HikVision DS-HD1 OpenIPC Notes

HikVision DS-HD1 OpenIPC Notes

FH8830 appears in flash dump and stock firmware boot multiple times.

load mini to 0xa0000000 ...
header_data.u32Magic is 0xea000014
header_data.u32header_len  is 0xe59ff014
header_data.u32RawDataLen is 0xe59ff014

HKVS # bdinfo
arch_number = 0x0000270F
env_t       = 0x00000000
boot_params = 0xA0000100
DRAM bank   = 0x00000000
-> start    = 0xA0000000
-> size     = 0x08000000
ethaddr     = 00:0E:99:02:B2:6B
ip_addr     = 192.0.0.64
baudrate    = 115200 bps

DRAM range
0xA0000000 (2560MiB)
0xA8000000 (2688MiB)
128MB total RAM

Kernel: 0xA1000000 (2576MiB) 16MiB offset
Safe System (mini): 0xA0000000

Ctrl-U to pause u-boot
Set environment vars
	setenv soc fh8833v100
	setenv totalmem 128M
	setenv osmem 32M
	setenv bootargs 'mem=${osmem:-32M} panic=20 root=/dev/mtdblock3 rootfstype=squashfs init=/init mtdparts=hi_sfc:256k(boot),64k(env),2048k(kernel),5120k(rootfs),-(rootfs_data)'
	setenv bootcmd 'setenv setargs setenv bootargs ${bootargs}; run setargs; sf probe 0; sf read 0xA1000000 0x70000 0x200000; bootm 0xA1000000'
	saveenv
Clear the last 16MB of RAM
	mw.b 0xA7000000 ff 0x1000000
Load kernel over serial with xmodem - “loady” is actually xmodem
	loady 0xA7000000 115200
	Press Ctrl-A, then colon to enter command mode
	“exec !! lsx -b -X /path/to/uImage” - might need multiple tries before transfer begins
Erase 2MB of flash starting at ? offset
	sf probe 0
	sf erase ? 0x200000
Copy kernel from RAM to flash
	sf write 0xA7000000 ? ${filesize}