Hikvision DS-2142FWD Boot Loop

Nick Robinson · Jul 5, 2018

Hey;

I've read a number of threads from this site, figured out how to access the camera via serial connection and verified that it was stuck in a boot loop.

The camera was installed and powered up for atleast 2 weeks. The iVMS-4500 would not connect to the camera, nor could I access the camera via its IP address. I connected to the camera via the serial port and used putty to see what's.

FROM PUTTY:

U-Boot 3.1.6-269644 (Jul 6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model

S-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[ 1.517298] Card authentication succeeded

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev: [ 5.095225] ------------[ cut here ]------------
[ 5.099835] kernel BUG at /data3/data_yanglei24/work/r6_5.5.5/trunk/kernel/linux-3.10/fs/inode.c:511!
[ 5.109024] Internal error: Oops - BUG: 0 [#1] PREEMPT ARM
[ 5.114484] Modules linked in:
[ 5.117524] CPU: 0 PID: 57 Comm: udevstart Not tainted 3.10.73+ #2
[ 5.123682] task: 866f6980 ti: 861f4000 task.ti: 861f4000
[ 5.129067] PC is at clear_inode+0x90/0xb0
[ 5.133145] LR is at evict+0xd0/0x1e8
[ 5.136789] pc : [<800bf958>] lr : [<800c0794>] psr: a0000093
[ 5.136789] sp : 861f5f10 ip : 00000019 fp : 00200200
[ 5.148231] r10: 85a161b8 r9 : 862c34d0 r8 : ffffff9c
[ 5.153432] r7 : 01c23ddc r6 : 803d3598 r5 : 861f4020 r4 : 85a161b8
[ 5.159932] r3 : ffffffff r2 : 861f4010 r1 : 00000001 r0 : 85a161b8
[ 5.166434] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 5.173629] Control: 10c53c7d Table: 05c00059 DAC: 00000015
[ 5.179350] Process udevstart (pid: 57, stack limit = 0x861f4238)
[ 5.185417] Stack: (0x861f5f10 to 0x861f6000)
[ 5.189754] 5f00: 861f4020 803d3598 01c23ddc 800c0794
[ 5.197907] 5f20: 86661000 00000000 00000000 800b5d50 8660fd50 86238b30 295cbf54 0000000a
[ 5.206058] 5f40: 86661015 00000000 00000000 86201800 8616b1b8 00000000 00000002 00000000
[ 5.214209] 5f60: 00000000 2756ccff 8660fd50 00000000 00000001 01c23ddc ffffff9c 00000000
[ 5.222360] 5f80: 861f4000 800a6e08 01c23ddc 01c239a4 00000000 0000000a 8000ebc4 861f4000
[ 5.230512] 5fa0: 00000000 8000ea40 01c23ddc 01c239a4 01c23ddc 00000000 00000000 0000002f
[ 5.238663] 5fc0: 01c23ddc 01c239a4 00000000 0000000a 01c239a4 00000000 00100100 00200200
[ 5.246815] 5fe0: 0001b16c 7ee6da2c 000113f4 76f73776 60000030 01c23ddc 00000000 00000000
[ 5.254982] [<800bf958>] (clear_inode+0x90/0xb0) from [<800c0794>] (evict+0xd0/0x1e8)
[ 5.262798] [<800c0794>] (evict+0xd0/0x1e8) from [<800b5d50>] (do_unlinkat+0x13c/0x1a4)
[ 5.270788] [<800b5d50>] (do_unlinkat+0x13c/0x1a4) from [<8000ea40>] (ret_fast_syscall+0x0/0x30)
[ 5.279549] Code: e3a03060 e5803060 e28dd00c e49df004 (e7f001f2)
[ 5.285621] ---[ end trace 74a1048f3965cf9f ]---
[ 5.290220] note: udevstart[57] exited with preempt_count 1
[ 5.295903] BUG: scheduling while atomic: udevstart/57/0x40000002
[ 5.302004] Modules linked in:
[ 5.305046] CPU: 0 PID: 57 Comm: udevstart Tainted: G D 3.10.73+ #2

I've tried using the TFTP program but am having troubles getting them to communicate. I have changed both device IP's to the required ones, but still no dice!!

Any help would be greatly appreciated!!!!

alastairstevenson · Jul 8, 2018

Suggestions:
Check out the PuTTY 'copy screen rollback to clipboard' facility, and the forum 'code' tags under the '+' of the edit menu. Easier for you and for us.

That looks like a code corruption that's crashing the kernel.
Is there any possibility that the camera has been hacked / subject to brickerbot?
ie is it accessible over the internet / us UPnP enabled both on the router and the camera?

Given that you know what the original firmware version was (on the label) an easy first step would be to use the Hikvision tftp updater to refresh the firmware and see if that fixes it.
You can find the Hikvision tftp updater (not the firmware) and instructions linked to in the second link first post here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
And a selection of firmware here : DOWNLOAD PORTAL

Nick Robinson said:
I've tried using the TFTP program but am having troubles getting them to communicate. I have changed both device IP's to the required ones, but still no dice!!

Can you be more specific?
If the camera is in the bootloop you won't be able to changes it's IP address - plus it's set differently in the bootloader.
The PC IP address should be 192.0.0.128 and that should show in the tftp update status screen.
What status messages do you get on the tftp updater?

Nick Robinson · Jul 9, 2018

Hey,
The camera is not accessible through the internet, I hadn't gotten that far in the setup. I have download the software and firmware (Hikvision TFTP) however the program is looking for 'mImage_r6' and not digicap.dav. I have attached the log files for both tftp and putty.
I'm assuming that since I can get to the bootloader prompt and am able to change the IP address of the camera, the camera is not bricked!
Thanks,
Nick

alastairstevenson · Jul 9, 2018

Nick Robinson said:
The camera is not accessible through the internet, I hadn't gotten that far in the setup.

It might be without your knowledge if UPnP is enabled on both router and camera.

Nick Robinson said:
I have download the software and firmware (Hikvision TFTP) however the program is looking for 'mImage_r6' and not digicap.dav

Did it look for this before you tried the 'upf' command? Strictly, upf is a factory reset / update command that will format parts of the flash, and without the right files to use could leave the camera unable to be recovered.
Do try not to run any random commands in u-boot without knowing exactly what they do.

mImage_r6 is the 'recovery system' which would be called to do any firmware updates from the u-boot environment.
Without it, and no running system, no updates are possible.
This is a bit of a long shot, as I don't have the same model of camera that I could extract from a flash partition an mImage_r6
However - as the camera is somewhat broken, I don't believe this will make it any worse, and might just fix it.
A while back I boaught a faulty a DS-2CD2042WD-I which is similar to your camera. After fixing and re-selling I extracted the flash partitions.
Attached is an image of mtd7 which is the rcvy partition, which might work as mImage_r6
Unzip the attached file into the folder that the tftp updater is using.
Also ensure that the unzipped digicap.dav from the R6 firmware download is in the same folder.

At the u-boot prompt, use the 'upf' command.
With luck that will re-write the min-system recovery partition.
Then use the 'update' command.
With luck that will use the refreshed mImage_r6 to do a firmware update.

Good luck!

BTW - so much easier for you, and use, if you paste the PuTTY text into the 'code' tags, using the '+' of the forum edit menu.

Nick Robinson · Jul 19, 2018

Awesome! Thank You!!

I have purchased another camera, for a different location, could you give me step by step instruction on how to copy/download a complete copy of all the flash partitions from the new camera? Its the exact same model as my broken one.
Thanks,
Nick

alastairstevenson · Jul 19, 2018

Nick Robinson said:
Awesome! Thank You!!

Are you saying the camera was able to be fixed with the mImage_r6 I tried to create?

Nick Robinson said:
could you give me step by step instruction on how to copy/download a complete copy of all the flash partitions from the new camera?

There are various ways in which this could be done - which vary a bit with the version of bootloader and kernel that's running.
Generally though, some knowledge of Linux at a command-line level would be needed, and ideally something like an NFS share on the network to move files around with.
Quite a usful method if supported would be to start by getting into a debug mode by modifying the 'bootargs' bootloader environment variable.
Something like :
setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri
saveenv
reset

But then, when it boots up, there would be a need to complete the kernel initiallisation, mount the NFS share, and do the extraction.
There is a fair bit of detail in that.

Nick Robinson · Jul 22, 2018

Hey;
Unfortunately No it did not work. The mImage_R6 does download to the camera however it won't load. I get a "version2 error". If I reboot and let it autoboot I end up at the busybox prompt! Any suggestions?

Code:

HKVS # upf

***** UPDATE START *****
MAC: 94:e1:ac:6e:87:77

TFTP from server 192.0.0.128; our IP address is 192.0.0.64

Filename: 'mImage_r6'

Load address: 0x00207F00

do_tftp_load:bld_udp_recv RRQ ok,opcode=3

################################################################################

################################################################################

################################################################################

################################################################################

################################################################################

######### got 10485760 bytes (10240 KB)

[ INFO][BLD]TFTP: Download File [OK]


version2 error.
hdr->crc32=0x8f639cdd
hdr->img_len=4108596
hdr->mem_addr=0xffffffff
hdr->magic=0x4d535953
build_time:Wed May 25 11:46:35 2016
username:  zhangjianzhong
hostname:  Cpl-Frt-BSP
verify data failed! error: upm.
update mini system [FAIL]!error: upf.
!!!!! UPDATE FAIL !!!!!
HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...


init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

#

Thanks,
Nick

alastairstevenson · Jul 23, 2018

Nick Robinson said:
Unfortunately No it did not work. The mImage_R6 does download to the camera however it won't load. I get a "version2 error".

That's a pity. The file is failing validation.
It was a straight dump of mtdblock7 - the recovery partition - from another R6 camera.

The kernel seems to boot OK.
As you have the serial console working OK, it may be worth trying this, and posting the result:
Power on, interrupt the bootloader with Control-U
With the tftp updater running, and an R6 digicap.dav firmware file in the same folder, try the 'update' command.
This probably won't work as it will need to boot the 'min-system' image to handle the update, but it would be worth seeing what happens.

Nick Robinson · Jul 27, 2018

Hey,
I've tried to do the "update" command but I get

Code:

HKVS # update

'update' is a ambiguous command! Exec the shortest command

Segmentation fault

Code:

update digicap.dav

HKVS # update digicap.dav

'update' is a ambiguous command! Exec the shortest command

Segmentation fault

It's been a while since I've used a Unix/Linux based system, used it extensively 20 years ago. but I have not yet figured out how to get access to all of the commands in U-Boot and half of the commands in BusyBox don't work! Any ideas or help would be greatly appreciated!
Thanks

alastairstevenson · Jul 27, 2018

Nick Robinson said:
I've tried to do the "update" command

OK - the 'update' command brings in the 'min-system' recovery partition to do the work.
And the 'segmentation fault' could occur if it is corrupt.

There is a chance that the mImage_r6 I attached would work if it can be directly applied to the partition it comes from.
If you feel inclined to spend some time experimenting, this may be possible.

To do this would involve getting a root command-line at a running kernel.
I'm not very familiar with the R6 series, and don't have one to experiment on, but there are usually ways to get the kernel to boot into a debug mode where it doesn't start up any apps.
If that can be done, and you have an NFS share (or maybe even an SMB/CIFS share) available on your network, the mImage_r6 file could be applied.

Quite a useful method if supported would be to try modifying the 'bootargs' bootloader environment variable.
First, though, make a copy of the existing bootloader status with these commands, the output copied and pasted into Notepad or similar for later reference.
Of particular interest would be the existing setting for bootargs

Interrupt the bootloader with Control-U
printenv
help

Then change bootargs using :
setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri
saveenv
reset

Nick Robinson · Aug 5, 2018

Hey
Sorry for taking so long to get back to you, summer time is a busy time for me!
I do have a NFS share on my home network that I can mount if/when I can get to a root command-line.
I tried to change the 'bootargs' and it won't let me.

Code:

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=2

dbg=9

HKVS # setenv boogtargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help

HKVS # help setenv

Help for 'setenv':

setenv [param] [val]

ipaddr        - network ip address

serverip    - tftp server ip address

netmask    - network ip mask

gatewayip    - gateway ip address

ethaddr    - ethernet mac address

bootdelay    - boot delay time

dbg            - debug level

HKVS #

I was able to change the debug level to '9' by setenv dbg 9 and then saved it. But I don't see any new commands/options available to me.

Any other options?
Thanks,
Nick

alastairstevenson · Aug 6, 2018

Nick Robinson said:
I tried to change the 'bootargs' and it won't let me.

It will when you type it correctly - although backspace is echoed, it isn't actioned, so a mistype gives an invalid command.
Give it another try.

Nick Robinson said:
I was able to change the debug level to '9' by setenv dbg 9 and then saved it. But I don't see any new commands/options available to me.

If that setting is valid for the firmware, it influences how the kernel operates on startup.
You won't see any effect until the camera boots up.
You can use the 'reset' command in the bootloader to boot the camera.

Nick Robinson · Aug 6, 2018

Hey
Sorry for that, I ran it twice before but I noticed putty didn't create a log file for me to use!
he following is a very long post, wanted to make sure you had/got all the info just in case.

Code:

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=2

dbg=9


HKVS # help setenv

Help for 'setenv':

setenv [param] [val]

ipaddr        - network ip address

serverip    - tftp server ip address

netmask    - network ip mask

gatewayip    - gateway ip address

ethaddr    - ethernet mac address

bootdelay    - boot delay time

dbg            - debug level

HKVS # setenv bootargs console=ttyS0

Type 'help setenv' for help

HKVS # setenv bootargs single KRN_PRT=pri

Type 'help setenv' for help

So I tried to see if it would accept 'boot pri' and then I got,

Code:

HKVS # boot pri

cmd 'null' is not supported.

nand booting ...

booting from sec part...
load kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] Ambarella:    FBMEM = 0x06800000[          ],0x00000000
[    0.000000] On node 0 totalpages: 28160
[    0.000000] free_area_init_node: node 0, pgdat 807d68f8, node_mem_map 80807000
[    0.000000]   Normal zone: 220 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 28160 pages, LIFO batch:7
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=sec dbg=9
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.271936] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.332606] pid_max: default: 32768 minimum: 301
[    1.794468] Card authentication succeeded
[    1.798530] Mount-cache hash table entries: 512
[    1.805559] CPU: Testing write buffer coherency: ok
[    1.810730] Setting up static identity map for 0x803cbd50 - 0x803cbdb8
[    1.820699] devtmpfs: initialized
[    1.825170] pinctrl core: initialized pinctrl subsystem
[    1.830712] NET: Registered protocol family 16
[    1.835875] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.843263] L310 cache controller enabled
[    1.847263] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    1.856684] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.864692] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.872464] read dev-tree[misc_ctrl_pin] pro [rst_time] error!
[    1.878277] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!
[    1.886656] bio: create slab <bio-0> at 0
[    1.891764] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.899345] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.906428] Advanced Linux Sound Architecture Driver Initialized.
[    1.913191] Switching to clocksource ambarella-cs-timer
[    1.924958] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.933248] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.942122] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    2.018494] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[    2.024506] NET: Registered protocol family 2
[    2.032852] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.039961] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    2.046337] TCP: Hash tables configured (established 1024 bind 1024)
[    2.052774] TCP: reno registered
[    2.056027] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.061902] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.068366] NET: Registered protocol family 1
[    2.073107] RPC: Registered named UNIX socket transport module.
[    2.079092] RPC: Registered udp transport module.
[    2.083776] RPC: Registered tcp transport module.
[    2.088479] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.301415] msgmni has been set to 201
[    2.306638] NET: Registered protocol family 38
[    2.311275] io scheduler noop registered
[    2.315182] io scheduler deadline registered
[    2.319492] io scheduler cfq registered (default)
[    2.325026] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    2.333843] brd: module loaded
[    2.339583] loop: module loaded
[    2.345410] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    2.351130] ambarella_nand: Use On Flash BBT
[    2.355459] NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.367695] Bad block table found at page 65472, version 0x01
[    2.373640] Bad block table found at page 65408, version 0x01
[    2.379579] nand_read_bbt: bad block at 0x000006000000
[    2.384776] 16 ofpart partitions found on MTD device amba_nand
[    2.390647] Creating 16 MTD partitions on "amba_nand":
[    2.395774] 0x000000000000-0x000000020000 : "bst"
[    2.401270] 0x000000020000-0x000000120000 : "bld"
[    2.406616] 0x000000120000-0x000000200000 : "ptb"
[    2.412071] 0x000000200000-0x000000280000 : "env"
[    2.420556] 0x000000280000-0x000000380000 : "sysflg"
[    2.426250] 0x000000380000-0x000000400000 : "param"
[    2.431923] 0x000000400000-0x000000500000 : "dpt"
[    2.437363] 0x000000500000-0x000000f00000 : "rcvy"
[    2.442955] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.448816] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.454596] 0x000001f00000-0x000004100000 : "app_pri"
[    2.460425] 0x000004100000-0x000006300000 : "app_sec"
[    2.466127] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.472891] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.478622] 0x000006f00000-0x000007700000 : "dbg"
[    2.483983] 0x000007700000-0x000007f00000 : "syslog"
[    2.490134] ambarella-spi e0020000.spi: SPI[0] uses DMA
[    2.495501] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.502712] tun: Universal TUN/TAP device driver, 1.6
[    2.507742] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.568428] libphy: Ambarella MII Bus: probed
[    2.572783] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.581916] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.589409] mdio_bus e000e000.etherne: registered phy phy at address 0
[    2.595930] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[    2.603226] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    2.610370] PPP generic driver version 2.4.2
[    2.614816] PPP BSD Compression module registered
[    2.619539] PPP Deflate Compression module registered
[    2.624743] mousedev: PS/2 mouse device common for all mice
[    5.628438] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.635300] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    5.642985] pcf85163 is not exist.
[    5.646367] i2c /dev entries driver
[    5.650374] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    5.657692] Netfilter messages via NETLINK v0.30.
[    5.662511] nf_conntrack version 0.5.0 (1614 buckets, 6456 max)
[    5.668798] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.674135] TCP: cubic registered
[    5.677463] NET: Registered protocol family 10
[    5.682821] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.688249] sit: IPv6 over IPv4 tunneling driver
[    5.693506] NET: Registered protocol family 17
[    5.698000] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    5.705676] ThumbEE CPU extension supported.
[    5.711129] ambarella-rtc e8015000.rtc: setting system clock to 1970-02-25 01:04:06 UTC (4755846)
[    5.720100] ALSA device list:
[    5.723052]   No soundcards found.
[    5.729159] Freeing unused kernel memory: 2628K (80503000 - 80794000)

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    6.322876] UBI: attaching mtd11 to ubi2
[    6.417503] UBI: scanning is finished
[    6.431983] UBI: attached mtd11 (name "app_sec", size 34 MiB) to ubi2
[    6.441195] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.447968] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.454723] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.461599] UBI: good PEBs: 271, bad PEBs: 1, corrupted PEBs: 0
[    6.467494] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.474619] UBI: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 68118096
[    6.483474] UBI: available PEBs: 0, total reserved PEBs: 271, PEBs reserved for bad PEB handling: 9
[    6.492518] UBI: background thread "ubi_bgt2d" started, PID 271
UBI device number 2, total 271 LEBs (34410496 bytes, 32.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi2_0.
[    6.514069] UBIFS: background thread "ubifs_bgt2_0" started, PID 276
[    6.541619] UBIFS: recovery needed
[    6.560353] UBIFS: recovery completed
[    6.564174] UBIFS: mounted UBI device 2, volume 0, name "app_sec"
[    6.570336] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.579468] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.589105] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.594920] UBIFS: media format: w4/r0 (latest is w4/r0), UUID F939CB7D-83C3-49A5-A12D-B0D962DBF5B2, small LPT model
pri_iUpgSuccCnt:0, sec_iUpgSuccCnt:1
Recovering ker from sec to pri partition ...
recover_mtd_partition: /dev/mtd9 -> /dev/mtd8
Reading image header from src mtd /dev/mtd9 ... Done.
crc32=0x411c70e6
img_len=5381572
mem_addr=0x208000
magic=0x4b45524e
[    6.888426] probe_rst_pin exceed
Reading image from src mtd /dev/mtd9 ... Done.
Writing image to dst mtd /dev/mtd8 ... Done.
Recovering app from sec to pri partition ...
ubiformat: mtd10 (nand), size 35651584 bytes (34.0 MiB), 272 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes

libscan: scanning eraseblock 0 --  0 % complete 
libscan: scanning eraseblock 1 --  0 % complete 
libscan: scanning eraseblock 2 --  1 % complete 
libscan: scanning eraseblock 3 --  1 % complete 
libscan: scanning eraseblock 4 --  1 % complete 
libscan: scanning eraseblock 5 --  2 % complete 
libscan: scanning eraseblock 6 --  2 % complete 
libscan: scanning eraseblock 7 --  2 % complete 
libscan: scanning eraseblock 8 --  3 % complete 
libscan: scanning eraseblock 9 --  3 % complete 
libscan: scanning eraseblock 10 --  4 % complete 
libscan: scanning eraseblock 11 --  4 % complete 
libscan: scanning eraseblock 12 --  4 % complete 
libscan: scanning eraseblock 13 --  5 % complete 
libscan: scanning eraseblock 14 --  5 % complete 
libscan: scanning eraseblock 15 --  5 % complete 
libscan: scanning eraseblock 16 --  6 % complete 
libscan: scanning eraseblock 17 --  6 % complete 
libscan: scanning eraseblock 18 --  6 % complete 
libscan: scanning eraseblock 19 --  7 % complete 
libscan: scanning eraseblock 20 --  7 % complete 
libscan: scanning eraseblock 21 --  8 % complete 
libscan: scanning eraseblock 22 --  8 % complete 
libscan: scanning eraseblock 23 --  8 % complete 
libscan: scanning eraseblock 24 --  9 % complete 
libscan: scanning eraseblock 25 --  9 % complete 
libscan: scanning eraseblock 26 --  9 % complete 
libscan: scanning eraseblock 27 -- 10 % complete 
libscan: scanning eraseblock 28 -- 10 % complete 
libscan: scanning eraseblock 29 -- 11 % complete 
libscan: scanning eraseblock 30 -- 11 % complete 
libscan: scanning eraseblock 31 -- 11 % complete 
libscan: scanning eraseblock 32 -- 12 % complete 
libscan: scanning eraseblock 33 -- 12 % complete 
libscan: scanning eraseblock 34 -- 12 % complete 
libscan: scanning eraseblock 35 -- 13 % complete 
libscan: scanning eraseblock 36 -- 13 % complete 
libscan: scanning eraseblock 37 -- 13 % complete 
libscan: scanning eraseblock 38 -- 14 % complete 
libscan: scanning eraseblock 39 -- 14 % complete 
libscan: scanning eraseblock 40 -- 15 % complete 
libscan: scanning eraseblock 41 -- 15 % complete 
libscan: scanning eraseblock 42 -- 15 % complete 
libscan: scanning eraseblock 43 -- 16 % complete 
libscan: scanning eraseblock 44 -- 16 % complete 
libscan: scanning eraseblock 45 -- 16 % complete 
libscan: scanning eraseblock 46 -- 17 % complete 
libscan: scanning eraseblock 47 -- 17 % complete 
libscan: scanning eraseblock 48 -- 18 % complete 
libscan: scanning eraseblock 49 -- 18 % complete 
libscan: scanning eraseblock 50 -- 18 % complete 
libscan: scanning eraseblock 51 -- 19 % complete 
libscan: scanning eraseblock 52 -- 19 % complete 
libscan: scanning eraseblock 53 -- 19 % complete 
libscan: scanning eraseblock 54 -- 20 % complete 
libscan: scanning eraseblock 55 -- 20 % complete 
libscan: scanning eraseblock 56 -- 20 % complete 
libscan: scanning eraseblock 57 -- 21 % complete 
libscan: scanning eraseblock 58 -- 21 % complete 
libscan: scanning eraseblock 59 -- 22 % complete 
libscan: scanning eraseblock 60 -- 22 % complete 
libscan: scanning eraseblock 61 -- 22 % complete 
libscan: scanning eraseblock 62 -- 23 % complete 
libscan: scanning eraseblock 63 -- 23 % complete 
libscan: scanning eraseblock 64 -- 23 % complete 
libscan: scanning eraseblock 65 -- 24 % complete 
libscan: scanning eraseblock 66 -- 24 % complete 
libscan: scanning eraseblock 67 -- 25 % complete 
libscan: scanning eraseblock 68 -- 25 % complete 
libscan: scanning eraseblock 69 -- 25 % complete 
libscan: scanning eraseblock 70 -- 26 % complete 
libscan: scanning eraseblock 71 -- 26 % complete 
libscan: scanning eraseblock 72 -- 26 % complete 
libscan: scanning eraseblock 73 -- 27 % complete 
libscan: scanning eraseblock 74 -- 27 % complete 
libscan: scanning eraseblock 75 -- 27 % complete 
libscan: scanning eraseblock 76 -- 28 % complete 
libscan: scanning eraseblock 77 -- 28 % complete 
libscan: scanning eraseblock 78 -- 29 % complete 
libscan: scanning eraseblock 79 -- 29 % complete 
libscan: scanning eraseblock 80 -- 29 % complete 
libscan: scanning eraseblock 81 -- 30 % complete 
libscan: scanning eraseblock 82 -- 30 % complete 
libscan: scanning eraseblock 83 -- 30 % complete 
libscan: scanning eraseblock 84 -- 31 % complete 
libscan: scanning eraseblock 85 -- 31 % complete 
libscan: scanning eraseblock 86 -- 31 % complete 
libscan: scanning eraseblock 87 -- 32 % complete 
libscan: scanning eraseblock 88 -- 32 % complete 
libscan: scanning eraseblock 89 -- 33 % complete 
libscan: scanning eraseblock 90 -- 33 % complete 
libscan: scanning eraseblock 91 -- 33 % complete 
libscan: scanning eraseblock 92 -- 34 % complete 
libscan: scanning eraseblock 93 -- 34 % complete 
libscan: scanning eraseblock 94 -- 34 % complete 
libscan: scanning eraseblock 95 -- 35 % complete 
libscan: scanning eraseblock 96 -- 35 % complete 
libscan: scanning eraseblock 97 -- 36 % complete 
libscan: scanning eraseblock 98 -- 36 % complete 
libscan: scanning eraseblock 99 -- 36 % complete 
libscan: scanning eraseblock 100 -- 37 % complete 
libscan: scanning eraseblock 101 -- 37 % complete 
libscan: scanning eraseblock 102 -- 37 % complete 
libscan: scanning eraseblock 103 -- 38 % complete 
libscan: scanning eraseblock 104 -- 38 % complete 
libscan: scanning eraseblock 105 -- 38 % complete 
libscan: scanning eraseblock 106 -- 39 % complete 
libscan: scanning eraseblock 107 -- 39 % complete 
libscan: scanning eraseblock 108 -- 40 % complete 
libscan: scanning eraseblock 109 -- 40 % complete 
libscan: scanning eraseblock 110 -- 40 % complete 
libscan: scanning eraseblock 111 -- 41 % complete 
libscan: scanning eraseblock 112 -- 41 % complete 
libscan: scanning eraseblock 113 -- 41 % complete 
libscan: scanning eraseblock 114 -- 42 % complete 
libscan: scanning eraseblock 115 -- 42 % complete 
libscan: scanning eraseblock 116 -- 43 % complete 
libscan: scanning eraseblock 117 -- 43 % complete 
libscan: scanning eraseblock 118 -- 43 % complete 
libscan: scanning eraseblock 119 -- 44 % complete 
libscan: scanning eraseblock 120 -- 44 % complete 
libscan: scanning eraseblock 121 -- 44 % complete 
libscan: scanning eraseblock 122 -- 45 % complete 
libscan: scanning eraseblock 123 -- 45 % complete 
libscan: scanning eraseblock 124 -- 45 % complete 
libscan: scanning eraseblock 125 -- 46 % complete 
libscan: scanning eraseblock 126 -- 46 % complete 
libscan: scanning eraseblock 127 -- 47 % complete 
libscan: scanning eraseblock 128 -- 47 % complete 
libscan: scanning eraseblock 129 -- 47 % complete 
libscan: scanning eraseblock 130 -- 48 % complete 
libscan: scanning eraseblock 131 -- 48 % complete 
libscan: scanning eraseblock 132 -- 48 % complete 
libscan: scanning eraseblock 133 -- 49 % complete 
libscan: scanning eraseblock 134 -- 49 % complete 
libscan: scanning eraseblock 135 -- 50 % complete 
libscan: scanning eraseblock 136 -- 50 % complete 
libscan: scanning eraseblock 137 -- 50 % complete 
libscan: scanning eraseblock 138 -- 51 % complete 
libscan: scanning eraseblock 139 -- 51 % complete 
libscan: scanning eraseblock 140 -- 51 % complete 
libscan: scanning eraseblock 141 -- 52 % complete 
libscan: scanning eraseblock 142 -- 52 % complete 
libscan: scanning eraseblock 143 -- 52 % complete 
libscan: scanning eraseblock 144 -- 53 % complete 
libscan: scanning eraseblock 145 -- 53 % complete 
libscan: scanning eraseblock 146 -- 54 % complete 
libscan: scanning eraseblock 147 -- 54 % complete 
libscan: scanning eraseblock 148 -- 54 % complete 
libscan: scanning eraseblock 149 -- 55 % complete 
libscan: scanning eraseblock 150 -- 55 % complete 
libscan: scanning eraseblock 151 -- 55 % complete 
libscan: scanning eraseblock 152 -- 56 % complete 
libscan: scanning eraseblock 153 -- 56 % complete 
libscan: scanning eraseblock 154 -- 56 % complete 
libscan: scanning eraseblock 155 -- 57 % complete 
libscan: scanning eraseblock 156 -- 57 % complete 
libscan: scanning eraseblock 157 -- 58 % complete 
libscan: scanning eraseblock 158 -- 58 % complete 
libscan: scanning eraseblock 159 -- 58 % complete 
libscan: scanning eraseblock 160 -- 59 % complete 
libscan: scanning eraseblock 161 -- 59 % complete 
libscan: scanning eraseblock 162 -- 59 % complete 
libscan: scanning eraseblock 163 -- 60 % complete 
libscan: scanning eraseblock 164 -- 60 % complete 
libscan: scanning eraseblock 165 -- 61 % complete 
libscan: scanning eraseblock 166 -- 61 % complete 
libscan: scanning eraseblock 167 -- 61 % complete 
libscan: scanning eraseblock 168 -- 62 % complete 
libscan: scanning eraseblock 169 -- 62 % complete 
libscan: scanning eraseblock 170 -- 62 % complete 
libscan: scanning eraseblock 171 -- 63 % complete 
libscan: scanning eraseblock 172 -- 63 % complete 
libscan: scanning eraseblock 173 -- 63 % complete 
libscan: scanning eraseblock 174 -- 64 % complete 
libscan: scanning eraseblock 175 -- 64 % complete 
libscan: scanning eraseblock 176 -- 65 % complete 
libscan: scanning eraseblock 177 -- 65 % complete 
libscan: scanning eraseblock 178 -- 65 % complete 
libscan: scanning eraseblock 179 -- 66 % complete 
libscan: scanning eraseblock 180 -- 66 % complete 
libscan: scanning eraseblock 181 -- 66 % complete 
libscan: scanning eraseblock 182 -- 67 % complete 
libscan: scanning eraseblock 183 -- 67 % complete 
libscan: scanning eraseblock 184 -- 68 % complete 
libscan: scanning eraseblock 185 -- 68 % complete 
libscan: scanning eraseblock 186 -- 68 % complete 
libscan: scanning eraseblock 187 -- 69 % complete 
libscan: scanning eraseblock 188 -- 69 % complete 
libscan: scanning eraseblock 189 -- 69 % complete 
libscan: scanning eraseblock 190 -- 70 % complete 
libscan: scanning eraseblock 191 -- 70 % complete 
libscan: scanning eraseblock 192 -- 70 % complete 
libscan: scanning eraseblock 193 -- 71 % complete 
libscan: scanning eraseblock 194 -- 71 % complete 
libscan: scanning eraseblock 195 -- 72 % complete 
libscan: scanning eraseblock 196 -- 72 % complete 
libscan: scanning eraseblock 197 -- 72 % complete 
libscan: scanning eraseblock 198 -- 73 % complete 
libscan: scanning eraseblock 199 -- 73 % complete 
libscan: scanning eraseblock 200 -- 73 % complete 
libscan: scanning eraseblock 201 -- 74 % complete 
libscan: scanning eraseblock 202 -- 74 % complete 
libscan: scanning eraseblock 203 -- 75 % complete 
libscan: scanning eraseblock 204 -- 75 % complete 
libscan: scanning eraseblock 205 -- 75 % complete 
libscan: scanning eraseblock 206 -- 76 % complete 
libscan: scanning eraseblock 207 -- 76 % complete 
libscan: scanning eraseblock 208 -- 76 % complete 
libscan: scanning eraseblock 209 -- 77 % complete 
libscan: scanning eraseblock 210 -- 77 % complete 
libscan: scanning eraseblock 211 -- 77 % complete 
libscan: scanning eraseblock 212 -- 78 % complete 
libscan: scanning eraseblock 213 -- 78 % complete 
libscan: scanning eraseblock 214 -- 79 % complete 
libscan: scanning eraseblock 215 -- 79 % complete 
libscan: scanning eraseblock 216 -- 79 % complete 
libscan: scanning eraseblock 217 -- 80 % complete 
libscan: scanning eraseblock 218 -- 80 % complete 
libscan: scanning eraseblock 219 -- 80 % complete 
libscan: scanning eraseblock 220 -- 81 % complete 
libscan: scanning eraseblock 221 -- 81 % complete 
libscan: scanning eraseblock 222 -- 81 % complete 
libscan: scanning eraseblock 223 -- 82 % complete 
libscan: scanning eraseblock 224 -- 82 % complete 
libscan: scanning eraseblock 225 -- 83 % complete 
libscan: scanning eraseblock 226 -- 83 % complete 
libscan: scanning eraseblock 227 -- 83 % complete 
libscan: scanning eraseblock 228 -- 84 % complete 
libscan: scanning eraseblock 229 -- 84 % complete 
libscan: scanning eraseblock 230 -- 84 % complete 
libscan: scanning eraseblock 231 -- 85 % complete 
libscan: scanning eraseblock 232 -- 85 % complete 
libscan: scanning eraseblock 233 -- 86 % complete 
libscan: scanning eraseblock 234 -- 86 % complete 
libscan: scanning eraseblock 235 -- 86 % complete 
libscan: scanning eraseblock 236 -- 87 % complete 
libscan: scanning eraseblock 237 -- 87 % complete 
libscan: scanning eraseblock 238 -- 87 % complete 
libscan: scanning eraseblock 239 -- 88 % complete 
libscan: scanning eraseblock 240 -- 88 % complete 
libscan: scanning eraseblock 241 -- 88 % complete 
libscan: scanning eraseblock 242 -- 89 % complete 
libscan: scanning eraseblock 243 -- 89 % complete 
libscan: scanning eraseblock 244 -- 90 % complete 
libscan: scanning eraseblock 245 -- 90 % complete 
libscan: scanning eraseblock 246 -- 90 % complete 
libscan: scanning eraseblock 247 -- 91 % complete 
libscan: scanning eraseblock 248 -- 91 % complete 
libscan: scanning eraseblock 249 -- 91 % complete 
libscan: scanning eraseblock 250 -- 92 % complete 
libscan: scanning eraseblock 251 -- 92 % complete 
libscan: scanning eraseblock 252 -- 93 % complete 
libscan: scanning eraseblock 253 -- 93 % complete 
libscan: scanning eraseblock 254 -- 93 % complete 
libscan: scanning eraseblock 255 -- 94 % complete 
libscan: scanning eraseblock 256 -- 94 % complete 
libscan: scanning eraseblock 257 -- 94 % complete 
libscan: scanning eraseblock 258 -- 95 % complete 
libscan: scanning eraseblock 259 -- 95 % complete 
libscan: scanning eraseblock 260 -- 95 % complete 
libscan: scanning eraseblock 261 -- 96 % complete 
libscan: scanning eraseblock 262 -- 96 % complete 
libscan: scanning eraseblock 263 -- 97 % complete 
libscan: scanning eraseblock 264 -- 97 % complete 
libscan: scanning eraseblock 265 -- 97 % complete 
libscan: scanning eraseblock 266 -- 98 % complete 
libscan: scanning eraseblock 267 -- 98 % complete 
libscan: scanning eraseblock 268 -- 98 % complete 
libscan: scanning eraseblock 269 -- 99 % complete 
libscan: scanning eraseblock 270 -- 99 % complete 
libscan: scanning eraseblock 271 -- 100 % complete 
ubiformat: 272 eraseblocks have valid erase counter, mean value is 21

ubiformat: formatting eraseblock 0 --  0 % complete 
ubiformat: formatting eraseblock 1 --  0 % complete 
ubiformat: formatting eraseblock 2 --  1 % complete 
ubiformat: formatting eraseblock 3 --  1 % complete 
ubiformat: formatting eraseblock 4 --  1 % complete 
ubiformat: formatting eraseblock 5 --  2 % complete 
ubiformat: formatting eraseblock 6 --  2 % complete 
ubiformat: formatting eraseblock 7 --  2 % complete 
ubiformat: formatting eraseblock 8 --  3 % complete 
ubiformat: formatting eraseblock 9 --  3 % complete 
ubiformat: formatting eraseblock 10 --  4 % complete 
ubiformat: formatting eraseblock 11 --  4 % complete 
ubiformat: formatting eraseblock 12 --  4 % complete 
ubiformat: formatting eraseblock 13 --  5 % complete 
ubiformat: formatting eraseblock 14 --  5 % complete 
ubiformat: formatting eraseblock 15 --  5 % complete 
ubiformat: formatting eraseblock 16 --  6 % complete 
ubiformat: formatting eraseblock 17 --  6 % complete 
ubiformat: formatting eraseblock 18 --  6 % complete 
ubiformat: formatting eraseblock 19 --  7 % complete 
ubiformat: formatting eraseblock 20 --  7 % complete 
ubiformat: formatting eraseblock 21 --  8 % complete 
ubiformat: formatting eraseblock 22 --  8 % complete 
ubiformat: formatting eraseblock 23 --  8 % complete 
ubiformat: formatting eraseblock 24 --  9 % complete 
ubiformat: formatting eraseblock 25 --  9 % complete 
ubiformat: formatting eraseblock 26 --  9 % complete 
ubiformat: formatting eraseblock 27 -- 10 % complete 
ubiformat: formatting eraseblock 28 -- 10 % complete 
ubiformat: formatting eraseblock 29 -- 11 % complete 
ubiformat: formatting eraseblock 30 -- 11 % complete 
ubiformat: formatting eraseblock 31 -- 11 % complete 
ubiformat: formatting eraseblock 32 -- 12 % complete 
ubiformat: formatting eraseblock 33 -- 12 % complete 
ubiformat: formatting eraseblock 34 -- 12 % complete 
ubiformat: formatting eraseblock 35 -- 13 % complete 
ubiformat: formatting eraseblock 36 -- 13 % complete 
ubiformat: formatting eraseblock 37 -- 13 % complete 
ubiformat: formatting eraseblock 38 -- 14 % complete 
ubiformat: formatting eraseblock 39 -- 14 % complete 
ubiformat: formatting eraseblock 40 -- 15 % complete 
ubiformat: formatting eraseblock 41 -- 15 % complete 
ubiformat: formatting eraseblock 42 -- 15 % complete 
ubiformat: formatting eraseblock 43 -- 16 % complete 
ubiformat: formatting eraseblock 44 -- 16 % complete 
ubiformat: formatting eraseblock 45 -- 16 % complete 
ubiformat: formatting eraseblock 46 -- 17 % complete 
ubiformat: formatting eraseblock 47 -- 17 % complete 
ubiformat: formatting eraseblock 48 -- 18 % complete 
ubiformat: formatting eraseblock 49 -- 18 % complete 
ubiformat: formatting eraseblock 50 -- 18 % complete 
ubiformat: formatting eraseblock 51 -- 19 % complete 
ubiformat: formatting eraseblock 52 -- 19 % complete 
ubiformat: formatting eraseblock 53 -- 19 % complete 
ubiformat: formatting eraseblock 54 -- 20 % complete 
ubiformat: formatting eraseblock 55 -- 20 % complete 
ubiformat: formatting eraseblock 56 -- 20 % complete 
ubiformat: formatting eraseblock 57 -- 21 % complete 
ubiformat: formatting eraseblock 58 -- 21 % complete 
ubiformat: formatting eraseblock 59 -- 22 % complete 
ubiformat: formatting eraseblock 60 -- 22 % complete 
ubiformat: formatting eraseblock 61 -- 22 % complete 
ubiformat: formatting eraseblock 62 -- 23 % complete 
ubiformat: formatting eraseblock 63 -- 23 % complete 
ubiformat: formatting eraseblock 64 -- 23 % complete 
ubiformat: formatting eraseblock 65 -- 24 % complete 
ubiformat: formatting eraseblock 66 -- 24 % complete 
ubiformat: formatting eraseblock 67 -- 25 % complete 
ubiformat: formatting eraseblock 68 -- 25 % complete 
ubiformat: formatting eraseblock 69 -- 25 % complete 
ubiformat: formatting eraseblock 70 -- 26 % complete 
ubiformat: formatting eraseblock 71 -- 26 % complete 
ubiformat: formatting eraseblock 72 -- 26 % complete 
ubiformat: formatting eraseblock 73 -- 27 % complete 
ubiformat: formatting eraseblock 74 -- 27 % complete 
ubiformat: formatting eraseblock 75 -- 27 % complete 
ubiformat: formatting eraseblock 76 -- 28 % complete 
ubiformat: formatting eraseblock 77 -- 28 % complete 
ubiformat: formatting eraseblock 78 -- 29 % complete 
ubiformat: formatting eraseblock 79 -- 29 % complete 
ubiformat: formatting eraseblock 80 -- 29 % complete 
ubiformat: formatting eraseblock 81 -- 30 % complete 
ubiformat: formatting eraseblock 82 -- 30 % complete 
ubiformat: formatting eraseblock 83 -- 30 % complete 
ubiformat: formatting eraseblock 84 -- 31 % complete 
ubiformat: formatting eraseblock 85 -- 31 % complete 
ubiformat: formatting eraseblock 86 -- 31 % complete 
ubiformat: formatting eraseblock 87 -- 32 % complete 
ubiformat: formatting eraseblock 88 -- 32 % complete 
ubiformat: formatting eraseblock 89 -- 33 % complete 
ubiformat: formatting eraseblock 90 -- 33 % complete 
ubiformat: formatting eraseblock 91 -- 33 % complete 
ubiformat: formatting eraseblock 92 -- 34 % complete 
ubiformat: formatting eraseblock 93 -- 34 % complete 
ubiformat: formatting eraseblock 94 -- 34 % complete 
ubiformat: formatting eraseblock 95 -- 35 % complete 
ubiformat: formatting eraseblock 96 -- 35 % complete 
ubiformat: formatting eraseblock 97 -- 36 % complete 
ubiformat: formatting eraseblock 98 -- 36 % complete 
ubiformat: formatting eraseblock 99 -- 36 % complete 
ubiformat: formatting eraseblock 100 -- 37 % complete 
ubiformat: formatting eraseblock 101 -- 37 % complete 
ubiformat: formatting eraseblock 102 -- 37 % complete 
ubiformat: formatting eraseblock 103 -- 38 % complete 
ubiformat: formatting eraseblock 104 -- 38 % complete 
ubiformat: formatting eraseblock 105 -- 38 % complete 
ubiformat: formatting eraseblock 106 -- 39 % complete 
ubiformat: formatting eraseblock 107 -- 39 % complete 
ubiformat: formatting eraseblock 108 -- 40 % complete 
ubiformat: formatting eraseblock 109 -- 40 % complete 
ubiformat: formatting eraseblock 110 -- 40 % complete 
ubiformat: formatting eraseblock 111 -- 41 % complete 
ubiformat: formatting eraseblock 112 -- 41 % complete 
ubiformat: formatting eraseblock 113 -- 41 % complete 
ubiformat: formatting eraseblock 114 -- 42 % complete 
ubiformat: formatting eraseblock 115 -- 42 % complete 
ubiformat: formatting eraseblock 116 -- 43 % complete 
ubiformat: formatting eraseblock 117 -- 43 % complete 
ubiformat: formatting eraseblock 118 -- 43 % complete 
ubiformat: formatting eraseblock 119 -- 44 % complete 
ubiformat: formatting eraseblock 120 -- 44 % complete 
ubiformat: formatting eraseblock 121 -- 44 % complete 
ubiformat: formatting eraseblock 122 -- 45 % complete 
ubiformat: formatting eraseblock 123 -- 45 % complete 
ubiformat: formatting eraseblock 124 -- 45 % complete 
ubiformat: formatting eraseblock 125 -- 46 % complete 
ubiformat: formatting eraseblock 126 -- 46 % complete 
ubiformat: formatting eraseblock 127 -- 47 % complete 
ubiformat: formatting eraseblock 128 -- 47 % complete 
ubiformat: formatting eraseblock 129 -- 47 % complete 
ubiformat: formatting eraseblock 130 -- 48 % complete 
ubiformat: formatting eraseblock 131 -- 48 % complete 
ubiformat: formatting eraseblock 132 -- 48 % complete 
ubiformat: formatting eraseblock 133 -- 49 % complete 
ubiformat: formatting eraseblock 134 -- 49 % complete 
ubiformat: formatting eraseblock 135 -- 50 % complete 
ubiformat: formatting eraseblock 136 -- 50 % complete 
ubiformat: formatting eraseblock 137 -- 50 % complete 
ubiformat: formatting eraseblock 138 -- 51 % complete 
ubiformat: formatting eraseblock 139 -- 51 % complete 
ubiformat: formatting eraseblock 140 -- 51 % complete 
ubiformat: formatting eraseblock 141 -- 52 % complete 
ubiformat: formatting eraseblock 142 -- 52 % complete 
ubiformat: formatting eraseblock 143 -- 52 % complete 
ubiformat: formatting eraseblock 144 -- 53 % complete 
ubiformat: formatting eraseblock 145 -- 53 % complete 
ubiformat: formatting eraseblock 146 -- 54 % complete 
ubiformat: formatting eraseblock 147 -- 54 % complete 
ubiformat: formatting eraseblock 148 -- 54 % complete 
ubiformat: formatting eraseblock 149 -- 55 % complete 
ubiformat: formatting eraseblock 150 -- 55 % complete 
ubiformat: formatting eraseblock 151 -- 55 % complete 
ubiformat: formatting eraseblock 152 -- 56 % complete 
ubiformat: formatting eraseblock 153 -- 56 % complete 
ubiformat: formatting eraseblock 154 -- 56 % complete 
ubiformat: formatting eraseblock 155 -- 57 % complete 
ubiformat: formatting eraseblock 156 -- 57 % complete 
ubiformat: formatting eraseblock 157 -- 58 % complete 
ubiformat: formatting eraseblock 158 -- 58 % complete 
ubiformat: formatting eraseblock 159 -- 58 % complete 
ubiformat: formatting eraseblock 160 -- 59 % complete 
ubiformat: formatting eraseblock 161 -- 59 % complete 
ubiformat: formatting eraseblock 162 -- 59 % complete 
ubiformat: formatting eraseblock 163 -- 60 % complete 
ubiformat: formatting eraseblock 164 -- 60 % complete 
ubiformat: formatting eraseblock 165 -- 61 % complete 
ubiformat: formatting eraseblock 166 -- 61 % complete 
ubiformat: formatting eraseblock 167 -- 61 % complete 
ubiformat: formatting eraseblock 168 -- 62 % complete 
ubiformat: formatting eraseblock 169 -- 62 % complete 
ubiformat: formatting eraseblock 170 -- 62 % complete 
ubiformat: formatting eraseblock 171 -- 63 % complete 
ubiformat: formatting eraseblock 172 -- 63 % complete 
ubiformat: formatting eraseblock 173 -- 63 % complete 
ubiformat: formatting eraseblock 174 -- 64 % complete 
ubiformat: formatting eraseblock 175 -- 64 % complete 
ubiformat: formatting eraseblock 176 -- 65 % complete 
ubiformat: formatting eraseblock 177 -- 65 % complete 
ubiformat: formatting eraseblock 178 -- 65 % complete 
ubiformat: formatting eraseblock 179 -- 66 % complete 
ubiformat: formatting eraseblock 180 -- 66 % complete 
ubiformat: formatting eraseblock 181 -- 66 % complete 
ubiformat: formatting eraseblock 182 -- 67 % complete 
ubiformat: formatting eraseblock 183 -- 67 % complete 
ubiformat: formatting eraseblock 184 -- 68 % complete 
ubiformat: formatting eraseblock 185 -- 68 % complete 
ubiformat: formatting eraseblock 186 -- 68 % complete 
ubiformat: formatting eraseblock 187 -- 69 % complete 
ubiformat: formatting eraseblock 188 -- 69 % complete 
ubiformat: formatting eraseblock 189 -- 69 % complete 
ubiformat: formatting eraseblock 190 -- 70 % complete 
ubiformat: formatting eraseblock 191 -- 70 % complete 
ubiformat: formatting eraseblock 192 -- 70 % complete 
ubiformat: formatting eraseblock 193 -- 71 % complete 
ubiformat: formatting eraseblock 194 -- 71 % complete 
ubiformat: formatting eraseblock 195 -- 72 % complete 
ubiformat: formatting eraseblock 196 -- 72 % complete 
ubiformat: formatting eraseblock 197 -- 72 % complete 
ubiformat: formatting eraseblock 198 -- 73 % complete 
ubiformat: formatting eraseblock 199 -- 73 % complete 
ubiformat: formatting eraseblock 200 -- 73 % complete 
ubiformat: formatting eraseblock 201 -- 74 % complete 
ubiformat: formatting eraseblock 202 -- 74 % complete 
ubiformat: formatting eraseblock 203 -- 75 % complete 
ubiformat: formatting eraseblock 204 -- 75 % complete 
ubiformat: formatting eraseblock 205 -- 75 % complete 
ubiformat: formatting eraseblock 206 -- 76 % complete 
ubiformat: formatting eraseblock 207 -- 76 % complete 
ubiformat: formatting eraseblock 208 -- 76 % complete 
ubiformat: formatting eraseblock 209 -- 77 % complete 
ubiformat: formatting eraseblock 210 -- 77 % complete 
ubiformat: formatting eraseblock 211 -- 77 % complete 
ubiformat: formatting eraseblock 212 -- 78 % complete 
ubiformat: formatting eraseblock 213 -- 78 % complete 
ubiformat: formatting eraseblock 214 -- 79 % complete 
ubiformat: formatting eraseblock 215 -- 79 % complete 
ubiformat: formatting eraseblock 216 -- 79 % complete 
ubiformat: formatting eraseblock 217 -- 80 % complete 
ubiformat: formatting eraseblock 218 -- 80 % complete 
ubi[   10.955342] UBI: attaching mtd10 to ubi1
format: formatting eraseblock 219 -- 80 % complete 
ubiformat: formatting eraseblock 220 -- 81 % complete 
ubiformat: formatting eraseblock 221 -- 81 % complete 
ubiformat: formatting eraseblock 222 -- 81 % complete 
ubiformat: formatting eraseblock 223 -- 82 % complete 
ubiformat: formatting eraseblock 224 -- 82 % complete 
ubiformat: formatting eraseblock 225 -- 83 % complete 
ubiformat: formatting eraseblock 226 -- 83 % complete 
ubiformat: formatting eraseblock 227 -- 83 % complete 
ubiformat: formatting eraseblock 228 -- 84 % complete 
ubiformat: formatting eraseblock 229 -- 84 % complete 
ubiformat: formatting eraseblock 230 -- 84 % complete 
ubiformat: formatting eraseblock 231 -- 85 % complete 
ubiformat: formatting eraseblock 232 -- 85 % complete 
ubiformat: formatting eraseblock 233 -- 86 % complete 
ubiformat: formatting eraseblock 234 -- 86 % complete 
ubiformat: formatting eraseblock 235 -- 86 % complete 
ubiformat: formatting eraseblock 236 -- 87 % complete 
ubiformat: formatting eraseblock 237 -- 87 % complete 
ubiformat: formatting eraseblock 238 -- 87 % complete 
ubi[   11.055469] UBI: scanning is finished
format: formatting eraseblock 239 -- 88 % complete 
ubiformat: formatting eraseblock 240 -- 88 % complete 
ubi[   11.069829] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
format: formatti[   11.076557] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ng eraseblock 24[   11.084772] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
1 -- 88 % comple[   11.092773] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
te 
ubiformat: [   11.100995] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
formatting erase[   11.108265] UBI: user volume: 0, internal volumes: 1, max. volumes count: 128
block 242 -- 89 [   11.116769] UBI: max/mean erase counter: 30/22, WL threshold: 4096, image sequence number: 1896280300
% complete 
ubi[   11.127340] UBI: available PEBs: 258, total reserved PEBs: 14, PEBs reserved for bad PEB handling: 10
format: formatti[   11.137924] UBI: background thread "ubi_bgt1d" started, PID 288
ng eraseblock 243 -- 89 % complete 
ubiformat: formatting eraseblock 244 -- 90 % complete 
ubiformat: formatting eraseblock 245 -- 90 % complete 
ubiformat: formatting eraseblock 246 -- 90 % complete 
ubiformat: formatting eraseblock 247 -- 91 % complete 
ubiformat: formatting eraseblock 248 -- 91 % complete 
ubiformat: formatting eraseblock 249 -- 91 % complete 
ubiformat: formatting eraseblock 250 -- 92 % complete 
ubiformat: formatting eraseblock 251 -- 92 % complete 
ubiformat: formatting eraseblock 252 -- 93 % complete 
ubiformat: formatting eraseblock 253 -- 93 % complete 
ubiformat: formatting eraseblock 254 -- 93 % complete 
ubiformat: f[   11.202608] UBIFS: default file-system created
ormatting eraseb[   11.207763] UBIFS: background thread "ubifs_bgt1_0" started, PID 296
lock 255 -- 94 % complete 
ubiformat: formatting eraseblock 256 -- 94 % complete 
ubiformat: formatting eraseblock 257 -- 94 % complete 
ubiformat: formatting eraseblock 258 -- 95 % complete 
ubiformat: formatting eraseblock 259 -- 95 % complete 
ubiformat: formatting eraseblock 260 -- 95 % complete 
ubiformat: formatting eraseblock 261 -- 96 % complete 
ubiformat: formatting eraseblock 262 -- 96 % complet[   11.250506] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
e 
ubiformat: f[   11.257085] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
ormatting eraseb[   11.267598] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
lock 263 -- 97 %[   11.278581] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
 complete 
ubif[   11.285767] UBIFS: media format: w4/r0 (latest is w4/r0), UUID CFA2B516-EF85-47F4-89D9-C8BA22B13B1D, small LPT model
ormat: formatting eraseblock 264 -- 97 % complete 
ubiformat: formatting eraseblock 265 -- 97 % complete 
ubiformat: formatting eraseblock 266 -- 98 % complete 
ubiformat: formatting eraseblock 267 -- 98 % complete 
ubiformat: formatting eraseblock 268 -- 98 % complete 
ubiformat: formatting eraseblock 269 -- 99 % complete 
ubiformat: formatting eraseblock 270 -- 99 %[   11.328849] UBIFS: un-mount UBI device 1, volume 0
 complete 
ubif[   11.335003] UBIFS: background thread "ubifs_bgt1_0" stops
ormat: formatting eraseblock 271 -- 100 % complete 
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available [   11.351482] UBI: detaching mtd10 from ubi1
258 LEBs (32759808 bytes, 31.2 MiB), LEB size 12[   11.359739] UBI: mtd10 is detached from ubi1
6976 bytes (124.0 KiB)
waiting for /dev/ubi1.
Set volume size to 32759808
Volume ID 0, size 258 LEBs (32759808 bytes, 31.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "app_pri", alignment 1
waiting for /dev/ubi1_0.
cp: can't stat '/dav/*': No such file or directory
done[   11.424438] UBI: attaching mtd12 to ubi3
[   11.445454] UBI: scanning is finished
[   11.459573] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[   11.465912] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   11.475433] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   11.482193] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[   11.489063] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[   11.494872] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[   11.501994] UBI: max/mean erase counter: 27/16, WL threshold: 4096, image sequence number: 1946849026
[   11.511194] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[   11.520241] UBI: background thread "ubi_bgt3d" started, PID 311
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[   11.541707] UBIFS: background thread "ubifs_bgt3_0" started, PID 316
[   11.569839] UBIFS: recovery needed
[   11.589137] UBIFS: recovery completed
[   11.593000] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[   11.599154] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.608262] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[   11.617556] UBIFS: reserved for root: 143937 bytes (140 KiB)
[   11.623210] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 6A250B7F-8753-42B6-BD31-C58EEAE0D66D, small LPT model
Check dir /davinci ok! (0)
[   11.649104] UBI: attaching mtd13 to ubi4
[   11.669795] UBI: scanning is finished
[   11.683980] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[   11.693095] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   11.699940] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   11.706618] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[   11.713486] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[   11.719306] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[   11.726416] UBI: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 1238795552
[   11.735529] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[   11.744571] UBI: background thread "ubi_bgt4d" started, PID 321
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[   11.766073] UBIFS: background thread "ubifs_bgt4_0" started, PID 326
[   11.794536] UBIFS: recovery needed
[   11.813897] UBIFS: recovery completed
[   11.817758] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[   11.823911] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.833038] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[   11.842329] UBIFS: reserved for root: 143937 bytes (140 KiB)
[   11.847971] UBIFS: media format: w4/r0 (latest is w4/r0), UUID FBAE680E-8B83-4FFE-8E44-D838C65303E5, small LPT model
Check dir /config ok! (0)

starting pid 349, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

After I reboot, and without hitting CTRL U. I now get

Code:

U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] Ambarella:    FBMEM = 0x06800000[          ],0x00000000
[    0.000000] On node 0 totalpages: 28160
[    0.000000] free_area_init_node: node 0, pgdat 807d68f8, node_mem_map 80807000
[    0.000000]   Normal zone: 220 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 28160 pages, LIFO batch:7
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=9
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.271938] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.332604] pid_max: default: 32768 minimum: 301
[    1.794478] Card authentication succeeded
[    1.798544] Mount-cache hash table entries: 512
[    1.805571] CPU: Testing write buffer coherency: ok
[    1.810745] Setting up static identity map for 0x803cbd50 - 0x803cbdb8
[    1.820727] devtmpfs: initialized
[    1.825200] pinctrl core: initialized pinctrl subsystem
[    1.830744] NET: Registered protocol family 16
[    1.835907] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.843296] L310 cache controller enabled
[    1.847297] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    1.856729] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.864747] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.872530] read dev-tree[misc_ctrl_pin] pro [rst_time] error!
[    1.878342] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!
[    1.886719] bio: create slab <bio-0> at 0
[    1.891828] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.899407] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.906494] Advanced Linux Sound Architecture Driver Initialized.
[    1.913262] Switching to clocksource ambarella-cs-timer
[    1.925036] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.933324] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.942198] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    2.018563] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[    2.024575] NET: Registered protocol family 2
[    2.032931] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.040040] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    2.046416] TCP: Hash tables configured (established 1024 bind 1024)
[    2.052851] TCP: reno registered
[    2.056107] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.061979] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.068437] NET: Registered protocol family 1
[    2.073180] RPC: Registered named UNIX socket transport module.
[    2.079164] RPC: Registered udp transport module.
[    2.083848] RPC: Registered tcp transport module.
[    2.088551] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.302865] msgmni has been set to 201
[    2.308044] NET: Registered protocol family 38
[    2.312659] io scheduler noop registered
[    2.316567] io scheduler deadline registered
[    2.321901] io scheduler cfq registered (default)
[    2.327421] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    2.335207] brd: module loaded
[    2.340945] loop: module loaded
[    2.346764] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    2.352458] ambarella_nand: Use On Flash BBT
[    2.356777] NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.369040] Bad block table found at page 65472, version 0x01
[    2.374941] Bad block table found at page 65408, version 0x01
[    2.380883] nand_read_bbt: bad block at 0x000006000000
[    2.386081] 16 ofpart partitions found on MTD device amba_nand
[    2.391956] Creating 16 MTD partitions on "amba_nand":
[    2.397086] 0x000000000000-0x000000020000 : "bst"
[    2.402583] 0x000000020000-0x000000120000 : "bld"
[    2.407924] 0x000000120000-0x000000200000 : "ptb"
[    2.413378] 0x000000200000-0x000000280000 : "env"
[    2.421870] 0x000000280000-0x000000380000 : "sysflg"
[    2.427556] 0x000000380000-0x000000400000 : "param"
[    2.433220] 0x000000400000-0x000000500000 : "dpt"
[    2.438709] 0x000000500000-0x000000f00000 : "rcvy"
[    2.444250] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.450104] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.455880] 0x000001f00000-0x000004100000 : "app_pri"
[    2.461705] 0x000004100000-0x000006300000 : "app_sec"
[    2.467410] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.474169] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.479913] 0x000006f00000-0x000007700000 : "dbg"
[    2.485256] 0x000007700000-0x000007f00000 : "syslog"
[    2.491417] ambarella-spi e0020000.spi: SPI[0] uses DMA
[    2.496784] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.503991] tun: Universal TUN/TAP device driver, 1.6
[    2.509054] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.568500] libphy: Ambarella MII Bus: probed
[    2.572853] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.581985] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.589476] mdio_bus e000e000.etherne: registered phy phy at address 0
[    2.595997] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[    2.603304] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    2.610448] PPP generic driver version 2.4.2
[    2.614891] PPP BSD Compression module registered
[    2.619611] PPP Deflate Compression module registered
[    2.624818] mousedev: PS/2 mouse device common for all mice
[    5.628510] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.635371] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    5.643058] pcf85163 is not exist.
[    5.646441] i2c /dev entries driver
[    5.650452] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    5.657775] Netfilter messages via NETLINK v0.30.
[    5.662598] nf_conntrack version 0.5.0 (1614 buckets, 6456 max)
[    5.668885] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.674222] TCP: cubic registered
[    5.677549] NET: Registered protocol family 10
[    5.682924] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.688350] sit: IPv6 over IPv4 tunneling driver
[    5.693610] NET: Registered protocol family 17
[    5.698104] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    5.705784] ThumbEE CPU extension supported.
[    5.711202] ambarella-rtc e8015000.rtc: setting system clock to 1970-02-25 01:15:29 UTC (4756529)
[    5.720173] ALSA device list:
[    5.723124]   No soundcards found.
[    5.729228] Freeing unused kernel memory: 2628K (80503000 - 80794000)

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    6.323987] UBI: attaching mtd10 to ubi1
[    6.418743] UBI: scanning is finished
[    6.433207] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    6.442431] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.449284] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.455961] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.462834] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    6.468744] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.475854] UBI: max/mean erase counter: 31/22, WL threshold: 4096, image sequence number: 1896280300
[    6.485056] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    6.494186] UBI: background thread "ubi_bgt1d" started, PID 271
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
[    6.515739] UBIFS: background thread "ubifs_bgt1_0" started, PID 276
[    6.543385] UBIFS: recovery needed
[    6.562083] UBIFS: recovery completed
[    6.565904] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    6.572074] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.581206] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.590843] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.596658] UBIFS: media format: w4/r0 (latest is w4/r0), UUID CFA2B516-EF85-47F4-89D9-C8BA22B13B1D, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[    6.619947] UBI: attaching mtd12 to ubi3
[    6.640051] UBI: scanning is finished
[    6.653983] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    6.663089] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.669941] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.676618] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.683490] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.689312] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.696421] UBI: max/mean erase counter: 27/16, WL threshold: 4096, image sequence number: 1946849026
[    6.705623] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.714671] UBI: background thread "ubi_bgt3d" started, PID 280
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[    6.736152] UBIFS: background thread "ubifs_bgt3_0" started, PID 285
[    6.763707] UBIFS: recovery needed
[    6.782413] UBIFS: recovery completed
[    6.786270] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    6.792433] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.801564] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.810853] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.816494] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 6A250B7F-8753-42B6-BD31-C58EEAE0D66D, small LPT model
Check dir /davinci ok! (0)
[    6.842378] UBI: attaching mtd13 to ubi4
[    6.862485] UBI: scanning is finished
[    6.876425] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    6.885543] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.892396] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.899088] probe_rst_pin exceed
[    6.902301] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.909165] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.914973] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.922094] UBI: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 1238795552
[    6.931206] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.940247] UBI: background thread "ubi_bgt4d" started, PID 290
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[    6.961771] UBIFS: background thread "ubifs_bgt4_0" started, PID 295
[    6.989943] UBIFS: recovery needed
[    7.009275] UBIFS: recovery completed
[    7.013137] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    7.019286] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.028394] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    7.037687] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    7.043342] UBIFS: media format: w4/r0 (latest is w4/r0), UUID FBAE680E-8B83-4FFE-8E44-D838C65303E5, small LPT model
Check dir /config ok! (0)

starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

Now, I'm sitting in the BusyBox shell but where do I go from here??
Thanks,
Nick
Sorry for the very very long posting!

alastairstevenson · Aug 7, 2018

Nick Robinson said:
I noticed putty didn't create a log file for me to use!

Logfiles are a bit cumbersome to use in PuTTY - easier, and generally OK even for lengthy transcripts, is to use the 'copy screen rollback to clipboard' in the menu from the top left button.

Nick Robinson said:
Now, I'm sitting in the BusyBox shell but where do I go from here??

Yes, that is the psh 'protected shell' that inhibits the more useful commands.
The trick will be to figure out which bootargs parameters will inhibit psh and just give a normal ash shell.
So some experimenting with that is worth doing.

On changing bootargs - have you realised that it's much quicker, and more accurate, to have the candidate commands set out in a text editor, such as Notepad, then you can simply copy/paste them in, and also keep a record of what they were before they were changed.

So it looks like dbg=9 inhibits the app startup, but still leaves psh active.
Paste the environment variables here, from the printenv command, let's see what exists currently.

Did you try the modified values :
setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri
I've usually found that the addition 'single' inhibits psh.

If/when you get to a full shell prompt, we can look at completing the initialisation, mounting the NFS share, and applying the mImage_r6 which should then allow the use of the 'update' command at the bootloader.

Nick Robinson · Aug 17, 2018

[Hey
Here is the variables from 'printenv' command.

Code:

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=0

I am still not able to change any 'bootargs', I always get the "Type 'help setenv' for help" response.

CODE]HKVS # setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help[/CODE]

I have spent some time trying out the different debug level (0-9) and allowed the camera to boot.

Level 1

Code:

HKVS # help setenv

Help for 'setenv':

setenv [param] [val]

ipaddr        - network ip address

serverip    - tftp server ip address

netmask    - network ip mask

gatewayip    - gateway ip address

ethaddr    - ethernet mac address

bootdelay    - boot delay time

dbg            - debug level

HKVS # setenv dbg 1

HKVS # saveenv

Writing env to Nand... done




U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    1.517297] Card authentication succeeded

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 323, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#   [4l

Level 2

Code:

HKVS # setenv dbg 2

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=2

HKVS # setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help

HKVS # setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    1.517279] Card authentication succeeded

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 323, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 3

Code:

HKVS # setenv dbg 3

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=3

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    1.517193] Card authentication succeeded

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 325, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 4

Code:

HKVS # setenv dbg 4

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=4

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    1.517186] Card authentication succeeded
[    1.919908] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    4.929898] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    4.936890] pcf85163 is not exist.

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 323, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 5

Code:

HKVS # setenv dbg 5

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=5

HKVS # setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    1.547168] Card authentication succeeded
[    1.949888] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    4.959870] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    4.966859] pcf85163 is not exist.

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 319, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

#   [4l

Level 6

Code:

HKVS # setenv dbg 6

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=6

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=6
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    1.627175] Card authentication succeeded
[    1.656531] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.664831] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.673706] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    1.968078] 16 ofpart partitions found on MTD device amba_nand
[    1.973992] Creating 16 MTD partitions on "amba_nand":
[    1.979153] 0x000000000000-0x000000020000 : "bst"
[    1.987726] 0x000000020000-0x000000120000 : "bld"
[    1.993213] 0x000000120000-0x000000200000 : "ptb"
[    1.998594] 0x000000200000-0x000000280000 : "env"
[    2.004107] 0x000000280000-0x000000380000 : "sysflg"
[    2.009779] 0x000000380000-0x000000400000 : "param"
[    2.015446] 0x000000400000-0x000000500000 : "dpt"
[    2.020863] 0x000000500000-0x000000f00000 : "rcvy"
[    2.026317] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.033121] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.038882] 0x000001f00000-0x000004100000 : "app_pri"
[    2.044711] 0x000004100000-0x000006300000 : "app_sec"
[    2.050527] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.056196] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.061935] 0x000006f00000-0x000007700000 : "dbg"
[    2.067283] 0x000007700000-0x000007f00000 : "syslog"
[    2.129935] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.142122] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    5.139918] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.146901] pcf85163 is not exist.
[    5.150854] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    5.753876] UBI: attaching mtd10 to ubi1
[    5.848560] UBI: scanning is finished
[    5.863024] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    5.869451] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    5.879002] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    5.885769] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    5.892646] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    5.898541] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    5.905667] UBI: max/mean erase counter: 37/25, WL threshold: 4096, image sequence number: 740774058
[    5.914782] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    5.923912] UBI: background thread "ubi_bgt1d" started, PID 272
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
[    5.945503] UBIFS: background thread "ubifs_bgt1_0" started, PID 277
[    5.973035] UBIFS: recovery needed
[    5.991770] UBIFS: recovery completed
[    5.995589] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    6.001748] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.010876] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.020514] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.026330] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 465AF92E-EB06-4A18-98D4-518FDE50B4F1, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[    6.049440] UBI: attaching mtd12 to ubi3
[    6.069630] UBI: scanning is finished
[    6.083591] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    6.092698] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.099471] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.106226] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.113101] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.118909] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.126034] UBI: max/mean erase counter: 29/18, WL threshold: 4096, image sequence number: 645503135
[    6.135149] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.144193] UBI: background thread "ubi_bgt3d" started, PID 281
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[    6.165631] UBIFS: background thread "ubifs_bgt3_0" started, PID 286
[    6.192937] UBIFS: recovery needed
[    6.217667] UBIFS: recovery completed
[    6.221561] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    6.227677] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.236813] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.246104] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.251759] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 0EF98B62-958F-416F-BCAB-60ED0F42692A, small LPT model
Check dir /davinci ok! (0)
[    6.277490] UBI: attaching mtd13 to ubi4
[    6.297688] UBI: scanning is finished
[    6.311709] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    6.318048] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.327591] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.334356] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.341229] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.347038] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.354163] UBI: max/mean erase counter: 17/11, WL threshold: 4096, image sequence number: 1914568613
[    6.363365] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.372409] UBI: background thread "ubi_bgt4d" started, PID 291
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[    6.393977] UBIFS: background thread "ubifs_bgt4_0" started, PID 296
[    6.421542] UBIFS: recovery needed
[    6.440282] UBIFS: recovery completed
[    6.444139] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    6.450298] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.459405] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.468704] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.474362] UBIFS: media format: w4/r0 (latest is w4/r0), UUID E6EF6707-D53C-4FF6-B85E-3A27C215E5B4, small LPT model
Check dir /config ok! (0)

starting pid 319, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 7

Code:

HKVS # setenv dbg 7

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=7

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] Ambarella:    FBMEM = 0x06800000[          ],0x00000000
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=7
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.238491] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.302606] pid_max: default: 32768 minimum: 301
[    1.764588] Card authentication succeeded
[    1.768652] Mount-cache hash table entries: 512
[    1.775624] CPU: Testing write buffer coherency: ok
[    1.780792] Setting up static identity map for 0x803cbd50 - 0x803cbdb8
[    1.790754] devtmpfs: initialized
[    1.795208] pinctrl core: initialized pinctrl subsystem
[    1.800748] NET: Registered protocol family 16
[    1.805908] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.813297] L310 cache controller enabled
[    1.817298] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    1.826722] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.834734] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.844986] bio: create slab <bio-0> at 0
[    1.850114] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.857703] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.864780] Advanced Linux Sound Architecture Driver Initialized.
[    1.871548] Switching to clocksource ambarella-cs-timer
[    1.883279] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.891569] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.900442] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    1.976851] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[    1.982867] NET: Registered protocol family 2
[    1.991216] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    1.998321] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    2.004696] TCP: Hash tables configured (established 1024 bind 1024)
[    2.011134] TCP: reno registered
[    2.014389] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.020260] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.026724] NET: Registered protocol family 1
[    2.031461] RPC: Registered named UNIX socket transport module.
[    2.037440] RPC: Registered udp transport module.
[    2.042124] RPC: Registered tcp transport module.
[    2.046828] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.260910] msgmni has been set to 201
[    2.266091] NET: Registered protocol family 38
[    2.270704] io scheduler noop registered
[    2.274611] io scheduler deadline registered
[    2.279945] io scheduler cfq registered (default)
[    2.285472] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    2.293265] brd: module loaded
[    2.299017] loop: module loaded
[    2.304837] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    2.310530] ambarella_nand: Use On Flash BBT
[    2.314851] NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.327110] Bad block table found at page 65472, version 0x01
[    2.333011] Bad block table found at page 65408, version 0x01
[    2.338951] nand_read_bbt: bad block at 0x000006000000
[    2.344148] 16 ofpart partitions found on MTD device amba_nand
[    2.350021] Creating 16 MTD partitions on "amba_nand":
[    2.355150] 0x000000000000-0x000000020000 : "bst"
[    2.360643] 0x000000020000-0x000000120000 : "bld"
[    2.365984] 0x000000120000-0x000000200000 : "ptb"
[    2.371438] 0x000000200000-0x000000280000 : "env"
[    2.379925] 0x000000280000-0x000000380000 : "sysflg"
[    2.385605] 0x000000380000-0x000000400000 : "param"
[    2.391278] 0x000000400000-0x000000500000 : "dpt"
[    2.396727] 0x000000500000-0x000000f00000 : "rcvy"
[    2.402320] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.408170] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.413942] 0x000001f00000-0x000004100000 : "app_pri"
[    2.419779] 0x000004100000-0x000006300000 : "app_sec"
[    2.425488] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.432248] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.437987] 0x000006f00000-0x000007700000 : "dbg"
[    2.443331] 0x000007700000-0x000007f00000 : "syslog"
[    2.449503] ambarella-spi e0020000.spi: SPI[0] uses DMA
[    2.454870] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.462081] tun: Universal TUN/TAP device driver, 1.6
[    2.467142] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.526786] libphy: Ambarella MII Bus: probed
[    2.531139] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.540273] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.547777] mdio_bus e000e000.etherne: registered phy phy at address 0
[    2.554298] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[    2.561604] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    2.568752] PPP generic driver version 2.4.2
[    2.573199] PPP BSD Compression module registered
[    2.577920] PPP Deflate Compression module registered
[    2.583126] mousedev: PS/2 mouse device common for all mice
[    5.586797] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.593657] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    5.601340] pcf85163 is not exist.
[    5.604723] i2c /dev entries driver
[    5.608730] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    5.616053] Netfilter messages via NETLINK v0.30.
[    5.620872] nf_conntrack version 0.5.0 (1614 buckets, 6456 max)
[    5.627159] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.632497] TCP: cubic registered
[    5.635825] NET: Registered protocol family 10
[    5.641199] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.646626] sit: IPv6 over IPv4 tunneling driver
[    5.651884] NET: Registered protocol family 17
[    5.656380] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    5.664057] ThumbEE CPU extension supported.
[    5.669480] ambarella-rtc e8015000.rtc: setting system clock to 1970-03-08 06:59:29 UTC (5727569)
[    5.678448] ALSA device list:
[    5.681400]   No soundcards found.
[    5.687505] Freeing unused kernel memory: 2628K (80503000 - 80794000)

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    6.283171] UBI: attaching mtd10 to ubi1
[    6.378161] UBI: scanning is finished
[    6.392618] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    6.401844] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.408695] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.415373] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.422245] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    6.428156] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.435266] UBI: max/mean erase counter: 37/25, WL threshold: 4096, image sequence number: 740774058
[    6.444381] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    6.453513] UBI: background thread "ubi_bgt1d" started, PID 271
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
[    6.475055] UBIFS: background thread "ubifs_bgt1_0" started, PID 276
[    6.502615] UBIFS: recovery needed
[    6.521318] UBIFS: recovery completed
[    6.525136] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    6.531304] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.540434] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.550073] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.555888] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 465AF92E-EB06-4A18-98D4-518FDE50B4F1, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[    6.579115] UBI: attaching mtd12 to ubi3
[    6.599254] UBI: scanning is finished
[    6.613163] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    6.622287] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.629136] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.635814] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.642690] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.648513] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.655623] UBI: max/mean erase counter: 29/18, WL threshold: 4096, image sequence number: 645503135
[    6.664738] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.673783] UBI: background thread "ubi_bgt3d" started, PID 280
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[    6.695296] UBIFS: background thread "ubifs_bgt3_0" started, PID 285
[    6.723019] UBIFS: recovery needed
[    6.741741] UBIFS: recovery completed
[    6.745600] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    6.751760] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.760890] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.770181] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.775823] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 0EF98B62-958F-416F-BCAB-60ED0F42692A, small LPT model
Check dir /davinci ok! (0)
[    6.801692] UBI: attaching mtd13 to ubi4
[    6.821832] UBI: scanning is finished
[    6.835721] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    6.844841] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.851693] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.858398] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.865246] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.871068] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.878187] UBI: max/mean erase counter: 17/11, WL threshold: 4096, image sequence number: 1914568613
[    6.887386] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.896418] UBI: background thread "ubi_bgt4d" started, PID 290
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[    6.918002] UBIFS: background thread "ubifs_bgt4_0" started, PID 295
[    6.945910] UBIFS: recovery needed
[    6.965267] UBIFS: recovery completed
[    6.969164] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    6.975279] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.984413] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.993702] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.999354] UBIFS: media format: w4/r0 (latest is w4/r0), UUID E6EF6707-D53C-4FF6-B85E-3A27C215E5B4, small LPT model
Check dir /config ok! (0)

starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 8

Code:

HKVS # setenv dbg 8

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=8

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] Ambarella:    FBMEM = 0x06800000[          ],0x00000000
[    0.000000] On node 0 totalpages: 28160
[    0.000000] free_area_init_node: node 0, pgdat 807d68f8, node_mem_map 80807000
[    0.000000]   Normal zone: 220 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 28160 pages, LIFO batch:7
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=8
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.271940] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.332606] pid_max: default: 32768 minimum: 301
[    1.794562] Card authentication succeeded
[    1.798626] Mount-cache hash table entries: 512
[    1.805623] CPU: Testing write buffer coherency: ok
[    1.810796] Setting up static identity map for 0x803cbd50 - 0x803cbdb8
[    1.820764] devtmpfs: initialized
[    1.825230] pinctrl core: initialized pinctrl subsystem
[    1.830771] NET: Registered protocol family 16
[    1.835932] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.843309] L310 cache controller enabled
[    1.847310] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    1.856721] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.864736] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.872515] read dev-tree[misc_ctrl_pin] pro [rst_time] error!
[    1.878328] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!
[    1.886707] bio: create slab <bio-0> at 0
[    1.891824] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.899405] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.906487] Advanced Linux Sound Architecture Driver Initialized.
[    1.913259] Switching to clocksource ambarella-cs-timer
[    1.925010] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.933299] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.942173] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    2.018559] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[    2.024572] NET: Registered protocol family 2
[    2.032921] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.040027] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    2.046402] TCP: Hash tables configured (established 1024 bind 1024)
[    2.052839] TCP: reno registered
[    2.056093] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.061966] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.068427] NET: Registered protocol family 1
[    2.073162] RPC: Registered named UNIX socket transport module.
[    2.079144] RPC: Registered udp transport module.
[    2.083828] RPC: Registered tcp transport module.
[    2.088530] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.301797] msgmni has been set to 201
[    2.307024] NET: Registered protocol family 38
[    2.311662] io scheduler noop registered
[    2.315569] io scheduler deadline registered
[    2.319879] io scheduler cfq registered (default)
[    2.325405] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    2.334207] brd: module loaded
[    2.339944] loop: module loaded
[    2.345771] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    2.351492] ambarella_nand: Use On Flash BBT
[    2.355812] NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.368048] Bad block table found at page 65472, version 0x01
[    2.373994] Bad block table found at page 65408, version 0x01
[    2.379929] nand_read_bbt: bad block at 0x000006000000
[    2.385126] 16 ofpart partitions found on MTD device amba_nand
[    2.390998] Creating 16 MTD partitions on "amba_nand":
[    2.396127] 0x000000000000-0x000000020000 : "bst"
[    2.401627] 0x000000020000-0x000000120000 : "bld"
[    2.406979] 0x000000120000-0x000000200000 : "ptb"
[    2.412434] 0x000000200000-0x000000280000 : "env"
[    2.420922] 0x000000280000-0x000000380000 : "sysflg"
[    2.426607] 0x000000380000-0x000000400000 : "param"
[    2.432279] 0x000000400000-0x000000500000 : "dpt"
[    2.437732] 0x000000500000-0x000000f00000 : "rcvy"
[    2.443326] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.449188] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.454966] 0x000001f00000-0x000004100000 : "app_pri"
[    2.460794] 0x000004100000-0x000006300000 : "app_sec"
[    2.466500] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.473262] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.479009] 0x000006f00000-0x000007700000 : "dbg"
[    2.484363] 0x000007700000-0x000007f00000 : "syslog"
[    2.490527] ambarella-spi e0020000.spi: SPI[0] uses DMA
[    2.495893] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.503102] tun: Universal TUN/TAP device driver, 1.6
[    2.508133] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.568497] libphy: Ambarella MII Bus: probed
[    2.572851] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.581985] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.589486] mdio_bus e000e000.etherne: registered phy phy at address 0
[    2.596007] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[    2.603315] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    2.610459] PPP generic driver version 2.4.2
[    2.614906] PPP BSD Compression module registered
[    2.619626] PPP Deflate Compression module registered
[    2.624833] mousedev: PS/2 mouse device common for all mice
[    5.628509] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.635372] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    5.643054] pcf85163 is not exist.
[    5.646437] i2c /dev entries driver
[    5.650449] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    5.657767] Netfilter messages via NETLINK v0.30.
[    5.662587] nf_conntrack version 0.5.0 (1614 buckets, 6456 max)
[    5.668876] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.674213] TCP: cubic registered
[    5.677542] NET: Registered protocol family 10
[    5.682904] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.688331] sit: IPv6 over IPv4 tunneling driver
[    5.693592] NET: Registered protocol family 17
[    5.698088] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    5.705764] ThumbEE CPU extension supported.
[    5.711200] ambarella-rtc e8015000.rtc: setting system clock to 1970-03-08 07:00:38 UTC (5727638)
[    5.720170] ALSA device list:
[    5.723122]   No soundcards found.
[    5.729224] Freeing unused kernel memory: 2628K (80503000 - 80794000)

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    6.324794] UBI: attaching mtd10 to ubi1
[    6.419535] UBI: scanning is finished
[    6.433998] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    6.443230] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.450084] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.456762] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.463635] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    6.469546] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.476656] UBI: max/mean erase counter: 37/25, WL threshold: 4096, image sequence number: 740774058
[    6.485770] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    6.494902] UBI: background thread "ubi_bgt1d" started, PID 271
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
[    6.516440] UBIFS: background thread "ubifs_bgt1_0" started, PID 276
[    6.544018] UBIFS: recovery needed
[    6.562737] UBIFS: recovery completed
[    6.566555] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    6.572720] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.581851] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.591489] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.597305] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 465AF92E-EB06-4A18-98D4-518FDE50B4F1, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[    6.620546] UBI: attaching mtd12 to ubi3
[    6.640599] UBI: scanning is finished
[    6.654500] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    6.663615] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.670470] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.677147] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.684019] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.689842] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.696952] UBI: max/mean erase counter: 29/18, WL threshold: 4096, image sequence number: 645503135
[    6.706066] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.715109] UBI: background thread "ubi_bgt3d" started, PID 280
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[    6.736585] UBIFS: background thread "ubifs_bgt3_0" started, PID 285
[    6.764201] UBIFS: recovery needed
[    6.782920] UBIFS: recovery completed
[    6.786775] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    6.792936] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.802066] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.811357] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.817000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 0EF98B62-958F-416F-BCAB-60ED0F42692A, small LPT model
Check dir /davinci ok! (0)
[    6.842915] UBI: attaching mtd13 to ubi4
[    6.863053] UBI: scanning is finished
[    6.876962] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    6.886085] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.892905] probe_rst_pin exceed
[    6.896148] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.902846] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.909707] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.915514] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.922635] UBI: max/mean erase counter: 17/11, WL threshold: 4096, image sequence number: 1914568613
[    6.931832] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.940872] UBI: background thread "ubi_bgt4d" started, PID 290
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[    6.962435] UBIFS: background thread "ubifs_bgt4_0" started, PID 295
[    6.990513] UBIFS: recovery needed
[    7.009836] UBIFS: recovery completed
[    7.013694] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    7.019848] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.028974] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    7.038250] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    7.043903] UBIFS: media format: w4/r0 (latest is w4/r0), UUID E6EF6707-D53C-4FF6-B85E-3A27C215E5B4, small LPT model
Check dir /config ok! (0)

starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 9

Code:

HKVS # setenv dbg 9

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=9

HKVS #   [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.73+ (yanglei24@Cpl-Frt-BSP) (gcc version 4.8.2 20130902 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2013.09) ) #2 PREEMPT Fri Dec 29 10:58:27 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[    0.000000] dev type:0x220b
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x07000000[          ],0x09000000
[    0.000000] Ambarella:    FBMEM = 0x06800000[          ],0x00000000
[    0.000000] On node 0 totalpages: 28160
[    0.000000] free_area_init_node: node 0, pgdat 807d68f8, node_mem_map 80807000
[    0.000000]   Normal zone: 220 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 28160 pages, LIFO batch:7
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 27940
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=9
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 110MB = 110MB total
[    0.000000] Memory: 103352k/103352k available, 9288k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x87000000 - 0xff000000   (1920 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x86e00000   ( 110 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80502748   (5098 kB)
[    0.000000]       .init : 0x80503000 - 0x80794574   (2630 kB)
[    0.000000]       .data : 0x80796000 - 0x807de690   ( 290 kB)
[    0.000000]        .bss : 0x807de690 - 0x808022b0   ( 144 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.271937] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.332605] pid_max: default: 32768 minimum: 301
[    1.794594] Card authentication succeeded
[    1.798659] Mount-cache hash table entries: 512
[    1.805635] CPU: Testing write buffer coherency: ok
[    1.810805] Setting up static identity map for 0x803cbd50 - 0x803cbdb8
[    1.820767] devtmpfs: initialized
[    1.825237] pinctrl core: initialized pinctrl subsystem
[    1.830778] NET: Registered protocol family 16
[    1.835941] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.843326] L310 cache controller enabled
[    1.847327] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[    1.856753] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.864770] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.872555] read dev-tree[misc_ctrl_pin] pro [rst_time] error!
[    1.878368] read dev-tree[misc_ctrl_pin] pro [rst_delay] error!
[    1.886755] bio: create slab <bio-0> at 0
[    1.891870] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.899452] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.906530] Advanced Linux Sound Architecture Driver Initialized.
[    1.913294] Switching to clocksource ambarella-cs-timer
[    1.925045] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[    1.933335] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.942209] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    2.018593] ambarella-sd e0002000.sdmmc0: 1 slots @ 50000000Hz
[    2.024605] NET: Registered protocol family 2
[    2.032957] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.040063] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    2.046439] TCP: Hash tables configured (established 1024 bind 1024)
[    2.052872] TCP: reno registered
[    2.056124] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.061996] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.068453] NET: Registered protocol family 1
[    2.073189] RPC: Registered named UNIX socket transport module.
[    2.079172] RPC: Registered udp transport module.
[    2.083856] RPC: Registered tcp transport module.
[    2.088560] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.301513] msgmni has been set to 201
[    2.306746] NET: Registered protocol family 38
[    2.311382] io scheduler noop registered
[    2.315289] io scheduler deadline registered
[    2.319600] io scheduler cfq registered (default)
[    2.325130] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[    2.333942] brd: module loaded
[    2.339688] loop: module loaded
[    2.345514] ambarella-nand e0001000.nand: in ecc-[1]bit mode
[    2.351234] ambarella_nand: Use On Flash BBT
[    2.355553] NAND device: Manufacturer ID: 0x98, Chip ID: 0xf1 (Toshiba NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.367793] Bad block table found at page 65472, version 0x01
[    2.373740] Bad block table found at page 65408, version 0x01
[    2.379676] nand_read_bbt: bad block at 0x000006000000
[    2.384874] 16 ofpart partitions found on MTD device amba_nand
[    2.390746] Creating 16 MTD partitions on "amba_nand":
[    2.395874] 0x000000000000-0x000000020000 : "bst"
[    2.401376] 0x000000020000-0x000000120000 : "bld"
[    2.406716] 0x000000120000-0x000000200000 : "ptb"
[    2.412162] 0x000000200000-0x000000280000 : "env"
[    2.420651] 0x000000280000-0x000000380000 : "sysflg"
[    2.426343] 0x000000380000-0x000000400000 : "param"
[    2.432009] 0x000000400000-0x000000500000 : "dpt"
[    2.437457] 0x000000500000-0x000000f00000 : "rcvy"
[    2.443062] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.448933] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.454704] 0x000001f00000-0x000004100000 : "app_pri"
[    2.460533] 0x000004100000-0x000006300000 : "app_sec"
[    2.466238] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.473000] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.478732] 0x000006f00000-0x000007700000 : "dbg"
[    2.484091] 0x000007700000-0x000007f00000 : "syslog"
[    2.490240] ambarella-spi e0020000.spi: SPI[0] uses DMA
[    2.495604] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.502812] tun: Universal TUN/TAP device driver, 1.6
[    2.507843] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.568531] libphy: Ambarella MII Bus: probed
[    2.572885] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.582019] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.589515] mdio_bus e000e000.etherne: registered phy phy at address 0
[    2.596035] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[    2.603339] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:6e:87:77].
[    2.610481] PPP generic driver version 2.4.2
[    2.614926] PPP BSD Compression module registered
[    2.619647] PPP Deflate Compression module registered
[    2.624856] mousedev: PS/2 mouse device common for all mice
[    5.628542] ambarella-i2c e8003000.i2c: No ACK from address 0xa2, 0:0!
[    5.635405] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    5.643090] pcf85163 is not exist.
[    5.646473] i2c /dev entries driver
[    5.650483] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    5.657804] Netfilter messages via NETLINK v0.30.
[    5.662626] nf_conntrack version 0.5.0 (1614 buckets, 6456 max)
[    5.668912] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.674251] TCP: cubic registered
[    5.677578] NET: Registered protocol family 10
[    5.682945] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.688372] sit: IPv6 over IPv4 tunneling driver
[    5.693633] NET: Registered protocol family 17
[    5.698128] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    5.705806] ThumbEE CPU extension supported.
[    5.711226] ambarella-rtc e8015000.rtc: setting system clock to 1970-03-08 07:01:30 UTC (5727690)
[    5.720195] ALSA device list:
[    5.723147]   No soundcards found.
[    5.729246] Freeing unused kernel memory: 2628K (80503000 - 80794000)

init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 46, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
[    6.324852] UBI: attaching mtd10 to ubi1
[    6.419538] UBI: scanning is finished
[    6.433995] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    6.443218] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.450070] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.456748] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.463620] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    6.469529] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.476639] UBI: max/mean erase counter: 37/25, WL threshold: 4096, image sequence number: 740774058
[    6.485754] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    6.494883] UBI: background thread "ubi_bgt1d" started, PID 271
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
[    6.516398] UBIFS: background thread "ubifs_bgt1_0" started, PID 276
[    6.544009] UBIFS: recovery needed
[    6.562750] UBIFS: recovery completed
[    6.566567] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    6.572733] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.581864] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    6.591502] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    6.597318] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 465AF92E-EB06-4A18-98D4-518FDE50B4F1, small LPT model
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
[    6.620584] UBI: attaching mtd12 to ubi3
[    6.640637] UBI: scanning is finished
[    6.654530] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    6.663642] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.670493] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.677171] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.684045] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.689868] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.696978] UBI: max/mean erase counter: 29/18, WL threshold: 4096, image sequence number: 645503135
[    6.706094] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.715139] UBI: background thread "ubi_bgt3d" started, PID 280
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
[    6.736643] UBIFS: background thread "ubifs_bgt3_0" started, PID 285
[    6.764276] UBIFS: recovery needed
[    6.783005] UBIFS: recovery completed
[    6.786867] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    6.793029] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    6.802160] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    6.811453] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    6.817094] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 0EF98B62-958F-416F-BCAB-60ED0F42692A, small LPT model
Check dir /davinci ok! (0)
[    6.842970] UBI: attaching mtd13 to ubi4
[    6.863129] UBI: scanning is finished
[    6.877052] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    6.886172] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.892991] probe_rst_pin exceed
[    6.896233] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.902931] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.909791] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    6.915598] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.922719] UBI: max/mean erase counter: 17/11, WL threshold: 4096, image sequence number: 1914568613
[    6.931919] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    6.940958] UBI: background thread "ubi_bgt4d" started, PID 290
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
[    6.962482] UBIFS: background thread "ubifs_bgt4_0" started, PID 295
[    6.990559] UBIFS: recovery needed
[    7.009901] UBIFS: recovery completed
[    7.013753] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    7.019904] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.029031] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    7.038307] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    7.043961] UBIFS: media format: w4/r0 (latest is w4/r0), UUID E6EF6707-D53C-4FF6-B85E-3A27C215E5B4, small LPT model
Check dir /config ok! (0)

starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#  [4l

Level 0

Code:

HKVS # setenv dbg 0

HKVS # saveenv

Writing env to Nand... done

HKVS # printenv

ipaddr=192.168.2.109

serverip=192.168.2.18

gatewayip=0.0.0.0

netmask=255.255.255.0

ethaddr=94:e1:ac:6e:87:77

loadaddr=0x00208000

bootfile=hImage

bootcmd=null

bootargs=console=ttyS0

bootdelay=4

dbg=0

HKVS #  [4l


U-Boot 3.1.6-269644 (Jul  6 2017-10:47:55)
boards:296717
Boot From: NAND 2048 RC

SYS_CONFIG: 0x3006005B POC: 101

Cortex freq: 600000000

ENET freq: 50000000

iDSP freq: 216000000

Dram freq: 564000000

Core freq: 216000000

AHB freq: 108000000

APB freq: 54000000

UART freq: 24000000

SD freq: 50000000

SDIO freq: 50000000

SDXC freq: 60000000

dev_model:DS-2CD2142FWD-IS
Hit Ctrl+u to stop autoboot: 4
Hit Ctrl+u to stop autoboot: 3
Hit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0

|BIND err|

cmd 'null' is not supported.

nand booting ...

booting from pri part...
load kernel...


init started: BusyBox v1.19.3 (2017-12-28 10:16:53 CST)

starting pid 47, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
waiting for /dev/ubi4_0.
Check dir /config ok! (0)

starting pid 325, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# help
Support Commands:
taskShow                    printPart                   prtHardInfo            
getPreviewStatus            setIp                       setV6ip                
setGateway                  dspStatus                   outputClose            
outputOpen                  getDebug                    setDebug              
debugLog                    getIrstate                  getMtu                
camCmd                      getCamVer                   getLux                
getMcuInfo                  getMotion                   getRawdata            
setIrcmd                    setRectFrame                updateCamera          
setLaserMode                getLaserMode                setIrMode              
getIrMode                   setBaiguangMode             getBaiguangMode        
setYTLock                   InquireFanSwitch            StartLaser            
CloseLaser                  LaserMotReset               EnlargeCur            
ReduceCur                   SetCur                      LaserMotDirect        
LaserTeleOffset             LaserWideOffset             InqSwitch              
InqCurrent                  InqCurMotDirect             getMcuStateInfo        
setFastFocus                getTrackStatus              getSelfcheckResult    
setLdcMode                  getLdcMode                  appCmd                
ezoomlens_start_t2_test     prtLensCurve                getLensCurve          
getIp                       gdbcfg                      {Test1}                
{Test2}                     {Test3}                     {Test4}                
{TestN}                     {TestY}                     getisp                
setisp                      regread                     regwrite              
setAgingMode                getAgingMode                setAgingTime          
getAgingTime                setLensZoomPos              getLensZoomPos        
showKey                     showServer                  showUpnp              
showStatus                  showDefence                 setLBS                
setAlarm                    cloudService                t1                    
ifconfig                    netstat                     ping                  
ping6                       top                         iostat                
mpstat                      ps                          reset                  
dmesg                       wl                          iwpriv                
iperf                       setWifiEnable               getWifiInfo            
exit                        getDateInfo                 diagnose              
diag                        help                        zhimakaimen            

#

So, it looks like no matter what debug level is set, the final bootup command "starting pid 325, tty '': '-/bin/psh'" is still present. I'm assuming that it the command to enter into psh? Can I edit that last command line out?
Thanks,
Nick

alastairstevenson · Aug 17, 2018

Nick Robinson said:
I am still not able to change any 'bootargs', I always get the "Type 'help setenv' for help" response.

CODE]HKVS # setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri

Type 'help setenv' for help[/CODE]

It seems on that version of the bootloader, Hikvision have crippled the ability to alter the bootargs.
Possibly in response to certain public posts that have shown that it was a pretty useful way to bypass psh and actually do some useful fixup work at a shell prompt.

And from what you've seen in the extensive dbg=n testing, none of the values gets past psh.

Well, that's a bit of a bummer, as these have worked OK before.

alastairstevenson · Aug 20, 2018

Nick Robinson said:
I am still not able to change any 'bootargs', I always get the "Type 'help setenv' for help" response.

OK, so in this version of u-boot, Hikvision have blocked the ability to set a value for bootargs (the command-line arguments that are passed to the Linux kernel to modify run-time behaviour) and have almost hard-coded the value.
Presumably because there were some useful (to techy users) values that got round the run-time access blocks.
But they still allow the use of dbg to change the kernel logging level at least.
There is probably a special value for dbg that does more than that.

It might be interesting to see how far they have locked down the values that can be assigned to dbg which then appear in bootargs.
setenv dbg 9 single debug=9
saveenv

Nick Robinson · Aug 25, 2018

Hey
I have tried to see if your suggestion would change the values in bootargs, but with no avail.

Code:

KVS # setenv dbg 9 single
HKVS # printenv
ipaddr=192.168.2.109
serverip=192.168.2.18
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=94:e1:ac:6e:87:77
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0
bootdelay=4
dbg=9
HKVS # setenv dbg 9 single debug=9
HKVS # saveenv
Writing env to Nand... done
HKVS # printenv
ipaddr=192.168.2.109
serverip=192.168.2.18
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=94:e1:ac:6e:87:77
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0
bootdelay=4
dbg=9
HKVS #

I have noticed that there is a user logon that only shows up on a few different debug levels in PSH help listing. One command found in the "help" listing is "zhimakaimen".

Code:

# zhimakaimen
BQAAAJThrG6Hd4LoViw=
Password:

Do you know what this is all about?
Thanks!

alastairstevenson · Aug 25, 2018

Nick Robinson said:
I have tried to see if your suggestion would change the values in bootargs, but with no avail.

That's a pity - it strips out the non-numeric values, so not possible to use it to insert interesting values.

Nick Robinson said:
One command found in the "help" listing is "zhimakaimen".

That's the psh login that requires the Hikvision private key to use.
I have a recollection that it means 'open sesame', but I may be wrong.

bilal bilal · Apr 5, 2023

alastairstevenson said:
Are you saying the camera was able to be fixed with the mImage_r6 I tried to create?

There are various ways in which this could be done - which vary a bit with the version of bootloader and kernel that's running.
Generally though, some knowledge of Linux at a command-line level would be needed, and ideally something like an NFS share on the network to move files around with.
Quite a usful method if supported would be to start by getting into a debug mode by modifying the 'bootargs' bootloader environment variable.
Something like :
setenv bootargs console=ttyS0 debug=9 single KRN_PRT=pri
saveenv
reset

But then, when it boots up, there would be a need to complete the kernel initiallisation, mount the NFS share, and do the extraction.
There is a fair bit of detail in that.

hello
I need how to extract the (mImage_r6) from another camera ??

Search

Hikvision DS-2142FWD Boot Loop

Nick Robinson

n3wb

Attachments

alastairstevenson

Nick Robinson

n3wb

Attachments

alastairstevenson

Attachments

Nick Robinson

n3wb

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

alastairstevenson

Nick Robinson

n3wb

alastairstevenson

bilal bilal

n3wb