Dahua NVR2108-8P-S2/NVR-NV21A08-P8-S2 Custom Firmware

eviveiro

n3wb
Joined
Oct 11, 2017
Messages
3
Reaction score
2
Hi All,

So I have been working on figuring out how to create my own custom firmware for my Unbranded Dahua NVR-NV21A08-P8-S2 using build root.

The NVR has a Hisilicon Hi3520Dv300 chip in it. Despite the chips name it is not the same as the Hi3520Dv200 chip. Through some research I found that the correct SDK provided by Hisilicon is the Hi3521a SDK. After searching through some chinese sites I came accross the SDK archive Hi3521A_V100R001C01SPC040.rar.

The SDK looks to have everything that is needed and I have proceeded using it to create a buildroot board, adding a few patches, and adding a few more configuration settings. I used the following github as an example on how to setup build root. *Note that the Hi3520D on this github is the v200*

After getting a build successfully compiled in build root, I used the Dahua firmware kit provided on the forums here, to replace the standard romfs with the romfs image created by build root.

I then used a UART CP2102 breakout board to connect to the serial port of the NVR and transferred the new romfs image to the NVR. The serial port on my NVR is labeled J6, I connected TX on the breakout board to pin 1 and RX to pin 2.

Just a bit of extra information but the NVR attempts to download a file in the format ID_<YOUR NVR SERIAL NUBMER>.txt from a tftp server at 192.168.254.254 on boot.

Here are some useful aliases I use from the uboot environment:
Code:
da=tftp 0x82000000 u-boot.bin.img; flwrite
dr=tftp 0x82000000 romfs-x.cramfs.img; flwrite
du=tftp 0x82000000 user-x.cramfs.img; flwrite
dw=tftp 0x82000000 web-x.cramfs.img; flwrite
dl=tftp 0x82000000 logo-x.cramfs.img; flwrite
ds=tftp 0x82000000 slave-x.cramfs.img; flwrite
dc=tftp 0x82000000 custom-x.cramfs.img; flwrite
up=tftp 0x82000000 update.img; flwrite
tk=tftp 0x82000000 uImage; bootm
So it seems like I almost got this working but it fails when it starts booting the kernel.
Perhaps someone on here can point me in the right direction of what to do next? My thoughts are that because the NVR has multiple MTD partitions that its not finding the rootfs or something.

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
hi3521a_map_io [arch/arm/mach-hi3521a/core.c]
V: fe000000 P: 00010000 S: 00400000 T: 00000000
V: fe400000 P: 00012000 S: 00230000 T: 00000000
V: fe700000 P: 00013000 S: 00160000 T: 00000000
hi3521a_map_io [arch/arm/mach-hi3521a/core.c]
hi3521a_init_early [arch/arm/mach-hi3521a/core.c]
hi3521a_gic_init_irq [arch/arm/mach-hi3521a/core.c]
hi3521a_init [arch/arm/mach-hi3521a/core.c]
hi3521a_init [arch/arm/mach-hi3521a/core.c]
hi3521a_init [arch/arm/mach-hi3521a/core.c]
hi3521a_init [arch/arm/mach-hi3521a/core.c]
Booting Linux on physical CPU 0x0
Linux version 3.10.0 (eviveiro@ArchDesktop) (gcc version 4.9.4 (Buildroot 2017.7
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: bigfish
Ignoring tag cmdline (using the default kernel command line)
Memory policy: ECC disabled, Data cache writeback
CPU: All CPU(s) started in SVC mode.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 36793
Kernel command line: mem=145M console=ttyAMA0,115200 root=/dev/mtdblock0 rootfs0
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 145MB = 145MB total
Memory: 140832k/140832k available, 7648k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xc9800000 - 0xff000000 ( 856 MB)
lowmem : 0xc0000000 - 0xc9100000 ( 145 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0008000 - 0xc05538d0 (5423 kB)
.init : 0xc0554000 - 0xc058025c ( 177 kB)
.data : 0xc0582000 - 0xc05b5720 ( 206 kB)
.bss : 0xc05b5720 - 0xc05eb968 ( 217 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
GIC CPU mask not found - kernel will fail to boot.
GIC CPU mask not found - kernel will fail to boot.
sched_clock: 32 bits at 62MHz, resolution 16ns, wraps every 68719ms
Console: colour dummy device 80x30
kmemleak: Kernel memory leak detector disabled
ODEBUG: selftest passed
kmemleak: Early log buffer exceeded (738), please increase DEBUG_KMEMLEAK_EARLYE
Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xc03e2790 - 0xc03e27e8
devtmpfs: initialized
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x12080000 (irq = 38) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x12090000 (irq = 39) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x120a0000 (irq = 40) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi_spi_init->761:
compile time:Nov 5 2017 12:37:47
hi_spi_init->769:

hi_spi_set_platdata->118:

hi_spi_probe->593:

hi3521a_spi_hw_init_cfg->77:

hi-spi-master hi-spi-master.0: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
CPU PMU: probing PMU on CPU 0
hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) �© 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, nod
msgmni has been set to 275
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
hiahci: initializing
ahci ahci.0: can't get clock
ahci: SSS flag set, parallel bus scan disabled
ahci ahci.0: AHCI 0001.0300 32 slots 2 ports 6 Gbps 0x3 impl platform mode
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs boh
scsi0 : ahci_platform
scsi1 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x100 irq 49
ata2: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x180 irq 49
Check Flash Memory Controller v100 ... Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
SPI Nand ID Table Version 1.7
Nand: Unknown AND 128MiB 3,3V 8-bit
Nand(Auto): Block:16KB Page:2KB OOB:64B ECC:4bit/512B Chip:128MB*1
NAND_ECC_NONE selected by board driver. This is not recommended!
hi_spi_setup->430:

hi_spi_setup->430:

Higmac dma_sg_phy: 0x88580000
libphy: higmac_mdio_bus: probed
PHY mdio0:01 not found
ETH0: rgmii, phy_addr=1, mii_name=mdio0
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
before uhci_hcd and ohci_hcd, not after
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 51, io mem 0x10040000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 50, io mem 0x10030000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usb-storage
mousedev: PS/2 mouse device common for all mice
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
oprofile: using timer interrupt.
TCP: cubic registered
NET: Registered protocol family 17
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
ata1.00: ATA-9: WDC WD20PURZ-85GU6Y0, 80.00A80, max UDMA/133
ata1.00: 3907029168 sectors, multi 0: LBA48 NCQ (depth 31/32)
ata1.00: configured for UDMA/133
scsi 0:0:0:0: Direct-Access ATA WDC WD20PURZ-85G 80.0 PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] 3907029168 512-byte logical blocks: (2.00 TB/1.81 TiB)
sd 0:0:0:0: [sda] 4096-byte physical blocks
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPA
sda: unknown partition table
sd 0:0:0:0: [sda] Attached SCSI disk
ata2: SATA link down (SStatus 0 SControl 300)
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] ARM
Modules linked in:
CPU: 0 PID: 283 Comm: kworker/0:1 Not tainted 3.10.0 #1
Workqueue: mtdblock0 mtd_blktrans_work
task: c8d73c00 ti: c8e28000 task.ti: c8e28000
PC is at hifmc100_send_cmd_readstart+0x34/0x1d4
LR is at nand_command_lp+0x210/0x268
pc : [<c02e7078>] lr : [<c02e2148>] psr: 00000113
sp : c8e29d88 ip : 00000000 fp : c90f8000
r10: 00000000 r9 : 00000001 r8 : 00000000
r7 : 00000000 r6 : 00000000 r5 : c8c561f8 r4 : c8c56040
r3 : 00000000 r2 : 00000000 r1 : 00000030 r0 : c8c56048
Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c53c7d Table: 80004059 DAC: 00000015

PC: 0xc02e6ff8:
6ff8 e1a03713 eb03d909 e59f3038 e3a00000 e58a3020 e59430fc e58a302c e59430f4
7018 e58a3030 e28dd008 e8bd87f0 c05a9b10 c04faca4 c04facf9 c0423d18 c04fad1e
7038 c04fad6d c04fada7 c0508c2c e92d4037 e1a04000 e59420dc e2800008 e59430e4
7058 e5945004 e1520003 1a000003 e59420e0 e59430e8 e1520003 0a000060 e594309c
7078 e5933000 e12fff33 e3500000 0a000006 e58d0000 e3a020ad e59f1168 e59f3168
7098 e59f0168 eb03d8e1 ea000054 f57ff04f e3a020bf e59430b4 e5832020 e5d430a2
70b8 e5d420a0 e3530050 11c40abe 03a03010 01c43abe e5d43022 03a00001 e203300f
70d8 e1832582 e5d43020 e2033007 e1823383 f57ff04f e59420b4 e5823030 e5953064

LR: 0xc02e20c8:
20c8 0a000002 e3560c01 1a000021 e8bd87f0 e5943030 e3530000 1a000025 e59f30ac
20e8 e5940054 e5933008 e12fff33 e5943028 e1a00005 e3a01070 e3a02083 e12fff33
2108 e5943028 e1a00005 e3e01000 e3a02081 e12fff33 e5943008 e1a00005 e12fff33
2128 e3100040 0afffffa e8bd87f0 e5943028 e1a00005 e3a01030 e3a02083 e12fff33
2148 e5943028 e1a00005 e3e01000 e3a02081 e12fff33 e5943030 e3530000 1a000004
2168 e59f3028 e5940054 e8bd47f0 e5933008 e12fff13 e59f3014 e59f0014 e5933004
2188 e12fff33 e1a00005 e8bd47f0 eafffebd c059b6d4 0001a36e e92d4ff0 e24dd03c
21a8 e1a08003 e1a06002 e59d7060 e1a05000 e5902020 e59040dc e5973004 e58d2024

SP: 0xc8e29d08:
9d08 c000d7c0 fffffffe 00000000 c003e3c4 c058201c c8d73c00 c0590c20 c0590c20
9d28 c000d7c0 c02e7078 00000113 ffffffff c8e29d74 c0011b98 c8c56048 00000030
9d48 00000000 00000000 c8c56040 c8c561f8 00000000 00000000 00000000 00000001
9d68 00000000 c90f8000 00000000 c8e29d88 c02e2148 c02e7078 00000113 ffffffff
9d88 c8c56040 00000030 00000000 c8c561f8 c8c56428 c02e2148 c8c561f8 c8c56428
9da8 c8532580 c8e29e28 00000000 00000000 00000000 c02e22dc 60000193 c05ab764
9dc8 60000113 00000200 00000000 00000200 c0590818 00000000 00000000 00000040
9de8 00000000 00000000 00000000 00000000 c8d73c00 c8c56428 c05a1474 00000000

FP: 0xc90f7f80:
7f80 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
7fa0 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
7fc0 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
7fe0 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
8000 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
8020 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
8040 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa
8060 aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa

R0: 0xc8c55fc8:
5fc8 c0012038 00000000 00000001 ffff8b74 00000000 00000000 00000000 00000000
5fe8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6008 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6028 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a c8c56428 c8c561f8
6048 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6068 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6088 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
60a8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

R4: 0xc8c55fc0:
5fc0 c05548b8 c03dc040 c0012038 00000000 00000001 ffff8b74 00000000 00000000
5fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6020 00000000 00000000 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a 5a5a5a5a
6040 c8c56428 c8c561f8 00000000 00000000 00000000 00000000 00000000 00000000
6060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6080 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
60a0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

R5: 0xc8c56178:
6178 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
6198 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
61b8 00000000 00000000 00000000 00000000 00000000 00000000 c98e5800 c98e581e
61d8 00000000 c02e7218 c02e73a0 c02e7044 c02e6ccc c02e7780 c02e7684 c02e62b8
61f8 c98e8000 c98e8000 c02e6b80 c02e6c94 c02e7664 c02e7638 c02def84 c02e7704
6218 c02e19e8 c02e3880 c02e74b0 00000000 c02e73c4 c02e1f38 c02e0d9c c02e0094
6238 c02e5370 00000000 c02e03d0 c02e00d0 c02e0368 00000019 000105e1 00000000
6258 0000000b 0000000e 0000000e 0000001b 00000001 00000000 08000000 00000000
Process kworker/0:1 (pid: 283, stack limit = 0xc8e28230)
Stack: (0xc8e29d88 to 0xc8e2a000)
9d80: c8c56040 00000030 00000000 c8c561f8 c8c56428 c02e2148
9da0: c8c561f8 c8c56428 c8532580 c8e29e28 00000000 00000000 00000000 c02e22dc
9dc0: 60000193 c05ab764 60000113 00000200 00000000 00000200 c0590818 00000000
9de0: 00000000 00000040 00000000 00000000 00000000 00000000 c8d73c00 c8c56428
9e00: c05a1474 00000000 00000000 00004000 c8c56428 c8e29ea4 00000000 c02e28cc
9e20: c8e29e28 00000000 00000000 00000200 c88207c0 c0590818 c88207c0 c88207c0
9e40: c90f8000 00000000 00000008 c8c56428 00000200 08000000 00000000 c02d4904
9e60: 00000200 c8e29ea4 c90f8000 00000000 00000200 00000000 c90f8000 00004000
9e80: c8c56428 c8e29ea4 c8545000 c02daa3c 00000200 c8e29ea4 c90f8000 c840c050
9ea0: c8647188 00000000 c840c050 c8647188 00000002 00000000 c8545040 c05a1514
9ec0: c90f8000 c8545010 c05a1514 c02d9ea8 00000000 00000000 c8545000 c840c050
9ee0: 00000000 c8e0dc80 c8545040 c0590344 00000000 c073e000 c8e0dc98 c8e28008
9f00: 00000000 c0035138 00000100 c002b8c0 c059036c a0000193 00000003 c8e0dc80
9f20: c0590344 c0590344 c8e28000 c8e28000 c8e0dc98 c0590354 00000009 c0036240
9f40: c8e0dc80 40000153 c8d73c00 c8c75eac 00000000 c8e0dc80 c003602c 00000000
9f60: 00000000 00000000 00000000 c003a92c aaaaaaaa 00000000 aaaaaaaa c8e0dc80
9f80: 00000000 c8e29f84 c8e29f84 00000000 c8e29f90 c8e29f90 c8e29fac c8c75eac
9fa0: c003a88c 00000000 00000000 c0012038 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 aaaaaaaa aaaaaaaa
[<c02e7078>] (hifmc100_send_cmd_readstart+0x34/0x1d4) from [<c02e2148>] (nand_c)
[<c02e2148>] (nand_command_lp+0x210/0x268) from [<c02e22dc>] (nand_do_read_ops+)
[<c02e22dc>] (nand_do_read_ops+0x13c/0x408) from [<c02e28cc>] (nand_read+0x68/0)
[<c02e28cc>] (nand_read+0x68/0x98) from [<c02d4904>] (mtd_read+0x70/0xa4)
[<c02d4904>] (mtd_read+0x70/0xa4) from [<c02daa3c>] (mtdblock_readsect+0xb4/0xf)
[<c02daa3c>] (mtdblock_readsect+0xb4/0xf0) from [<c02d9ea8>] (mtd_blktrans_work)
[<c02d9ea8>] (mtd_blktrans_work+0x1c0/0x268) from [<c0035138>] (process_one_wor)
[<c0035138>] (process_one_work+0x1f4/0x30c) from [<c0036240>] (worker_thread+0x)
[<c0036240>] (worker_thread+0x214/0x334) from [<c003a92c>] (kthread+0xa0/0xac)
[<c003a92c>] (kthread+0xa0/0xac) from [<c0012038>] (ret_from_fork+0x14/0x3c)
Code: e59430e8 e1520003 0a000060 e594309c (e5933000)
---[ end trace f26dc3ae855a4141 ]---
Kernel panic - not syncing: Fatal exception
 

MacBeton

n3wb
Joined
Jun 6, 2020
Messages
3
Reaction score
0
Location
Latvija
Any progress since?
I would settle to install OpenWRT on some older DVR, just as a Backup server with RSync and FTP.
 
Top