goncalomb / reolink-tools

My explorations, tools and scripts for Reolink hardware (NVR only, for now).
16 stars 2 forks source link

Is this possible to flash firmware by UART? #2

Open greenoaktree opened 6 months ago

greenoaktree commented 6 months ago

Hello, Thanks for your works .

I have a reolink RLN8-410(hardware version:N2MB02 or H3MB18) It does not start up successfully after powering up

I can putty to nvr,and this below is the output:

SPI NAND Flash ID read done Normal Boot [SECURE_INF]: Platform:0x51039 BuildTime:0x5d68d27f

[SECURE_INF]: [SECURE] <<< Check secure boot enable >>>

[SECURE_INF]: <<< Non-Secure Boot >>>

[SECURE_INF]: loader ready to boot 0NA51039 Version 3.0.5 clock change...done PLATFORM_8312 DDR0 1800 4Gbx2 P32 value:0x28 N32 value:0x24 P16 value:0x24 N16 value:0x21 SPI NAND ID code:0xc8 0xd2 0xc8 Copy NAND FDT from addr = 0xa0000 to DRAM offset: 0x1f00000 Load UBOOT image offset: 0x120000. size: 0xe0000

U-Boot 2016.07 (Jan 29 2021 - 17:41:18 +0800) ver 2.0.7

CPU: 1100 MHz DRAM: 256 MiB pwm read 3, set duty = 10 NAND: ID = 0xc8,0xd2,0xc8,0xd2 256 MiB *** Warning - bad CRC, using default environment if not saveenv before

PHY 0xfce00000 = 0x44000786 USB power saving by device mode... end. SCU 0x0 -> 0x83131000


8312 D AXI0: 467 AXI1: 400 AXI2: 350 HCK: 308 CA53:1100 DDR0:1865 CEVA: 600 DDR1: 1865 CODEC:380 DISP0:297 DISP1:270 DISP2: 54 CNN:600

NAND read: device 0 offset 0x0, size 0x20000 131072 bytes read: OK

NAND read: device 0 offset 0x3e00000, size 0x100000 1048576 bytes read: OK jpg_addr=0x2000000; fb addr=0x39a9e000 start JPEG decode end LCD300:0 chooses PLL5_DISP0:297000000 with div=4 (drv:1.0) hdmi_if_init, apply new vid:4 setting. hdmitx_initPhy, clock_rate:74250KHz, ofs 0xE:0x1 Init PHY END Skip InitDDC hdmi: audio stream enable.

begin update imgs. upd_do_read 0x20000 byte from flash:0x4000000 to buf:02000000, lim=0x4000000. load:131072 byte from flash:0x4000000 to memory:02000000, flash totalsize:0x10000000 can used size:0x8000000. show_hex len:64. ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

checking... new test before check imgs:


upgrade file corrupt,skip...
corrupt...
Hit any key to stop autoboot:  0
kernel partition kernel addr = 0x200000, size=0x500000
=>run cmd : nand read 0x2000000 0x200000 0x500000

NAND read: device 0 offset 0x200000, size 0x500000
 5242880 bytes read: OK
=>run cmd : bootm 0x2000000 - 0x1f00000
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-4.9.44
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3023032 Bytes = 2.9 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
=>

```
````
greenoaktree commented 6 months ago

Is this possible to flash the PAK firmware file to flash?

greenoaktree commented 6 months ago

This is the help output:

=> help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootefi - Boots an EFI payload from memory
bootlogo- show lcd bootlogo [hdmi]
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
cpu_test- pld : Use pre load to fatch data via memcpy

crc32   - checksum calculation
dm      - Driver model low level access
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
erase   - erase FLASH memory
eth_init- ethernet init
fdt     - flattened device tree utility commands
fire    - frequency change
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print command description/usage
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mdio    - MDIO utility commands
memtester- memory tester
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
nvt_boot- nvt boot
nvt_bootcmd- nvt bootcmd
nvt_bootm- nvt bootm
nvt_ddr_scan- nvt ddr scan
nvt_ddr_scan_ep- nvt ddr scan ep
nvt_ddr_train- nvt ddr train
nvt_ddr_train_ep- nvt ddr train ep
nvt_dump_data- dump nvt data
nvt_ep  - nvt ep
nvt_heavyload- nvt_heavyload addr times
nvt_read- read data
nvt_read_help- nvt_read command version
pcie    - create pcie-mapping
pcietest- PCIE r/w test
ping    - send ICMP ECHO_REQUEST to network host
power_ctl- nvt power IC control
power_ctl_ep- nvt power IC control
printenv- print environment variables
protect - enable or disable FLASH write protection
pwm     - nvt pwm operation
pwm_ep  - nvt pwm operation
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
thermal - sensor cmd
upgrade - UPGRADE sub-system
version - print monitor, compiler and linker version
=>
greenoaktree commented 6 months ago

I found the script file did not run when power up.