Восстановление NVR AS-N0810AW

[jean]

Адреса эти для меня темный лес ))) надо бы изучить... просто первый раз столкнулся с таким, обычно просто бинарник или имадже лил и все... Смещение делать аналогично - sf erase f00000 A00000?

Т.е. для 0x000001900000-0x000001d00000 : "www" делать так:

mw.b 82000000 ff 1d00000
tftp 82000000 HI3520DWWW.bin
sf probe 0
sf erase 1900000 A00000
sf write 82000000 1900000 1d00000

?

[Dim32]

Попробуйте так:

mw.b 82000000 ff 500000
tftp 82000000 HI3520DWWW.bin
sf probe 0
sf erase 1900000 400000
sf write 82000000 1900000 1d00000

[jean]

Аналогично. Видимо надо использовать не диапазон а смещение.

Код: Выделить всё

hisilicon # mw.b 82000000 ff 500000
hisilicon # tftp 82000000 HI3520DWWW.bin
Hisilicon ETH net controler
MAC:   00-00-23-34-45-66
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 172.18.187.218; our IP address is 172.18.187.219
Download Filename 'HI3520DWWW.bin'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 3207168 (30f000 hex)
hisilicon # sf probe 0
32768 KiB hi_sfc at 0:0 is now current device
hisilicon # sf erase 1900000 400000
Erasing at 0x1d00000 -- 100% complete.
hisilicon # sf write 82000000 1900000 1d00000
ERROR: read/write area is out of range!

[Dim32]

Ну тут все просто:
Sf write 82000000 1900000 400000

[jean]

Ок, прошло без ошибок. Подскажите пожалуйста как быть с - 0x000001e00000-0x000001f00000 : "config" и HI3520DCONF_8V_2D_4I.bin с учетом смещения.

[Dim32]

Полагаю, 100000

[jean]

Получилось, без ошибок. Результат прежний весь лог не выкладываю -

Код: Выделить всё

MAC:7a:3e:9c:92:bf:b8
set ip(192:168:1:175) success!
set mask(255:255:255:0): success
set gw(192:168:1:1): success!
setRoute(192.168.1.1): success

Т.е. установки что и были до этого, видимо хранятся где-то в другом месте.

Что делать с участком - 0x000001d00000-0x000001e00000 : "data" ? В него писать уже вроде как и нечего... Может это как раз там?

[jean]

Сделал

Код: Выделить всё

sf probe 0
sf erase 1d00000 100000 

, рег теперь выводит на монитор сообщение с предложение произвести первоначальную настройку, жму ок - перезагруз. Ну хоть что-то на мониторе показал - прогресс )))

[jean]

Вот весь лог:

Код: Выделить всё

U-Boot 2010.06 (Dec 03 2013 - 11:29:28)

Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x19 0xC2 0x20 0x19
Spi(cs1): Block:64KB Chip:32MB Name:"MX25L25635E/735E/635F"
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
32768 KiB hi_sfc at 0:0 is now current device

jpeg decoding ...
<<addr=0x82000000, size=0x100000, vobuf=0x8f000000>>
mmu_enable
<<imgwidth=1280, imgheight=720, linebytes=2560>>
decode success!!!!
decode jpeg!
dev 0 opened!
graphic layer 0 opened!


## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.0.8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3195980 Bytes = 3 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (root@ubuntu) (gcc version 4.4.1 (Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)) ) #2 Fri Oct 10 08:53:33 CST 2014
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: hi3520d
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 41402
Kernel command line: mem=150M console=ttyAMA0,115200 initrd=0x82400000,0xA00000 root=/dev/ram0 init=/linuxrc mtdparts=hi_sfc:1M(boot),4M(kernel),10M(rootfs),10M(app),4M(www),1M(data),1M(config),1M(logo)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 163MB = 163MB total
Memory: 148836k/148836k available, 18076k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xca800000 - 0xfe000000   ( 824 MB)
    lowmem  : 0xc0000000 - 0xca300000   ( 163 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc002b000   ( 140 kB)
      .text : 0xc002b000 - 0xc05a3000   (5600 kB)
      .data : 0xc05a4000 - 0xc05c6d20   ( 140 kB)
       .bss : 0xc05c6d44 - 0xc0621528   ( 362 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128 nr_irqs:128 128
sched_clock: 32 bits at 82MHz, resolution 12ns, wraps every 52060ms
Console: colour dummy device 80x30
Calibrating delay loop... 1318.91 BogoMIPS (lpj=6594560)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 10240K
NetWinder Floating Point Emulator V0.97 (double precision)
L2cache cache controller enabled
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
SGI XFS with security attributes, large block/inode numbers, no debug enabled
msgmni has been set to 310
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
ahci: SSS flag set, parallel bus scan disabled
ahci ahci.0: AHCI 0001.0200 32 slots 2 ports 3 Gbps 0x3 impl platform mode
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp pio slum part ccc sxs boh
scsi0 : ahci_platform
scsi1 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x100 irq 52
ata2: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x180 irq 52
Spi id table Version 1.22
Spi(cs1) ID: 0xC2 0x20 0x19 0xC2 0x20 0x19
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:32MB
Name:"MX25L25635E/735E/635F"
spi size: 32MB
chip num: 1
8 cmdlinepart partitions found on MTD device hi_sfc
Creating 8 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000500000 : "kernel"
0x000000500000-0x000000f00000 : "rootfs"
0x000000f00000-0x000001900000 : "app"
0x000001900000-0x000001d00000 : "www"
0x000001d00000-0x000001e00000 : "data"
0x000001e00000-0x000001f00000 : "config"
0x000001f00000-0x000002000000 : "logo"
Fixed MDIO Bus: probed
ata1: SATA link down (SStatus 0 SControl 300)
himii: probed
ata2: SATA link down (SStatus 0 SControl 300)
Invalid HW-MAC Address: 00:00:00:00:00:00
Set Random MAC address: DE:72:E8:94:59:D9
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 53, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 54, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
registered taskstats version 1
RAMDISK: cramfs filesystem found at block 0
RAMDISK: Loading 8120KiB [1 disk] into ram disk... -
usb 1-1: new high speed USB device number 2 using hiusb-ehci
done.
VFS: Mounted root (cramfs filesystem) readonly on device 1:0.
Freeing init memory: 140K
scsi2 : usb-storage 1-1:1.0

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd[576]: mainudevd (576): /proc/576/oom_adj is deprecated, please use /proc/576/oom_score_adj instead.
: error opening /dev/null: No such file or directory
[RCS]: /etc/init.d/S80network
ADDRCONF(NETDEV_UP): eth0: link is not ready
usb 2-2: new low speed USB device number 2 using hiusb-ohci
SDK_TYPE type is 8d1
input:  USB OPTICAL MOUSE as /devices/platform/hiusb-ohci.0/usb2/2-2/2-2:1.0/input/input0
generic-usb 0003:0000:0538.0001: input: USB HID v1.11 Mouse [ USB OPTICAL MOUSE] on usb-hiusb-ohci-2/input0
Hisilicon Media Memory Zone Manager
hi3520D_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
load sys.ko ...OK!
Load tde.ko ...OK!
load venc.ko ...OK!
load group.ko ...OK!
load chnl.ko ...OK!
load h264e.ko ...OK!
load rc.ko ...OK!
load jpege.ko ...OK!
load viu.ko ...OK!
load vou.ko ....OK!
scsi 2:0:0:0: Direct-Access     Imation  Ridge            PMAP PQ: 0 ANSI: 4
load vpss.ko ....OK!
sd 2:0:0:0: Attached scsi generic sg0 type 0
PHY: himii:03 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
sd 2:0:0:0: [sda] 15245312 512-byte logical blocks: (7.80 GB/7.26 GiB)
sd 2:0:0:0: [sda] Write Protect is off
sd 2:0:0:0: [sda] No Caching mode page present
sd 2:0:0:0: [sda] Assuming drive cache: write through
sd 2:0:0:0: [sda] No Caching mode page present
sd 2:0:0:0: [sda] Assuming drive cache: write through
 sda: sda1
sd 2:0:0:0: [sda] No Caching mode page present
sd 2:0:0:0: [sda] Assuming drive cache: write through
sd 2:0:0:0: [sda] Attached SCSI removable disk
load vda.ko ....OK!
load region.ko ....OK!
load vdec.ko ....OK
load vhd firmware.ko OK
load hdmi.ko ....OK!
Load jpeg6b.ko success.         (SDK_VERSION:[jpeg6bv1.0] Build Time:[Sep 29 2014, 18:04:52])
HISI_IRDA-MF @Hi3520Dv100R00
hiir: init ok. ver=Sep 30 2014, 10:56:00.
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
========== GPIO_SET_DIR:0x1
=== Init OK ===
Welcome to HiLinux.
 app start
(none) login: there   isn't   demo   process!
killall: demo: no process killed
killall: main_gui: no process killed
killall: P2P_Danale: no process killed
killall: P2P_FreeIp: no process killed
okkkkkkkkkkkkkkkkkkkkkkkkinit
killall: demo: no process killed
killall: main_gui: no process killed
killall: P2P_Danale: no process killed
killall: P2P_FreeIp: no process killed
open gpio success, fd = 3
decodeLib.c:1070 -> ccccccccccccccccccccc resolution 16, displayNum 0
[SAMPLE_COMM_SYS_CalcPicVbBlkSize]-174: w:768, u32AlignWidth:64
myThreadScheduled.c:95 -> set pthread priority value 1, error
myThreadScheduled.c:95 -> set pthread priority value 1, error
u32Width:1280, u32Square:1
HDMI start success.
u32Width:1280, u32Square:1
had no stream and pic left
------ port:10000
---------> listen_sock = 3
open gpio success, fd = 4
>>>>>>>>>> listen_sock: 3
>>>>>>>>>> listen_sock: 3
watchdogLib.c:34 -> open success  fd=6
watchdogLib.c:163 -> fd=6
watchdogLib.c:59 -> options=33152 firmware_version= 0 identity= Hisilicon Watchdog
watchdogLib.c:174 -> options=33152 firmware_version= 0 identity= Hisilicon Watchdog
watchdogLib.c:76 -> WDIOC_GETSTATUS t=2
watchdogLib.c:92 -> WDIOC_GETBOOTSTATUS t=2
watchdogLib.c:125 -> WDIOC_SETTIMEOUT t=3
appFunc.c:614 -> P2pInitStart

/sys/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/host2/target2:0:0/2:0:0:0/block/sda/size
diskInfo.c:347 -> usb 10
disk sda
diskInfo.c:492 -> devName EXT4-fs (sda1): VFS: Can't find ext4 filesystem
/dev/sda diskSize 7 G
=====mountSataDisk  diskNum 1
sataPort 10 devName /dev/sda size 7 G
======== devPath /dev/sda1 mount failed
enter checkFallocateFile
==========use devName /dev/sda
Pwd:      sn:)

NatCommunicationImpl::Login ..
Error: can not resole serverName=www.freeipc.com
Login to www.freeipc.com failed
~ServerControl() in
can't find fd in m_transMap
~ServerControl() exit
Stop MessageIO
killall: crond: no process killed
[log][log.c:99:sdk_log_init]:>>>>>> dbg_mask: 0x0003, dbg_level: 4
create s_semid = 0
accept connect from 127.0.0.1, msg_sock: 7
add ---> fd:7, sock_count:1
======> user_ip=127.0.0.1
ok: open_nonblock_sock ===> connect_nonb success, sock:3
SOCK_LIST_MOD   id.src:6, fd:7
networkLib.c:1102 ->
##############my networkLibInit######################
decodeLib.c:1070 -> ccccccccccccccccccccc resolution 16, displayNum 8
[SAMPLE_COMM_SYS_CalcPicVbBlkSize]-174: w:768, u32AlignWidth:64
u32Width:1280, u32Square:1
HDMI start success.
u32Width:1280, u32Square:4
server_sockaddr.sin_addr.s_addr =0
[01/Jan/1970:11:00:36 +0000] boa: server version Boa/0.94.13
[01/Jan/1970:00:23:24 +0000] boa: server built Oct 24 2014 at 15:01:02.
[11/Aug/2004:10:17:24 +0000] boa: starting server pid=906, port 80
recordLib.c:1950 -> g_maxDiskNum ==== 2, g_maxDisplayNum = 8
diskInfo.c:347 -> usb 10
disk sda
diskInfo.cEXT4-fs (sda1): VFS: Can't find ext4 filesystem
:492 -> devName /dev/sda diskSize 7 G
=====mountSataDisk  diskNum 1
sataPort 10 devName /dev/sda size 7 G
======== devPath /dev/sda1 mount failed
==========use devName /dev/sda
email.c:775 -> Getting smtp config....
devdiscovery.c:119 -> Start DevDescovery success!
recordLib.c:428 -> recordWorkThread diskNo 1, running
recordLib.c:428 -> recordWorkThread diskNo 0, running
appFunc.c:100 -> get preview info error, len = -1
stColorKey stColorKey stColorKey
RegisterMyDesktopMenuFunc sucess
RegisterMyDesktopCommandFunc sucess
RegisterMyDesktopWindowProc sucess
RegisterMyDefaultKeyProc sucess
RegisterMyDesktopMenuFunc sucess
RegisterMyDesktopCommandFunc sucess
RegisterMyDesktopWindowProc sucess
RegisterMyDefaultKeyProc sucess
[fbvideo.c:FB_SetVideoMode:658]:width = 1280 , height = 720, bpp = 16
[fbvideo.c:FB_SetVideoMode:702]:xres=1280,yres=720,w=1280,h=720
[kbd_tty.c:TTY_Open:150]:debug
IMPS2_Open mouse find ok
crond[1050]: crond: crond (busybox 1.16.1) started, log level 8
load kor start......
load kor end......
playbackLib.c:703 -> displayChannel 0 error
playbackLib.c:703 -> displayChannel 1 error
playbackLib.c:703 -> displayChannel 2 error
playbackLib.c:703 -> displayChannel 3 error
threadPool.c:182 -> used 0, cur 48, queue size 1
threadPool.c:272 -> thread 0x5970f470 is starting to work, used thread num 0, cur thread num 48
threadPool.c:182 -> used 1, cur 48, queue size 1
threadPool.c:272 -> thread 0x575ae470 is starting to work, used thread num 1, cur thread num 48
pData->data == NULL
decodeLib.c:279 -> run decode, channelNo 7, streamNo 0, viewPos 8
get key 0
NatCommunicationImpl::Login ..
Error: can not resole serverName=www.freeipc.com
Login to www.freeipc.com failed
~ServerControl() in
~ServerControl() exit
Stop MessageIO

Вот что при этом на HDMI выходе рега:



Вот что после нажатия Next step:

Код: Выделить всё

cp: can't stat '/config/system.db': No such file or directory
umount: can't remount /dev/mtdblock5 read-only
umount: /dev/mtdblock3 busy - remounted read-only
umount: tmpfs busy - remounted read-only
umount: tmpfs busy - remounted read-only
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.

Ну, и соответственно перезагрузка...

[Dim32]

Все понятно, он не находит какие то файлы конфигурации и делает "going down NOW!"
Есть предположение, что оставшаяся область - область настроек. Например к мини помимо прошивки идет файл настроек конфигурации. Но где их брать для вашего рега - хз.

ps все таки, попробуйте залить мой дамп

mw.b 82000000 ff 800000
tftp 82000000 dump.bin //заливаем в озу все 8 мбайт
sf probe 0
sf erase 100000 800000
sf write 82100000 100000 800000 //пишем в флешь, начиная с 100000 адреса

если u-boot занимает ту же область, что и в вашем реге (что не факт, в мини он 000000 - 050000), должно прокатить...

[jean]

если u-boot занимает ту же область, что и в вашем реге (что не факт, в мини он 000000 - 050000), должно прокатить...

А то что проскакивает в логе -

Код: Выделить всё

0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000500000 : "kernel"

?

[Dim32]

Да, но в мини NVR так:
0x000000000000-0x000000050000 : "boot"
0x000000050000-0x000000хх0000 : "kernel"
в реге, с которого слил прошивку - хз, я тогда этим не заморачивался.....
В принципе, могу и с мини слить, но тогда заливать надо с 0 адреса - переписывать область у-бута.
Вообще, было бы неплохо создать топик с коллекцией дампов, прошивок и т.д. Но боюсь, он потеряется на этом форуме....