Неудачно перепрошил свой 4-канальный NVR NBD7804T-F. Залил прошивку от другой модели 8-канального NVR SimpGeneral_General_NBD7808T-PL_V4.02.R11.Nat.OnvifC.20170227 через CMS.
Там в прошивке было 4 раздела:
custom-x.cramfs.img
logo-x.cramfs.img
romfs-x.cramfs.img
user-x.cramfs.img
и файл InstallDesc
Каюсь очень, что не сделал никакой бэкап прошивки, кроме конфигурации NVR.
На пинги не отвечает, при загрузке появляется только логотип iDVR.
На плате наклеен лейбл 7804T-PL
Стояла версия V4.02.R11.00031118.12001.130000 от 2015-06-23.
В файле ProductType.ini значится вообще NBD6804T-F
Чип на самом деле HI3515C, хотя в линухе на команду cat /proc/cpuinfo выдавало HI3520D.
Подключился через UART. Использовал старый data-com кабель от Siemens C35.
Обнаружил, что при загрузке дело доходило только этого момента:
Код: Выделить всё
U-Boot 2010.06-svn198 (Dec 08 2014 - 09:53:48)
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xef3c66a3
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
USB: scanning bus for devices... 1 USB Device(s) found
0 Storage Device(s) found
Press CTRL-C to abort autoboot in 0 seconds8192 KiB hi_sfc at 0:0 is now current device
CFG_BOOT_ADDR:0x0
0ff:0x84000000
### /UbootLogo UbootLogoload complete: 21986 bytes loaded to 0x8e800000
jpeg decoding ...
<<addr=0x8e800000, size=0xb85f9, vobuf=0x8e800000>>
<<imgwidth=800, imgheight=600, linebytes=1600>>
decode success!!!!
decode jpeg success.
decode jpeg!
srcAddr 0x82000000, dstAddr 0x82000000
find_squashfs_file: name bin, start_block 0, offset 1315, type 1
find_squashfs_file: name boot, start_block 0, offset 1403, type 1
read inode: name boot, sb 0, of 1403, type 1
find_squashfs_file: name zImage.img, start_block 0, offset 1347, type 2
read inode: name zImage.img, sb 0, of 1347, type 2
### FS load complete: 1443044 bytes loaded to 0x82000000
## Booting kernel from Legacy Image at 82000000 ...
Image Name: linux
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1442980 Bytes = 1.4 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
SimpGeneral_General_NBD7804T-F_V4.02.R11.20150623 (1)
Вытащил разделы из прошивки и по tftp при помощи
run du
run dr
run dc
run dl
команд залил их.
Код: Выделить всё
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xef3c66a3
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
USB: scanning bus for devices... 1 USB Device(s) found
0 Storage Device(s) found
Press CTRL-C to abort autoboot in 0 secondshisilicon #
hisilicon # ѕЯ
Unknown command 'ѕЯ' - try 'help'
hisilicon # printenv
bootcmd=sf probe 0;sf read 84000000 770000 10000;logoload 84000000;decjpg;sf read 82000000 30000 400000;squashfsload 82000000;bootm 0x82000000
bootdelay=1
baudrate=115200
bootfile="uImage"
restore=1
da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
dl=mw.b 0x82000000 ff 1000000;tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite
tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 zImage.img; bootm 0x82000000
dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
ipaddr=192.168.1.10
netmask=255.255.255.0
gatewayip=192.168.0.1
ethaddr=00:0b:3f:00:00:01
appVideoStandard=PAL
appSystemLanguage=English
bootargs=mem=132M console=ttyAMA0,115200 root=1f01 rootfstype=squashfs mtdparts=hi_sfc:192K(boot),1984K(romfs),3776K(usr),1664K(custom),64K(logo),512K(mtd)
serverip=192.168.1.120
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn198 (Dec 08 2014 - 09:53:48)
Environment size: 1345/65532 bytes
hisilicon # ю
Unknown command 'ю' - try 'help'
hisilicon #run dr
Hisilicon ETH net controler
MAC: 00-0B-3F-00-00-01
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.120; our IP address is 192.168.1.10
Download Filename 'romfs-x.cramfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 1847360 (1c3040 hex)
8192 KiB hi_sfc at 0:0 is now current device
## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1847296 Bytes = 1.8 MiB
Load Address: 00030000
Entry Point: 00220000
Data CRC Checking ... OK
Programing start at: 0x00030000
Programing end at: 0x00220000
Erasing at 0x220000 -- 100% complete.
done.
Erased sectors.
Saving Image to Flash ...
Writing at 0x220000 -- 100% complete.
done.
hisilicon # run dc
Hisilicon ETH net controler
miiphy_register: non unique device name '0:3'
miiphy_register: non unique device name '0:2'
MAC: 00-0B-3F-00-00-01
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.120; our IP address is 192.168.1.10
Download Filename 'custom-x.cramfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 1699904 (19f040 hex)
8192 KiB hi_sfc at 0:0 is now current device
## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 1699840 Bytes = 1.6 MiB
Load Address: 005d0000
Entry Point: 00770000
Data CRC Checking ... OK
Programing start at: 0x005d0000
Programing end at: 0x00770000
Erasing at 0x770000 -- 100% complete.
done.
Erased sectors.
Saving Image to Flash ...
Writing at 0x770000 -- 100% complete.
done.
hisilicon # run du
Hisilicon ETH net controler
miiphy_register: non unique device name '0:3'
miiphy_register: non unique device name '0:2'
MAC: 00-0B-3F-00-00-01
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.120; our IP address is 192.168.1.10
Download Filename 'user-x.cramfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 3780672 (39b040 hex)
8192 KiB hi_sfc at 0:0 is now current device
## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 3780608 Bytes = 3.6 MiB
Load Address: 00220000
Entry Point: 005d0000
Data CRC Checking ... OK
Programing start at: 0x00220000
Programing end at: 0x005d0000
Erasing at 0x5d0000 -- 100% complete.
done.
Erased sectors.
Saving Image to Flash ...
Writing at 0x5d0000 -- 100% complete.
done.
hisilicon # run dl
Hisilicon ETH net controler
miiphy_register: non unique device name '0:3'
miiphy_register: non unique device name '0:2'
MAC: 00-0B-3F-00-00-01
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.1.120; our IP address is 192.168.1.10
Download Filename 'logo-x.cramfs.img'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 20544 (5040 hex)
8192 KiB hi_sfc at 0:0 is now current device
## Checking Image at 0x82000000 ...
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 20480 Bytes = 20 KiB
Load Address: 00770000
Entry Point: 00780000
Data CRC Checking ... OK
Programing start at: 0x00770000
Programing end at: 0x00780000
Erasing at 0x780000 -- 100% complete.
done.
Erased sectors.
Saving Image to Flash ...
Writing at 0x780000 -- 100% complete.
done.
hisilicon # printenv
bootcmd=sf probe 0;sf read 84000000 770000 10000;logoload 84000000;decjpg;sf read 82000000 30000 400000;squashfsload 82000000;bootm 0x82000000
bootdelay=1
baudrate=115200
bootfile="uImage"
restore=1
da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
dl=mw.b 0x82000000 ff 1000000;tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite
tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 zImage.img; bootm 0x82000000
dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
ethaddr=00:0b:3f:00:00:01
appVideoStandard=PAL
appSystemLanguage=English
bootargs=mem=132M console=ttyAMA0,115200 root=1f01 rootfstype=squashfs mtdparts=hi_sfc:192K(boot),1984K(romfs),3776K(usr),1664K(custom),64K(logo),512K(mtd)
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn198 (Dec 08 2014 - 09:53:48)
filesize=5040
fileaddr=82000000
gatewayip=192.168.0.1
netmask=255.255.255.0
ipaddr=192.168.1.10
serverip=192.168.1.120
Код: Выделить всё
hisilicon # boot
8192 KiB hi_sfc at 0:0 is now current device
CFG_BOOT_ADDR:0x0
0ff:0x84000000
### /UbootLogo UbootLogoload complete: 21986 bytes loaded to 0x8e800000
jpeg decoding ...
<<addr=0x8e800000, size=0xb85f9, vobuf=0x8e800000>>
<<imgwidth=800, imgheight=600, linebytes=1600>>
decode success!!!!
decode jpeg success.
decode jpeg!
srcAddr 0x82000000, dstAddr 0x82000000
find_squashfs_file: name bin, start_block 0, offset 1315, type 1
find_squashfs_file: name boot, start_block 0, offset 1403, type 1
read inode: name boot, sb 0, of 1403, type 1
find_squashfs_file: name zImage.img, start_block 0, offset 1347, type 2
read inode: name zImage.img, sb 0, of 1347, type 2
### FS load complete: 1443044 bytes loaded to 0x82000000
## Booting kernel from Legacy Image at 82000000 ...
Image Name: linux
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1442980 Bytes = 1.4 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Почему не грузится kernel? Где взять валидный? Смотрел несколько версий прошивок от NVR, нигде кернела не нашел.
По идее, через CMS он не перешивался изначально. Я его тоже не трогал через UART.