has no &&, so it answered the compound line with the tftp help entry and executed none of it. You then re-entered the transfer and the write — but the sf erase 0x0 0x1000000 that sat between them was dropped.

NOR flash programming can only clear bits, never set them. A sf write onto unerased flash stores old AND new, and it reports "100% complete" while doing it — there is no error anywhere. Your write started at offset 0x0, so the bootloader itself is now the bitwise AND of the XM U-Boot and the OpenIPC image. That is why there is no serial output at all and no PHY link: there is nothing executable left in the chip to print or bring up the MAC.

Nothing you did lost the backup — 16.000 MB upload ok means backup-hi3516cv300-nor16m.bin on your TFTP server is a good raw dump of the original.

Why the camera is still reachable. Every HiSilicon and Goke SoC has a mask-ROM bootrom that listens on UART0 for a serial download handshake at power-on, before it looks at flash. It's in silicon. Whatever is or isn't in your NOR chip is irrelevant to it — so you can upload a working U-Boot straight into RAM over the UART you already have connected, and get a console back without writing anything.

The tool is defib. Use the CLI, not the web version — hi3516cv300 needs a "frame-blast" handshake the browser build can't drive yet (defib#121); the page will let you pick the chip but the upload won't complete.

uv tool install git+https://github.com/OpenIPC/defib   # or pipx install git+...
defib burn -c hi3516cv300 -p /dev/ttyUSB0 -t

Start defib first, then cut power to the camera and reapply it — it sends the handshake continuously to catch the bootrom window. -t drops you at a U-Boot prompt. Nothing has been written to flash at this point.

From there, either put your backup back:

defib agent flash -c hi3516cv300 -i backup-hi3516cv300-nor16m.bin -p /dev/ttyUSB0

(hi3516cv300 is in the flash agent's supported table; the agent erases before writing, needs no network at all, and verifies CRC32 — roughly 2 minutes for 16MB.)

Or install OpenIPC properly, this time with a tool that can't skip the erase:

defib install -c hi3516cv300 \
  --firmware openipc.hi3516cv300-nor-ultimate.tgz \
  -p /dev/ttyUSB0 --nor-size 16

Two side notes. go 0x80008000 on ipctool giving undefined instruction is expected and unrelated — ipctool is a Linux userspace binary, so it has to run from a shell on a booted camera, not from the U-Boot prompt. And for next time: when the bootloader answers a ... && ... && ... line with a usage message, enter all three parts separately — transfer, erase, write — checking each one. The erase is the part that cannot be skipped.

Background reading: Side-loading an unlocked bootloader.

[packlet]

Brilliant! C:\WINDOWS\system32>python Python 3.14.7 (tags/v3.14.7:823f032, Aug 5 2026, 10:51:32) [MSC v.1944 64 bit (AMD64)] on win32 Type "help", "copyright", "credits" or "license" for more information.

>> uv tool install git+https://github.com/OpenIPC/defib

File "<python-input-0>", line 1 uv tool install git+https://github.com/OpenIPC/defib ^^^^ SyntaxError: invalid syntax

>> pipx install git+https://github.com/OpenIPC/defib

File "<python-input-1>", line 1 pipx install git+https://github.com/OpenIPC/defib ^^^^^^^ SyntaxError: invalid syntax

>>

Forgive my incompetence, but how to I install/run 'defib' on Windows? (I think I have Python installed...)

[packlet]

nm, i think i'm unstuck... :-)

C:\WINDOWS\system32>defib

Usage: defib [OPTIONS] COMMAND [ARGS]...

Universal camera recovery tool - shocking dead devices back to life.

┌─ Options ───────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ --install-completion Install completion for the current shell. │
│ --show-completion Show completion for the current shell, to copy it or customize the installation. │
│ --help Show this message and exit. │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
┌─ Commands ──────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ burn Wake a dead device so its flash can be written. │
│ list-chips List all supported chip models. │
│ ports List available serial ports. │
│ detect Auto-detect the SoC by trying protocol handshakes. │
│ capture Record a raw UART session to a .dcap file. │
│ replay Display the contents of a .dcap capture file. │
│ dump-flash Dump flash contents via U-Boot serial console. │
│ tui Launch the interactive TUI for device recovery. │
│ network Recover a device via network (TFTP). Requires root/admin for IP assignment. │
│ list-interfaces List available network interfaces. │
│ install Install a full OpenIPC firmware (U-Boot + kernel + rootfs) via UART + TFTP. │
│ restore Restore a flash dump to a device. │
│ agent Flash agent commands (fast binary protocol) │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

[packlet]

then again... :-(

C:\Users\pozze\Downloads>defib burn -c hi3516cv300 -p COM5
Firmware: u-boot-hi3516cv300-universal.bin (cached)
Protocol: HiSilicon Standard
Port: COM5
INFO:defib.transport.serial_platform:Using standard SerialTransport for win32
Loaded profile: hi3516cv300
Using sendFrameForStart handshake for hi3516cv300
Sending 131852 bytes of firmware...
Recovery failed: DDR init failed: PRESTEP0 DATA frame not ACKed
⠋ Sending DDR step ------------------------------ 0% 0:00:08

Failed: DDR init failed: PRESTEP0 DATA frame not ACKed

But then (running again WITHOUT rebooting cam did the trick!: :-)

C:\Users\pozze\Downloads>defib burn -c hi3516cv300 -p COM5
Firmware: u-boot-hi3516cv300-universal.bin (cached)
Protocol: HiSilicon Standard
Port: COM5
INFO:defib.transport.serial_platform:Using standard SerialTransport for win32
Loaded profile: hi3516cv300
Using sendFrameForStart handshake for hi3516cv300
Sending 131852 bytes of firmware...
INFO:defib.protocol.hisilicon_standard:SPL boundary detected (LZMA) at 0x5400 (21504 bytes); profile default was 0x4F00 (20224 bytes)
Sending DDR step ------------------------------ 100% 0:00:00
Sending SPL ------------------------------ 100% 0:00:02
Sending U-Boot ------------------------------ 100% 0:00:16

Done! (19318ms)

next:

C:\Users\pozze\Downloads>defib install -c hi3516cv300 --firmware openipc.hi3516cv300-nor-ultimate.tgz --nor-size 16 -p COM5
OpenIPC Firmware Install
Chip: hi3516cv300
Port: COM5
Flash: NOR 16MB
...
FileNotFoundError: [Errno 2] No such file or directory: 'openipc.hi3516cv300-nor-ultimate.tgz'

I have a .bin file, not a .tgz?...

and trying to re-install backup:

C:\Users\pozze\Downloads>defib agent flash -c hi3516cv300 -i backup-hi3516cv300-nor16m.bin -p COM5
No agent binary for 'hi3516cv300'

"what did i do wrong? and why did it let me?"

[packlet]

Not finding a .tgz for the Hi3516CV300 ULTIMATE build, i did find one for the MINI, but no luck applying that:

C:\Users\pozze\Downloads>defib install -c hi3516cv300 --firmware openipc.hi3516cv300-nor-mini.tgz --nor-size 16 -p COM5
OpenIPC Firmware Install
Chip: hi3516cv300
Port: COM5
Flash: NOR 16MB
Kernel: uImage.hi3516cv300 (1698315 bytes)
Rootfs: rootfs.squashfs.hi3516cv300 (3862528 bytes)
U-Boot: u-boot-hi3516cv300-universal.bin (131852 bytes → padded to 262144)

Phase 1: Burning U-Boot to RAM
Power-cycle the camera now!
INFO:defib.transport.serial_platform:Using standard SerialTransport for win32
Loaded profile: hi3516cv300
Using sendFrameForStart handshake for hi3516cv300
Sending 131852 bytes of firmware...
Sending DDR step
DDR step complete
INFO:defib.protocol.hisilicon_standard:SPL boundary detected (LZMA) at 0x5400 (21504 bytes); profile default was 0x4F00 (20224 bytes)
Sending SPL
SPL complete
Sending U-Boot
U-Boot complete
Recovery complete
U-Boot loaded in 24200ms
Autoboot detected, sending Ctrl-C...
U-Boot shell mode

Phase 2: Flash via TFTP
SPI flash detected
NIC: ethernet_0, Host IP: 192.168.1.10
INFO:defib.network.ip_manager:Adding IP 192.168.1.10/24 to ethernet_0: netsh interface ip add address ethernet_0 192.168.1.10 255.255.255.0
┌───────────────────────────────────────── Traceback (most recent call last) ─────────────────────────────────────────┐
│ C:\Users\pozze\AppData\Roaming\uv\tools\defib\Lib\site-packages\defib\cli\app.py:2123 in install │
│ │
│ 2120 │ flashes them to NOR or NAND. │
│ 2121 │ """ │
│ 2122 │ import asyncio │
│ > 2123 │ asyncio.run(_install_async( │
│ 2124 │ │ chip, firmware, port, power_cycle, poe_port_override, nic, host_ip, device_ip, │
│ 2125 │ │ tftp_port, nor_size, nand, wipe_env, tftp_via, output, debug, │
│ 2126 │ )) │
│ │
│ C:\Users\pozze\AppData\Local\Python\pythoncore-3.14-64\Lib\asyncio\runners.py:205 in run │
│ │
│ 202 │ │ │ "asyncio.run() cannot be called from a running event loop") │
│ 203 │ │
│ 204 │ with Runner(debug=debug, loop_factory=loop_factory) as runner: │
│ > 205 │ │ return runner.run(main) │
│ 206 │
│ 207 │
│ 208 def _cancel_all_tasks(loop): │
│ │
│ C:\Users\pozze\AppData\Local\Python\pythoncore-3.14-64\Lib\asyncio\runners.py:128 in run │
│ │
│ 125 │ │ │
│ 126 │ │ self._interrupt_count = 0 │
│ 127 │ │ try: │
│ > 128 │ │ │ return self._loop.run_until_complete(task) │
│ 129 │ │ except exceptions.CancelledError: │
│ 130 │ │ │ if self._interrupt_count > 0: │
│ 131 │ │ │ │ uncancel = getattr(task, "uncancel", None) │
│ │
│ C:\Users\pozze\AppData\Local\Python\pythoncore-3.14-64\Lib\asyncio\base_events.py:720 in run_until_complete │
│ │
│ 717 │ │ if not future.done(): │
│ 718 │ │ │ raise RuntimeError('Event loop stopped before Future completed.') │
│ 719 │ │ │
│ > 720 │ │ return future.result() │
│ 721 │ │
│ 722 │ def stop(self): │
│ 723 │ │ """Stop running the event loop. │
│ │
│ C:\Users\pozze\AppData\Roaming\uv\tools\defib\Lib\site-packages\defib\cli\app.py:2636 in _install_async │
│ │
│ 2633 │ │ │ if output == "human": │
│ 2634 │ │ │ │ console.print(f" [green]Pod TFTP ready on {serverip}:69[/green]") │
│ 2635 │ │ else: │
│ > 2636 │ │ │ await stack.enter_async_context( │
│ 2637 │ │ │ │ temporary_ip(nic, host_ip, "255.255.255.0") │
│ 2638 │ │ │ ) │
│ 2639 │ │ │ if output == "human": │
│ │
│ C:\Users\pozze\AppData\Local\Python\pythoncore-3.14-64\Lib\contextlib.py:668 in enter_async_context │
│ │
│ 665 │ │ │ raise TypeError(f"'{cls.module}.{cls.qualname}' object does " │
│ 666 │ │ │ │ │ │ │ f"not support the asynchronous context manager protocol" │
│ 667 │ │ │ │ │ │ ) from None │
│ > 668 │ │ result = await _enter(cm) │
│ 669 │ │ self._push_async_cm_exit(cm, _exit) │
│ 670 │ │ return result │
│ 671 │
│ │
│ C:\Users\pozze\AppData\Local\Python\pythoncore-3.14-64\Lib\contextlib.py:214 in aenter │
│ │
│ 211 │ │ # they are only needed for recreation, which is not possible anymore │
│ 212 │ │ del self.args, self.kwds, self.func │
│ 213 │ │ try: │
│ > 214 │ │ │ return await anext(self.gen) │
│ 215 │ │ except StopAsyncIteration: │
│ 216 │ │ │ raise RuntimeError("generator didn't yield") from None │
│ 217 │
│ │
│ C:\Users\pozze\AppData\Roaming\uv\tools\defib\Lib\site-packages\defib\network\ip_manager.py:125 in temporary_ip │
│ │
│ 122 │ Yields: │
│ 123 │ │ The assigned IP address. │
│ 124 │ """ │
│ > 125 │ await add_ip(interface, ip, netmask) │
│ 126 │ try: │
│ 127 │ │ yield ip │
│ 128 │ finally: │
│ │
│ C:\Users\pozze\AppData\Roaming\uv\tools\defib\Lib\site-packages\defib\network\ip_manager.py:69 in add_ip │
│ │
│ 66 │ returncode, stdout, stderr = await _run_command(cmd) │
│ 67 │ │
│ 68 │ if returncode != 0: │
│ > 69 │ │ raise IPManagerError( │
│ 70 │ │ │ f"Failed to add IP {ip} to {interface}: {stderr.strip() or stdout.strip()}" │
│ 71 │ │ ) │
│ 72 │ logger.info("Successfully added %s to %s", ip, interface) │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
IPManagerError: Failed to add IP 192.168.1.10 to ethernet_0: Failed to configure the DHCP service. The interface may be
disconnected.
The system cannot find the file specified.

C:\Users\pozze\Downloads>

any ideas? TIA.

[packlet]

tried the 'burn' again, seemed to do more, but no response after apparently going into terminal mode...

C:\Users\pozze\Downloads>defib burn -c hi3516cv300 -p COM5 -t
Firmware: u-boot-hi3516cv300-universal.bin (cached)
Protocol: HiSilicon Standard
Port: COM5
INFO:defib.transport.serial_platform:Using standard SerialTransport for win32
Loaded profile: hi3516cv300
Using sendFrameForStart handshake for hi3516cv300
Sending 131852 bytes of firmware...
Sending DDR step ------------------------------ 100% 0:00:04INFO:defib.protocol.hisilicon_standard:SPL boundary detected (LZMA) at 0x5400 (21504 bytes); profile default was 0x4F00 (20224 bytes)
Sending DDR step ------------------------------ 100% 0:00:04
Sending SPL ------------------------------ 100% 0:00:02
Sending U-Boot ------------------------------ 100% 0:00:15

Done! (23619ms)

System startup

Uncompress........Ok

System startup

U-Boot 2010.06 (May 08 2026 - 11:58:11)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0x20 0x70 0x18
Block:64KB Chip:16MB Name:"XM25QH128A"
SPI Nor total size: 16MB
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
*** Warning - bad CRC, using default environment

In: serial
Out: serial
Err: serial
RAM size: 128MB
Hit any key to stop autoboot: 0
16384 KiB hi_fmc at 0:0 is now current device

Wrong Image Format for bootm command
ERROR: can't get kernel image!
resetting ...

--- Terminal mode (Ctrl-C to exit) ---

what am i doing wrong?...

[packlet]

some progress:

got past the 'adding ip address' bit by renaming my "Ethernet" interface to "ethernet_0" to match the hardcoded name used in ip_manager.py , but firing up the tftpd server fails...

Why is it REMOVING the ip it just added before trying to bind TFTPd to it?...

C:\Users\pozze\Downloads> defib install -c hi3516cv300 -p COM5 --firmware openipc.hi3516cv300-nor-mini.tgz
...
Phase 2: Flash via TFTP SPI flash detected NIC: ethernet_0, Host IP: 192.168.1.10 INFO:defib.network.ip_manager:Adding IP 192.168.1.10/24 to ethernet_0: netsh interface ip add address ethernet_0 192.168.1.10 255.255.255.0 INFO:defib.network.ip_manager:Successfully added 192.168.1.10 to ethernet_0 IP assigned INFO:defib.network.ip_manager:Removing IP 192.168.1.10 from ethernet_0: netsh interface ip delete address ethernet_0 192.168.1.10 INFO:defib.network.ip_manager:Successfully removed 192.168.1.10 from ethernet_0 ┌────────────────────────────────────────────────────────────────── Traceback (most recent call last) ──────────────────────────────────────────────────────────────────┐ │ C:\Users\pozze\AppData\Roaming\uv\tools\defib\Lib\site-packages\defib\network\tftp_server.py:383 in start_tftp_server │ │ │ │

Also tried mnaully adding IP 192.168.1.10 before running, but that generates an error:

IPManagerError: Failed to add IP 192.168.1.10 to ethernet_0: The object already exists.

Seems to me that if it exists already, it should proceed (and not remove when done) rather than barf...

[openipc-ai]

Good news first: your camera is alive. That burn output is a real OpenIPC U-Boot running on the SoC — it found the flash chip (XM25QH128A, 16MB) and sized the RAM (128MB). The bootrom path works. Everything below is tooling trouble, not camera trouble.

Why it went dead again after burn -t. Look at the last lines:

Wrong Image Format for bootm command
ERROR: can't get kernel image!
resetting ...

The U-Boot you uploaded lives in RAM only. It autobooted, found the flash still full of the garbage from the missing erase, gave up and reset — and the reset threw away the RAM copy, so terminal mode was talking to a dead board again. You have to stop the autoboot. There's a flag for it:

defib burn -c hi3516cv300 -p COM5 -b -t

-b sends Ctrl-C right after the upload. -t alone doesn't. That should leave you sitting at a hisilicon # prompt.

My mistake on defib agent flash — sorry. No agent binary for 'hi3516cv300' is not something you did. The agent is C code that gets compiled per SoC with make SOC=hi3516cv300, and no prebuilt binary ships in the pip/uv package — get_agent_binary() looks for it in a path that only exists in a git checkout. I shouldn't have recommended it for an installed defib. That's a defib gap, and I'll fix it.

The route that avoids all of this: you already have a working TFTP server. You used it to pull the 16MB backup off the camera. So skip defib install entirely — get to the prompt with -b -t, then type the flash by hand, and this time the erase is in there.

To put OpenIPC on (the .bin is still on your TFTP server from before):

setenv ipaddr 192.168.0.10
setenv serverip 192.168.0.11
mw.b 0x82000000 0xff 0x1000000
sf probe 0
tftp 0x82000000 openipc-hi3516cv300-nor-ultimate-16mb.bin
sf erase 0x0 0x1000000
sf write 0x82000000 0x0 ${filesize}
reset

One line at a time. Check tftp says Bytes transferred = 16777216 (1000000 hex) before you erase, and let the erase finish — 16MB takes a little while. To go back to the vendor firmware instead, the same commands with backup-hi3516cv300-nor16m.bin.

(This U-Boot does understand &&, so the one-liner from the website would work here too. Your XM one didn't, which is where this started.)

Now, "what did i do wrong? and why did it let me?" On the Windows side: nothing, and it shouldn't have. Four separate defib bugs, all yours to be annoyed about:

1. The interface name. list_interfaces() uses socket.if_nameindex(), which on Windows returns ethernet_0-style names — but netsh interface ip add address wants the adapter's friendly name, Ethernet. So defib hands netsh a name it can't resolve and you get "The interface may be disconnected." Renaming your adapter was a fair workaround; --nic "Ethernet" would also have done it.
2. add_ip treats "The object already exists" as fatal. You're right that it should just carry on — and, having not added the address, it shouldn't strip it on the way out either.
3. The IP gets removed because the TFTP bind failed, not before it. defib adds the address, immediately binds UDP to it, the bind raises, and the cleanup removes the address on the way out — so the log reads backwards from what actually happened. Your traceback is cut off just above the part that matters; could you paste the last line, the TFTPBindError: ... one? It says whether the address wasn't ready yet, whether something else holds port 69, or whether the firewall ate it. Windows tends to return from netsh before the address is actually usable, which would make this a race defib has to wait out.
4. The PRESTEP0 DATA frame not ACKed on your first burn is the bootrom window closing before the handshake lands. Retrying while the board is still in that window is exactly the right move — as you found.

If you'd rather use defib install once it's fixed, the ultimate tarball for your SoC is openipc.hi3516cv300-nor-ultimate.tgz (8.4MB) — --firmware wants the path to a file you have already downloaded, which is what the FileNotFoundError was about. There is no mini variant for this SoC in the mainline release; lite, ultimate and neo are the three.

[packlet]

Re-burning with -b gets me an #OpenIPC prompt (not hisilcon), but it's unresponsive to any/all keystrokes and i have to ctrl-c out of it...

Packet capture (using wireshark) during the process hows no network activity, tho the
ethernet switch port shows a link light, and I can't find it at any (guessed) IP's using NMap...

(not sure if it's relevant, but this particular camera board has an add-on card with wifi/antenna and an sdcard slot with a formatted card in it, tho i get the same results with the card removed...)

C:\Users\pozze\Downloads>defib burn -c hi3516cv300 -p COM5 -b -t Firmware: u-boot-hi3516cv300-universal.bin (cached) Protocol: HiSilicon Standard Port: COM5 INFO:defib.transport.serial_platform:Using standard SerialTransport for win32 Loaded profile: hi3516cv300 Using sendFrameForStart handshake for hi3516cv300 Sending 131852 bytes of firmware... Recovery failed: DDR init failed: PRESTEP0 DATA frame not ACKed ⠧ Sending DDR step ------------------------------ 0% 0:00:06 Failed: DDR init failed: PRESTEP0 DATA frame not ACKed C:\Users\pozze\Downloads>defib burn -c hi3516cv300 -p COM5 -b -t Firmware: u-boot-hi3516cv300-universal.bin (cached) Protocol: HiSilicon Standard Port: COM5 INFO:defib.transport.serial_platform:Using standard SerialTransport for win32 Loaded profile: hi3516cv300 Using sendFrameForStart handshake for hi3516cv300 Sending 131852 bytes of firmware... Sending DDR step ------------------------------ 100% 0:00:08INFO:defib.protocol.hisilicon_standard:SPL boundary detected (LZMA) at 0x5400 (21504 bytes); profile default was 0x4F00 (20224 bytes) Waiting for U-Boot to start (up to 15s)... Autoboot detected, sending Ctrl-C... U-Boot console ready Sending DDR step ------------------------------ 100% 0:00:08 Sending SPL ------------------------------ 100% 0:00:02 Sending U-Boot ------------------------------ 100% 0:00:18 Done! (30495ms) System startup Uncompress........Ok System startup U-Boot 2010.06 (May 08 2026 - 11:58:11) Check Flash Memory Controller v100 ... Found SPI Nor(cs 0) ID: 0x20 0x70 0x18 Block:64KB Chip:16MB Name:"XM25QH128A" SPI Nor total size: 16MB MMC: EMMC/MMC/SD controller initialization. Card did not respond to voltage select! No EMMC/MMC/SD device found ! *** Warning - bad CRC, using default environment In: serial Out: serial Err: serial RAM size: 128MB Hit any key to stop autoboot: 0 OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <IN--- Terminal mode (Ctrl-C to exit) --- TERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC # <INTERRUPT> OpenIPC

as for (3) above...

TFTPBindError: TFTP server cannot bind 192.168.1.10:69: no interface has that address. The host needs 192.168.1.10 configured on the NIC the camera is plugged into, e.g. netsh interface ip add address "<adapter>" 192.168.1.10 255.255.255.0 -- check ipconfig to see what is actually set.

but BEFORE that, it said:

OSError: [WinError 10049] The requested address is not valid in its context The above exception was the direct cause of the following exception: