Bricked SV3C IP 1080P Firmware help

RubberDinero

Young grasshopper
Aug 13, 2018
54
1
phoenix, az
I tried to upgrade the firmware via the provided OV file from their website and it bricked.

I am able to get info off the Serial UART connection on Putty and it says that it's looking for "uImage".

How can I extract the uImage file from the good camera? I know how to get it back in the bricked camera with TFTP, but i do not know what address to overwrite after loaded.
I can see "Booting kernel from Legacy Image at 00008000" but I'm not too code-smart, but I'm very good at following directions.

Maybe someone knows of a better way to extract and restore the bricked camera. I'm all ears.

Please see the serial info i get from both the good and bricked cameras.

This is what I get from the bad boot
Code:
U-Boot 2011.09 (Aug 09 2016 - 17:07:22)

DRAM:  64 MiB
MMC:   SD Card not detect
mmci_host_init error - -1

SPI FLASH: 8 MB
In:    serial
Out:   serial
Err:   serial
GPIO[2] is high
Hit any key to stop autoboot:  0
## Booting kernel from Legacy Image at 00008000 ...
   Image Name:   Linux-2.6.35.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1294032 Bytes = 1.2 MiB
   Load Address: 00008000
   Entry Point:  00008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.12 (cwz@vvvsvr) (gcc version 4.5.2 (SONiX GCC-4.5.2 Release 2011-12-06) ) #16 Fri Jul 1 20:27:18 CST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00057177
CPU: VIVT data cache, VIVT instruction cache
Machine: SONiX SN98600 Development Platform
Memory policy: ECC disabled, Data cache writeback
CPU: found ITCM 16k @ ffff4000, enabled
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/linuxrc mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 38816k/38816k available, 26720k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc4800000 - 0xe0000000   ( 440 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc001d000   (  84 kB)
      .text : 0xc001d000 - 0xc0330000   (3148 kB)
      .data : 0xc0344000 - 0xc035cae0   (  99 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:96
Console: colour dummy device 80x30
console [ttyS0] enabled
Calibrating delay loop... 200.29 BogoMIPS (lpj=1001472)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
0x00b00000 bytes system memory reserved for isp device at 0x003fd000
0x00b00000 bytes system memory reserved for vc device at 0x00efd000
bio: create slab <bio-0> at 0
Linux media interface: v0.10
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource ft_clocksource
Switched to NOHz mode on CPU #0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.14)
msgmni has been set to 75
async_tx: api initialized (async)
io scheduler noop registered (default)
SONIX UART driver, (c) 2013 Sonix
snx_uart.0: ttyS0 at MMIO 0x98a00000 (irq = 8) is a SONiX
snx_uart.1: ttyS1 at MMIO 0x98b00000 (irq = 10) is a SONiX
loop: module loaded
5 cmdlinepart partitions found on MTD device snx-spi
Creating 5 MTD partitions on "snx-spi":
0x000000000000-0x000000050000 : "uboot"
0x000000050000-0x0000001b0000 : "kernel"
0x0000001b0000-0x000000790000 : "rootfs"
0x000000790000-0x0000007a0000 : "key"
0x0000007a0000-0x000000800000 : "etc"
snx_spi_init register
SONiX Ethernet driver, (c) 2013 Sonix
eth0: Dropping NETIF_F_SG since no checksum feature.
snx_mac: SNX Ethernet MAC controller at 0x90500000 (irq = 17) 00:b0:27:08:90:14.
snx_mac: IP101G Ethernet PHY 100 Mbps FullDuplex (Auto Negotiation)
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
SONIX SNX I2C adapter driver, (c) 2012 Sonix
snx_i2c.0: SNX I2C0 controller at 0x98300000 (irq = 1)
I2C GPIO driver INIT
snx_i2c.1: SNX I2C1 controller at 0x98400000 (irq = 2)
snx_hdma snx_hdma: SNX AHB DMA Controller (memcpy memset), 4 channels
SNX AHB DMA driver register
ALSA device list:
  No soundcards found.
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
SQUASHFS error: squashfs_read_data failed to read block 0x5a95ce
SQUASHFS error: Unable to read metadata cache entry [5a95ce]
SQUASHFS error: Unable to read inode 0x1185169f
VFS: Cannot open root device "mtdblock2" or unknown-block(31,2)
Please append a correct "root=" boot option; here are the available partitions:
1f00             320 mtdblock0 (driver?)
1f01            1408 mtdblock1 (driver?)
1f02            6016 mtdblock2 (driver?)
1f03              64 mtdblock3 (driver?)
1f04             384 mtdblock4 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[<c0023510>] (unwind_backtrace+0x0/0xf4) from [<c021ca20>] (panic+0x58/0xd4)
[<c021ca20>] (panic+0x58/0xd4) from [<c0008d00>] (mount_block_root+0x1d8/0x29c)
[<c0008d00>] (mount_block_root+0x1d8/0x29c) from [<c0008f48>] (prepare_namespace+0x120/0x178)
[<c0008f48>] (prepare_namespace+0x120/0x178) from [<c00089e4>] (kernel_init+0x110/0x150)
[<c00089e4>] (kernel_init+0x110/0x150) from [<c001f0d0>] (kernel_thread_exit+0x0/0x8)

and this is what i get from the camera that does boot
Code:
U-Boot 2011.09 (Aug 09 2016 - 17:07:22)

DRAM:  64 MiB
MMC:   SD Card not detect
mmci_host_init error - -1

SPI FLASH: 8 MB
In:    serial
Out:   serial
Err:   serial
GPIO[2] is high
Hit any key to stop autoboot:  0
## Booting kernel from Legacy Image at 00008000 ...
   Image Name:   Linux-2.6.35.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1294032 Bytes = 1.2 MiB
   Load Address: 00008000
   Entry Point:  00008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.12 (cwz@vvvsvr) (gcc version 4.5.2 (SONiX GCC-4.5.2 Release 2011-12-06) ) #16 Fri Jul 1 20:27:18 CST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00057177
CPU: VIVT data cache, VIVT instruction cache
Machine: SONiX SN98600 Development Platform
Memory policy: ECC disabled, Data cache writeback
CPU: found ITCM 16k @ ffff4000, enabled
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/linuxrc mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 38816k/38816k available, 26720k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc4800000 - 0xe0000000   ( 440 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc001d000   (  84 kB)
      .text : 0xc001d000 - 0xc0330000   (3148 kB)
      .data : 0xc0344000 - 0xc035cae0   (  99 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:96
Console: colour dummy device 80x30
console [ttyS0] enabled
Calibrating delay loop... 200.29 BogoMIPS (lpj=1001472)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
0x00b00000 bytes system memory reserved for isp device at 0x003fd000
0x00b00000 bytes system memory reserved for vc device at 0x00efd000
bio: create slab <bio-0> at 0
Linux media interface: v0.10
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource ft_clocksource
Switched to NOHz mode on CPU #0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.14)
msgmni has been set to 75
async_tx: api initialized (async)
io scheduler noop registered (default)
SONIX UART driver, (c) 2013 Sonix
snx_uart.0: ttyS0 at MMIO 0x98a00000 (irq = 8) is a SONiX
snx_uart.1: ttyS1 at MMIO 0x98b00000 (irq = 10) is a SONiX
loop: module loaded
5 cmdlinepart partitions found on MTD device snx-spi
Creating 5 MTD partitions on "snx-spi":
0x000000000000-0x000000050000 : "uboot"
0x000000050000-0x0000001b0000 : "kernel"
0x0000001b0000-0x000000790000 : "rootfs"
0x000000790000-0x0000007a0000 : "key"
0x0000007a0000-0x000000800000 : "etc"
snx_spi_init register
SONiX Ethernet driver, (c) 2013 Sonix
eth0: Dropping NETIF_F_SG since no checksum feature.
snx_mac: SNX Ethernet MAC controller at 0x90500000 (irq = 17) 00:b0:27:08:90:14.
snx_mac: IP101G Ethernet PHY 100 Mbps FullDuplex (Auto Negotiation)
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
SONIX SNX I2C adapter driver, (c) 2012 Sonix
snx_i2c.0: SNX I2C0 controller at 0x98300000 (irq = 1)
I2C GPIO driver INIT
snx_i2c.1: SNX I2C1 controller at 0x98400000 (irq = 2)
snx_hdma snx_hdma: SNX AHB DMA Controller (memcpy memset), 4 channels
SNX AHB DMA driver register
ALSA device list:
  No soundcards found.
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing init memory: 84K
Create device file
mount: mounting none on /proc/bus/usb failed: No such file or directory
modprobe: module 'snx_crypto' not found
starting pid 338, tty '': '/etc/init.d/rcS'

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S10mpp
sysctl: error: 'net.ipv6.conf.all.disable_ipv6' is an unknown key
sysctl: error: 'net.ipv6.conf.default.disable_ipv6' is an unknown key
sysctl: error: 'net.ipv6.conf.lo.disable_ipv6' is an unknown key
vm.dirty_background_ratio = 5
vm.dirty_background_bytes = 0
vm.dirty_ratio = 5
vm.dirty_bytes = 0
vm.dirty_writeback_centisecs = 100
vm.dirty_expire_centisecs = 1000
vm.min_free_kbytes = 3000
net.ipv4.tcp_keepalive_time = 20
net.ipv4.tcp_keepalive_probes = 6
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_max_tw_buckets = 60
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_orphan_retries = 4
[RCS]: /etc/init.d/S90p2p
/usr/local/lib:/usr/lib:/usr/lib/alsa-lib/:/rt/lib
starting pid 348, tty '/dev/ttyS0': '/sbin/getty -L ttyS0 115200 vt100'
start p2p_deamon 346
=== start run boottab ===

(none) login: killall: vs_server: no process killed
Sonix GPIO Driver
BTLED- board---8700.
Init led ko OK
Load drivers...
sh: write error: Device or resource busy
sh: write error: Device or resource busy
SONIX RTC, (c) 2012
snx_rtc snx_rtc: rtc core: registered snx_rtc as rtc0
driver loaded.
sonix snx_aud_gpio diver register
modprobe: module 'snx_aud_core' not found
modprobe: module 'snx_aud_sigma' not found
modprobe: module 'snx_aud_r2r' not found
snx_isp snx_isp.0: [ISP] isp_camera_probe
soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0
scan:sc2135
sc2135 0-0060: Product ID error 2032
sc2135: probe of 0-0060 failed with error -22
scan:ov9715
ov9715 0-0060: Product ID error 0:0
ov9715: probe of 0-0060 failed with error -22
scan:ov2715
ov2715: probe of 0-006c failed with error -22
scan:imx238
scan:ar0330
scan:h22
scan:h42
scan:imx225
scan:imx322
start reset
pix_clock: 80000000
imx322: probe of 0-0034 failed with error -22
scan:sc2035
0x3105 = 0x02
0x0103 = 0x00
0x3105 = 0x02
0x0100 = 0x00
0x301e = 0xb0
0x320c = 0x03
0x320d = 0xe8
0x3231 = 0x24
0x320e = 0x04
0x320f = 0x65
0x3211 = 0x08
0x3213 = 0x08
0x3e03 = 0x03
0x3e01 = 0x46
0x3e08 = 0x00
0x3e09 = 0x10
0x3518 = 0x03
0x5025 = 0x09
0x3908 = 0xc0
0x3907 = 0x01
0x3928 = 0x01
0x3416 = 0x12
0x3401 = 0x1e
0x3402 = 0x0c
0x3403 = 0x70
0x3e0f = 0x90
0x3638 = 0x84
0x3637 = 0xbc
0x3639 = 0x98
0x3035 = 0x01
0x3034 = 0xc2
0x3300 = 0x30
0x3301 = 0x08
0x3308 = 0x30
0x3306 = 0x3a
0x330a = 0x00
0x330b = 0x90
0x3303 = 0x30
0x3309 = 0x30
0x331e = 0x2c
0x331f = 0x2c
0x3320 = 0x2e
0x3321 = 0x2e
0x3322 = 0x2e
0x3323 = 0x2e
0x3626 = 0x03
0x3621 = 0x28
0x3f08 = 0x04
0x3f09 = 0x44
0x4500 = 0x25
0x3c09 = 0x08
0x335d = 0x20
0x3368 = 0x02
0x3369 = 0x00
0x336a = 0x04
0x336b = 0x65
0x330e = 0x50
0x3367 = 0x08
0x3f00 = 0x06
0x3f04 = 0x01
0x3f05 = 0xdf
0x3905 = 0x1c
0x5780 = 0x7f
0x5781 = 0x0a
0x5782 = 0x0a
0x5783 = 0x08
0x5784 = 0x08
0x5785 = 0x18
0x5786 = 0x18
0x5787 = 0x18
0x5788 = 0x18
0x5789 = 0x01
0x578a = 0x0f
0x5000 = 0x06
0x3632 = 0x44
0x3622 = 0x0e
0x3627 = 0x08
0x3630 = 0xb4
0x3633 = 0x97
0x3620 = 0x62
0x363a = 0x0c
0x3333 = 0x10
0x3334 = 0x20
0x3312 = 0x06
0x3340 = 0x03
0x3341 = 0xb0
0x3342 = 0x02
0x3343 = 0x20
0x303f = 0x81
0x501f = 0x00
0x3b00 = 0xf8
0x3b01 = 0x40
0x3c01 = 0x14
0x4000 = 0x00
0x3d08 = 0x01
0x3640 = 0x00
0x320c = 0x04
0x320d = 0x5e
0x320e = 0x04
0x320f = 0x5e
0x3035 = 0x05
0x3207 = 0x49
0x303a = 0x18
0x3039 = 0x76
0x3034 = 0x72
0x3621 = 0x18
0x3626 = 0x02
0x3300 = 0x12
0x3306 = 0x40
0x330b = 0x9c
0x3f05 = 0xff
0x0100 = 0x01
0x303f = 0x82
0x3621 = 0x28
0x335e = 0x02
0x335f = 0x0a
0x3662 = 0x82
0x3636 = 0x88
0x3631 = 0x80
0x3635 = 0x66
0x3105 = 0x04
0x3105 = 0x04
sensor:sc2035 (id:0x0020) driver loadded
IQ.bin OK!
snx_isp snx_isp.0: ISP Camera driver loaded
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
./load: line 65: can't create /etc/firmware/sensor.list: Read-only file system
sh: : unknown operand
I2C device (0) is open
addr: 60 set 0x3621 = 0x28
I2C device (0) is open
addr: 60 set 0x335e = 0x2
I2C device (0) is open
addr: 60 set 0x335f = 0xa
I2C device (0) is open
addr: 60 set 0x3662 = 0x82
snx_vc snx_vc: sonix_vc device registered as /dev/video1
snx_vc snx_vc: sonix_vc device registered as /dev/video1
snx_vc snx_vc: sonix_vc device registered as /dev/video2
snx_vc snx_vc: sonix_vc device registered as /dev/video2
snx_sd: Unknown symbol mmc_request_done (err 0)
snx_sd: Unknown symbol mmc_remove_host (err 0)
snx_sd: Unknown symbol mmc_alloc_host (err 0)
snx_sd: Unknown symbol mmc_add_host (err 0)
snx_sd: Unknown symbol mmc_wait_for_cmd (err 0)
snx_sd: Unknown symbol mmc_free_host (err 0)
snx_sd: Unknown symbol mmc_detect_change (err 0)
snx_sd: Unknown symbol mmc_request_done (err 0)
snx_sd: Unknown symbol mmc_remove_host (err 0)
snx_sd: Unknown symbol mmc_alloc_host (err 0)
snx_sd: Unknown symbol mmc_add_host (err 0)
snx_sd: Unknown symbol mmc_wait_for_cmd (err 0)
snx_sd: Unknown symbol mmc_free_host (err 0)
snx_sd: Unknown symbol mmc_detect_change (err 0)
modprobe: 'kernel/drivers/snx_sd.ko': unknown symbol in module or invalid parameter
SNX Watchdog Timer, (c) 2012
Sonix926 Watchdog Timer: timer margin 10 sec
hwclock: applet not found
i2c_interfaces: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
File[/home/cwz/work-code/gk_ipc/drivers/eeprom/eeprom.c] Func[eeprom_init] Line[620]: eeprom load ok
==============load key rom=================

---[libkeypartition build Jun  8 2016 16:15:10]---

--------------------VVV----------------------
DEVICE_VENDOR=RTJ
EXT_PARAM1=
P2P_EXTINFO=CSUUAU
P2P_SERVER=EFGBFFBJKDJIGEJIENGKFIEPHMNGDEJOGAEKBJCLBFIGPLKAGPEFDBKAHOLCNMOMBKNNLBCIPMNHEACDMKJMJEFHNNPD
FactoryInit=0
--------------------USER----------------------
--------------------key rom----------------------
mac=C0:99:58:DE:ED:22
devid=VVVIPCNTD161017Z-051528pUSHtoPxv
rtuid=RTV11-NTD-002-05152-680366d99fae
P2P_TRAN=rtj_tran
P2P_ID=PPCN-552734-ESHEN
P2P_PWD=admin

Run Native
----------Extract web-------------
 start net_serv daemon 527
[VAL_TEST]Exit custom test
 debug Net Action Change NONE
 [ipconfig]Set MAC
 set MAC C0:99:58:DE:ED:22
eth0: Setting MAC address to c0:99:58:de:ed:22
lsusb: /sys/bus/usb/devices: No such file or directory
 wifi_realenable is -1
 debug linestate_change NONE TO 1.
 debug Net Action Change PLUGLINE
 process netaction plug line
 debug CurrWifiMode NONE switchto LINED, isforce:Y
 AP APName
 AP APPrefix
 AP APPostfix 552734-ESHEN
not set apname, use default
 AP SSID=IPCAM-AP-552734-ESHEN
/etc/Wireless/RT2870AP/RT2870AP.dat Exist
 Enter LINED Mode
 wifi setmode to NONE
 debug wifi state Change NONE
ifconfig: SIOCSIFADDR: No such device
 debug Net Action Change NONE
 iface:eth0,dhcp:n,ip:192.168.0.39,netmask:255.255.255.0,gateway:192.168.0.1:dnsflag:server
 dnstype:server, dnsflag:1
 net change, cache it.nettype eth0 ip 192.168.0.39 dhcp 0
 ledflash mode 0

==============================
Prepare start IPCAMERA
V2.3.4.2103-M00-NTD-B20170823B
=========================
ARPING to 192.168.0.1 from 192.168.0.39 via eth0
Unicast reply from 192.168.0.1 [48:f8:b3:f0:d3:b5] 3.230ms
RTLED v20131113
lednum:0 ledmode:0
led opr ok
[thread0]Create task:thdMSGPROC(stacpre_margin = 5
k:262144),1078047952,ret:0
msg_proc.c:254("VTOP_MSG_Main"): INFO(0x0, "MSGProc V1.1.0.0(R) Start success!!")
[mthread]tMSGPROC run, pid:545, threadid:1078047952, tid:605
[thread0]Create task:thdWDT(stack:262144),1078310096,ret:0
the load ini path:/etc/ipcamera/config_cfgaccess.ini
ARGParser:{ ./vs_server -sensortype sc2035 -boardtype 8700 -restartcnt 0  }ARGParser--END
Find Sensor:sc2035, idx:28
the load ini path:/etc/ipcamera/config_cfgaccess.ini
log path=mkdir -p /bin/vs/log
log path=mkdir -p /bin/vs/log
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/devmng/extdrv/hi_devm_io.c] Func[qv_initGPIO] Line[30]: ---------------------board_type(8700)-----------------------
[mthread]thdLog run, pid:545, threadid:1078572240, tid:608
[thread0]Create task:thdLog(stack:262144),1078572240,ret:0
[thread0]Create task:thd_hsds(stack:262144),1078834384,ret:0
[IMG]Set ImageAttr by Configfile
[IMG]Video Color Mode:0
[IMG]Image Scene : auto.
[IMG]COLORMode,0
[IMG]PowerFreq,60
snx_rtc_read_elapsed_second:293: not ready to read time
get rtc time :2000-1-1 0:0:0 954096
USER WILL SET TIME = 2000-1-1 0:0:0
SetTime . diffhour:0 diffmin:0, diffsec:0
snx_rtc_write_elapsed_second:323: not ready to write time
 save time 2000-01-01
Unicast reply from 192.168.0.1 [48:f8:b3:f0:d3:b5] 0.322ms
get TimeZone  : Asia/Hong_Kong
daylight:off
Set timezone: Asia/Hong_Kong
Unkown timezone.
asTZBuffer = STD-8:0:0
TZ information :STD-8:0:0
USER WILL SET TIME = 2000-1-1 0:0:0
SetTime . diffhour:0 diffmin:0, diffsec:0
snx_rtc_write_elapsed_second:323: not ready to write time
get system time :2000-1-1 0:0:0 6
[sysinfo]Runuptime:totalminutes:0, merror:0  10, 0 day, 0:0
<NET>update net config
BTTODO_NET, GetNetInfo, GetCurInterface HI_SysInfo_Init
[thread0]Create task:thdPTZ(stack:262144),1079096528,ret:0
[MP]InputMode:4096,Norm:0,VideoMode: 262144
ZZZZZZZZZZZZProduchannel 0 buffer count=2, size=3133440
ctMode:31 W:1920 H:1080
[thread0]Create task:thdSnapMsg(stack:262144),1079358672,ret:0
creat snap msg recv thread 1079358672 sucess
IDM.add chn:11 to cam:1 success
[venc] srcfram is 30
 Func[RT_ADPT_ENC_StartAenc] Line[1967] Info: StartAenc() enAudioCodsnx_vc snx_vc: snx_vc_open: Created instance c3c42000, m2m_ctx: c3f52800
ec(7) u32BitRate_bps(65536)
Isnx_vc snx_vc: snx_vidioc_s_parm: snx_vidioc_s_parm: OUTPUT fps == 25
DM.add chn:12 to cam:1 susnx_vc snx_vc: snx_vidioc_s_parm: snx_vidioc_s_parm: CAPTURE fps == 24
ccess
[venc] srcfram is snx_vc snx_vc: s_fmt: Setting format for type 2, wxh: 1920x1080, fmt: 808596563
30
 File[adpt_sonix_986xxsnx_vc snx_vc: s_fmt: Setting format for type 1, wxh: 1920x1080, fmt: 875967048
_enc.c] Func[PrepareForStrm] Line[223]: enStrmType(0) gop(24)
Func[PrepareForStrm] Line[275] Info: snx_open_device() return 0xa
<<<snx_vb2_alloc>>> alloc size=6266880 reduce size=3133440
----->has ability to crop!!
cropcap.defrect = (0, 0, 1920, 1080)
----->sussess crop to (0, 0, 1920, 1080)
[mthread]thdPTZ run, pid:545, threadid:1079096528, tid:621
[mthread]THD_Snap_MsgProc run, pid:545, threadid:1079358672, tid:622
Func[PrepareForStrm] Line[279] Info: snx_isp_init() return 0x0
Func[PrepareForStrm] Line[286] Info: snx_channel 1 buffer count=2, size=356352
isp_start() return 0x0
Func[PrepareForStrm] Line[snx_vc snx_vc: snx_vc_open: Created instance c3c42800, m2m_ctx: c3f10000
291] Info: snx_open_device() return 0xb
1920 snx_vc snx_vc: snx_vidioc_s_parm: snx_vidioc_s_parm: OUTPUT fps == 25
1080  scale == 1
nx_vc snx_vc: snx_vidioc_s_parm: snx_vidioc_s_parm: CAPTURE fps == 25
mFunc[PrepareForStrm] Linsnx_vc snx_vc: s_fmt: Setting format for type 2, wxh: 640x360, fmt: 808596563
e[299] Info: snx_codec_init() retusnx_vc snx_vc: s_fmt: Setting format for type 1, wxh: 640x360, fmt: 875967048
rn 0x0
Can find folder rc->rc_folder, defaul<<<snx_vb2_alloc>>> alloc size=712704 reduce size=356352
t folder is /etc/rc
Func[PrepareForStrm] Line[336] Info: snx_codec_start(0) return 0x0
Filesnx_vc snx_vc: snx_vc_open: Created instance c3c43000, m2m_ctx: c3f11400
[adpt_sonix_986xx_enc.c] Func[Prepsnx_vc snx_vc: snx_vidioc_s_parm: snx_vidioc_s_parm: CAPTURE fps == 1
areForStrm] Line[223]: enStrmType(1snx_vc snx_vc: s_fmt: Setting format for type 1, wxh: 1920x1080, fmt: 1196444237
) gop(25)
Fun<<<snx_vb2_alloc>>> alloc size=6266880 reduce size=3133440
c[PrepareForStrm] Line[275] Info: snx_open_device() return 0xc
----->has ability to crop!!
cropcap.defrect = (0, 0, 1920, 1080)
----->sussess crop to (0, 0, 640, 360)
Func[PrepareForStrm] Line[279] Info: snx_isp_init() return 0x0
Func[PrepareForStrm] Line[286] Info: snx_isp_start() return 0x0
Func[PrepareForStrm] Line[291] Info: snx_open_device() return 0xd
640 360  scale == 1
Func[PrepareForStrm] Line[299] Info: snx_codec_init() return 0x0
Can find folder rc->rc_folder, default folder is /etc/rc
Func[PrepareForStrm] Line[336] Info: snx_codec_start(1) return 0x0
Func[PrepareForSnap] Line[418] Info: snx_open_device() return 0xe
1920 1080  scale == 1
Func[PrepareForSnap] Line[422] Info: snx_codec_init() return 0xe
Func[PrepareForSnap] Line[436] Info: Cfg for Snap
Func[ADPT_OSD_Init] Line[64] Info: Create file(/tmp/osd_string) OK
Func[ADPT_OSD_Init] Line[92] Info: cds->dev_name(/proc/codec/1_h)
Func[ADPT_OSD_Init] Line[92] Info: cds->dev_name(/proc/codec/2_h)
 the nalutype is :7
 the sps  addr 40B56000 nal addr pstrTemp 40B56004 len 12
 the nalutype is :8
 the pps addr 40B56010 nal addr pstrTemp 40B56014 len 4
 the nalutype is :5
the chn :11 sps pps is :Z2RAKawsqAeAIn5U,aO44gA==
 the nalutype is :7
 the sps  addr 411FE000 nal addr pstrTemp 411FE004 len 11
 the nalutype is :8
 the pps addr 411FE00F nal addr pstrTemp 411FE013 len 4
 the nalutype is :5
the chn :12 sps pps is :Z2RAKawsqAoC/5U=,aO44gA==
bps modify  == 96000 --> 768000
bps modify  == 128000 --> 1024000
[OSD]Read config file, item:0
Func[RT_ADPT_ENC_SetTimeOSD] Line[949] Info: snx_isp_osd_position_set(1463, 0) for ISP_CH_0 return 0x0
Func[RT_ADPT_ENC_SetTimeOSD] Line[963] Info: snx_isp_osd_position_set(480, 0) for ISP_CH_1 return 0x0
sh: can't create /etc/rc/md_max_fps: Read-only file system
[OSD]Read config file, item:1
sh: can't create /etc/rc/md_cnt_en: Read-only file system
sh: can't create /etc/rc/md_ratectl_en: Read-only file system
sh: can't create /etc/rc/mbrc_en: Read-only file system
bmp data_offset = 54
read bmp finish
....................................................................
ds mmap finish
cds->bit_count = 24
Unicast reply from 192.168.0.1 [48:f8:b3:f0:d3:b5] 0.180ms
ds pallet init finish
Func[RT_ADPT_ENC_SetOSD] Line[1208] Info: snx_cds_set_scale() return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1211] Info: snx_cds_set_position(1120, 5) return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1214] Info: snx_cds_set_color_attr() return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1217] Info: snx_cds_set_color() return 0x0
bmp data_offset = 54
read bmp finish
Sent 3 probe(s) (3 broadcast(s))
Received 3 reply (0 request(s), 0 broadcast(s))
...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
ds mmap finish
cds->bit_count = 24
ds pallet init finish
Func[RT_ADPT_ENC_SetOSD] Line[1208] Info: snx_cds_set_scale() return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1211] Info: snx_cds_set_position(352, 1) return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1214] Info: snx_cds_set_color_attr() return 0x0
Func[RT_ADPT_ENC_SetOSD] Line[1217] Info: snx_cds_set_color() return 0x0
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/mp/hi_mp_osd.c] Func[HI_MP_OSD_CamInit] Line[562]: HI_OSD_CamGet() failed with 0xffffffff
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/mp/hi_mp_osd.c] Func[HI_MP_OSD_CamInit] Line[562]: HI_OSD_CamGet() failed with 0xffffffff
[OSD]Read config file, item:0
[CD:0]x y w h:0 0 100 100
Func[RT_ADPT_ENC_DisablePrivacy] Line[1480] Info: u32RgnId(0)
[CHNCD]OSD_Insert RGN: 0 To Cam:1 OK
[OSD]Read config file, item:1
[CD:1]x y w h:150 0 100 100
Func[RT_ADPT_ENC_DisablePrivacy] Line[1480] Info: u32RgnId(1)
[CHNCD]OSD_Insert RGN: 1 To Cam:1 OK
[OSD]Read config file, item:2
[CD:2]x y w h:300 0 100 100
Func[RT_ADPT_ENC_DisablePrivacy] Line[1480] Info: u32RgnId(2)
[CHNCD]OSD_Insert RGN: 2 To Cam:1 OK
[OSD]Read config file, item:3
[CD:3]x y w h:450 0 100 100
Func[RT_ADPT_ENC_DisablePrivacy] Line[1480] Info: u32RgnId(3)
[CHNCD]OSD_Insert RGN: 3 To Cam:1 OK
~~~~~~~~~ start md by cam 1 ~~~~~~~~~~~~~~~~~
~~~~~~~~~ start od by cam 1 ~~~~~~~~~~~~~~~~~
ADJUST_OD_SENSITIVITY (2 150 80 15 6)
ADJUST_OD_REGION (0 0 320 176)
ADJUST_OD_SENSITIVITY (2 150 80 15 6)
ADJUST_OD_REGION (0 0 320 176)
ADJUST_OD_SENSITIVITY (2 150 80 15 6)
ADJUST_OD_REGION (0 0 320 176)
ADJUST_OD_SENSITIVITY (2 150 80 15 6)
ADJUST_OD_REGION (0 0 320 176)
[thread2]Create task:thdStream(stack:262144),1078834384,ret:0
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/record/hi_recorder.c] Func[HI_REC_InitChn] Line[359]: size(1920 * 1080) bitrate(1024000) for s32VsChn(11)
Func[RT_GOPBUF_Create] Line[209] Info: u32BlkSize(131072) blknum(12) u32BufSize(1572864) u32TailSize(512000) u32FrmsMaxCnt(1500)
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/record/hi_recorder.c] Func[HI_REC_InitChn] Line[359]: size(640 * 360) bitrate(768000) for s32VsChn(12)
Func[RT_GOPBUF_Create] Line[209] Info: u32BlkSize(65536) blknum(6) u32BufSize(393216) u32TailSize(128000) u32FrmsMaxCnt(1500)
[thread2]Create task:thdMPMsg(stack:262144),1104069840,ret:0
 start mp msg center thread 1104069840 ok...
[mthread]thdMPMsg run, pid:545, threadid:1104069840, tid:658
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
Func[RT_GOPBUF_WriteFrm] Line[402] Info: Current need key frm, but no one is.
<DEVM>Set PowerFreq:60
<DEVM>Set Scene:0
Not support adjustmode now
mtmng init start
MTMNGGetCfgFrmIni start
MPMNG rtspsvr:enable = 1.
MPMNG rtspsvr:bUserVerify = 0.
MPMNG rtspsvr:lisnport = 554.
MPMNG rtspsvr:max_conn_num = 32.
MPMNG rtspsvr:udp_sendport_min = 5000.
MPMNG rtspsvr.udp_send_port_max = 6000.
MPMNG phttpsvr:enable = 1.
MPMNG httpsvr:lisnport = 8800.
MPMNG httpsvr:max_conn_num = 32.
MPMNG packet_len:packet_len = 1200.
MPMNG rtspohttp:enable = 1.
MPMNG rtspohttp:lisnport = 8840.
MPMNG rtspohttp:max_conn_num = 4.
 /home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c HI_MTMng_Init 1209

[MTMNG]-[2] </home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c>(711)VOD :HI_VS_IDM_GetCams  =1.

[MTMNG]-[2] </home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c>(727)VOD :HI_VS_IDM_GetVsChns cam 1 vschnnum 2.
=-============================= 2
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[MTMNGGetVsChnInfo] Line[733]: s32CamsId(0), s32VsChnNumByCam(0)
[MTMNG]GetPicInfo, [1920,1080]
mbuf[0].chnid = 11, u32PicWH(1920, 1080)
mbuf[0].max_connect_num = 3
mbuf[0].buf_size = 1638400
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[MTMNGGetVsChnInfo] Line[733]: s32CamsId(0), s32VsChnNumByCam(1)
[MTMNG]GetPicInfo, [640,360]
mbuf[1].chnid = 12, u32PicWH(640, 360)
mbuf[1].max_connect_num = 3
mbuf[1].buf_size = 307200
alarm mbuf[2].chnid = 14
alarm mbuf[2].max_connect_num = 3
alarm mbuf[2].buf_size = 20480
 /home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c HI_MTMng_Init 1220
MTMNT Init cfg chnid 11 , max connect num 3, bufsize 1638400
 <MTMNG>stMtCfg.extinfo
 /home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c HI_MTMng_Init 1271
libmt version: v0.4build20110904
<VOD>VOD Session number = 9
Mbuf Init cfg chnid 11 , max connect num 3, bufsize 1638400
 Mbuf Init cfg chnid 12 , max connect num 3, bufsize 307200
 Mbuf Init cfg chnid 14 , max connect num 3, bufsize 20480
 num:3 MBUF_Init vschn 11 , mbuf chn 0, buf_size:1638400
num:3 MBUF_Init vschn 12 , mbuf chn 0, buf_size:307200
num:3 MBUF_Init vschn 14 , mbuf chn 0, buf_size:20480
MBUF_Init vschn 11 , mbuf chn 0, buf_size:1638400, buf_discard_threshold:20480
MBUF_Init vschn 12 , mbuf chn 1, buf_size:307200, buf_discard_threshold:20480
MBUF_Init vschn 14 , mbuf chn 3, buf_size:20480, buf_discard_threshold:20480
vschn 11 (mbufchn 0) user 0: pheader 2883d0 header size 40
vschn 11 (mbufchn 0) user 1: pheader 288410 header size 40
vschn 11 (mbufchn 0) user 2: pheader 288450 header size 40
vschn 12 (mbufchn 1) user 0: pheader 288490 header size 40
vschn 12 (mbufchn 1) user 1: pheader 2884d0 header size 40
vschn 12 (mbufchn 1) user 2: pheader 288510 header size 40
vschn 14 (mbufchn 3) user 0: pheader 288550 header size 40
vschn 14 (mbufchn 3) user 1: pheader 288590 header size 40
vschn 14 (mbufchn 3) user 2: pheader 2885d0 header size 40
MTRANS Init:conn num=9 minport-maxport=5000-6000,pack len=1200.
Start HI_VOD_Init.vod Successed.
 /home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c HI_MTMng_Init 1278
http Live svr Init ok.
Start MediaTrans.http_streamsvr Successed.
Create task:HI_HTTP_LISNSVR(stack:262144),1104331984,ret:0
open file error
: No such file or directory
RTSP Live svr Init ok.
Start MediaTrans.rtsp_streamsvr Successed.
Create task:HI_HTTP_LISNSVR(stack:262144),1104594128,ret:0
rtsp_o_http Live svr Init ok.
Start rtspOhttp svr Successed.
[thread0]Create task:thdImageProc(stack:262144),1104856272,ret:0
ircut proc init:0;
[mthread]thdImageProc run, pid:545, threadid:1104856272, tid:680
[INT]Cannot Find Module:ircut
[conf], AddModule, {ircut},{(null)},{config_ircut.ini}
[conf], AddModule OK, {ircut},{(null)},{config_ircut.ini}
IRCUT Enable:1, ActiveMode:0, interval:1, interval2:7 dayNight 0 s_type:0
<IO>2, 0.6
<IO>5, 0.3
<IO>6, 1.2
IRCUT mode 2
[ircut]reset ircut end
[IRCUT]101010
[thread0]Create task:thdUSBDev(stack:262144),1105118416,ret:0
[thread0]Create task:thdUSBStatus(stack:262144),1105380560,ret:0
[IRCUT] 0 -> 1, 2
[mthread]tUSBStatus run, pid:545, threadid:1105380560, tid:706

[mthread]tUSBPlug run, pid:545, threadid:1105118416, tid:705

[thread0]Create task:THD_RecMng_MsgProc(stack:262144),1105642704,ret:0
emng msize: 1, mqval: 100
[thread0]Create task:thdAlmMngMsg(stack:262144),1105904848,ret:0
TYPE:16,LOOP:1,ENABLE:0,ACT:1,TIME:0:0:0,DATE:0_0_0,WEEK:0,TIMEOUT:60.
TYPE:2,LOOP:1,ENABLE:1,ACT:2,TIME:-1:-1:-1,DATE:-1_-1_-1,WEEK:-1,TIMEOUT:0.

[HI_TimerMng_Init_All]-[2] </home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/services/common/timermng/hi_timermng.c>(879)Load timers OK. timers load:2
[thread0]Create task:thdTimerMng(stack:262144),1106429136,ret:0
[mthread]THD_RecMng_MsgProc run, pid:545, threadid:1105642704, tid:707
[mthread]thdAlmMngMsg run, pid:545, threadid:1105904848, tid:708
[mthread]thdTimerMng run, pid:545, threadid:1106429136, tid:710
[mthread]THD_NTT run, pid:545, threadid:1106691280, tid:711
[thread0]Create task:THD_NTT(stack:262144),1106691280,ret:0
[thread0]Create task:THD_NOTIFY_MSGRECV(stack:262144),1106953424,ret:0
[thread0]Create task:THD_NTT(stack:262144),1107215568,ret:0
Set Event Time Mode: 2
Set Event Time Mode: 2
Set Event Time Mode: 0
[mthread]tNOTIFY_MSGRECV run, pid:545, threadid:1106953424, tid:712
[mthread]THD_NTT run, pid:545, threadid:1107215568, tid:713
Set Event Time Mode: 0
Set Event Time Mode: 0
Set Event Time Mode: 0
Set Event Time Mode: 0
Set Event Time Mode: 2
[ALM]Load Action Conf
[ALM]SetRel:alarmtimesnap:snap, V:1
[ALM]SetRel:sdalarm:sdalmdo, V:1
[mthread]thdEMNGMsg run, pid:545, threadid:1107477712, tid:714
[thread0]Create task:thdEMNGMsg(stack:262144),1107477712,ret:0
devs device init
devs v2 test :device
VVV DevSearch V2.2B20140513
[DEVS]Total used Nics 1
[DEVS]Create Socket:19 on NIC:eth0, ip:192.168.0.39
[DEVS]mcast init start ok.
[thread0]Create task:DEVSMR(stack:262144),1107739856,ret:0
[DEVS]V2 Init OK, SendMode:0XFF
[DEVSB]Create Socket:20 on NIC:eth0, ip:192.168.0.39
[DEVSB]bcast init start ok.
[thread0]Create task:DEVSBR(stack:262144),1108002000,ret:0
start qvnet svr
HTTP_start Client port 0
CHTTPServer Create thread with 256K stack
[thread0]Create task:thdHttpd(stack:262144),1108526288,ret:0
[mthread]devsmthd run, pid:545, threadid:1107739856, tid:715
[mthread]DEVSBR run, pid:545, threadid:1108002000, tid:716
http accept:listensocket=21,listenport=0
[mthread]thdHttpd run, pid:545, threadid:1108526288, tid:718
Start httpd
INIT WEB SERVER[OK][thread0]Create task:thdNTP(stack:262144),1108788432,ret:0
Enable:0  interval:10
[thread0]Create task:thdTF(stack:262144),1109050576,ret:0
Started Init sysalm_init ! s32Rtn = 0
<IO>1, -1.-1
Not Define DO io port .Function Disable
[dio] init driver error
Started Init ioalm_do_init ! s32Rtn = ffffffff
Enable:0, ActiveMode:1, alm_interval:10 interval:0, interval2:0, net_enable:0, aitype:0, shake:1, vaildtime:0
[DI]Init almtype:0
<IO>0, -1.-1
Not Define DI io port .Function Disable
[DI] init driver error
Started Init ioalm_di_init ! s32Rtn = ffffffff
<IO>13, -1.-1
Not Define buzzer io port .Function Disable
[INT]Cannot Find Module:playaudio
[conf], AddModule, {playaudio},{(null)},{config_playaudio.ini}
[conf], AddModule OK, {playaudio},{(null)},{config_playaudio.ini}
md:/bin/vs/media/md.g711a, io:/bin/vs/media/md.g711a
[thread0]Create task:thdPlayAudio(stack:262144),1109312720,ret:0
[thread0]Create task:thdRoutine(stack:262144),1109574864,ret:0

[recsearch]-[7] </home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/recsearch/hi_recsearch.c>(2352)recsearch message task register success:8
[thread0]Create task:thdRecSearchMsg(stack:262144),1109837008,ret:0
[mthread]thdNTP run, pid:545, threadid:1108788432, tid:719
[mthread]thdTF run, pid:545, threadid:1109050576, tid:720
Starrt Normal Sysalm. timer
[mthread]tPlayAudio run, pid:545, threadid:1109312720, tid:721
[mthread]thdRoutine run, pid:545, threadid:1109574864, tid:722
Starrt Normal routine. timer
[mthread]thdRecSearchMsg run, pid:545, threadid:1109837008, tid:723
---------------------------md_interval:0, almin_interval:0, mw_interval:5
---------------------------enable:0, snap_interval:2, snap_time:30, snap_quality:1
[sysinfo]Runuptime:totalminutes:0, merror:0  14, 0 day, 0:0
[thread0]Create task:tFactoryInit(stack:262144),1110099152,ret:0
[Onvif]ByRT V20151215
[ONVIF] NVT Init!
HI_NVT_ProductCfgInit Get Video Encoder cfg
Read CFG NUM:0
[ONVIF]1 Get video_encoder_configuration-video_encoder_configuration_0:vschn,vschn:11 ret:0
[ONVIF]2 Get video_encoder_configuration-video_encoder_configuration_0:token, ret:0
Read CFG NUM:1
[ONVIF]1 Get video_encoder_configuration-video_encoder_configuration_1:vschn,vschn:12 ret:0
[ONVIF]2 Get video_encoder_configuration-video_encoder_configuration_1:token, ret:0
Get Audio Source cfg
Free some
[ONVIF] HI_NVT_InitVideoSource!
HI_NVT_InitVideoSourceConfiguration begin!
HI_NVT_InitVideoSourceConfigurationOptions begin!
HI_NVT_InitVideoEncoderConfiguration begin!
[onvif]chn:0,frameratelimit:15,bitratelimit:8000
[onvif]chn:1,frameratelimit:15,bitratelimit:8000
HI_NVT_InitVideoEncoderConfigurationOptions begin!
unkown type enter¦¦put the Data instead
0 : <tns1:VideoAnalytics><MotionDetection wstop:topic="true"><tt:MessageDescription><tt:Source><tt:SimpleItem Name="VideoSourceConfigurationToken" Type="tt:ReferenceToken"/></tt:Source><tt:Data><tt:SimpleItem Name="MotionActive" Type="xs:integer"/></tt:Data></tt:MessageDescription></MotionDetection></tns1:VideoAnalytics>

1 : <tns1:RuleEngine><tt:CellMotionDetector><tt:Motion wstop:topic="true"><tt:MessageDescription><tt:Source><tt:SimpleItemDescription Name="VideoSourceConfigurationToken" Type="tt:ReferenceToken"/></tt:Source><tt:Source><tt:SimpleItemDescription Name="VideoAnalyticsConfigurationToken" Type="xs:string"/></tt:Source><tt:Source><tt:SimpleItemDescription Name="Rule" Type="xs:string"/></tt:Source><tt:Data><tt:SimpleItemDescription Name="IsMotion" Type="xs:string"/></tt:Data></tt:MessageDescription></tt:Motion></tt:CellMotionDetector></tns1:RuleEngine>

2 : <tns1:Device><tns1:Trigger><tns1:DigitalInput wstop:topic="true"><tt:MessageDescription><tt:Source><tt:SimpleItemDescription Name="InputToken" Type="tt:ReferenceToken"/></tt:Source><tt:Data><tt:SimpleItemDescription Name="LogicalState" Type="boolean"/></tt:Data></tt:MessageDescription></tns1:DigitalInput></tns1:Trigger></tns1:Device>

../../src/nvt/src/hi_nvt_event.c HI_NVT_DevEvent_RegSetSynchronizationPoint 2079 shut down by locky_wu
g_profile_vs[i].profileToken is MainStreamTooken
g_profile_vs[i].profileToken is SubStreamTooken
g_profile_vs[i].profileToken is
g_profile_vs[i].profileToken is MobileStreamTooken
g_profile_vs[i].profileToken is
[onvif_f]:HI_NVT_InitProfile
[IRCUT]Call Color->BW, 4
[mthread]tFTInit run, pid:545, threadid:1110099152, tid:724
[onvif]ADM AddProfile, token:MainStreamTooken, VsChn:11
the profile is depend the vschn:11
[onvif]ADM AddProfile, token:MainStreamTooken, VsChn:11
add the profile :MainStreamTooken  depend vschn:11
[onvif]ADM AddProfile, token:SubStreamTooken, VsChn:12
the profile is depend the vschn:12
[onvif]ADM AddProfile, token:SubStreamTooken, VsChn:12
add the profile :SubStreamTooken  depend vschn:12
[onvif_f]:HI_NVT_CHECK_VideoEncoder_Attr
2000-01-01 00:00:05 [   ircut]<6>Func[HI_DEVM_Video_I_SetIRCutMode] Line[913] Info: RT_ADPT_ENC_SetDayNightMode(RT_DAY_NIGHT_MODE_NIGHT) return (0)
cut to Night
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/mp/hi_mp_enc.c] Func[HI_MP_ENC_MsgProc] Line[897]: pMsgBody->s32Chn = 11
[onvif_f]:HI_NVT_CHECK_VideoEncoder_Attr
[onvif]vencattr,chn:0,1024000,8000,15,24
[onvif_f]:HI_NVT_CHECK_VideoEncoder_Attr
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/vss_module/funcmod.gk71xx/mp/hi_mp_enc.c] Func[HI_MP_ENC_MsgProc] Line[897]: pMsgBody->s32Chn = 12
[onvif_f]:HI_NVT_CHECK_VideoEncoder_Attr
[onvif]vencattr,chn:1,768000,8000,15,25
 HI_NVT_InitPtzConfiguration 45======
[INT]Cannot Find Module:ptz_configuration
[conf], AddModule, {ptz_configuration},{/mnt/config/ipcamera/hi_nvt_config/},{ptz_configuration.ini}
[conf], AddModule OK, {ptz_configuration},{/mnt/config/ipcamera/hi_nvt_config/},{ptz_configuration.ini}
 HI_NVT_InitPtzConfiguration 102======
 NVT_PTZ init ok ======
HI_NVT_WebServer_Init begin!
++++ NOTICE: You have enter HI_NVT_WebServer_Init ++++
[onvif]scope max_num :8
[onvif]Get OnvifPort:1018
++++ NOTICE: You have enter HI_NVT_WebServer_Add ++++
->>>>>>>1018
Socket connection successful: master socket = 24



++++ NOTICE: You enter HI_NVT_DevSearch_SetServerPort ++++
++++ NOTICE: You will set XAddr port to 1018 ++++
the discovery uuid is :0ff8a2d8-b5a1-405a-9f06-63b8cb55e071 ip:192.168.0.39
++++ NOTICE: You enter HI_NVT_DevSearch_Add ++++


===== The device list: =====
Card 0: ,
Card 1: ,
===== Device list End! =====




===== The device list: =====
Card 0: ANY, 192.168.0.39
Card 1: ,
===== Device list End! =====


[UUID]call uuid_gen, ../../src/nvt/src/hi_nvt_devsearch.c,1404
[UUID]00931fac-9dab-2b36-c248-b87d6ae33f
[onvif] SendHello
<onvif>GetIP:192.168.0.39
 soap_in_SOAP_ENV__Header 60570===OOOOOOOOOOOOOvif===
[onvif]run soap_getelement
[onvif]run soap_getelement
soap error: 1, SOAP-ENV:Sender, A required message information header, To, MessageID, or Action, is not present.
no Hello Response receive!
soapdelete:0x32e0b0
++++ NOTICE: Listening End ++++
++++ NOTICE: You enter HI_NVT_DevSearch_RegGetDevinfo ++++
++++ NOTICE: You enter HI_NVT_DevSearch_RegSetDevinfo ++++
[onvif]Donot Send Hello Period
===================================
           Start Success! ShenZhen Runtop Ltd. V2.3.4.2103-S50-NTD-B20170823B
===================================


===== The device soap: =====
Card 0: 192.168.0.39, soap num:27, master:1
===== Device list End! =====


[thread0]Create task:auto maintenance(stack:262144),1110885584,ret:0
vs_server pid:545
<devs>send notify:1
[sysinfo]Runuptime:totalminutes:0, merror:0  16, 0 day, 0:0
[mthread]auto_maintenance run, pid:545, threadid:1110885584, tid:759
[INT]Cannot Find Module:maintenance
[conf], AddModule, {maintenance},{(null)},{config_maintenance.ini}
[conf], AddModule OK, {maintenance},{(null)},{config_maintenance.ini}



[UUID]call uuid_gen, ../../src/nvt/src/hi_nvt_devsearch.c,1404
[UUID]005789e4-b2d6-b441-e241-1dc709e111
[onvif] SendHello
<onvif>GetIP:192.168.0.39
 soap_in_SOAP_ENV__Header 60570===OOOOOOOOOOOOOvif===
[onvif]run soap_getelement
[onvif]run soap_getelement
soap error: 1, SOAP-ENV:Sender, A required message information header, To, MessageID, or Action, is not present.
no Hello Response receive!
soapdelete:0x34c210
****onvif StartListen ****
 soap_in_SOAP_ENV__Header 60570===OOOOOOOOOOOOOvif===
[onvif_f]:==== soap_serve_request ====
[onvifd]soap tag is d:Hello
../../src/gsoap/src/soapServer.c soap_serve___dnrd__Hello 366 oookkk by locky_wu
[onvif]Recv Hello
soapdelete:0x4230e814



 ntp update time success
USER WILL SET TIME = 2018-8-11 10:2:17
SetTime . diffhour:0 diffmin:0, diffsec:0
snx_rtc_write_elapsed_second:323: not ready to write time
 save time 2018-08-11
----Normal----------ntp update time success!!!--------------


















id name:SCC_ID

start p2p: /bin/vs/rtj_tran -u admin -p admin -t 80 -i PPCN-552734-ESHEN  -w admin -s EFGBFFBJKDJIGEJIENGKFIEPHMNGDEJOGAEKBJCLBFIGPLKAGPEFDBKAHOLCNMOMBKNNLBCIPMNHEACDMKJMJEFHNNPD -x CSUUAU -v RTJ -c 00
killall: rtj_tran: no process killed
-------[JSY]----------Nov 16 2016 14:55:32-------------------------
[JSY]--------------------------------------g_port = 80

 ==================================
web server accept the qvnet message  read_idx is 239  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:1000001e,0x3333e0,151
QVSendData:239,0
[NET]->src/qv_net_manager.c(58) QV NET LOGIN SUCCESS!! HANDLE:5189968 ip:127.0.0.1
QV_NET_CloseSocket recv



 ==================================
web server accept the qvnet message  read_idx is 176  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000002,0x3333e0,88
QVSendData:176,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 288  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000008,0x3333e0,200
[Image]flip:0, mirror:0
QVSendData:288,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 600  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:1000001c,0x32f2d8,780
QVSendData:868,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 120  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000007,0x3333e0,32
QVSendData:120,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 144  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:1000000e,0x3333e0,56
QVSendData:144,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 144  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:1000000e,0x3333e0,56
QVSendData:144,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 124  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:1000000f,0x3333e0,36
QVSendData:124,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 296  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000133,0x3333e0,208
[ALM]GetRel:almmw:email, V:0
[ALM]GetRel:almmw:ftp, V:0
[ALM]GetRel:almmw:snap, V:0
[ALM]GetRel:almmw:record, V:0
[ALM]GetRel:almmw:ioalmdo, V:0
[ALM]GetRel:almmw:emailsnap, V:0
QVSendData:296,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 600  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000010,0x32f2d8,688
QVSendData:776,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 460  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000001,0x3333e0,372
[sysinfo]Runuptime:totalminutes:0, merror:0  35, 0 day, 0:0
QVSendData:460,0
QV_NET_CloseSocket recv

 ==================================
web server accept the qvnet message  read_idx is 292  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:10000016,0x3333e0,204

QVSendData:292,0
QV_NET_CloseSocket recv
audio start stream 804656
[thread]Create task:vvaudio(stack:262144),1075569856,ret:0
[thread]Create task:vvalm(stack:262144),1075832000,ret:0
Debug: srcs/jsy_common.c CreateIni 33 /etc/ipcamera/conf_jsy/jsyusernum.ini exist

-----------------------nUserNum=3
===>>[JSY] BTBT P2PCamAPI_Initial
Debug: srcs/jsy_sample.c main 1657 stringIp = EBGDEIBIKEJMGAJMEIGEFGEAHCNIHPNDHDFJBGCGAAJELLLCDOADCOPGGNLPJBLNAJMJKFDMOJNJBJCDIL

Debug: srcs/jsy_common.c CreateIni 33 /etc/ipcamera/config_ioalm.ini exist

[AUDIO]->src/qv_audio_stream.c(101) START AUDIO STREAM,Handle:0 804656

 ==================================
web server accept the livestream message  read_idx is 277  content is GET http://127.0.0.1:80/livestream/12?action=play&media=_audio HTTP/1.1
User-Agent: HiIpcam/V100R003 VodClient/1.0.0
Connection: Keep-Alive
Cache-Control: no-cache
Authorization: admin admin
Content-Length: 57

Cseq: 1
Transport: RTP/AVP/TCP;unicast;interleaved=0-1

 ==================================
Process HTTP Streaming
http live server accept a distribute link 26with msg len 277
File[/home/gbh/SN/ipcPPLIB_1212/srcs/libsrc/libmtran/src/sess_http/hi_msession_http.c] Func[HI_HTTP_DistribLink] Line[1838]: SO_SNDBUF default value(50196)
Create task:HTTPLive(stack:262144),1111147728,ret:0

 ==================================
web server accept the qvnet message  read_idx is 92  content is qvnet01
 ==================================
Process HDIPC Config
onCmdCallback:15487132,0x32e460,4
QVSendData:92,0
----------------g_ioType=0
QV_NET_CloseSocket recv

 ==================================
web server accept the livestream message  read_idx is 276  content is GET http://127.0.0.1:80/livestream/14?action=play&media=_data HTTP/1.1
User-Agent: HiIpcam/V100R003 VodClient/1.0.0
Connection: Keep-Alive
Cache-Control: no-cache
Authorization: admin admin
Content-Length: 57

Cseq: 1
Transport: RTP/AVP/TCP;unicast;interleaved=0-1
¦
 ==================================
Process HTTP Streaming
http live server accept a distribute link 28with msg len 276
File[/home/gbh/SN/ipcPPLIB_1212/srcs/libsrc/libmtran/src/sess_http/hi_msession_http.c] Func[HI_HTTP_DistribLink] Line[1838]: SO_SNDBUF default value(50196)
[VOD]MediaFile:12 vod of vschn 12
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[HI_MTMNG_GetMediaInfo] Line[474]: s32Chn(12)
MTMNG: sps pps=Z2RAKawsqAoC/5U=,aO44gA== len 25
the ssrc is :855636226 32fff902
VOD SETUP
MTMNGVarifyUser user=admin, pasword=admin ret = 0
the vod session init after
[VOD]MediaFile:12 vod of vschn 12
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[HI_MTMNG_GetMediaInfo] Line[474]: s32Chn(12)
MTMNG: sps pps=Z2RAKawsqAoC/5U=,aO44gA== len 25
MBUF_Alloc vschn 12 , mbuf chn 1
[VOD]MediaFile:14 vod of vschn 14
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[HI_MTMNG_GetMediaInfo] Line[474]: s32Chn(14)
MTMNG: sps pps=Z2RAKawsqAeAIn5U,aO44gA== len 25
the ssrc is :1749698586 684a481a
VOD SETUP
MTMNGVarifyUser user=admin, pasword=admin ret = 0
the vod session init after
[VOD]MediaFile:14 vod of vschn 14
File[/home/gbh/SN/ipcsn_zhaoyang0823/srcs/ipcam.gk71xx/src/mtmng/hi_mtmng.c] Func[HI_MTMNG_GetMediaInfo] Line[474]: s32Chn(14)
MTMNG: sps pps=Z2RAKawsqAeAIn5U,aO44gA== len 25
MBUF_Alloc vschn 14 , mbuf chn 3
<mbuf>start_addr = 0x334400
mtrans task init the media:4
Vod Play
<mtrans> the fua malloc pack buffer
get the audio frame
Create task:HTTPLive(stack:262144),1111409872,ret:0
<httpd.para>cmd=getptzcfg
====ARGParser:{ ptzcfg -act list  }ARGParser--END
Create thread with 256K stack
VVV_NET_StartStream success:0x55d2e0,0x4f3150
[ALARM]->src/qv_alarm.c(196)  START handle:5624544
<mbuf>start_addr = 0x423ed008
mtrans task init the media:2
Vod Play
<mtrans> the fua malloc pack buffer
get the audio frame
Create thread with 256K stack
VVV_NET_StartStream success:0x555218,0x4f3150
[AUDIO]->src/qv_audio_stream.c(109) START AUDIO STREAM,Handle:5591576 804656

----------s32HttpProcRet =0,s32SendRespRet = 0----------
[Info]client 127.0.0.1 connected (2 client alive) !!!
----------s32HttpProcRet =0,s32SendRespRet = 0----------
[Info]client 127.0.0.1 connected (2 client alive) !!!
Creat Recv Tread 1076094144 ok!
Creat Recv Tread 1075832000 ok!


Debug: srcs/jsy_system.c get_board_type 73 [JSY]--------get boardType=8700,len=4

Debug: srcs/jsy_common.c CreateIni 33 /etc/ipcamera/config_p2pstream.ini exist

----------------g_wifiEnable=-1
Debug: srcs/jsy_common.c CreateIni 33 /etc/ipcamera/conf_jsy/jsy.ini exist

---------Save ----
[thread]Create task:thdRTJListen(stack:262144),1075569856,ret:0
[thread]Create task:thdRTJNet(stack:262144),1076356288,ret:0
[thread]Create task:thdRTJInst(stack:262144),1076618432,ret:0
Debug: srcs/jsy_sample.c main 1779 [JSY]-----------ID = PPCN-552734-ESHEN,IDLEN=17,LC = CSUUAU,LCLEN=6

Debug: srcs/jsy_sample.c main 1780 [JSY]-----------------pPwd = admin

[thread]Create task:rtjdevs(stack:262144),1076880576,ret:0
Debug: srcs/jsy_sample.c main 1790 [JSY] Wait Client Connecting..............................

Thanks ahead of time
 
I am able to get info off the Serial UART connection on Putty and it says that it's looking for "uImage".
It's the rootfs (root file system) that's missing or corrupted, causing the kernel abort.

To recover this, the camera needs to get to a state where the flash memory can be written.
Either way - you need to interrupt the bootloader and find out what flash commands it's equipped with.

A simple and maybe effective thing to try at first:
Interrupt the bootloader.
Use 'printenv' to show the existing environment variables.
Paste the result into a text file to preserve the 'as-is' state.
Look for the 'bootargs' value.
It may be possible to either insert (if it doesn't exist) or alter (if a definition is already there)
init=/bin/sh
which could enable it to boot into a shell access with the ability to mount a network share and re-write mtdblock2
The syntax to set the value for bootargs is
setenv bootargs <all the values it needs to affect how the kernel boots>
saveenv

Also use the 'help' command to show what functionality exists.
 
This is what I get with the variables for the Bricked camera, should i see what the bootargs are for the working camera?

Printenv
Code:
printenv
baudrate=115200
bootargs=console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/linuxrc mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
bootcmd=loadkernel 0x00007FFC 0x0;bootm 0x00008000
bootdelay=0
bootfile=uImage
console_pwd=mmnipcam
ethaddr=00:B0:27:08:90:14
gatewayip=10.19.1.254
ipaddr=192.168.0.124
netmask=255.255.254.0
netretry=3
serverip=192.168.0.120
stderr=serial
stdin=serial
stdout=serial

Environment size: 502/131068 bytes


Help
Code:
?
?       - alias for 'help'
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
devinfo - devinfo
dump    - dump image
erase   - erase FLASH memory
eraseetc- eraseetc
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatupdate- update firmware from fat32 filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print command description/usage
hwcrc16 - hwcrc16 - hardware crc16 calculate

loadb   - load binary file over serial line (kermit mode) and update to flash
loadkernel- loadkernel
loady   - load binary file over serial line (ymodem mode) and update to flash
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spi     - spi - Serial Flash sub-system
tftpboot- boot image via network using TFTP protocol
update  - update image, u-env, factory, u-logo, user, kernel, rootfs-r, rootfs-rw, firmware/firmware_f
upgrade - upgrade board
usb     - USB sub-system
usbboot - boot from USB device
verify  - verify image, flash-info, hw-setting, flash-layout, u-boot, rescue, user, factory, kernel, rootfs-r, u-env
version - print monitor, compiler and linker version
 
See if this gets you to a stable shell prompt:
Code:
setenv bootargs console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/bin/sh mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
saveenv
reset

Do you have an NFS or SMB/CIFS share on your LAN?
 
Do you have an NFS or SMB/CIFS share on your LAN?
I don't believe I do. I do have a NAS that I use as a share folder. (Sorry, my programming knowledge is not too up-there)
I was able to update the bootargs

Code:
printenv
baudrate=115200
bootargs=console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/bin/sh mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
bootcmd=loadkernel 0x00007FFC 0x0;bootm 0x00008000
bootdelay=0
bootfile=uImage
console_pwd=mmnipcam
ethaddr=00:B0:27:08:90:14
gatewayip=10.19.1.254
ipaddr=192.168.0.124
netmask=255.255.254.0
netretry=3
serverip=192.168.0.120
stderr=serial
stdin=serial
stdout=serial

Environment size: 501/131068 bytes
 
See if this gets you to a stable shell prompt:
Code:
setenv bootargs console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/bin/sh mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
saveenv
reset

I'm also noticing that the Ethernet is completely solid, won't blink and Putty now says, "eth0: link down"
 
With the modified bootargs, let it boot up, then scroll back to just after the kernel starts and check the 'kernel command line' for the 'init=/bin/sh' value.
 
With the modified bootargs, let it boot up, then scroll back to just after the kernel starts and check the 'kernel command line' for the 'init=/bin/sh' value.
Code:
U-Boot 2011.09 (Aug 09 2016 - 17:07:22)

DRAM:  64 MiB
MMC:   SD Card not detect
mmci_host_init error - -1

SPI FLASH: 8 MB
In:    serial
Out:   serial
Err:   serial
GPIO[2] is high
Hit any key to stop autoboot:  0
## Booting kernel from Legacy Image at 00008000 ...
   Image Name:   Linux-2.6.35.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1294032 Bytes = 1.2 MiB
   Load Address: 00008000
   Entry Point:  00008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.12 (cwz@vvvsvr) (gcc version 4.5.2 (SONiX GCC-4.5.2 Release 2011-12-06) ) #16 Fri Jul 1 20:27:18 CST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00057177
CPU: VIVT data cache, VIVT instruction cache
Machine: SONiX SN98600 Development Platform
Memory policy: ECC disabled, Data cache writeback
CPU: found ITCM 16k @ ffff4000, enabled
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/bin/sh mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 38816k/38816k available, 26720k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc4800000 - 0xe0000000   ( 440 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc001d000   (  84 kB)
      .text : 0xc001d000 - 0xc0330000   (3148 kB)
      .data : 0xc0344000 - 0xc035cae0   (  99 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:96
Console: colour dummy device 80x30
console [ttyS0] enabled
Calibrating delay loop... 200.29 BogoMIPS (lpj=1001472)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
0x00b00000 bytes system memory reserved for isp device at 0x003fd000
0x00b00000 bytes system memory reserved for vc device at 0x00efd000
bio: create slab <bio-0> at 0
Linux media interface: v0.10
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource ft_clocksource
Switched to NOHz mode on CPU #0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.14)
msgmni has been set to 75
async_tx: api initialized (async)
io scheduler noop registered (default)
SONIX UART driver, (c) 2013 Sonix
snx_uart.0: ttyS0 at MMIO 0x98a00000 (irq = 8) is a SONiX
snx_uart.1: ttyS1 at MMIO 0x98b00000 (irq = 10) is a SONiX
loop: module loaded
5 cmdlinepart partitions found on MTD device snx-spi
Creating 5 MTD partitions on "snx-spi":
0x000000000000-0x000000050000 : "uboot"
0x000000050000-0x0000001b0000 : "kernel"
0x0000001b0000-0x000000790000 : "rootfs"
0x000000790000-0x0000007a0000 : "key"
0x0000007a0000-0x000000800000 : "etc"
snx_spi_init register
SONiX Ethernet driver, (c) 2013 Sonix
eth0: Dropping NETIF_F_SG since no checksum feature.
snx_mac: SNX Ethernet MAC controller at 0x90500000 (irq = 17) 00:b0:27:08:90:14.
snx_mac: IP101G Ethernet PHY 100 Mbps FullDuplex (Auto Negotiation)
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
SONIX SNX I2C adapter driver, (c) 2012 Sonix
snx_i2c.0: SNX I2C0 controller at 0x98300000 (irq = 1)
I2C GPIO driver INIT
snx_i2c.1: SNX I2C1 controller at 0x98400000 (irq = 2)
snx_hdma snx_hdma: SNX AHB DMA Controller (memcpy memset), 4 channels
SNX AHB DMA driver register
ALSA device list:
  No soundcards found.
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
SQUASHFS error: squashfs_read_data failed to read block 0x5a95ce
SQUASHFS error: Unable to read metadata cache entry [5a95ce]
SQUASHFS error: Unable to read inode 0x1185169f
VFS: Cannot open root device "mtdblock2" or unknown-block(31,2)
Please append a correct "root=" boot option; here are the available partitions:
1f00             320 mtdblock0 (driver?)
1f01            1408 mtdblock1 (driver?)
1f02            6016 mtdblock2 (driver?)
1f03              64 mtdblock3 (driver?)
1f04             384 mtdblock4 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[<c0023510>] (unwind_backtrace+0x0/0xf4) from [<c021ca20>] (panic+0x58/0xd4)
[<c021ca20>] (panic+0x58/0xd4) from [<c0008d00>] (mount_block_root+0x1d8/0x29c)
[<c0008d00>] (mount_block_root+0x1d8/0x29c) from [<c0008f48>] (prepare_namespace+0x120/0x178)
[<c0008f48>] (prepare_namespace+0x120/0x178) from [<c00089e4>] (kernel_init+0x110/0x150)
[<c00089e4>] (kernel_init+0x110/0x150) from [<c001f0d0>] (kernel_thread_exit+0x0/0x8)
eth0: link down
 
The first attempt at a stable access to try recovery aims at getting the kernel and a stable shell running.
Quite often, the init=/bin/sh commandline option works.
Without trying to interrupt the bootloader, can you confirm that the modified bootargs is what is showing on the 'kernel command line' that shows shortly after the kernel boots?
Jut scroll back with PuTTY to see it.

I can get a # if i inturrupt boot
Presumably this is the bootloader, or do you mean after the kernel has started?
 
The first attempt at a stable access to try recovery aims at getting the kernel and a stable shell running.
Quite often, the init=/bin/sh commandline option works.
Without trying to interrupt the bootloader, can you confirm that the modified bootargs is what is showing on the 'kernel command line' that shows shortly after the kernel boots?
Jut scroll back with PuTTY to see it.


Presumably this is the bootloader, or do you mean after the kernel has started?
No # after kernel has started.
 
I see your bootup transcript now with the modified bootargs - oddly, it was not there earlier, so apologies for the repeated questions.
It does show that the init=/bin/sh change has not been effective.

This was going to be the second attempt:
In the bootloader, there is a NAND subsystem.
With some care not to execute any commands to erase or format the flash, can you see what subcommands it supports?