Author Topic: Swann DVR (security camera recorder) bricked after firmware update (Fixed) (Read 10071 times)

poot36 · « **on:** March 27, 2021, 08:24:19 pm »

I have a Swann DVR model swdvr-44000H / DVR4-4000 that I found a firmware update from this link: https://www.swann.com/downloads/drivers/DVR_4000/GA1.9/ I selected the DVR4-4000_GA1.9_1025.pak file and it updated and booted normally. I then found by going back a link and to this link: https://www.swann.com/downloads/drivers/DVR_4000/GA2.0/ a newer (or what I thought) version of the firmware here DVR4-4000.0118.759.676.10.2.nor.sw.S300.pak and it installed but when the unit rebooted it never fully booted up (no screen output and the blue remote activity indicator light on the front never de illuminated). What would I have to do to unbrick the unit? I did find it a bit odd with the first successful firmware update that the USB drive that I used to install the update with was giving me an error about unable to mount the file system and I had to use another one to install the (newer) update that bricked the unit. The motherboard has the markings TCBB02 V140 2012-04-07 and the sub board with the CPU on it has these markings TCCB01_V110 2012-03-09. I think this unit runs Linux but I am unsure. Can send pictures if needed.

ttx450 · « **Reply #1 on:** March 27, 2021, 10:07:41 pm »

I accidentally bricked a dsl modem/router/w-wireless. spent many calls / time trying to undo with company, no luck. It's good for australia, canada and maybe others - ebay item

. The wireless I think I can get to work with my network, have not tried. sitting on the shelve for the last several years.

poot36 · « **Reply #2 on:** March 28, 2021, 01:23:25 am »

Well I found the serial port and all I get out of it is a repeating string of CCCC's. I think the uboot firmware has been bricked. Is there any way to use an Arduino UNO to fix the NAND flash by writing to it?

rsjsouza · « **Reply #3 on:** March 28, 2021, 02:36:51 am »

CCCC is typically the ROM bootloader testing the line, so an external host can respond and perform a serial boot. Depending on the device on the board, there is a chance its manufacturer will have the procedure documented somewhere. Then, locate a valid firmware (probably a
.bin file) then there is a chance the box will boot normally.

If this is a linux-based device, you will probably need to check the status of the flash before the kernel boots - you need to halt at the u-boot phase to erase and write flash, etc. But at this point anything is heavily dependent on the device in question.

amyk · « **Reply #4 on:** March 28, 2021, 03:17:06 am »

If you can locate the chip that holds the firmware and have a way of reading/writing it, you may be able to fix this.

poot36 · « **Reply #5 on:** March 28, 2021, 10:02:31 pm »

Ok, after some more research I have found that this CPU board is in a China ST DVR-1604 unit that supports 16 channels of recording. My unit only supports 4 so is missing some of the decoder chips. At the bottom of this translated post there are some pictures of what the CPU board looks like with all 4 decoder chips installed (mine only has the one on the top of the PCB by the crystal) https://translate.google.com/translate?hl=en&sl=ru&u=https://monitor.net.ru/forum/threads/585570/page-3&prev=search&pto=aue not sure if this is helpful or not. And about halfway down this post: https://translate.google.com/translate?hl=en&sl=ru&u=http://monitor.espec.ws/section8/printview288201.html&prev=search&pto=aue it mentions that the CCCC message I am seeing is somehow related to corrupt or missing NAND (search for CCCCC on the page and you will find it). I am starting to think that I may be screwed unless I can directly access the NAND chip.

rsjsouza · « **Reply #6 on:** March 28, 2021, 10:23:36 pm »

Quote from: poot36 on March 28, 2021, 10:02:31 pm

(...) it mentions that the CCCC message I am seeing is somehow related to corrupt or missing NAND (search for CCCCC on the page and you will find it). I am starting to think that I may be screwed unless I can directly access the NAND chip.

It makes sense. If the processor can't find a valid image on the NAND Flash, its bootloader routine may or may not circle around several other boot modes (it could be SPI, Ethernet, etc.) or, what seems to be your case, lock on UART bootmode.

One thing is that, depending on the image, it may have a u-boot in it that allows accessing, verifying, erasing and reprogramming the NAND Flash. You need, however, the device information itself.

dc101 · « **Reply #7 on:** March 28, 2021, 10:46:10 pm »

Perhaps this is u-boot over UART? http://www.staroceans.org/e-book/AM335x_U-Boot_User%27s_Guide.html#Boot_Over_UART

I'm familiar with u-boot, but I've never booted over UART before. It looks like it's expecting u-boot-spl.bin for your specific architecture?

I took a look at the update binary in the 2nd cramfs image in the firmware, but I haven't seen anything interesting so far. I was hoping maybe there would be something that pointed to alternate firmware update modes.

Cheers
-Tim

poot36 · « **Reply #8 on:** April 03, 2021, 02:00:37 am »

Well I did a bit of research into the UART booting and found this: http://web.archive.org/web/20210115021712if_/http://processors.wiki.ti.com/index.php/DM814x_AM387x_PSP_U-Boot#U-Boot-MIN_for_UART_boot and this https://www.xuebuyuan.com/2133280.html. Hopefully by downloading the files from here: https://software-dl.ti.com/dsps/dsps_public_sw/ezsdk/latest/index_FDS.html I can figure out how to make the U-Boot_Min for my board and load the correct firmware back onto it. I have very little experience with Linux so it will be an adventure that is for sure.

poot36 · « **Reply #9 on:** April 04, 2021, 12:17:13 am »

Not sure if anyone cares but here is the link to download the CodeSourcery version that the EZSDK installer needs: http://www.codesourcery.com/sgpp/lite/arm/portal/package4573/public/arm-none-linux-gnueabi/arm-2009q1-203-arm-none-linux-gnueabi.bin

rsjsouza · « **Reply #10 on:** April 04, 2021, 01:19:53 am »

This is indeed a very old family of DaVinci devices... Something that I suspect there is no support anymore, unless you buy heaps of parts.

The details escape me. I think the EZSDK has some documentation but the (now decomissioned) wiki is your friend here. That and some threads on the e2e support.

Also, be sure to use the Ubuntu version used by the EZSDK, as many gremlins will appear if using something newer.

Good luck in your journey.

poot36 · « **Reply #11 on:** April 04, 2021, 03:48:08 am »

Well after a lot of fighting with the VM, compiler errors and running out of space on the VM hard drive I got it to compile. If you get the compiler error make: arm-none-linux-gnueabi-gcc: Command not found you need to add these lines to your .bashrc file in your home directory /home/(User Name)/CodeSourcery/Sourcery_G++_Lite/bin and CROSS_COMPILE=arm-none-linux-gnueabi-. You should also check your permissions on the CodeSourcery and folder you installed the EZSDK to as that can also cause errors due to not being able to read or write to various files as needed. I have attached the u-boot.min.uart file to this post after I copied it out of the VM so that other people do not have to go through what I did to make the file (not sure if this will cause issues or not due to how Windows handles files). You should just have to take the .hex extension off the end of the file.

poot36 · « **Reply #12 on:** April 04, 2021, 04:28:08 am »

Well here is the results of 1st and 2nd stage boot:

U-Boot 2010.06 (Apr 03 2021 - 21:26:14)

TI8148-GP rev 2.1

ARM clk: 600MHz
DDR clk: 400MHz

DRAM: 2 GiB
Using default environment

The 2nd stage U-Boot will now be auto-loaded
Please do not interrupt the countdown till TI8148_EVM prompt if 2nd stage is already flashed
Hit any key to stop autoboot: 0
TI-MIN#loadb 0x81000000
## Ready for binary (kermit) download to 0x81000000 at 115200 bps...
## Total Size = 0x000335e0 = 210400 Bytes
## Start Addr = 0x81000000
TI-MIN#go 0x81000000
## Starting application at 0x81000000 ...

U-Boot 2010.06 (Dec 26 2012 - 18:12:01)

TI8148-GP rev 2.1

ARM clk: 600MHz
DDR clk: 400MHz

I2C: ready
DRAM: 2 GiB
NAND: HW ECC BCH8 Selected
128 MiB
MMC: OMAP SD/MMC: 0
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
ECC: uncorrectable.
*** Warning - bad CRC or NAND, using default environment

.:;rrr;;.
,5#@@@@#####@@@@@@#2,
,A@@@hi;;;r5;;;;r;rrSG@@@A,
r@@#i;:;s222hG;rrsrrrrrr;ri#@@r
:@@hr:r;SG3ssrr2r;rrsrsrsrsrr;rh@@:
B@H;;rr;3Hs;rrr;sr;;rrsrsrsrsrsr;;H@B
@@s:rrs;5#;;rrrr;r#@H:;;rrsrsrsrsrr:s@@
@@;;srs&X#9;r;r;;,2@@@rrr:;;rrsrsrsrr;;@@
@@;;rrsrrs@MB#@@@@@###@@@@@@#rsrsrsrsrr;;@@
G@r;rrsrsr;#X;SX25Ss#@@#M@#9H9rrsrsrsrsrs;r@G
@9:srsrsrs;2@;:;;:.X@@@@@H::;rrsrsrsrsrsrr:3@
X@;rrsrsrsrr;XAi;;:&@@#@Bs:rrsrsrsrsrsrsrsrr;@X
@#;rsrsrsrsrr;r2ir@@@###::rrsrsrsrsrsrsrsrsr:@@
@A:rrsrsrsrr;:2@29@@M@@@;:;rrrrsrsrsrsrsrsrs;H@
@&;rsrsrsrr;A@@@@@@###@@@s::;:;;rrsrsrsrsrsr;G@
@#:rrsrsrsr;G@5Hr25@@@#@@@#9XG9s:rrrrsrsrsrs:#@
M@;rsrsrsrs;r@&#;::S@@@@@@@M@@@@Grr:;rsrsrsr;@#
:@s;rsrsrsrr:M#Msrr;;&#@@@@@@@@@@H@@5;rsrsr;s@,
@@:rrsrsrsr;S@rrrsr;:;r3MH@@#@M5,S@@irrsrr:@@
@A:rrsrsrsrrrrrsrsrrr;::;@##@r:;rH@h;srr:H@
;@9:rrsrsrsrrrsrsrsrsr;,S@Hi@i:;s;MX;rr:h@;
r@B:rrrrsrsrsrsrsrr;;sA@#i,i@h;r;S5;r:H@r
,@@r;rrrsrsrsrsrr;2BM3r:;r:G@:rrr;;r@@,
B@Mr;rrrrsrsrsr@@S;;;rrr:5M;rr;rM@H
.@@@i;;rrrrsrs2i;rrrrr;r@M:;i@@@.
.A@@#5r;;;r;;;rrr;r:r#AsM@@H.
;&@@@@MhXS5i5SX9B@@@@G;
:ihM#@@@@@##hs,

Net: <ethaddr> not set. Reading from E-fuse
Detected MACID:0:17:eb:ed:11:5a
cpsw
Hit any key to stop autoboot: 0
Card did not respond to voltage select!
** Can't read from device 0 **

** Unable to use mmc 0:1 for fatload **
In case ENV on MMC/SD is required
Please put a valid script named boot.scr on the card
Refer to the User Guide on how to generate the image
TI8148_EVM#

If you type help you get this list of commands:

? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
bmp - manipulate BMP image data
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
exit - exit script
false - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
go - start application at address 'addr'
help - print command description/usage
i2c - I2C sub-system
icache - enable or disable instruction cache
iminfo - print header information for application image
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nandecc - Switch NAND ECC calculation algorithm b/w hardware and software
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
version - print monitor version

I think I should be able to somehow fix this over the network.

rsjsouza · « **Reply #13 on:** April 04, 2021, 09:12:53 am »

Good progress. Deslite slow, having u-boot is a great thing as you can tell the surrounding hardware is working well for the most part. Obviously that your NAND seems to be indeed shot - not an uncommon scenario.

If the Ethernet is working well, then you can load the uImage kernel from TFTP and the filesystem from an NFS share - be prepared for one more round of wrenching with Linux to configure these two services. Also, you will need a sequence of commands to be passed to u-boot - there is a page on the wiki named Teraterm scripts (or something similar) that has some ready-to-run u-boot scripts for several boards - I think DM814x is there as well. Otherwise, you can check the setup program of the EZSDK and configure it for NFS boot - it should create a minicom script for the sequence of commands/parameters for u-boot there.

I don't remember if the EZSDK user's guide has this information as well but, with the wiki out of commission, things become a lot harder to browse (I still can't believe why they killed this, but oh well...)

poot36 · « **Reply #14 on:** April 11, 2021, 11:46:08 pm »

I have made some headway, I have managed to dump 2Kb of the NAND over the serial terminal using the nand dump 0 command. This has dumped page 00000000 from the NAND at what I presume is the start of the flash. I have found that if you increment it by the hex value 800 you get to the next 2Kb block of data. Now that I know that I can try and figure out where the u-boot code starts and where the file system is. I have attached the first 2Kb dump of the NAND to this post and have found that it matches the incorrect firmware .pak file starting at hex address 4F8. It would be great if all I have to do is dump a modified .pak file into the RAM and then write it to the NAND and have the unit boot.

poot36 · « **Reply #15 on:** April 12, 2021, 02:39:54 am »

Well here is what I got from what I think is the 2nd stage u-boot that I extracted from the correct .pak firmware file:

## Starting application at 0x81000000 ...

U-Boot 2010.06 (Jun 07 2012 - 16:12:09)

TI8148-GP rev 2.1

ARM clk: 720MHz
DDR clk: 400MHz
IVA clk: 321MHz
ISS clk: 400MHz
DSS clk: 200MHz
DSP clk: 600MHz

I2C: ready
DRAM: 1 GiB
NAND: HW ECC Hamming Code selected
128 MiB
*** Warning - bad CRC or NAND, using default environment

_____ ___ _ _____ _ _ _ _ ___ __ _
| _ \ / | | | / ___| | | | | | | | | / | | \ | |
| |_| | / /| | | | | | | |_| | | | | | / /| | | \| |
| _ { / / | | | | | | | _ | | | | | / / | | | |\ |
| |_| | / / | | | | | |___ | | | | | |_| | / / | | | | \ |
|_____/ /_/ |_| |_| \_____| |_| |_| \_____/ /_/ |_| |_| \_|

MMC: OMAP SD/MMC: 0
Net: <ethaddr> not set. Reading from E-fuse
Detected MACID:0:17:eb:ed:11:5a
cpsw
Hit any key to stop autoboot: 0

NAND read: device 0 offset 0x1ee0000, size 0x200000
2097152 bytes read: OK
change to 400K for i2c
NAND read: device 0 offset 0x280000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at 81000000 ...
Image Name: Linux-2.6.37
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2700532 Bytes = 2.6 MiB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #11 Tue Jan 15 14:52:00 CST 2013
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: ti8148evm
bootconsole [earlycon0] enabled
ti81xx_reserve: ### Reserved DDR region @87f00000
reserved size = 52428800 at 0x0
FB: Reserving 52428800 bytes SDRAM for VRAM
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8148 2.1
SRAM: Mapped pa 0x402f1000 to va 0xfe400000 size: 0xf000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 19456
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 76MB 1MB = 77MB total
Memory: 71852k/71852k available, 59220k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc8800000 - 0xf8000000 ( 760 MB)
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.init : 0xc0008000 - 0xc0042000 ( 232 kB)
.text : 0xc0042000 - 0xc051f000 (4980 kB)
.data : 0xc0520000 - 0xc056d280 ( 309 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:407
omap_hwmod: gpio1: softreset failed (waited 10000 usec)
omap_hwmod: gpio2: softreset failed (waited 10000 usec)
omap_hwmod: gpio3: softreset failed (waited 10000 usec)
omap_hwmod: gpio4: softreset failed (waited 10000 usec)
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
GPMC revision 6.0
Trying to install interrupt handler for IRQ400
Trying to install interrupt handler for IRQ401
Trying to install interrupt handler for IRQ402
Trying to install interrupt handler for IRQ403
Trying to install interrupt handler for IRQ404
Trying to install interrupt handler for IRQ405
Trying to install interrupt handler for IRQ406
Trying to install type control for IRQ407
Trying to set irq flags for IRQ407
OMAP clockevent source: GPTIMER1 at 20000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
TI81XX: Map 0x87f00000 to 0xfe500000 for dram barrier
TI81XX: Map 0x40300000 to 0xfe600000 for sram barrier
omap_voltage_early_init: voltage driver support not added
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
omap_voltage_domain_lookup: Voltage driver init not yet happened.Faulting!
omap_voltage_add_dev: VDD specified does not exist!
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
ti8148_evm_init: LIXUEQIANG failed to request GPIO for TSC IRQ
omap_mux_init: Add partition: #1: core, flags: 4
_omap_mux_init_gpio: Could not set gpio38
NOR: Can't request GPMC CS
ti814x_sata_pllcfg: LIXUEQIANG (cpu_is_ti814x()) && (!cpu_is_dm385()))
clk get on i2c3 fck failed
Cannot clk_get ck_32
omap2_init_devices: LIXUEQIANG begin 8
Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported now
registered ti81xx_vpss device
registered ti81xx_vidout device
registered ti81xx on-chip HDMI device
registered ti81xx_fb device
registered ti81xx_vin device
ti81xx_pcie: Invoking PCI BIOS...
ti81xx_pcie: Setting up Host Controller...
ti81xx_pcie: Register base mapped @0xc8820000
ti81xx_pcie: Starting PCI scan...
PCI: bus0: Fast back to back transfers enabled
ti81xx_pcie: PCI scan done.
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
USBSS revision 4ea2080b
registerd cppi-dma Intr @ IRQ 17
Cppi41 Init Done
omap_i2c omap_i2c.1: bus 1 rev4.0 at 400 kHz
I2C: Read failed at pcf8575_cir_enable 236 with error code: -121
I2C: Transfer failed at pcf8575_cir_enable 243 with error code: -121
tps65910 1-002d: read from reg 3f failed
tps65910 1-002d: read from reg 1e failed
set_machine_constraints: failed to enable VRTC
tps65910 1-002d: failed to register tps65910-pmic regulator
tps65910-pmic: probe of tps65910-pmic failed with error -121
tps65910 1-002d: No interrupt support, no core IRQ
omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHz
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource gp timer
musb-hdrc: version 6.0, host, debug=0
musb-hdrc musb-hdrc.0: dma type: dma-cppi41
MUSB controller-0 revision 4ea20800
usb2phy: computed values rxcalib(15)DACs(37 11 11)
usb2phy: override computed values rxcalib(15)DACs(37 11 11)
usb2phy_config: musb(0) rxcalib done, rxcalib read value 6f72d75e
musb-hdrc musb-hdrc.0: MUSB HDRC host driver
musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 2.6.37 musb-hcd
usb usb1: SerialNumber: musb-hdrc.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18
musb-hdrc musb-hdrc.1: dma type: dma-cppi41
MUSB controller-1 revision 4ea20800
usb2phy: computed values rxcalib(15)DACs(38 13 14)
usb2phy: override computed values rxcalib(15)DACs(38 13 14)
usb2phy_config: musb(1) rxcalib done, rxcalib read value 6f735b76
musb-hdrc musb-hdrc.1: MUSB HDRC host driver
musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: MUSB HDRC host driver
usb usb2: Manufacturer: Linux 2.6.37 musb-hcd
usb usb2: SerialNumber: musb-hdrc.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
musb-hdrc musb-hdrc.1: USB Host mode controller at c8826800 using DMA, IRQ 19
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
PMU: registered new PMU device of type 0
omap-iommu omap-iommu.0: ducati registered
omap-iommu omap-iommu.1: sys registered
fuse init (API version 7.15)
msgmni has been set to 140
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
omap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0
console [ttyO0] enabled, bootconsole disabled
console [ttyO0] enabled, bootconsole disabled
omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
brd: module loaded
loop: module loaded
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
omap2-nand driver initializing
ONFI flash detected
ONFI param page 0 valid
NAND device: Maf ID: 0xad, Chip ID: 0xf1 (Hynix, NAND 128MiB 3,3V 8-bit)
erasesize: 0x20000, writesize: 2048, oobsize: 64
Creating 7 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x000000580000 : "U-Boot Logo"
0x000000580000-0x0000009c0000 : "Kernel"
0x0000009c0000-0x00000d1e0000 : "File System"
mtd: partition "File System" extends beyond the end of device "omap2-nand.0" -- size truncated to 0x7640000
0x000008000000-0x000008000000 : "Reserved"
mtd: partition "Reserved" is out of reach -- disabled
davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
davinci_mdio davinci_mdio.0: detected phy mask fffffffd
davinci_mdio.0: probed
davinci_mdio davinci_mdio.0: phy[1]: device 0:01, driver unknown
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
qt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failed
qt602240_ts: probe of 1-004a failed with error -5
omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0
i2c /dev entries driver
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v1.0.0)
OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
notify_init : notify drivercreated for remote proc id 2 at physical Address 0xbfd00000
usbcore: registered new interface driver snd-usb-audio
function cs4334_modinit,line:219
Registered tvp5158 audio codec
asoc: HDMI-DAI-CODEC <-> hdmi-dai mapping ok
ALSA device list:
#0: TI81XX SOUND1
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
omap_voltage_late_init: Voltage driver support not added
Power Management for TI81XX.
Detected MACID=0:17:eb:ed:11:5a
omap_rtc omap_rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)
usb 1-1: new high speed USB device using musb-hdrc and address 2
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 2-1: new high speed USB device using musb-hdrc and address 2
usb 2-1: New USB device found, idVendor=05e3, idProduct=0718
usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2
usb 2-1: Product: USB Storage
usb 2-1: SerialNumber: 000000000033
scsi1 : usb-storage 2-1:1.0
scsi 1:0:0:0: Direct-Access USB TO I DE/SATA Device 0016 PQ: 0 ANSI: 4
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Attached SCSI disk
ata1: SATA link down (SStatus 0 SControl 300)
cramfs_fill_nand blocks is 34
List of all partitions:
1f00 128 mtdblock0 (driver?)
1f01 2304 mtdblock1 (driver?)
1f02 128 mtdblock2 (driver?)
1f03 3072 mtdblock3 (driver?)
1f04 4352 mtdblock4 (driver?)
1f05 121088 mtdblock5 (driver?)
No filesystem could mount root, tried: cramfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)
Backtrace:
[<c0050bf4>] (dump_backtrace+0x0/0x110) from [<c03d707c>] (dump_stack+0x18/0x1c)
r7:c4814000 r6:c0079854 r5:c002fb94 r4:c056de90
[<c03d7064>] (dump_stack+0x0/0x1c) from [<c03d70e0>] (panic+0x60/0x17c)
[<c03d7080>] (panic+0x0/0x17c) from [<c00092b4>] (mount_block_root+0x1e0/0x220)
r3:00000000 r2:00000020 r1:c4825f58 r0:c049ce8c
[<c00090d4>] (mount_block_root+0x0/0x220) from [<c00093a0>] (mount_root+0xac/0xcc)
[<c00092f4>] (mount_root+0x0/0xcc) from [<c0009530>] (prepare_namespace+0x170/0x1d4)
r4:c056d2e4
[<c00093c0>] (prepare_namespace+0x0/0x1d4) from [<c00087c4>] (kernel_init+0x114/0x154)
r5:c00086b0 r4:c056d280
[<c00086b0>] (kernel_init+0x0/0x154) from [<c0079854>] (do_exit+0x0/0x5e4)
r5:c00086b0 r4:00000000

I think it crashes due to the flash being messed up. I also extracted what I think is the u-boot-min.nand file as well. I have attached both these files to this post for you to look over and tell me what you think. It looks like the ASCII art did not fully copy correctly, what is says is baichuan.

poot36 · « **Reply #16 on:** April 19, 2021, 02:18:43 am »

More progress has been made. I have managed to extract the correct u-boot-min.nand file from the .pak file and have found that if I load it over serial when the unit is displaying CCCCC it will actually boot it and then start booting the u-boot that is on the NAND but crashes due to the u-boot being for a different processor. I have attached the corrected u-boot-min.nand and a potentially correct u-boot files to this post. The last boot log that I posted is for the incorrect kernel that was flashed onto the unit and that is why I suspect it does not fully boot. I am working on extracting the kernel out of the correct .pak file. I have been able to confirm that the kernel starts at hex address 0x280000 and the u-boot image (.bmp file) starts at hex address 0x1ee0000 in the NAND. u-boot-min.nand starts at hex address 0x0 and u-boot starts at hex address 0x20000. Not sure if that helps anyone.

dc101 · « **Reply #17 on:** April 19, 2021, 02:48:21 am »

I recently ran into this same issue after modifying filesystems on several embedded devices, I ended up bricking them. After looking at the boot logs we determined that the most likely cause was a difference in the filesystem size compared to the Linux kernel command line arguments.

However, in your case it appears the Linux kernel is trying to load rootfs from the wrong mtd partition:


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee