Author Topic: Swann DVR (security camera recorder) bricked after firmware update  (Read 3005 times)

0 Members and 2 Guests are viewing this topic.

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
I have a Swann DVR model swdvr-44000H / DVR4-4000 that I found a firmware update from this link: https://www.swann.com/downloads/drivers/DVR_4000/GA1.9/ I selected the DVR4-4000_GA1.9_1025.pak file and it updated and booted normally.  I then found by going back a link and to this link: https://www.swann.com/downloads/drivers/DVR_4000/GA2.0/ a newer (or what I thought) version of the firmware here DVR4-4000.0118.759.676.10.2.nor.sw.S300.pak and it installed but when the unit rebooted it never fully booted up (no screen output and the blue remote activity indicator light on the front never de illuminated).  What would I have to do to unbrick the unit?  I did find it a bit odd with the first successful firmware update that the USB drive that I used to install the update with was giving me an error about unable to mount the file system and I had to use another one to install the (newer) update that bricked the unit.  The motherboard has the markings TCBB02 V140 2012-04-07 and the sub board with the CPU on it has these markings TCCB01_V110 2012-03-09.  I think this unit runs Linux but I am unsure.  Can send pictures if needed.
« Last Edit: April 15, 2021, 01:41:44 am by poot36 »
 

Offline ttx450

  • Regular Contributor
  • *
  • Posts: 69
  • Country: us
Re: Swann DVR bricked after firmware update
« Reply #1 on: March 27, 2021, 10:07:41 pm »
I accidentally bricked a dsl modem/router/w-wireless.  spent many calls / time trying to undo with company, no luck.  It's good for australia, canada and maybe others - ebay item :-//.  The wireless I think I can get to work with my network, have not tried.  sitting on the shelve for the last several years.
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #2 on: March 28, 2021, 01:23:25 am »
Well I found the serial port and all I get out of it is a repeating string of CCCC's.  I think the uboot firmware has been bricked.  Is there any way to use an Arduino UNO to fix the NAND flash by writing to it?
 

Offline rsjsouza

  • Super Contributor
  • ***
  • Posts: 4571
  • Country: us
  • Eternally curious
    • Vbe - vídeo blog eletrônico
Re: Swann DVR bricked after firmware update
« Reply #3 on: March 28, 2021, 02:36:51 am »
CCCC is typically the ROM bootloader testing the line, so an external host can  respond and perform a serial boot. Depending on the device on the board, there is a chance its manufacturer will have the procedure documented somewhere. Then, locate a valid firmware (probably a
.bin file) then there is a chance the box will boot normally.

If this is a linux-based device, you will probably need to check the status of the flash before the kernel boots - you need to halt at the u-boot phase to erase and write flash, etc. But at this point anything is heavily dependent on the device in question.
Vbe - vídeo blog eletrônico http://videos.vbeletronico.com

Oh, the "whys" of the datasheets... The information is there not to be an axiomatic truth, but instead each speck of data must be slowly inhaled while carefully performing a deep search inside oneself to find the true metaphysical sense...
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 7303
Re: Swann DVR bricked after firmware update
« Reply #4 on: March 28, 2021, 03:17:06 am »
If you can locate the chip that holds the firmware and have a way of reading/writing it, you may be able to fix this.
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #5 on: March 28, 2021, 10:02:31 pm »
Ok, after some more research I have found that this CPU board is in a China ST DVR-1604 unit that supports 16 channels of recording.  My unit only supports 4 so is missing some of the decoder chips.  At the bottom of this translated post there are some pictures of what the CPU board looks like with all 4 decoder chips installed (mine only has the one on the top of the PCB by the crystal) https://translate.google.com/translate?hl=en&sl=ru&u=https://monitor.net.ru/forum/threads/585570/page-3&prev=search&pto=aue not sure if this is helpful or not.  And about halfway down this post: https://translate.google.com/translate?hl=en&sl=ru&u=http://monitor.espec.ws/section8/printview288201.html&prev=search&pto=aue it mentions that the CCCC message I am seeing is somehow related to corrupt or missing NAND (search for CCCCC on the page and you will find it).  I am starting to think that I may be screwed unless I can directly access the NAND chip.
 

Offline rsjsouza

  • Super Contributor
  • ***
  • Posts: 4571
  • Country: us
  • Eternally curious
    • Vbe - vídeo blog eletrônico
Re: Swann DVR bricked after firmware update
« Reply #6 on: March 28, 2021, 10:23:36 pm »
(...) it mentions that the CCCC message I am seeing is somehow related to corrupt or missing NAND (search for CCCCC on the page and you will find it).  I am starting to think that I may be screwed unless I can directly access the NAND chip.
It makes sense. If the processor can't find a valid image on the NAND Flash, its bootloader routine may or may not circle around several other boot modes (it could be SPI, Ethernet, etc.) or, what seems to be your case, lock on UART bootmode.

One thing is that, depending on the image, it may have a u-boot in it that allows accessing, verifying, erasing and reprogramming the NAND Flash. You need, however, the device information itself.
Vbe - vídeo blog eletrônico http://videos.vbeletronico.com

Oh, the "whys" of the datasheets... The information is there not to be an axiomatic truth, but instead each speck of data must be slowly inhaled while carefully performing a deep search inside oneself to find the true metaphysical sense...
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR bricked after firmware update
« Reply #7 on: March 28, 2021, 10:46:10 pm »
Perhaps this is u-boot over UART? http://www.staroceans.org/e-book/AM335x_U-Boot_User%27s_Guide.html#Boot_Over_UART

I'm familiar with u-boot, but I've never booted over UART before. It looks like it's expecting u-boot-spl.bin for your specific architecture?

I took a look at the update binary in the 2nd cramfs image in the firmware, but I haven't seen anything interesting so far. I was hoping maybe there would be something that pointed to alternate firmware update modes.

Cheers
-Tim
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #8 on: April 03, 2021, 02:00:37 am »
Well I did a bit of research into the UART booting and found this: http://web.archive.org/web/20210115021712if_/http://processors.wiki.ti.com/index.php/DM814x_AM387x_PSP_U-Boot#U-Boot-MIN_for_UART_boot and this https://www.xuebuyuan.com/2133280.html.  Hopefully by downloading the files from here: https://software-dl.ti.com/dsps/dsps_public_sw/ezsdk/latest/index_FDS.html I can figure out how to make the U-Boot_Min for my board and load the correct firmware back onto it.  I have very little experience with Linux so it will be an adventure that is for sure.
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #9 on: April 04, 2021, 12:17:13 am »
Not sure if anyone cares but here is the link to download the CodeSourcery version that the EZSDK installer needs: http://www.codesourcery.com/sgpp/lite/arm/portal/package4573/public/arm-none-linux-gnueabi/arm-2009q1-203-arm-none-linux-gnueabi.bin
 

Offline rsjsouza

  • Super Contributor
  • ***
  • Posts: 4571
  • Country: us
  • Eternally curious
    • Vbe - vídeo blog eletrônico
Re: Swann DVR bricked after firmware update
« Reply #10 on: April 04, 2021, 01:19:53 am »
This is indeed a very old family of DaVinci devices... Something that I suspect there is no support anymore, unless you buy heaps of parts.

The details escape me. I think the EZSDK has some documentation but the (now decomissioned) wiki is your friend here. That and some threads on the e2e support.

Also, be sure to use the Ubuntu version used by the EZSDK, as many gremlins will appear if using something newer.

Good luck in your journey.
Vbe - vídeo blog eletrônico http://videos.vbeletronico.com

Oh, the "whys" of the datasheets... The information is there not to be an axiomatic truth, but instead each speck of data must be slowly inhaled while carefully performing a deep search inside oneself to find the true metaphysical sense...
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #11 on: April 04, 2021, 03:48:08 am »
Well after a lot of fighting with the VM, compiler errors and running out of space on the VM hard drive I got it to compile.  If you get the compiler error make: arm-none-linux-gnueabi-gcc: Command not found you need to add these lines to your .bashrc file in your home directory /home/(User Name)/CodeSourcery/Sourcery_G++_Lite/bin and CROSS_COMPILE=arm-none-linux-gnueabi-.  You should also check your permissions on the CodeSourcery and folder you installed the EZSDK to as that can also cause errors due to not being able to read or write to various files as needed.  I have attached the u-boot.min.uart file to this post after I copied it out of the VM so that other people do not have to go through what I did to make the file (not sure if this will cause issues or not due to how Windows handles files).  You should just have to take the .hex extension off the end of the file.
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #12 on: April 04, 2021, 04:28:08 am »
Well here is the results of 1st and 2nd stage boot:

U-Boot 2010.06 (Apr 03 2021 - 21:26:14)

TI8148-GP rev 2.1

ARM clk: 600MHz
DDR clk: 400MHz

DRAM:  2 GiB
Using default environment

The 2nd stage U-Boot will now be auto-loaded
Please do not interrupt the countdown till TI8148_EVM prompt if 2nd stage is already flashed
Hit any key to stop autoboot:  0
TI-MIN#loadb 0x81000000
## Ready for binary (kermit) download to 0x81000000 at 115200 bps...
## Total Size      = 0x000335e0 = 210400 Bytes
## Start Addr      = 0x81000000
TI-MIN#go 0x81000000
## Starting application at 0x81000000 ...


U-Boot 2010.06 (Dec 26 2012 - 18:12:01)

TI8148-GP rev 2.1

ARM clk: 600MHz
DDR clk: 400MHz

I2C:   ready
DRAM:  2 GiB
NAND:  HW ECC BCH8 Selected
128 MiB
MMC:   OMAP SD/MMC: 0
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
*** Warning - bad CRC or NAND, using default environment

                          .:;rrr;;.
                    ,5#@@@@#####@@@@@@#2,
                 ,A@@@hi;;;r5;;;;r;rrSG@@@A,
               r@@#i;:;s222hG;rrsrrrrrr;ri#@@r
             :@@hr:r;SG3ssrr2r;rrsrsrsrsrr;rh@@:
            B@H;;rr;3Hs;rrr;sr;;rrsrsrsrsrsr;;H@B
           @@s:rrs;5#;;rrrr;r#@H:;;rrsrsrsrsrr:s@@
          @@;;srs&X#9;r;r;;,2@@@rrr:;;rrsrsrsrr;;@@
         @@;;rrsrrs@MB#@@@@@###@@@@@@#rsrsrsrsrr;;@@
        G@r;rrsrsr;#X;SX25Ss#@@#M@#9H9rrsrsrsrsrs;r@G
        @9:srsrsrs;2@;:;;:.X@@@@@H::;rrsrsrsrsrsrr:3@
       X@;rrsrsrsrr;XAi;;:&@@#@Bs:rrsrsrsrsrsrsrsrr;@X
       @#;rsrsrsrsrr;r2ir@@@###::rrsrsrsrsrsrsrsrsr:@@
       @A:rrsrsrsrr;:2@29@@M@@@;:;rrrrsrsrsrsrsrsrs;H@
       @&;rsrsrsrr;A@@@@@@###@@@s::;:;;rrsrsrsrsrsr;G@
       @#:rrsrsrsr;G@5Hr25@@@#@@@#9XG9s:rrrrsrsrsrs:#@
       M@;rsrsrsrs;r@&#;::S@@@@@@@M@@@@Grr:;rsrsrsr;@#
       :@s;rsrsrsrr:M#Msrr;;&#@@@@@@@@@@H@@5;rsrsr;s@,
        @@:rrsrsrsr;S@rrrsr;:;r3MH@@#@M5,S@@irrsrr:@@
         @A:rrsrsrsrrrrrsrsrrr;::;@##@r:;rH@h;srr:H@
         ;@9:rrsrsrsrrrsrsrsrsr;,S@Hi@i:;s;MX;rr:h@;
          r@B:rrrrsrsrsrsrsrr;;sA@#i,i@h;r;S5;r:H@r
           ,@@r;rrrsrsrsrsrr;2BM3r:;r:G@:rrr;;r@@,
             B@Mr;rrrrsrsrsr@@S;;;rrr:5M;rr;rM@H
              .@@@i;;rrrrsrs2i;rrrrr;r@M:;i@@@.
                .A@@#5r;;;r;;;rrr;r:r#AsM@@H.
                   ;&@@@@MhXS5i5SX9B@@@@G;
                       :ihM#@@@@@##hs,

Net:   <ethaddr> not set. Reading from E-fuse
Detected MACID:0:17:eb:ed:11:5a
cpsw
Hit any key to stop autoboot:  0
Card did not respond to voltage select!
** Can't read from device 0 **

** Unable to use mmc 0:1 for fatload **
In case ENV on MMC/SD is required
Please put a valid script named boot.scr on the card
Refer to the User Guide on how to generate the image
TI8148_EVM#

If you type help you get this list of commands:

?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bmp     - manipulate BMP image data
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
exit    - exit script
false   - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nandecc - Switch NAND ECC calculation algorithm b/w hardware and software
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
version - print monitor version

I think I should be able to somehow fix this over the network.
 

Offline rsjsouza

  • Super Contributor
  • ***
  • Posts: 4571
  • Country: us
  • Eternally curious
    • Vbe - vídeo blog eletrônico
Re: Swann DVR bricked after firmware update
« Reply #13 on: April 04, 2021, 09:12:53 am »
Good progress. Deslite slow, having u-boot is a great thing as you can tell the surrounding hardware is working well for the most part. Obviously that your NAND seems to be indeed shot - not an uncommon scenario.

If the Ethernet is working well, then you can load the uImage kernel from TFTP and the filesystem from an NFS share - be prepared for one more round of wrenching with Linux to configure these two services. Also, you will need a sequence of commands to be passed to u-boot - there is a page on the wiki named Teraterm scripts (or something similar) that has some ready-to-run u-boot scripts for several boards - I think DM814x is there as well. Otherwise, you can check the setup program of the EZSDK and configure it for NFS boot - it should create a minicom script for the sequence of commands/parameters for u-boot there.

I don't remember if the EZSDK user's guide has this information as well but, with the wiki out of commission, things become a lot harder to browse (I still can't believe why they killed this, but oh well...)
Vbe - vídeo blog eletrônico http://videos.vbeletronico.com

Oh, the "whys" of the datasheets... The information is there not to be an axiomatic truth, but instead each speck of data must be slowly inhaled while carefully performing a deep search inside oneself to find the true metaphysical sense...
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #14 on: April 11, 2021, 11:46:08 pm »
I have made some headway, I have managed to dump 2Kb of the NAND over the serial terminal using the nand dump 0 command.  This has dumped page 00000000 from the NAND at what I presume is the start of the flash.  I have found that if you increment it by the hex value 800 you get to the next 2Kb block of data.  Now that I know that I can try and figure out where the u-boot code starts and where the file system is.  I have attached the first 2Kb dump of the NAND to this post and have found that it matches the incorrect firmware .pak file starting at hex address 4F8.  It would be great if all I have to do is dump a modified .pak file into the RAM and then write it to the NAND and have the unit boot.
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR bricked after firmware update
« Reply #15 on: April 12, 2021, 02:39:54 am »
Well here is what I got from what I think is the 2nd stage u-boot that I extracted from the correct .pak firmware file:

## Starting application at 0x81000000 ...


U-Boot 2010.06 (Jun 07 2012 - 16:12:09)

TI8148-GP rev 2.1

ARM clk: 720MHz
DDR clk: 400MHz
IVA clk: 321MHz
ISS clk: 400MHz
DSS clk: 200MHz
DSP clk: 600MHz

I2C:   ready
DRAM:  1 GiB
NAND:  HW ECC Hamming Code selected
128 MiB
*** Warning - bad CRC or NAND, using default environment

 _____       ___   _   _____   _   _   _   _       ___   __   _
|  _  \     /   | | | /  ___| | | | | | | | |     /   | |  \ | |
| |_| |    / /| | | | | |     | |_| | | | | |    / /| | |   \| |
|  _  {   / / | | | | | |     |  _  | | | | |   / / | | | |\   |
| |_| |  / /  | | | | | |___  | | | | | |_| |  / /  | | | | \  |
|_____/ /_/   |_| |_| \_____| |_| |_| \_____/ /_/   |_| |_|  \_|

MMC:   OMAP SD/MMC: 0
Net:   <ethaddr> not set. Reading from E-fuse
Detected MACID:0:17:eb:ed:11:5a
cpsw
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x1ee0000, size 0x200000
 2097152 bytes read: OK
change to 400K for i2c
NAND read: device 0 offset 0x280000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   Linux-2.6.37
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2700532 Bytes = 2.6 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #11 Tue Jan 15 14:52:00 CST 2013
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: ti8148evm
bootconsole [earlycon0] enabled
ti81xx_reserve: ### Reserved DDR region @87f00000
reserved size = 52428800 at 0x0
FB: Reserving 52428800 bytes SDRAM for VRAM
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8148 2.1
SRAM: Mapped pa 0x402f1000 to va 0xfe400000 size: 0xf000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 19456
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 76MB 1MB = 77MB total
Memory: 71852k/71852k available, 59220k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc8800000 - 0xf8000000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .init : 0xc0008000 - 0xc0042000   ( 232 kB)
      .text : 0xc0042000 - 0xc051f000   (4980 kB)
      .data : 0xc0520000 - 0xc056d280   ( 309 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:407
omap_hwmod: gpio1: softreset failed (waited 10000 usec)
omap_hwmod: gpio2: softreset failed (waited 10000 usec)
omap_hwmod: gpio3: softreset failed (waited 10000 usec)
omap_hwmod: gpio4: softreset failed (waited 10000 usec)
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
GPMC revision 6.0
Trying to install interrupt handler for IRQ400
Trying to install interrupt handler for IRQ401
Trying to install interrupt handler for IRQ402
Trying to install interrupt handler for IRQ403
Trying to install interrupt handler for IRQ404
Trying to install interrupt handler for IRQ405
Trying to install interrupt handler for IRQ406
Trying to install type control for IRQ407
Trying to set irq flags for IRQ407
OMAP clockevent source: GPTIMER1 at 20000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
TI81XX: Map 0x87f00000 to 0xfe500000 for dram barrier
TI81XX: Map 0x40300000 to 0xfe600000 for sram barrier
omap_voltage_early_init: voltage driver support not added
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
omap_voltage_domain_lookup: Voltage driver init not yet happened.Faulting!
omap_voltage_add_dev: VDD specified does not exist!
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
ti8148_evm_init: LIXUEQIANG failed to request GPIO for TSC IRQ
omap_mux_init: Add partition: #1: core, flags: 4
_omap_mux_init_gpio: Could not set gpio38
NOR: Can't request GPMC CS
ti814x_sata_pllcfg: LIXUEQIANG (cpu_is_ti814x()) && (!cpu_is_dm385()))
clk get on i2c3 fck failed
Cannot clk_get ck_32
omap2_init_devices: LIXUEQIANG begin 8
Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported now
registered ti81xx_vpss device
registered ti81xx_vidout device
registered ti81xx on-chip HDMI device
registered ti81xx_fb device
registered ti81xx_vin device
ti81xx_pcie: Invoking PCI BIOS...
ti81xx_pcie: Setting up Host Controller...
ti81xx_pcie: Register base mapped @0xc8820000
ti81xx_pcie: Starting PCI scan...
PCI: bus0: Fast back to back transfers enabled
ti81xx_pcie: PCI scan done.
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
USBSS revision 4ea2080b
registerd cppi-dma Intr @ IRQ 17
Cppi41 Init Done
omap_i2c omap_i2c.1: bus 1 rev4.0 at 400 kHz
I2C: Read failed at pcf8575_cir_enable 236 with error code: -121
I2C: Transfer failed at pcf8575_cir_enable 243 with error code: -121
tps65910 1-002d: read from reg 3f failed
tps65910 1-002d: read from reg 1e failed
set_machine_constraints: failed to enable VRTC
tps65910 1-002d: failed to register tps65910-pmic regulator
tps65910-pmic: probe of tps65910-pmic failed with error -121
tps65910 1-002d: No interrupt support, no core IRQ
omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHz
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource gp timer
musb-hdrc: version 6.0, host, debug=0
musb-hdrc musb-hdrc.0: dma type: dma-cppi41
MUSB controller-0 revision 4ea20800
usb2phy: computed values rxcalib(15)DACs(37 11 11)
usb2phy: override computed values rxcalib(15)DACs(37 11 11)
usb2phy_config: musb(0) rxcalib done, rxcalib read value 6f72d75e
musb-hdrc musb-hdrc.0: MUSB HDRC host driver
musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 2.6.37 musb-hcd
usb usb1: SerialNumber: musb-hdrc.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18
musb-hdrc musb-hdrc.1: dma type: dma-cppi41
MUSB controller-1 revision 4ea20800
usb2phy: computed values rxcalib(15)DACs(38 13 14)
usb2phy: override computed values rxcalib(15)DACs(38 13 14)
usb2phy_config: musb(1) rxcalib done, rxcalib read value 6f735b76
musb-hdrc musb-hdrc.1: MUSB HDRC host driver
musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: MUSB HDRC host driver
usb usb2: Manufacturer: Linux 2.6.37 musb-hcd
usb usb2: SerialNumber: musb-hdrc.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
musb-hdrc musb-hdrc.1: USB Host mode controller at c8826800 using DMA, IRQ 19
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
PMU: registered new PMU device of type 0
omap-iommu omap-iommu.0: ducati registered
omap-iommu omap-iommu.1: sys registered
fuse init (API version 7.15)
msgmni has been set to 140
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
omap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0
console [ttyO0] enabled, bootconsole disabled
console [ttyO0] enabled, bootconsole disabled
omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
brd: module loaded
loop: module loaded
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
omap2-nand driver initializing
ONFI flash detected
ONFI param page 0 valid
NAND device: Maf ID: 0xad, Chip ID: 0xf1 (Hynix, NAND 128MiB 3,3V 8-bit)
 erasesize: 0x20000, writesize: 2048, oobsize: 64
Creating 7 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x000000580000 : "U-Boot Logo"
0x000000580000-0x0000009c0000 : "Kernel"
0x0000009c0000-0x00000d1e0000 : "File System"
mtd: partition "File System" extends beyond the end of device "omap2-nand.0" -- size truncated to 0x7640000
0x000008000000-0x000008000000 : "Reserved"
mtd: partition "Reserved" is out of reach -- disabled
davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
davinci_mdio davinci_mdio.0: detected phy mask fffffffd
davinci_mdio.0: probed
davinci_mdio davinci_mdio.0: phy[1]: device 0:01, driver unknown
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
qt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failed
qt602240_ts: probe of 1-004a failed with error -5
omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0
i2c /dev entries driver
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v1.0.0)
OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
notify_init : notify drivercreated  for  remote proc id 2 at physical Address 0xbfd00000
usbcore: registered new interface driver snd-usb-audio
function cs4334_modinit,line:219
Registered tvp5158 audio codec
asoc: HDMI-DAI-CODEC <-> hdmi-dai mapping ok
ALSA device list:
  #0: TI81XX SOUND1
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
omap_voltage_late_init: Voltage driver support not added
Power Management for TI81XX.
Detected MACID=0:17:eb:ed:11:5a
omap_rtc omap_rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)
usb 1-1: new high speed USB device using musb-hdrc and address 2
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 2-1: new high speed USB device using musb-hdrc and address 2
usb 2-1: New USB device found, idVendor=05e3, idProduct=0718
usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2
usb 2-1: Product: USB Storage
usb 2-1: SerialNumber: 000000000033
scsi1 : usb-storage 2-1:1.0
scsi 1:0:0:0: Direct-Access     USB TO I DE/SATA Device   0016 PQ: 0 ANSI: 4
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Attached SCSI disk
ata1: SATA link down (SStatus 0 SControl 300)
cramfs_fill_nand blocks is 34
List of all partitions:
1f00             128 mtdblock0  (driver?)
1f01            2304 mtdblock1  (driver?)
1f02             128 mtdblock2  (driver?)
1f03            3072 mtdblock3  (driver?)
1f04            4352 mtdblock4  (driver?)
1f05          121088 mtdblock5  (driver?)
No filesystem could mount root, tried:  cramfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)
Backtrace:
[<c0050bf4>] (dump_backtrace+0x0/0x110) from [<c03d707c>] (dump_stack+0x18/0x1c)
 r7:c4814000 r6:c0079854 r5:c002fb94 r4:c056de90
[<c03d7064>] (dump_stack+0x0/0x1c) from [<c03d70e0>] (panic+0x60/0x17c)
[<c03d7080>] (panic+0x0/0x17c) from [<c00092b4>] (mount_block_root+0x1e0/0x220)
 r3:00000000 r2:00000020 r1:c4825f58 r0:c049ce8c
[<c00090d4>] (mount_block_root+0x0/0x220) from [<c00093a0>] (mount_root+0xac/0xcc)
[<c00092f4>] (mount_root+0x0/0xcc) from [<c0009530>] (prepare_namespace+0x170/0x1d4)
 r4:c056d2e4
[<c00093c0>] (prepare_namespace+0x0/0x1d4) from [<c00087c4>] (kernel_init+0x114/0x154)
 r5:c00086b0 r4:c056d280
[<c00086b0>] (kernel_init+0x0/0x154) from [<c0079854>] (do_exit+0x0/0x5e4)
 r5:c00086b0 r4:00000000

I think it crashes due to the flash being messed up.  I also extracted what I think is the u-boot-min.nand file as well.  I have attached both these files to this post for you to look over and tell me what you think.  It looks like the ASCII art did not fully copy correctly, what is says is baichuan.
« Last Edit: April 12, 2021, 02:42:14 am by poot36 »
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #16 on: April 19, 2021, 02:18:43 am »
More progress has been made.  I have managed to extract the correct u-boot-min.nand file from the .pak file and have found that if I load it over serial when the unit is displaying CCCCC it will actually boot it and then start booting the u-boot that is on the NAND but crashes due to the u-boot being for a different processor.  I have attached the corrected u-boot-min.nand and a potentially correct u-boot files to this post.  The last boot log that I posted is for the incorrect kernel that was flashed onto the unit and that is why I suspect it does not fully boot.  I am working on extracting the kernel out of the correct .pak file.  I have been able to confirm that the kernel starts at hex address 0x280000 and the u-boot image (.bmp file) starts at hex address 0x1ee0000 in the NAND.  u-boot-min.nand starts at hex address 0x0 and u-boot starts at hex address 0x20000.  Not sure if that helps anyone.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #17 on: April 19, 2021, 02:48:21 am »
I recently ran into this same issue after modifying filesystems on several embedded devices, I ended up bricking them. After looking at the boot logs we determined that the most likely cause was a difference in the filesystem size compared to the Linux kernel command line arguments.

However, in your case it appears the Linux kernel is trying to load rootfs from the wrong mtd partition:
Code: [Select]
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
In this case loading from the mtdblock4, but looking at the partitions, it should be mtdblock5.
Code: [Select]
Creating 7 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x000000580000 : "U-Boot Logo"
0x000000580000-0x0000009c0000 : "Kernel"
0x0000009c0000-0x00000d1e0000 : "File System"
mtd: partition "File System" extends beyond the end of device "omap2-nand.0" -- size truncated to 0x7640000
0x000008000000-0x000008000000 : "Reserved"
...
List of all partitions:
1f00             128 mtdblock0  (driver?)
1f01            2304 mtdblock1  (driver?)
1f02             128 mtdblock2  (driver?)
1f03            3072 mtdblock3  (driver?)
1f04            4352 mtdblock4  (driver?)
1f05          121088 mtdblock5  (driver?)

So you are correct, this is the incorrect kernel. The kernel seems to be working though, so you might actually be able to just modify the kernel using a hex editor and change the rootfs partition from 4 to 5. Although that size truncated error is a bit suspect. Changing the 4 to a 5 in a hex editor won't change the size of the file, so it should still work fine. If you don't already have a favorite hex editor, I like HxD and 010 Editor, on Linux sometimes I'll use Bless in a pinch.

I would try flashing the correct Linux kernel if you have it. You should be able to flash it using uboot, not all uboot images support networking though, so you may have to use ymodem or something.

Good luck!

Cheers
-Tim
« Last Edit: April 19, 2021, 02:55:52 am by dc101 »
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #18 on: April 19, 2021, 03:35:34 am »
It should be fairly straight forward to extract the kernel from the .pak file.

Code: [Select]
user@femto:~/re_projs/dvr4000$ binwalk DVR4-4000_GA1.9_1025.pak

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
78648         0x13338         CRC32 polynomial table, little endian
255164        0x3E4BC         CRC32 polynomial table, little endian
433280        0x69C80         uImage header, header size: 64 bytes, header CRC: 0x4918710A, created: 2012-09-21 03:11:57, image size: 2662416 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x343FB2FF, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.37"
449983        0x6DDBF         gzip compressed data, maximum compression, from Unix, last modified: 2012-09-21 03:11:56
3095760       0x2F3CD0        CramFS filesystem, little endian, size: 8011776 version 2 sorted_dirs CRC 0xD8777123, edition 0, 4491 blocks, 1405 files
11107536      0xA97CD0        CramFS filesystem, little endian, size: 8957952 version 2 sorted_dirs CRC 0x3CE298E8, edition 0, 6640 blocks, 746 files
20065488      0x1322CD0       PC bitmap, Windows 3.x format,, 684 x 456 x 24

The uImage wrapped kernel starts at 0x69C80 and goes to 0x2F3CD0, so extract with:
Code: [Select]
user@femto:~/re_projs/dvr4000$ dd if=DVR4-4000_GA1.9_1025.pak bs=1 skip=433280 count=2662480 of=uimage.bin
user@femto:~/re_projs/dvr4000$ mkimage -l uimage.bin
Image Name:   Linux-2.6.37
Created:      Thu Sep 20 23:11:57 2012
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:    2662416 Bytes = 2600.02 KiB = 2.54 MiB
Load Address: 80008000
Entry Point:  80008000
Strip off the uboot header:
Code: [Select]
user@femto:~/re_projs/dvr4000$ tail -c+65 < uimage.bin > zimage.bin
user@femto:~/re_projs/dvr4000$ file zimage.bin
zimage.bin: Linux kernel ARM boot executable zImage (little-endian)
user@femto:~/re_projs/dvr4000$
Now you should be able to load zimage.bin in uboot (loadb/loady) and flash it using the nand subsystem commands (nand write)

Cheers
-Tim
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #19 on: April 19, 2021, 03:40:57 am »
I think I have already extracted the kernel under windows but I am not sure.  I have attached what I think it is to this post.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #20 on: April 19, 2021, 04:25:54 am »
Your file does not appear to be the correct size.

Code: [Select]
user@femto:~/re_projs/dvr4000$ file Kernel.bin
Kernel.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2

The kernel should be 2662416 bytes. Comparing your Kernel.bin to the zimage.bin you can also see that Kernel.bin appears to contain some amount of the cramfs file system that follows the kernel image in the .pak file.

Side note, .hex is usually reserved for ascii files that contain the ascii hex values of data to be flashed. Intel and Motorola are two popular formats, but they are also used for Atmel AVRs and PIC micros. https://en.wikipedia.org/wiki/Intel_HEX
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #21 on: April 19, 2021, 04:32:37 am »
You can try flashing your kernel.hex file. The kernel mtd partition is 0x440000 bytes which works out to 4456448 decimal, so it should still fit without spilling over into the rootfs partition. You may have to strip of the 64 byte uImage header though, I'm not certain if it's supposed to be there or not.

I would dump the first page of the kernel image flash space and see what the first 64 bytes look like. If they look like your kernel.hex, you should be good to go, otherwise you may need to remove the uImage header.

Cheers
-Tim
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #22 on: April 20, 2021, 02:08:51 am »
Here is the first 2Kb of data from address 0x280000 in the NAND (note this is the incorrect kernel so it may not match with what you have got from binwalk).  Not sure if it is enough data to figure out where it ends though.  I have had to add the hex extention to all files that I upload as the forum does not support odd file types.  @dc101 The log file you are looking at is from the incorrect firmware so the file size mentioned may be wrong.  I do know that the partition map is incorrect but oddly the u-boot file for for the incorrect firmware also references 0x280000 for booting the kernel but then also in the kernel boot assigns it to the u-boot logo.  Very odd.
« Last Edit: April 20, 2021, 02:21:51 am by poot36 »
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 159
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #23 on: April 20, 2021, 02:39:45 am »
Interesting, it does actually have the uImage header, so you should not remove it when you flash it.
Code: [Select]
user@femto:~/re_projs/dvr4000$ file nand_dump_280000.bin
nand_dump_280000.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2700532 bytes, Tue Jan 15 06:52:04 2013, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xE86EB12F, Data CRC: 0x38CEFF47
user@femto:~/re_projs/dvr4000$ file uimage.bin
uimage.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2FF

I understand the log file you posted was for the wrong kernel. The kernel size I mentioned was the one I extracted from the original firmware you posted in your first message, DVR4-4000_GA1.9_1025.pak.

You should be fine flashing the kernel image you extracted. Linux shows the kernel size should be 2662416 bytes. I renamed it .bin on my system because it's a binary file and not ascii hex, .hex is used for ascii files, but this is the same file you posted.

Code: [Select]
user@femto:~/re_projs/dvr4000$ file Kernel.bin
Kernel.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2FF
user@femto:~/re_projs/dvr4000$ ll Kernel.bin
-rw------- 1 user user 3145728 Apr 19 00:06 Kernel.bin

As I mentioned, you have some extra data at the end of the kernel image you attached to your previous post. It won't hurt anything since the file size is smaller than the Linux mtd kernel partition, but it would be safer to extract just the kernel and nothing more. The reason the count is larger that than the kernel size is to account for the 64 byte uImage kernel header.
Code: [Select]
dd if=DVR4-4000_GA1.9_1025.pak bs=1 skip=433280 count=2662480 of=uimage.bin
Cheers
-Tim
 

Offline poot36

  • Frequent Contributor
  • **
  • Posts: 564
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #24 on: April 20, 2021, 02:45:29 am »
Well I got the kernel booting from RAM, here is the output (no video out of the device though):

TI8148_EVM#bootm 0x81000000
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   Linux-2.6.37
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2662416 Bytes = 2.5 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: ti8148evm
reserved size = 52428800 at 0x0
FB: Reserving 52428800 bytes SDRAM for VRAM
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8148 2.0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 19712
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 78MB = 78MB total
Memory: 73032k/73032k available, 58040k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc8800000 - 0xf8000000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .init : 0xc0008000 - 0xc003a000   ( 200 kB)
      .text : 0xc003a000 - 0xc0506000   (4912 kB)
      .data : 0xc0506000 - 0xc0547f80   ( 264 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:375
omap_hwmod: gpio1: softreset failed (waited 10000 usec)
omap_hwmod: gpio2: softreset failed (waited 10000 usec)
omap_hwmod: gpio3: softreset failed (waited 10000 usec)
omap_hwmod: gpio4: softreset failed (waited 10000 usec)
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
GPMC revision 6.0
Trying to install interrupt handler for IRQ368
Trying to install interrupt handler for IRQ369
Trying to install interrupt handler for IRQ370
Trying to install interrupt handler for IRQ371
Trying to install interrupt handler for IRQ372
Trying to install interrupt handler for IRQ373
Trying to install interrupt handler for IRQ374
Trying to install type control for IRQ375
Trying to set irq flags for IRQ375
OMAP clockevent source: GPTIMER1 at 20000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
omap_voltage_early_init: voltage driver support not added
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
omap_mux_init: Add partition: #1: core, flags: 4
registered ti814x_vpss device
registered TI814x on-chip HDMI device
clk get on i2c3 fck failed
registered ti81xx_vidout device
Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported now
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
registerd cppi-dma Intr @ IRQ 17
Cppi41 Init Done
omap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHz
pcf857x: probe of 1-0021 failed with error -121
omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHz
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource gp timer
musb-hdrc: version 6.0, host, debug=0
musb-hdrc musb-hdrc.0: dma type: dma-cppi41
musb-hdrc musb-hdrc.0: MUSB HDRC host driver
musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 2.6.37 musb-hcd
usb usb1: SerialNumber: musb-hdrc.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18
musb-hdrc musb-hdrc.1: dma type: dma-cppi41
musb-hdrc musb-hdrc.1: MUSB HDRC host driver
musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: MUSB HDRC host driver
usb usb2: Manufacturer: Linux 2.6.37 musb-hcd
usb usb2: SerialNumber: musb-hdrc.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
musb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
PMU: registered new PMU device of type 0
omap-iommu omap-iommu.0: ducati registered
omap-iommu omap-iommu.1: sys registered
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.15)
msgmni has been set to 142
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
omap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0
console [ttyO0] enabled
omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
brd: module loaded
loop: module loaded
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
omap2-nand driver initializing
ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Creating 11 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x0000006c0000 : "Kernel"
0x0000006c0000-0x000000ec0000 : "File System"
0x000000ec0000-0x000001ac0000 : "Application"
0x000001ac0000-0x000001ec0000 : "Param"
0x000001ec0000-0x000001ee0000 : "Version"
0x000001ee0000-0x0000020e0000 : "Logo"
0x000000000000-0x000004000000 : "Whole"
0x0000020e0000-0x000008000000 : "Reserved"
usb 1-1: new high speed USB device using musb-hdrc and address 2
davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
davinci_mdio davinci_mdio.0: detected phy mask fffffffd
davinci_mdio.0: probed
davinci_mdio davinci_mdio.0: phy[1]: device 0:01, driver unknown
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
qt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failed
qt602240_ts: probe of 1-004a failed with error -5
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
rtc-isl1208 1-006f: rtc power failure detected, please set clock.
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v1.0.0)
OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
notify_init : notify drivercreated  for  remote proc id 2 at physical Address 0xbfd00000
function cs4334_modinit,line:219
function cs4334_codec_probe,line:192
function hdmi_dai_init,line:276
function davinci_hdmi_probe,line:238
function cs4334_probe,line:164
function cs4334_init,line:158
asoc: cs4334 <-> davinci-mcasp.2 mapping ok
asoc: HDMI-DAI-CODEC <-> hdmi-dai mapping ok
asoc: tvp5158-hifi <-> davinci-mcasp.0 mapping ok
ALSA device list:
  #0: TI81XX EVM
  #1: TI81XX EVM {TVP5158}
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
omap_voltage_late_init: Voltage driver support not added
Power Management for TI81XX.
Detected MACID=0:17:eb:ed:11:5a
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
rtc-isl1208 1-006f: hctosys: invalid date/time
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 2-1: new high speed USB device using musb-hdrc and address 2
usb 2-1: New USB device found, idVendor=05e3, idProduct=0718
usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2
usb 2-1: Product: USB Storage
usb 2-1: SerialNumber: 000000000033
scsi1 : usb-storage 2-1:1.0
scsi 1:0:0:0: Direct-Access     USB TO I DE/SATA Device   0016 PQ: 0 ANSI: 4
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Attached SCSI disk
ata1: SATA link down (SStatus 0 SControl 300)
cramfs_fill_nand blocks is 64
VFS: Mounted root (cramfs filesystem) readonly on device 31:4.
devtmpfs: mounted
Freeing init memory: 200K
INIT: version 2.86 booting
Please wait: booting...
Error opening /dev/fb0: No such file or directory
Starting udev
udevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.
Remounting root file system...
Caching udev devnodes
ALSA: Restoring mixer settings...
Configuring network interfaces... PHY 0:00 not found

CPSW phy found : id is : 0x2430c54
done.
Setting up IP spoofing protection: rp_filter.
mount nfs...
Mon Dec 19 13:46:00 UTC 2011
INIT: Entering runlevel: 5
Starting telnet daemon.
Starting syslogd/klogd: done
usb is not ready for autoexec
cramfs_fill_nand blocks is 96
UBI: attaching mtd6 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
UBI error: ubi_read_volume_table: the layout volume was not found
ubiattach: error!: cannot attach "/dev/mtd6"
           error 22 (Invalid argument)
mount: unknown filesystem type 'ubifs'
/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x/
/etc/rc5.d/S81appinit: line 22: ./init.sh: not found
/etc/rc5.d/S81appinit: line 23: ./load.sh: not found
/etc/rc5.d/S81appinit: line 19: ./logo: not found
insmod: can't read './kermod/ti_gpio.ko': No such file or directory
insmod: can't read './kermod/at88sc.ko': No such file or directory
SCREEN_MOD_4
            SCREEN_MOD_4
                        SCREEN_MOD_4
                                    SCREEN_MOD_4
                                                init is :0,max is:10
                                                                    umount2: Invalid argument
             umount: /mnt/para/: not mounted
Erasing 128 Kibyte @ 100000 -- 25 % completyaffs: dev is 32505862 name is "mtdblock6" rw
Erasing 128 Kyaffs: passed flags ""
Erasing 128 Kibyte @ 400000 -- 100 % complete.
                                              --------dvr configure start--------
 board_type:TNMB01
                  frontboard_type:S300
                                      display_type_info:DVR4-4000
                                                                 detail_machine_type:5804S300
             cfg_ptz_dev:/dev/ttyO1
                                   cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVR
                                                                               default_norm:1
             default_output_reso:5
                                  default_time_zone:28800
                                                         default_language:1
                                                                           default_playbacknum:4
                default_alarmin_num:0
                                     default_alarmout_num:0
                                                           default_enable_485:1
                                                                               default_audio_num:4
                  default_osd_fmt:0
                                   default_disk_num:4
                                                     default_esata_port:-1
                                                                          default_record_type:1
               support_avi_backup:1
                                   support_chn_switch:1
                                                       support_swann_ddns:1
                                                                           support_dyndns_ddns:1
                support_3322_ddns:0
                                   http_port:85
                                               support_ntsc:1
                                                             support_pal:1
                                                                          need_reduce_fps:0
           --------dvr configure end--------
                                            watchdog not enabled!
                                                                 [FUN]:scan_key_wt5700_init [LINE]370   Open /dev/ti_gpio Dev error, Init scan key fail!
                                                                        ERROR: Module ti_cir does not exist in /proc/modules
                                            cramfs: bad compressed blocksize 3642924313
cramfs: bad compressed blocksize 3719287697
cramfs: bad compressed blocksize 2922450229
cramfs: bad compressed blocksize 3642924313
insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error
                                                                         [FUN]:misc_ir_open_s [LINE]853   /dev/ti_cir
                                     [FUN]:misc_led_open_s [LINE]987   open gpio err!
     [FUN]:misc_buzzer_open [LINE]951   open gpio err!
                                                      Open /dev/at88sc0104 error!
 VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CH
                                                          Venc_init complete:1
                                                                              vdec_init complete
                type_init_vdis_param vodev :0 resolution:13
                                                           SCREEN_MOD_4
                                                                       window 0 start x,y=0,0; w,h=960.540
                          window 1 start x,y=960,0; w,h=960.540
                                                               window 2 start x,y=0,540; w,h=960.540
                    window 3 start x,y=960,540; w,h=960.540
                                                           VoDev :0 width is:1920,height is :1080

 [FUN]:Device_ths8200Init  [LINE]:28  =======>>  Global semaphore create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:97  =======>>  Device_ths8200Create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:121  =======>>  Device_ths8200Create !!!!!! done
 [FUN]:Device_ths8200Control  [LINE]:178  =======>>  Device_ths8200Control !!!!!!
standard is :13
                [FUN]:Device_ths8200Control  [LINE]:214  =======>>  Device_ths8200Control !!!!!!done
Vdis_init complete
                  Venc_registerCallback complete
                                                 0: SYSTEM: IPC init in progress !!!
    OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directory
                                                                        OsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor
                                                       /dev/syslinkipc_MultiProc: No such file or directory
                           MultiProc driver close: : Bad file descriptor
                                                                        SharedRegion driver open: : No such file or directory
                                             SharedRegion driver close: : Bad file descriptor
             /dev/syslinkipc_GateMP: No such file or directory
                                                              /dev/syslinkipc_MessageQ: No such file or directory
                                 MessageQ driver close: : Bad file descriptor
                                                                             Notify driver open: /dev/syslinkipc_Notify: No such file or directory
                                                                  Notify driver close: /dev/syslinkipc_Notify: Bad file descriptor
                                                  ProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directory
                                         ProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor
                           /dev/syslinkipc_HeapBufMP: No such file or directory
                                                                               /dev/syslinkipc_HeapMemMP: No such file or directory
                                                   /dev/syslinkipc_ListMP: No such file or directory
                    /dev/syslinkipc_RingIO: No such file or directory
                                                                     RingIO driver close: : Bad file descriptor
                               /dev/syslinkipc_RingIOShm: No such file or directory
   RingIO driver close: : Bad file descriptor
                                             /dev/syslinkipc_ClientNotifyMgr: No such file or directory
                       ClientNotifyMgr driver close: : Bad file descriptor
                                                                          /dev/syslinkipc_FrameQBufMgr: No such file or directory
                                                 FrameQBufMgr driver close: : Bad file descriptor
                 /dev/syslinkipc_FrameQ: No such file or directory
                                                                  FrameQ driver close: : Bad file descriptor
                            /dev/syslinkipc_Ipc: No such file or directory
                                                                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                       15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                             15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                   15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                         15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                               15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                     15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                       ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)
dm814x-evm login:
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf