Lorex Cloud LHV221600/LHV2016 Boot Loop Help!

asm340cs

asm340cs

n3wb
Jan 15, 2026
4
0
United States of America
Hi everyone, I’m looking for recovery help on a Lorex Cloud LHV221600 DVR. It may be the same hardware family as LHV2016 (that's the hostname that shows up on LAN), but I’m not 100% sure. Model string I’ve seen in env is deviceid=lhvb11f1e4f6.

Problem​

  • The unit boot loops continuously.
  • Over UART, it progresses through U-Boot and kernel start, then hangs/freezes around FA6/FA7 core bring-up and reboots back into U-Boot.
  • The most repeatable point is right after:
    • wait FA6 core response ok
    • done, FA7 core now is booting.
    • then it resets and starts the full boot sequence again.

​

What I've already checked and tried​

  • Power: tested with a known-good 12V 5A supply, behavior unchanged.
  • Storage: tested with no HDD, and also with a known-good HDD, behavior unchanged.
  • Connected via 3.3V UART, 115200 baud, and can interrupt autoboot into the U-Boot GM # shell by pressing *.
  • U-Boot shows SPI NOR flash:
    • Winbond W25Q256FV (32MB)
  • U-Boot version:
    • U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)

​

TFTP flashing attempt​

  • I set up a Linux box as a TFTP server with dnsmasq.
  • Used tcpdump to see what the DVR requests over TFTP.
  • It requests a device-specific ID file like:
    • ID_ND011601000102.txt
  • I created that file and also success.txt, and confirmed the device reacts to them, it just goes to the #GM shell because I made the ID and success file empty dummy files.
  • I downloaded Lorex firmware .bin files for the LHV2016 family from this pdf.
  • Used binwalk and found an embedded ZIP file and extracted it.
  • Extracted the following images:
    • romfs-x.cramfs.img
    • web-x.cramfs.img
    • custom-x.cramfs.img
    • logo-x.cramfs.img
    • extend-x.cramfs.img
  • For some reason, the packages did not include user-x or slave-x, even though my U-Boot env has du/ds scripts for those.
From printenv, I found the built-in update commands:
  • dr -> romfs
  • dw -> web
  • dc -> custom
  • dl -> logo
  • de -> extend
  • du/ds exist but I do not have matching user-x / slave-x images from the firmware packages I extracted
I ran the following update macros over TFTP:
  • run dl
  • run dc
  • run de
  • run dw
  • run dr
Each one:
  • successfully TFTP-loaded the file
  • passed checks
  • wrote flash
  • rebooted as part of the script
After flashing, the behavior is still the same: it boot loops at the same point during the normal boot flow.

​

Frontboard and watchdog tests​

There are messages in the update scripts about the frontboard. I tested boot behavior with the frontboard ribbon unplugged:
  • If I interrupt autoboot, run wd_disable, and leave the frontboard unplugged, the box can sit at GM # without rebooting.
  • If I let it autoboot into the kernel, it still reaches FA6/FA7 loading and continues the same boot loop.

I really need help figuring out what's happening to this system. Any help and guidance would be greatly appreciated. I can attach full minicom logs, TCP captures from my TFTP server, and other data to help guide towards a solution.
 
asm340cs said:
After flashing, the behavior is still the same: it boot loops at the same point during the normal boot flow.
Click to expand...
What's the serial console showing before the device restarts? There may be an error indication that provides a clue.

I had a similar situation ages ago on a Dahua NVR I bought as 'spares and repairs' on eBay.
Despite successfully flashing the individual partitions as you have done, the problem persisted.
I had avoided flashing the bootloader because if that went wrong, the device would likely not be recoverable - but eventually I did, and then the device booted normally.
On checking what was different, there were a couple of extra items in the kernel command line, as defined in the environment variables held within the bootloader.
I speculated that the owner has flashed incorrect firmware that included the bootloader and associated environment variables.
When the correct firmware excluding the bootloader was successfully applied, the invalid kernel command line still existed and caused a problem.
 
  • Like
Reactions: VorlonFrog and Flintstone61
alastairstevenson said:
What's the serial console showing before the device restarts? There may be an error indication that provides a clue.

I had a similar situation ages ago on a Dahua NVR I bought as 'spares and repairs' on eBay.
Despite successfully flashing the individual partitions as you have done, the problem persisted.
I had avoided flashing the bootloader because if that went wrong, the device would likely not be recoverable - but eventually I did, and then the device booted normally.
On checking what was different, there were a couple of extra items in the kernel command line, as defined in the environment variables held within the bootloader.
I speculated that the owner has flashed incorrect firmware that included the bootloader and associated environment variables.
When the correct firmware excluding the bootloader was successfully applied, the invalid kernel command line still existed and caused a problem.
Click to expand...
Thanks for the response,

Here are the serial console logs of when I flashed the system:

GM # run dl
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'logo-x.cramfs.img'.
Load address: 0x3000000
Loading: #
2 MiB/s
done
Bytes transferred = 12352 (3040 hex)
close frondboard!
Header CRC Checking ... OK
Data CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 12288 Bytes = 12 KiB
Load Address: a1680000
Entry Point: a16c0000
img_addr 0x03000000 write to: 0xa1680000
write : 0%

write : 100%
done
connect frondboard!
resetting ...
0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip

In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address

Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip

32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
usb device not found
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'ID_ND011601000102.txt'.
Load address: 0x3000000
Loading: T T T
TFTP error: 'file /srv/tftp/ID_ND011601000102.txt not found for 192.168.1.108' (1)
Not retrying...
tftp receive failed ,please check net environment
autoup - load update file from server

Usage:
autoup
part_table->offet:0x01680000,part_table->size:0x00040000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip

### CRAMFS loading '/bmp_logo.bmp' to 0x100000
BMPW:400 BMPH:138 bit:16 biSizeImage:110402 bmp_size = 110402
start hdmi polling thread.
HDMI cable not connect
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip

SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x2000000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x2000000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x18100000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x18100000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0xf600000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0xf600000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0x12800000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!

SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0x12800000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/fc7500.bin' to 0x0
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 634436 bytes loaded to 0x0
move ddr map to 0x00000000, offset 0x0, size 0x500000
move ddr map to 0x00000000, offset 0x2000000, size 0x500000
move ddr map to 0x18000000, offset 0x100000, size 0x500000
move ddr map to 0x18000000, offset 0x96000, size 0x4000
move ddr map to 0x00000000, offset 0x3000000, size 0x500000
move ddr map to 0x08000000, offset 0x0, size 0x500000
## Booting kernel from Legacy Image at 02000000 ...
Image Name: gm8210
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2122064 Bytes = 2 MiB
Load Address: 02000000
Entry Point: 02000040
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK
[dahua_env_to_kernel] sec_erase value 2
EP slave: initrd=0x8000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=400M@0x07000000; gmmem=336M console=ttyS0,115200 mem=256M@0x20000000
EP master: initrd=0x3000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=96M@0x01000000 gmmem=30M console=ttyS0,115200 user_debug=3
move ddr map to 0x00000000, offset 0x1000000, size 0x400
move ddr map to 0x10000000, offset 0x0, size 0x400
move ddr map to 0x00000000, offset 0x0, size 0x0
slave: initrd=0x12800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=390M@0x47800000
: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=630M@0x20000000 dh_keyboard=1 load_modules=1 matchinit_mode=530436 env_off=458752 env_size=32768 sec_era=2

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
start to copy FC7500 core boot image at 0x18100000 and wait response...
wait FA6 core response ok
done, FA7 core now is booting.
0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
GM # run dc
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'custom-x.cramfs.img'.
Load address: 0x3000000
Loading: T T T #
1000 Bytes/s
done
Bytes transferred = 4160 (1040 hex)
close frondboard!
Header CRC Checking ... OK
Data CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: a1540000
Entry Point: a1680000
img_addr 0x03000000 write to: 0xa1540000
write : 0%

write : 100%
done
connect frondboard!
resetting ...
%0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
usb device not found
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'ID_ND011601000102.txt'.
Load address: 0x3000000
Loading: T T T
TFTP error: 'file /srv/tftp/ID_ND011601000102.txt not found for 192.168.1.108' (1)
Not retrying...
tftp receive failed ,please check net environment
autoup - load update file from server

Usage:
autoup
part_table->offet:0x01680000,part_table->size:0x00040000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


### CRAMFS loading '/bmp_logo.bmp' to 0x100000
BMPW:400 BMPH:138 bit:16 biSizeImage:110402 bmp_size = 110402
start hdmi polling thread.
HDMI cable not connect
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x2000000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x2000000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x18100000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x18100000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0xf600000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0xf600000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0x12800000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0x12800000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/fc7500.bin' to 0x0
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 634436 bytes loaded to 0x0
move ddr map to 0x00000000, offset 0x0, size 0x500000
move ddr map to 0x00000000, offset 0x2000000, size 0x500000
move ddr map to 0x18000000, offset 0x100000, size 0x500000
move ddr map to 0x18000000, offset 0x96000, size 0x4000
move ddr map to 0x00000000, offset 0x3000000, size 0x500000
move ddr map to 0x08000000, offset 0x0, size 0x500000
## Booting kernel from Legacy Image at 02000000 ...
Image Name: gm8210
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2122064 Bytes = 2 MiB
Load Address: 02000000
Entry Point: 02000040
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK
[dahua_env_to_kernel] sec_erase value 2
EP slave: initrd=0x8000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=400M@0x07000000; gmmem=336M console=ttyS0,115200 mem=256M@0x20000000
EP master: initrd=0x3000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=96M@0x01000000 gmmem=30M console=ttyS0,115200 user_debug=3
move ddr map to 0x00000000, offset 0x1000000, size 0x400
move ddr map to 0x10000000, offset 0x0, size 0x400
move ddr map to 0x00000000, offset 0x0, size 0x0
slave: initrd=0x12800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=390M@0x47800000
: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=630M@0x20000000 dh_keyboard=1 load_modules=1 matchinit_mode=530436 env_off=458752 env_size=32768 sec_era=2

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
start to copy FC7500 core boot image at 0x18100000 and wait response...
wait FA6 core response ok
done, FA7 core now is booting.
À0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
GM # run de
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'extend-x.cramfs.img'.
Load address: 0x3000000
Loading: T T T #
1000 Bytes/s
done
Bytes transferred = 4160 (1040 hex)
close frondboard!
Header CRC Checking ... OK
Data CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: a1800000
Entry Point: a2000000
img_addr 0x03000000 write to: 0xa1800000
write : 0%

write : 100%
done
connect frondboard!
resetting ...
0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
GM # run dw
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'web-x.cramfs.img'.
Load address: 0x3000000
Loading: T T T #################################################################
########################################
398.4 KiB/s
done
Bytes transferred = 1540160 (178040 hex)
close frondboard!
Header CRC Checking ... OK
Data CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 1540096 Bytes = 1.5 MiB
Load Address: a1340000
Entry Point: a1360000
img_addr 0x03000000 write to: 0xa1340000
write : 0%

write : 0%

write : 4%

write : 8%

write : 12%

write : 16%

write : 20%

write : 25%

write : 29%

write : 33%

write : 37%

write : 41%

write : 45%

write : 50%

write : 54%

write : 58%

write : 62%

write : 66%

write : 70%

write : 75%

write : 79%

write : 83%

write : 87%

write : 91%

write : 100%
done
connect frondboard!
resetting ...
''0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
GM # run dr
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'romfs-x.cramfs.img'.
Load address: 0x3000000
Loading: T T T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
####################################
1.4 MiB/s
done
Bytes transferred = 13881408 (d3d040 hex)
close frondboard!
Header CRC Checking ... OK
Data CRC Checking ... OK
Image Name: 32Mgm8210Dromfs
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 13881344 Bytes = 13.2 MiB
Load Address: a0080000
Entry Point: a1340000
img_addr 0x03000000 write to: 0xa0080000
write : 0%

write : 0%

write : 0%

write : 0%

write : 1%

write : 1%

write : 2%

write : 2%

write : 3%

write : 3%

write : 4%

write : 4%

write : 5%

write : 5%

write : 6%

write : 6%

write : 7%

write : 7%

write : 8%

write : 8%

write : 8%

write : 9%

write : 9%

write : 10%

write : 10%

write : 11%

write : 11%

write : 12%

write : 12%

write : 13%

write : 13%

write : 14%

write : 14%

write : 15%

write : 15%

write : 16%

write : 16%

write : 16%

write : 17%

write : 17%

write : 18%

write : 18%

write : 19%

write : 19%

write : 20%

write : 20%

write : 21%

write : 21%

write : 22%

write : 22%

write : 23%

write : 23%

write : 24%

write : 24%

write : 25%

write : 25%

write : 25%

write : 26%

write : 26%

write : 27%

write : 27%

write : 28%

write : 28%

write : 29%

write : 29%

write : 30%

write : 30%

write : 31%

write : 31%

write : 32%

write : 32%

write : 33%

write : 33%

write : 33%

write : 34%

write : 34%

write : 35%

write : 35%

write : 36%

write : 36%

write : 37%

write : 37%

write : 38%

write : 38%

write : 39%

write : 39%

write : 40%

write : 40%

write : 41%

write : 41%

write : 41%

write : 42%

write : 42%

write : 43%

write : 43%

write : 44%

write : 44%

write : 45%

write : 45%

write : 46%

write : 46%

write : 47%

write : 47%

write : 48%

write : 48%

write : 49%

write : 49%

write : 50%

write : 50%

write : 50%

write : 51%

write : 51%

write : 52%

write : 52%

write : 53%

write : 53%

write : 54%

write : 54%

write : 55%

write : 55%

write : 56%

write : 56%

write : 57%

write : 57%

write : 58%

write : 58%

write : 58%

write : 59%

write : 59%

write : 60%

write : 60%

write : 61%

write : 61%

write : 62%

write : 62%

write : 63%

write : 63%

write : 64%

write : 64%

write : 65%

write : 65%

write : 66%

write : 66%

write : 66%

write : 67%

write : 67%

write : 68%

write : 68%

write : 69%

write : 69%

write : 70%

write : 70%

write : 71%

write : 71%

write : 72%

write : 72%

write : 73%

write : 73%

write : 74%

write : 74%

write : 75%

write : 75%

write : 75%

write : 76%

write : 76%

write : 77%

write : 77%

write : 78%

write : 78%

write : 79%

write : 79%

write : 80%

write : 80%

write : 81%

write : 81%

write : 82%

write : 82%

write : 83%

write : 83%

write : 83%

write : 84%

write : 84%

write : 85%

write : 85%

write : 86%

write : 86%

write : 87%

write : 87%

write : 88%

write : 88%

write : 89%

write : 89%

write : 90%

write : 90%

write : 91%

write : 91%

write : 91%

write : 92%

write : 92%

write : 93%

write : 93%

write : 94%

write : 94%

write : 95%

write : 95%

write : 96%

write : 96%

write : 97%

write : 97%

write : 98%

write : 98%

write : 99%

write : 100%
done
connect frondboard!
resetting ...
'0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
usb device not found
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'ID_ND011601000102.txt'.
Load address: 0x3000000
Loading: T T T
TFTP error: 'file /srv/tftp/ID_ND011601000102.txt not found for 192.168.1.108' (1)
Not retrying...
tftp receive failed ,please check net environment
autoup - load update file from server

Usage:
autoup
part_table->offet:0x01680000,part_table->size:0x00040000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


### CRAMFS loading '/bmp_logo.bmp' to 0x100000
BMPW:400 BMPH:138 bit:16 biSizeImage:110402 bmp_size = 110402
start hdmi polling thread.
HDMI cable not connect
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x2000000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x2000000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x18100000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x18100000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0xf600000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0xf600000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0x12800000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0x12800000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/fc7500.bin' to 0x0
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 634436 bytes loaded to 0x0
move ddr map to 0x00000000, offset 0x0, size 0x500000
move ddr map to 0x00000000, offset 0x2000000, size 0x500000
move ddr map to 0x18000000, offset 0x100000, size 0x500000
move ddr map to 0x18000000, offset 0x96000, size 0x4000
move ddr map to 0x00000000, offset 0x3000000, size 0x500000
move ddr map to 0x08000000, offset 0x0, size 0x500000
## Booting kernel from Legacy Image at 02000000 ...
Image Name: gm8210
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2122064 Bytes = 2 MiB
Load Address: 02000000
Entry Point: 02000040
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK
[dahua_env_to_kernel] sec_erase value 2
EP slave: initrd=0x8000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=400M@0x07000000; gmmem=336M console=ttyS0,115200 mem=256M@0x20000000
EP master: initrd=0x3000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=96M@0x01000000 gmmem=30M console=ttyS0,115200 user_debug=3
move ddr map to 0x00000000, offset 0x1000000, size 0x400
move ddr map to 0x10000000, offset 0x0, size 0x400
move ddr map to 0x00000000, offset 0x0, size 0x0
slave: initrd=0x12800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=390M@0x47800000
: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=630M@0x20000000 dh_keyboard=1 load_modules=1 matchinit_mode=530436 env_off=458752 env_size=32768 sec_era=2

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
start to copy FC7500 core boot image at 0x18100000 and wait response...
wait FA6 core response ok
done, FA7 core now is booting.
'0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 0
GM # 0cmp okSYSTEM go.................set ddr1 arg




Here is the boot sequence post flash:

GM # ���0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip






In: serial
Out: serial
Err: serial

-------------------------------
ID:82101100
AC: 360 HC: 332 P1:1080 P4: 996
C7: 996 C6: 720 DR:1440
J: 332 H1: 360 H2: 360
-------------------------------
Net: eth0 [PRIME], eth1
Warning: failed to set MAC address


Found slave GM8210 device, prepare booting sequence...
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip



32M
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
nice on GMAC0 found PHYID 0x00221620
hwid_gpio_val=0x11B
Hit any key to stop autoboot: 3 2 1 0
usb device not found
KSZ9031 found Phy ID = 0x00221622
FULL
PHY_SPEED_100M
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.108
Filename 'ID_ND011601000102.txt'.
Load address: 0x3000000
Loading: *T T T
TFTP error: 'file /srv/tftp/ID_ND011601000102.txt not found for 192.168.1.108' (1)
Not retrying...
tftp receive failed ,please check net environment
autoup - load update file from server

Usage:
autoup
part_table->offet:0x01680000,part_table->size:0x00040000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


### CRAMFS loading '/bmp_logo.bmp' to 0x100000
BMPW:400 BMPH:138 bit:16 biSizeImage:110402 bmp_size = 110402
start hdmi polling thread.
HDMI cable not connect
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x2000000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x2000000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/boot/uImage' to 0x18100000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 2122128 bytes loaded to 0x18100000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0xf600000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0xf600000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/rootfs_ramfs' to 0x12800000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 1410461 bytes loaded to 0x12800000
part_table->offet:0x00080000,part_table->size:0x012c0000
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs loading '/slave/fc7500.bin' to 0x0
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip
compressor use:lzma
### squashfs load complete: 634436 bytes loaded to 0x0
move ddr map to 0x00000000, offset 0x0, size 0x500000
move ddr map to 0x00000000, offset 0x2000000, size 0x500000
move ddr map to 0x18000000, offset 0x100000, size 0x500000
move ddr map to 0x18000000, offset 0x96000, size 0x4000
move ddr map to 0x00000000, offset 0x3000000, size 0x500000
move ddr map to 0x08000000, offset 0x0, size 0x500000
## Booting kernel from Legacy Image at 02000000 ...
Image Name: gm8210
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2122064 Bytes = 2 MiB
Load Address: 02000000
Entry Point: 02000040
Verifying Checksum ... OK
XIP Kernel Image ... OK
OK
[dahua_env_to_kernel] sec_erase value 2
EP slave: initrd=0x8000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=400M@0x07000000; gmmem=336M console=ttyS0,115200 mem=256M@0x20000000
EP master: initrd=0x3000000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=96M@0x01000000 gmmem=30M console=ttyS0,115200 user_debug=3
move ddr map to 0x00000000, offset 0x1000000, size 0x400
move ddr map to 0x10000000, offset 0x0, size 0x400
move ddr map to 0x00000000, offset 0x0, size 0x0
slave: initrd=0x12800000,0x300000 ramdisk_size=10240 root=/dev/ram rw init=/init mem=256M@0x10000000 gmmem=190M console=ttyS0,115200 mem=390M@0x47800000
: mem=240M@0x01000000 gmmem=50M console=ttyS0,115200 user_debug=31 init=/squashfs_init root=/dev/mtdblock1 rootfstype=squashfs mem=630M@0x20000000 dh_keyboard=1 load_modules=1 matchinit_mode=530436 env_off=458752 env_size=32768 sec_era=2

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
start to copy FC7500 core boot image at 0x18100000 and wait response...
wait FA6 core response ok
done, FA7 core now is booting. <---- THIS IS WHERE IT HALTS AND BEGINS THE BOOT LOOP
��0cmp okSYSTEM go.................set ddr1 arg
DR 1.6 2GB
Test addr: 0x0, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
Test addr: 0x20000000, len = 0x100000
Test pass, pattern 0x5a5a5a5a, 0xa5a5a5a5
MP SPI-NOR Bootstrap v0.3
SPI020 Revision:0x10001
SPI flash ID code:ef 40 19
Boot image offset: 0x5000. size: 0x4b000. Booting Image .....


U-Boot 2013.01-svn2178 (May 27 2016 - 14:03:50)svn:2178

I2C: ready
DRAM: 2 GiB
ROM CODE has enable I cache

Init 8210 PCIe RC...done

Init 8312 PCIe RC...done

SPI mode
SF: Got idcodes
00000000: ef 40 19 00 .@..
sector erase support!


SF: Detected W25Q256FV with page size 64 KiB, total 32 MiB
flash is 4byte mode
WINBOND chip


If these logs don't give enough info, I can paste more minicom logs.
 
asm340cs said:
If these logs don't give enough info, I can paste more minicom logs.
Click to expand...
I didn't see any clues as to why when the uImage is booted it resets straight back to the bootloader without any messages as to why.
I don't really follow the memory mapping, though this would have to be closely linked to the specific hardware with matching firmware.
 
alastairstevenson said:
What specific change if any caused the boot loop to start?

How have you selected the firmware to apply, and how have you confirmed it's a correct match for the DVR?
Click to expand...
I do not know what caused the boot loop to start, the unit was sitting in my attic and running fine for a while until around late December when I noticed that I couldn't access the video feed and I heard beeping. I never attempted to manually update firmware, the closest guess I have is that maybe a power outage happened during some write operation and caused this to happen.

To select firmware, I initially looked up "LHV221600 firmware image" or "LHV221600 firmware bin". I couldn't find anything on that model string, but I realized on my router the DVR hostname had "LHV2016" in it and after some research, I learned that LHV2016 and LHV221600 both refer to the same 16 channel 1080p DVR by Lorex. After learning that I searched up "LHV2016 firmware" and found multiple URLs from official Lorex USA website, I used this link: which had a whole table of Lorex cloud models and their corresponding firmware, and i found a file for LHV2016.

It was a .bin, and i used binwalk on my linux box to extract it and found a zip file embedded in it and extracted the .img files from it.

There really isn't much on this specific unit online, but I believe its basically a rebranded Dahua unit because they owned Lorex for some time till recently.
 
I flashed the bootloader, it flashed successfully and went back to default env variables, but the issue persists.
Now, instead of boot looping, it just hangs at "done, FA7 core now is booting." and during the hang, it makes one short beep.

Any help would be greatly appreciated!
 
  • Sad
Reactions: alastairstevenson
You must log in or register to reply here.
Top Bottom