HIKVISION DS-7316HI-S

Table of Contents

1 Symptoms

The HIKVISION DS-7316HI-S is an NVR supporting analog CCTV cameras which I got for free. It was declared to be broken and indeed was failing to boot. The console output was providing the following hints:

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 
ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 
### JFFS2 loading 'uImage' to 0x80700000
jffs2: scanning filesystem . done.
jffs2: cannot find inode(uImage)
### JFFS2 load uImage error(0)
## Booting image at 80700000 ...
Bad Magic Number
HKVS # 

1.1 RS-232 interface fix

The bootloader is U-Boot but the console did not work. It would print the above messages but did not accept any input. After investigating this I found out that the RS-232 interface receive path seemed to be broken so I replaced the SP2020EEN chip that was responsible. After this the boot process could be stopped and the U-Boot console accessed. Some discovery follows:

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 
ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 
HKVS # help                                              
?       - alias for 'help'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
format  - format nand except bootloader area
fsinfo	- print information about filesystems
fsload	- load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
ls	- list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
ping	- send ICMP ECHO_REQUEST to network host
pready  - set panel to ready
printenv- print environment variables
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
update  - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ubl(ubl_646x.bin) to nand
updatefs- update filesystem(davinci.img) to nand
updatek - update kernel(uImage) to nand
updates - serial update kernel or filesys
HKVS # printenv
bootargs=console=ttyS0,115200n8 initrd=2g,1 root=/dev/ram
bootdelay=3
baudrate=115200
ipaddr=192.0.0.64
serverip=192.0.0.128
bootfile="uImage"
netmask=255.255.255.0
bootcmd=fsload 0x80700000 uImage;bootm
ethaddr=00:40:48:38:15:07

Environment size: 230/131068 bytes
HKVS # fsinfo
### filesystem type is JFFS2
jffs2: scanning filesystem . done.
Compression: NONE
  frag count: 1569
  compressed sum: 6204344
  uncompressed sum: 6204344
Compression: ZERO
  frag count: 0
  compressed sum: 0
  uncompressed sum: 0
Compression: RTIME
  frag count: 0
  compressed sum: 0
  uncompressed sum: 0
Compression: RUBINMIPS
  frag count: 0
  compressed sum: 0
  uncompressed sum: 0
Compression: COPY
  frag count: 0
  compressed sum: 0
  uncompressed sum: 0
Compression: DYNRUBIN
  frag count: 0
  compressed sum: 0
  uncompressed sum: 0
Compression: ZLIB
  frag count: 352
  compressed sum: 591484
  uncompressed sum: 1422185
HKVS # ls
 -rwxrwxrwx   711436 Thu Jan 01 00:00:00 1970 rootfs.img
 -rwxrwxrwx   829440 Thu Jan 01 00:00:00 1970 720.422
 -rwxrwxrwx   269846 Thu Jan 01 00:00:00 1970 ds8062_fpga.rbf
 -rwxrwxrwx      267 Thu Jan 01 00:00:00 1970 initrun.sh
 -rwxrwxrwx  4297989 Thu Jan 01 00:00:00 1970 guirc.tar.gz
 -rwxrwxrwx  1510288 Thu Jan 01 00:00:00 1970 webs.tar.gz
HKVS # 

We can see what is wrong here, the 'bootcmd' contains instructions to load the uImage from jffs2 but there is no file named uImage there so the boot process fails.

1.2 Firmware restore

I found a firmware image and a user's manual on a Polish CCTV shop download site (old-skool plain file server!). In order to perform the update you need to setup a TFTP server responding to the IP address 192.0.0.128. I used dnsmasq for this and a simple config file:

interface = enx00248c007801
enable-tftp
tftp-root=/srv/tftp

This config uses a USB Ethernet device enx00248c007801 and /srv/tftp as the location where files are served from. The file we need from the firmware is digicap.dav. The 'update' commands in the U-Boot console triggers the update:

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 
ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 
HKVS # help    
?       - alias for 'help'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
format  - format nand except bootloader area
fsinfo	- print information about filesystems
fsload	- load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
ls	- list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
ping	- send ICMP ECHO_REQUEST to network host
pready  - set panel to ready
printenv- print environment variables
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
update  - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ubl(ubl_646x.bin) to nand
updatefs- update filesystem(davinci.img) to nand
updatek - update kernel(uImage) to nand
updates - serial update kernel or filesys
HKVS # update
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Filename 'digicap.dav'.
Load address: 0x81200000
Loading: #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   #################################################################
   ####
done
Bytes transferred = 10000988 (989a5c hex)
jffs2: add update file(uImage)...(1569292B->1580004B)done.
jffs2: add update file(rootfs.img)...(714721B->722692B)done.
jffs2: add update file(720.422)...(829440B->75324B)done.
jffs2: add update file(ds8062_fpga.rbf)...(269846B->231764B)done.
jffs2: add update file(initrun.sh)...(459B->396B)done.
jffs2: add update file(preAllocMem)...(4704B->2388B)done.
jffs2: add update file(waitAllocMem)...(3232B->1556B)done.
jffs2: add update file(guirc.tar.gz)...(5072087B->5145416B)done.
jffs2: add update file(webs.tar.gz)...(1536747B->1563068B)done.
Un-Protect Flash space
Un-Protected 122 sectors
erase Flash space

 Erase Operation Completed.
Erased 122 sectors
Writing jffs2 to Flash.../done
Re-Protect Flash space
Protected 122 sectors
HKVS # 

After the update process the NVR now boots successfuly:

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 
ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 
### JFFS2 loading 'uImage' to 0x80700000
jffs2: scanning filesystem . done.
### JFFS2 load complete: 1569292 bytes loaded to 0x80700000
## Booting image at 80700000 ...
   Image Name:   Linux-2.6.10_mvl401-davinci_evm
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1569228 Bytes =  1.5 MB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.


BusyBox v1.2.1 (2009.08.25-02:50+0000) Built-in shell (ash)
Enter 'help' for a list of davinci system commands.

Creating initial udev device nodes ... done.
mount jffs2 filesystem done.
before allocArmMemory
after allocArmMemory, vAddr:0x0x40065000, pAddr:0x0x83000000
waiting allocate memory...
start compress.
waiting decompression...
bootParms.encodeChans 16
bootParms.decodeChans 1
devHardInfo.encodeChans 16
devHardInfo.decodeChans 1
devHardInfo.alarmInNums = 16
devHardInfo.alarmOutNums = 4
devHardInfo.ataCtrlNums = 2
devHardInfo.decodeChans = 16
devHardInfo.dspSoftwareBuildDate = 0x0
devHardInfo.dspSoftwareVersion = 0x0
devHardInfo.encodeChans = 16
devHardInfo.hardwareVersion = 0xc100
devHardInfo.networkNums = 1
devHardInfo.panelVersion = 0
devHardInfo.ramSize = 256
devHardInfo.softwareBuildDate = 0x0
devHardInfo.softwareVersion = 0x0
devModel = DS-7316HI-S
prodNo = 402151991
magicNumber = 1212897107
voNums = 3
ipcChans = 0
paraChecksum = 2119
paraLength = 244
language = 1
device_class = 2
oemCode = 1
encodeChans = 16
decodeChans = 16
picFormat = 2
devHigh = 2
cpuFreq = 4
dspFreq = 4
zone = 3
webSupport = 1
voipSupport = 0
usbNums = 2
lcdSupport = 0
vtSupport = 1
videoMaxtrix = 0
extendedDecoder = 1
extendedIVS = 1
extendedAlarmOut = 1
devType = 0x50ef
ubootAdrs = 0x0
ubootSize = 0
ubootCheckSum = 0
tinyKernelAdrs	= 0x0
tinyKernelSize = 0
tinyKernelCheckSum = 0
open /home/hik/netOsd.bin OK !
readDevParam open devCfg.bin fd 7
before freeArmMemory
after freeArmMemory
write 1 byte to FIFO_FROM_PAM success.
read 1 byte from FIFO_FROM_PAM, memStat:2
memset dspMem  0
chan 0 rec buffer virtAddr = 0x478d4000 phyAddr = 0x8c000000
chan 0 net buffer virtAddr = 0x47a54000 phyAddr = 0x81300000
chan 0 sub net buffer virtAddr = 0x47ad4000 phyAddr = 0x81380000
chan 1 rec buffer virtAddr = 0x47af4000 phyAddr = 0x8c180000
chan 1 net buffer virtAddr = 0x47c74000 phyAddr = 0x81400000
chan 1 sub net buffer virtAddr = 0x47cf4000 phyAddr = 0x813a0000
chan 2 rec buffer virtAddr = 0x47d14000 phyAddr = 0x8c300000
chan 2 net buffer virtAddr = 0x47e94000 phyAddr = 0x81480000
chan 2 sub net buffer virtAddr = 0x47f14000 phyAddr = 0x813c0000
chan 3 rec buffer virtAddr = 0x47f34000 phyAddr = 0x8c480000
chan 3 net buffer virtAddr = 0x480b4000 phyAddr = 0x81500000
chan 3 sub net buffer virtAddr = 0x48134000 phyAddr = 0x813e0000
chan 4 rec buffer virtAddr = 0x48154000 phyAddr = 0x8c600000
chan 4 net buffer virtAddr = 0x482d4000 phyAddr = 0x81580000
chan 4 sub net buffer virtAddr = 0x48354000 phyAddr = 0x81600000
chan 5 rec buffer virtAddr = 0x48374000 phyAddr = 0x8c780000
chan 5 net buffer virtAddr = 0x484f4000 phyAddr = 0x81680000
chan 5 sub net buffer virtAddr = 0x48574000 phyAddr = 0x81640000
chan 6 rec buffer virtAddr = 0x48594000 phyAddr = 0x8c900000
chan 6 net buffer virtAddr = 0x48714000 phyAddr = 0x81700000
chan 6 sub net buffer virtAddr = 0x48794000 phyAddr = 0x81660000
chan 7 rec buffer virtAddr = 0x487b4000 phyAddr = 0x8ca80000
chan 7 net buffer virtAddr = 0x48934000 phyAddr = 0x81780000
chan 7 sub net buffer virtAddr = 0x489b4000 phyAddr = 0x81800000
chan 8 rec buffer virtAddr = 0x489d4000 phyAddr = 0x8cc00000
chan 8 net buffer virtAddr = 0x48b54000 phyAddr = 0x81880000
chan 8 sub net buffer virtAddr = 0x48bd4000 phyAddr = 0x81820000
chan 9 rec buffer virtAddr = 0x48bf4000 phyAddr = 0x8cd80000
chan 9 net buffer virtAddr = 0x48d74000 phyAddr = 0x81900000
chan 9 sub net buffer virtAddr = 0x48df4000 phyAddr = 0x81840000
chan 10 rec buffer virtAddr = 0x48e14000 phyAddr = 0x8cf00000
chan 10 net buffer virtAddr = 0x48f94000 phyAddr = 0x81980000
chan 10 sub net buffer virtAddr = 0x49014000 phyAddr = 0x81860000
chan 11 rec buffer virtAddr = 0x49034000 phyAddr = 0x8d080000
chan 11 net buffer virtAddr = 0x491b4000 phyAddr = 0x81a00000
chan 11 sub net buffer virtAddr = 0x49234000 phyAddr = 0x81a80000
chan 12 rec buffer virtAddr = 0x49254000 phyAddr = 0x8d200000
chan 12 net buffer virtAddr = 0x493d4000 phyAddr = 0x81b00000
chan 12 sub net buffer virtAddr = 0x49454000 phyAddr = 0x81aa0000
chan 13 rec buffer virtAddr = 0x49474000 phyAddr = 0x8d380000
chan 13 net buffer virtAddr = 0x495f4000 phyAddr = 0x81b80000
chan 13 sub net buffer virtAddr = 0x49674000 phyAddr = 0x81ac0000
chan 14 rec buffer virtAddr = 0x49694000 phyAddr = 0x8d500000
chan 14 net buffer virtAddr = 0x49814000 phyAddr = 0x81c00000
chan 14 sub net buffer virtAddr = 0x49894000 phyAddr = 0x81ae0000
chan 15 rec buffer virtAddr = 0x498b4000 phyAddr = 0x8d680000
chan 15 net buffer virtAddr = 0x49a34000 phyAddr = 0x81c80000
chan 15 sub net buffer virtAddr = 0x49ab4000 phyAddr = 0x81d00000
mapbuf0: len=1572864,offset=84000000
mapbuf1: len=1572864,offset=84180000
mapbuf2: len=1572864,offset=84300000
count = 0 visig=0 vi is ok
 (gxy)------->ky6467 bufparam bufaddr=0x85743c00,yuvH=288,yuvW=352
 (lkt)------>ky6467 bufparam audio addr[0]=0x8586cc80,addr[1]=0x8586d1a4,addr[2]=0x8586d6c8
The read of ISCSI_VERSION_FILE is 2.0-869 
# [0]ky2009_sdram =0x49fce000
viDevice:10
FH streambuf:0x87000000
 -  - -- - - --logPrintAddr = 0x81190000
dsp_share_mem->magic1 = bad3126a
dsp_share_mem->magic2 = 312df654
DSP(0) initialization success.
retry = 2856
bootInfo = 100
DSP START OK
name = eth0 speed = 0, duplex = 0, and autoneg = 1
=============set mtu[1500] OK!!!===========
=============set ipaddr OK!!!===========
=============set netmask OK!!!===========
=============set ipaddr OK!!!===========
eth0 1
=============set gateway OK!!!===========
sensorType = 0x0
send a heartbeat to panel
startHttpServer!!!
channel 1 start video capture
channel 2 start video capture
channel 3 start video capture
channel 4 start video capture
channel 5 start video capture
channel 6 start video capture
channel 7 start video capture
channel 8 start video capture
channel 9 start video capture
channel 10 start video capture
channel 11 start video capture
channel 12 start video capture
channel 13 start video capture
channel 14 start video capture
channel 15 start video capture
channel 16 start video capture
!!!!!!!!!!! mainout = 3, auxout = 1
######## w = 1024, h = 768
video_w = 1024, video_h = 768, video_bpp = 32
--------end of InitGAL--------
open mouse success!!
~~~~~~~ ctrlname: calendar_bk_bmp 2
viLostProc:Chan 1 VI lost.
viLostProc:Chan 2 VI lost.
viLostProc:Chan 3 VI lost.
viLostProc:Chan 4 VI lost.
viLostProc:Chan 5 VI lost.
viLostProc:Chan 6 VI lost.
viLostProc:Chan 7 VI lost.
viLostProc:Chan 8 VI lost.
viLostProc:Chan 9 VI lost.
viLostProc:Chan 10 VI lost.
viLostProc:Chan 11 VI lost.
viLostProc:Chan 12 VI lost.
viLostProc:Chan 13 VI lost.
viLostProc:Chan 14 VI lost.
viLostProc:Chan 15 VI lost.
viLostProc:Chan 16 VI lost.
~~~~~~~ ctrlname: cancel 2
End of InitGUI!!
Panel Version:0xa
Panel Type:0x301c05
Shuttle:1
DoubledDigit:0
F1/F2:0

Fortunately, the console connection exposes us with a root shell:

# ps w
  PID  Uid     VmSize Stat Command
    1 root        276 S   init      
    2 root            SW< [ksoftirqd/0]
    3 root            SW< [desched/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
   10 root            SW< [kthread]
   21 root            SW< [kblockd/0]
   44 root            SW  [khubd]
  108 root            SW  [pdflush]
  109 root            SW  [pdflush]
  111 root            SW< [aio/0]
  110 root            SW  [kswapd0]
  219 root            SW  [kseriod]
  259 root            SW  [mtdblockd]
  280 root            SW< [vbi]
  293 root            SW< [vbi]
  315 root            SW< [iscsi_eh]
  336 root        300 S   /bin/inetd 
  337 root        392 S   -sh 
  360 root            SWN [jffs2_gcd_mtd2]
  377 root        260 S < udevd 
  391 root      10092 S   ./hicore 
  393 root      10092 S   ./hicore 
  394 root      10092 S   ./hicore 
  397 root      10092 S   ./hicore 
  413 root        200 S   ./execSystemCmd 
  415 root        576 S < ./iscsid 
  426 root      10092 S   ./hicore 
  427 root      10092 S   ./hicore 
  428 root      10092 S   ./hicore 
  429 root      10092 S   ./hicore 
  430 root      10092 S   ./hicore 
  431 root      10092 S   ./hicore 
  432 root      10092 S   ./hicore 
  433 root      10092 S   ./hicore 
  434 root      10092 S   ./hicore 
  435 root      10092 S   ./hicore 
  436 root      10092 S   ./hicore 
  437 root      10092 S   ./hicore 
  438 root      10092 S   ./hicore 
  439 root      10092 S   ./hicore 
  440 root      10092 S   ./hicore 
  441 root      10092 S   ./hicore 
  442 root      10092 S   ./hicore 
  443 root      10092 S   ./hicore 
  444 root      10092 S   ./hicore 
  445 root      10092 S   ./hicore 
  446 root      10092 S   ./hicore 
  447 root      10092 S   ./hicore 
  448 root      10092 S   ./hicore 
  449 root      10092 S   ./hicore 
  450 root      10092 S   ./hicore 
  451 root      10092 S   ./hicore 
  452 root      10092 S   ./hicore 
  453 root      10092 S   ./hicore 
  454 root      10092 S   ./hicore 
  455 root      10092 S   ./hicore 
  456 root      10092 S   ./hicore 
  457 root      10092 S   ./hicore 
  458 root      10092 S   ./hicore 
  460 root      10092 S   ./hicore 
  461 root      10092 S   ./hicore 
  462 root      10092 S   ./hicore 
  463 root      10092 S   ./hicore 
  464 root      10092 S   ./hicore 
  465 root      10092 S   ./hicore 
  466 root      10092 S   ./hicore 
  468 root      10092 S   ./hicore 
  469 root      10092 S   ./hicore 
  470 root      10092 S   ./hicore 
  471 root      10092 S   ./hicore 
  472 root      10092 S   ./hicore 
  473 root      10092 S   ./hicore 
  474 root      10092 S   ./hicore 
  475 root      10092 S   ./hicore 
  476 root      10092 S   ./hicore 
  477 root      10092 S   ./hicore 
  478 root      10092 S   ./hicore 
  479 root      10092 S   ./hicore 
  480 root      10092 S   ./hicore 
  482 root      10092 S   ./hicore 
  483 root      10092 S   ./hicore 
  484 root      10092 S   ./hicore 
  485 root      10092 S   ./hicore 
  486 root      10092 S   ./hicore 
  489 root        304 R   ps w 
# whoami
-sh: whoami: not found
# id -a
id: illegal option -- a
BusyBox v1.2.1 (2009.08.25-02:50+0000) multi-call binary

Usage: id [OPTIONS]... [USERNAME]

Print information for USERNAME or the current user

Options:
  -g	prints only the group ID
  -u	prints only the user ID
  -n	print a name instead of a number
  -r	prints the real user ID instead of the effective ID

# id -ur   
0
# dmesg   
<4>Linux version 2.6.10_mvl401-davinci_evm (root@localhost.localdomain)
<4>(gcc version 3.4.3 (MontaVista 3.4.3-25.0.104.0600975 2006-07-06))
<4>#111 Fri Oct 29 05:41:05 CST 2010
<4>CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ)
<4>CPU0: D VIVT write-back cache
<4>CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
<4>CPU0: D cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
<4>Machine: DaVinci-DM6467
<4>boardtype is 0xc100
<4>Memory policy: ECC disabled, Data cache writeback
<7>On node 0 totalpages: 16384
<7>  DMA zone: 16384 pages, LIFO batch:4
<7>  Normal zone: 0 pages, LIFO batch:1
<7>  HighMem zone: 0 pages, LIFO batch:1
<4>Kernel command line: console=ttyS0,115200n8 initrd=2g,1 root=/dev/ram  ip=192.0.0.64:::255.255.255.0 eth=00:40:48:38:15:07 mem=64M
<4>TI DaVinci EMAC: Kernel Boot params Eth address: 00:40:48:38:15:07
<4>PID hash table entries: 512 (order: 9, 8192 bytes)
<4>Console: colour dummy device 80x30
<4>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<4>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Memory: 64MB = 64MB total
<5>Memory: 61328KB available (2585K code, 622K data, 116K init)
<7>Calibrating delay loop... 181.86 BogoMIPS (lpj=909312)
<4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
<6>CPU: Testing write buffer coherency: ok
<4>spawn_desched_task(00000000)
<4>desched cpu_callback 3/00000000
<4>ksoftirqd started up.
<4>desched cpu_callback 2/00000000
<4>desched thread 0 started up.
<6>NET: Registered protocol family 16
<6>Registering platform device 'serial8250.0'. Parent at platform
<6>Registering platform device 'nand_davinci.0'. Parent at platform
<6>Registering platform device 'nor_davinci.0'. Parent at platform
<6>DaVinci: 48 gpio irqs
<6>Registering platform device 'i2c'. Parent at platform
<5>SCSI subsystem initialized
<6>usbcore: registered new driver usbfs
<6>usbcore: registered new driver hub
<6>musb_hdrc: version 2.2a/db-0.4.8 [pio] [host] [debug=0]
<6>Registering platform device 'musb_hdrc'. Parent at platform
<7>musb_hdrc: ConfigData=0x06 (UTMI-8, dyn FIFOs, SoftConn)
<7>musb_hdrc: MHDRC RTL version 1.500 
<7>musb_hdrc: setup fifo_mode 4
<6>musb_hdrc: USB Host mode controller at c4800000 using PIO, IRQ 13
<6>musb_hdrc musb_hdrc: new USB bus registered, assigned bus number 1
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 1 port detected
<4>CDCE906 driver registered.
<4><duhao>----->pinmux_sw(0)
<4>load boot params from flash[420a8000] ok.
<4>Successfully initialized hikio module
<6>Registering platform device 'dm_spi.0'. Parent at platform
<6>JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
<4>yaffs Oct 29 2010 05:42:52 Installing. 
<6>Initializing Cryptographic API
<4>eeprom driver init(0),magic=0x484b5753,vo_mode=0x00,tc_mode=0x00
<4>register cmem driver successed.
<0>rtc: [2020-09-20 16:18:26],week is 0
<6>Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
<6>Registering platform device 'serial8250'. Parent at platform
<4>ttyS0 at MMIO 0x1c20000 (irq = 40) is a ST16654
<4>ttyS1 at MMIO 0x1c20400 (irq = 41) is a ST16654
<4>ttyS2 at MMIO 0x1c20800 (irq = 42) is a ST16654
<6>io scheduler noop registered
<4>RAMDISK driver initialized: 1 RAM disks of 4096K size 1024 blocksize
<6>loop: loaded (max 8 devices)
<6>Registering platform device 'ti_davinci_emac'. Parent at platform
<4>TI DaVinci EMAC: MAC address is 00:40:48:38:15:07
<4>TI DaVinci EMAC Linux version updated 5.0
<4>TI DaVinci EMAC: Installed 1 instances.
<6>PPP generic driver version 2.4.2
<6>PPP Deflate Compression module registered
<6>PPP BSD Compression module registered
<6>NET: Registered protocol family 24
<6>SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).
<6>i2c /dev entries driver
<6>elevator: using noop as default io scheduler
<5>DaVinci flash: probing 16-bit flash bus
<6>DaVinci flash: Found 1 x16 devices at 0x0 in 16-bit bank
<7>DaVinci flash: Found an alias at 0x1000000 for the chip at 0x0
<4> Amd/Fujitsu Extended Query Table at 0x0040
<4>DaVinci flash: CFI does not contain boot bank location. Assuming top.
<5>number of CFI chips: 1
<5>cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
<5>Creating 3 MTD partitions on "DaVinci flash":
<5>0x00000000-0x000a0000 : "bootloader"
<5>0x000a0000-0x000c0000 : "params"
<5>0x000c0000-0x01000000 : "filesystem"
<6>Linux video capture interface: v1.00
<6>tvp5158A driver registered.
<6>tvp5158B driver registered.
<6>usb 1-1: new high speed USB device using musb_hdrc and address 2
<6>hub 1-1:1.0: USB hub found
<6>hub 1-1:1.0: 4 ports detected
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,58
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<7>i2c: NACK detected,59
<4>tvp5158 chipnum is.......................0
<6>Registering platform device 'vpif capture.1'. Parent at platform
<6>tvp5154A driver registered.
<6>tvp5154B driver registered.
<6>tvp5154C driver registered.
<6>tvp5154D driver registered.
<4>display: set ddr2 VBPR to 0x10
<6>Registering platform device 'vpif display.1'. Parent at platform
<4>mount filesystem ok.
<4>load_yaffs2_file 768
<4>load fpga filesize is 269846
<4>load_yaffs2_file 787
<4>load logo filesize is 829440
<7>i2c: NACK detected,69
<7>i2c: NACK detected,69
<7>i2c: NACK detected,69
<4>cdce906: hardware not present
<4>set default video output to PAL
<4>loading rootfs ... done.
<4><duhao>----->pinmux_sw(2)
<7>dm6467 pci config done.
<4>pci: cpld disk count is 4
<6>PCI: bus0: Fast back to back transfers disabled
<4>SiI3114: register driver done.
<6>Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
<6>ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
<6>SiI3114 Serial ATA: IDE controller at PCI slot 0000:00:00.0
<4>PCI: enabling device 0000:00:00.0 (0140 -> 0143)
<6>SiI3114 Serial ATA: chipset revision 2
<6>SiI3114 Serial ATA: 100% native mode on irq 50
<6>    ide0: MMIO-DMA , BIOS settings: hda:pio, hdb:pio
<4>init ide0!!!!,No 0
<6>    ide1: MMIO-DMA , BIOS settings: hdc:pio, hdd:pio
<4>init ide1!!!!,No 1
<6>    ide2: MMIO-DMA , BIOS settings: hde:pio, hdf:pio
<4>init ide2!!!!,No 2
<6>    ide3: MMIO-DMA , BIOS settings: hdg:pio, hdh:pio
<4>init ide3!!!!,No 3
<7>Probing IDE interface ide0...
<7>Probing IDE interface ide1...
<7>Probing IDE interface ide2...
<7>Probing IDE interface ide3...
<4>ide is not exist
<6>Loading iSCSI transport class v2.0-869.
<5>iscsi: registered transport (tcp)
<6>Initializing USB Mass Storage driver...
<6>usbcore: registered new driver usb-storage
<6>USB Mass Storage support registered.
<6>usbcore: registered new driver usbhid
<6>drivers/usb/input/hid-core.c: v2.6:USB HID core driver
<6>mice: PS/2 mouse device common for all mice
<6>NET: Registered protocol family 2
<6>IP: routing cache hash table of 512 buckets, 4Kbytes
<6>TCP: Hash tables configured (established 4096 bind 8192)
<6>NET: Registered protocol family 1
<6>NET: Registered protocol family 17
<4>------------->phy_alive_status=512
<4>IP-Config: Complete:
<4>      device=eth0, addr=192.0.0.64, mask=255.255.255.0, gw=255.255.255.255,
<4>     host=192.0.0.64, domain=, nis-domain=(none),
<4>     bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=
<5>RAMDISK: Compressed image found at block 0
<4>VFS: Mounted root (minix filesystem).
<6>Freeing init memory: 116K
<4><duhao>----->pinmux_sw(0)
<4>----->[MAP]size=0x1000000,phy=0x83000000,virt=0x40065000
<4>dsplinkk: no version for "struct_module" found: kernel tainted.
<4>dsplinkk: module license 'DSP/BIOS(TM) LINK' taints kernel.
<1>DSPLINK Module (1.50) created on Date: Jan 21 2009 Time: 11:20:30
<0><KY09> :Compiled Time: Nov 30 2009 at 10:30:07
<0><KY09> :---------------------------------Module init!------------------------------
<0><KY09> :vendor=0x3086
<0><KY09> : <switch to PCI bus!!>
<0><KY09> :pci device [3086:0101] probed
<4>PCI: enabling device 0000:00:02.0 (0140 -> 0142)
<0><KY09> :set DSP in PCI master mode
<0><KY09> :device (dsp0) resource -  [PCI physical base address, size, type]
<0><KY09> :               sdram:      [ 0x90000000, 0x2000000, 0x1208 ]
<0><KY09> :               DDR_CFG:	   [ 0x93000000, 0x400000, 0x1208 ]
<0><KY09> :               Reg_CFG:	   [ 0x92000000, 0x1000000, 0x0200 ]
<0><KY09> :ky2009_probe(): ky2009_nums = 1
<0><KY09> :1 device (dsp) found totally
<4>
<0><KY09> :ky2009_install_dev(): device minor number 0.
<0><KY09> :vSdramBase:		0xc7900000
<0><KY09> :vDDR_CFG_base:		0xc9980000
<0><KY09> :vReg_CFG_base:		0xc9e00000
<0><KY09> :*****0)**************************dsp_handle->logBufAddr=0x81190000
<0><KY09> :Setup ky2009 DSP(0)
<0><KY09> :HOST_CMD0 val=0
<0><KY09> :KY2009[0] init ok.
<0><KY09> :read file size=518408
<0><KY09> :start to download firmware...
<0><KY09> :... ... verify download date OK !
<0><KY09> :DSP[0]:download_dsp_program success!
<4>
<4><duhao>----->pinmux_sw(0)
<7>watchdog start,clk is 182250000,time is 25(s),f92db90,1
<4><duhao>----->pinmux_sw(2)
<4>----->[FREE]size=0x1000000,phy=0x83000000,virt=0x40065000
<4>----->[MAP]size=0x80000,phy=0x81300000,virt=0x47a54000
<4>----->[MAP]size=0x20000,phy=0x81380000,virt=0x47ad4000
<4>----->[MAP]size=0x80000,phy=0x81400000,virt=0x47c74000
<4>----->[MAP]size=0x20000,phy=0x813a0000,virt=0x47cf4000
<4>----->[MAP]size=0x80000,phy=0x81480000,virt=0x47e94000
<4>----->[MAP]size=0x20000,phy=0x813c0000,virt=0x47f14000
<4>----->[MAP]size=0x80000,phy=0x81500000,virt=0x480b4000
<4>----->[MAP]size=0x20000,phy=0x813e0000,virt=0x48134000
<4>----->[MAP]size=0x80000,phy=0x81580000,virt=0x482d4000
<4>----->[MAP]size=0x20000,phy=0x81600000,virt=0x48354000
<4>----->[MAP]size=0x80000,phy=0x81680000,virt=0x484f4000
<4>----->[MAP]size=0x20000,phy=0x81640000,virt=0x48574000
<4>----->[MAP]size=0x80000,phy=0x81700000,virt=0x48714000
<4>----->[MAP]size=0x20000,phy=0x81660000,virt=0x48794000
<4>----->[MAP]size=0x80000,phy=0x81780000,virt=0x48934000
<4>----->[MAP]size=0x20000,phy=0x81800000,virt=0x489b4000
<4>----->[MAP]size=0x80000,phy=0x81880000,virt=0x48b54000
<4>----->[MAP]size=0x20000,phy=0x81820000,virt=0x48bd4000
<4>----->[MAP]size=0x80000,phy=0x81900000,virt=0x48d74000
<4>----->[MAP]size=0x20000,phy=0x81840000,virt=0x48df4000
<4>----->[MAP]size=0x80000,phy=0x81980000,virt=0x48f94000
<4>----->[MAP]size=0x20000,phy=0x81860000,virt=0x49014000
<4>----->[MAP]size=0x80000,phy=0x81a00000,virt=0x491b4000
<4>----->[MAP]size=0x20000,phy=0x81a80000,virt=0x49234000
<4>----->[MAP]size=0x80000,phy=0x81b00000,virt=0x493d4000
<4>----->[MAP]size=0x20000,phy=0x81aa0000,virt=0x49454000
<4>----->[MAP]size=0x80000,phy=0x81b80000,virt=0x495f4000
<4>----->[MAP]size=0x20000,phy=0x81ac0000,virt=0x49674000
<4>----->[MAP]size=0x80000,phy=0x81c00000,virt=0x49814000
<4>----->[MAP]size=0x20000,phy=0x81ae0000,virt=0x49894000
<4>----->[MAP]size=0x80000,phy=0x81c80000,virt=0x49a34000
<4>----->[MAP]size=0x20000,phy=0x81d00000,virt=0x49ab4000
<4>devfreq is 729000000
<4>adv7343 driver is already initialized..
<4>vobuftype=1,voStd=2
<4>vo phys buf=84000000
<4>vo phys buf=84180000
<4>vo phys buf=84300000
<7><duhao>----->pinmux0 in PCI,cpld_reset(1) not valid.
<0><KY09> :[ky2009_mmap-0]: vsize = 0x2000000, offs = 0x0 
<0><KY09> :[ky2009_mmap-0]: vsize = 0x400000, offs = 0x0 
<6>device eth0 entered promiscuous mode
# 

The repair seems to be successful as the boot splashscreen appears on the connected VGA monitor and the NVR can be reached via telnet and FTP.

Created: 2020-09-20 18:12

Validate