Linux Device Hacking - uBoot

Re: Iomega ix2-200ng U-boot needed

bodhi — Thu, 12 Mar 2026 14:43:08 -0500

Lewis65,

> If I tried with an ix4-200, I might be able to
> download BootROM v.1.21. ?

BootROM = Boot Read-Only Memory.

With these old Kirkwood boxes, if you can't kwboot, then last resort would be JTAG.

See the Wiki threads

Quote

Repair Pogo E02 with Raspberry PI (JTAG) and OpenOCD

Unbricking Dockstar with JTAG and OpenOCD

Netgear Stora JTAG Pinout

This box and the Pogo E02 is almost identical. So use the first topic. The JTAG header (20-pin header) usually unpopulated and needs to be soldered.

Re: Iomega ix2-200ng U-boot needed

Lewis65 — Thu, 12 Mar 2026 12:47:07 -0500

Ok, Bodhi,
Never give up!

If I tried with an ix4-200, I might be able to download BootROM v.1.21. ?

Re: Iomega ix2-200ng U-boot needed

bodhi — Wed, 11 Mar 2026 14:31:46 -0500

Lewis65,

> Marvell>> md ff00003c
> ff00003c: 00000111

Bad news! this olderBootROM version does not support kwboot. The good BootROM is version 1.21 (i.e. 00000121).

Re: Iomega ix2-200ng U-boot needed

Lewis65 — Wed, 11 Mar 2026 05:45:36 -0500

...ok I will try next days!
MyOp

Marvell>> md ff00003c
ff00003c: 00000111 e3a00000 e59f222c e5921000 ........,"......
ff00004c: e2013008 e3530000 1a000002 e3811008 .0....S.........
ff00005c: e5821000 e5921000 e3a03000 ee2f3f1b .........0...?/.
ff00006c: e59f2208 e5921000 e3c11cff e3c110ff ."..............
ff00007c: e3710801 1a000003 e5921000 e3c114ff ..q.............
ff00008c: e3c118ff e5821000 e59f21e0 e5922000 .........!... ..
ff00009c: e3a01902 e0112002 0a00000b e59f21d0 ..... .......!..
ff0000ac: e5921000 e3c11080 e5821000 e59f21c4 .............!..
ff0000bc: e5921000 e3c11080 e5821000 e59f21b8 .............!..
ff0000cc: e5921000 e3c1120f e5821000 e10f5000 .............P..
ff0000dc: e3c5501f e38550d3 e121f005 e3a05000 .P...P....!..P..
ff0000ec: ee075f17 ee075f16 ee075f15 ee085f17 ._..._..._..._..
ff0000fc: e59f2174 e3a03010 e5924000 e1c44003 t!...0...@...@..
ff00010c: e5824000 ee3f1f11 e3811505 ee2f1f11 .@....?......./.
ff00011c: e3a04003 ee034f10 e59f4160 ee024f10 .@...O..`A...O..
ff00012c: e3a03601 e3a02000 e3a01d06 e59f0150 .6... ......P...
Marvell>>

Done! ...and now?

Re: Iomega ix2-200ng U-boot needed

bodhi — Tue, 10 Mar 2026 16:35:06 -0500

Also, if you can run picocom as normal serial console, then run it, interrupt u-boot count down, and

md ff00003c

The above command dumps the BootROM version. If it is too old, then kwboot will not work.

Re: Iomega ix2-200ng U-boot needed

bodhi — Tue, 10 Mar 2026 14:47:43 -0500

Lewis65,

> I have discover that yours mtd files are for NAND
> BOOT because first byte is 0x8B.
> The UART BOOT mtd have 0x69 as first byte and I
> wan try to upload this with kwboot.

No. The NAND version should be used. kwboot patches the header to 0x69 when it starts running.

Please post the log of kwboot execution you did.

Re: Stock env for Zyxel NSA310

bodhi — Tue, 10 Mar 2026 14:45:48 -0500

jurop,

> Is it wrong made a boot usb or is it a wrong
> u-boot env configuration?

The USB rootfs was not prepared correctly.

Quote
https://forum.doozan.com/read.php?2,12096

Latest released kernel: linux-6.18.10-kirkwood-tld-1-bodhi.tar.bz2 (15 Feb 2026)
Latest released rootfs: Debian-6.5.7-kirkwood-tld-1-rootfs-bodhi.tar.bz2 (01 Nov 2023)

Note: If this is your first time installation, then you only need rootfs Debian-6.5.7-kirkwood-tld-1-rootfs-bodhi.tar.bz2 (this has kernel linux-6.5.7-kirkwood-tld-1 already installed). Please scroll down to 01 Nov 2023 section for download link and installation instruction.

So redo the rootfs following the instruction at 01 Nov 2023 section.

Re: Iomega ix2-200ng U-boot needed

Lewis65 — Tue, 10 Mar 2026 11:47:27 -0500

Hi Bodhi,

I have discover that yours mtd files are for NAND BOOT because first byte is 0x8B.
The UART BOOT mtd have 0x69 as first byte and I wan try to upload this with kwboot.

In new unit I wish copy correct mtd :

Welcome to CenterPoint.
ix2-200-KBS2YYR login: root
Password:
root@ix2-200-KBS2YYR:/# cd /tmp
root@ix2-200-KBS2YYR:/tmp# ls
auditLine logrotate.status resolv.conf.old sohoRAM.xml
cups netplugd.log samba sohoRAM.xml~
dm.fifo.in netplugd.pid smbd.events sohoSchedule.xml
firmware_details resolv.conf snmpinfo.log sohoSchedule.xml~
hotplug.in resolv.conf.dhclient-eth1 sohoAlerts.xml status
interface resolv.conf.merge sohoAlerts.xml~
root@ix2-200-KBS2YYR:/tmp# cat /proc/mtd
dev: size erasesize name
mtd0: 000c0000 00004000 "uboot"
mtd1: 00020000 00004000 "env"
mtd2: 00300000 00004000 "zImage"
mtd3: 00300000 00004000 "initrd"
root@ix2-200-KBS2YYR:/tmp# dd if=/dev/mtd0 of=/tmp/u-boot-dump.kwb bs=512 count=1
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.00027789 s, 1.8 MB/s
root@ix2-200-KBS2YYR:/tmp# cp /tmp/u-boot-dump.kwb ./u-boot-uart.kwb
root@ix2-200-KBS2YYR:/tmp#
v=syncx2-200-KBS2YYR:/tmp# printf '\x69' | dd of=u-boot-uart.kwb bs=1 count=1 conv=sync
1+0 records in
1+0 records out
1 byte (1 B) copied, 0.000113705 s, 8.8 kB/s
root@ix2-200-KBS2YYR:/tmp#
root@ix2-200-KBS2YYR:/tmp# ls -ahl
total 80K
drwxrwxrwt 4 root root 540 Mar 10 09:39 .
drwxrwxrwt 17 root root 500 Mar 10 09:30 ..
-rw-r--r-- 1 root root 4 Mar 10 09:30 auditLine
drwxrwxr-x 2 root nobody 120 Mar 10 09:30 cups
p-w--w--w- 1 root root 0 Mar 10 09:30 dm.fifo.in
-rw-r--r-- 1 root root 32 Mar 10 09:29 firmware_details
p--------- 1 root root 0 Mar 10 09:30 hotplug.in
-rw-r--r-- 1 root root 10 Mar 10 09:30 interface
-rw-r--r-- 1 root root 421 Mar 10 09:39 logrotate.status
-rw-r--r-- 1 root root 1.9K Aug 16 1932 netplugd.log
-rw-r--r-- 1 root root 5 Aug 16 1932 netplugd.pid
-rw-r--r-- 1 root root 25 Aug 16 1932 resolv.conf
-rw-r--r-- 1 root root 89 Aug 16 1932 resolv.conf.dhclient-eth1
-rw-r--r-- 1 root root 25 Aug 16 1932 resolv.conf.merge
-rw-r--r-- 1 root root 25 Aug 16 1932 resolv.conf.old
drwxr-xr-x 4 root root 600 Mar 10 09:38 samba
p--------- 1 root root 0 Mar 10 09:30 smbd.events
-rw-r--r-- 1 root root 51 Mar 10 09:30 snmpinfo.log
-rw-rw-rw- 1 root root 368 Mar 10 09:39 sohoAlerts.xml
-rw-r--r-- 1 root root 367 Mar 10 09:39 sohoAlerts.xml~
-rw-r--r-- 1 root root 615 Mar 10 09:30 sohoRAM.xml
-rw-r--r-- 1 root root 661 Mar 10 09:30 sohoRAM.xml~
-rw-r--r-- 1 root root 232 Mar 10 09:31 sohoSchedule.xml
-rw-r--r-- 1 root root 231 Mar 10 09:31 sohoSchedule.xml~
-rw-r--r-- 1 root root 332 Mar 10 09:39 status
-rw-r--r-- 1 root root 512 Mar 10 09:37 u-boot-dump.kwb
-rw-r--r-- 1 root root 512 Mar 10 09:39 u-boot-uart.kwb
root@ix2-200-KBS2YYR:/tmp#

...now how can I export the kwb file? If I insert a USB key it reboots and I can't even use WinSCP...
.-( thanks

Re: Stock env for Zyxel NSA310

jurop — Tue, 10 Mar 2026 04:17:11 -0500

bodhi Wrote:
-------------------------------------------------------
> jurop,
>
> > It is possible get the env from the flash?
>
> Not likely, but let's try this.
>
> Cold start (recycle power), interrupt count down
> and
>

> printenv
>

> and post the entire serial console log here.
>
> > NSA310 has started correct but in UART i can
> not
> > boot from TFTP and any ping. I have set ipaddr,
> > gatewayip, serverip.
>
> IIRC, I don't think this stock u-boot has network
> capability. You could try the latest Debian rootf
> on USB, see this post:
>
> https://forum.doozan.com/read.php?2,139998

I tried to create a USB according to the instructions and the kernel panicked:

Begin: Loading essential drivers ... done.
Begin: Running /scripts/init-premount ... done.
Begin: Mounting root file system ... Begin: Running /scripts/nfs-top ... done.
Begin: Running /scripts/nfs-premount ... done.
Begin: Waiting up to 180 secs for any network device to become available ... Failure: Network device did not appear in time
done.
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no devices to configure
ipconfig: no dev[ 189.313695][ T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200
[ 189.322663][ T1] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.18.10-kirkwood-tld-1 #4 NONE a0f4bd7277a1fb453850e5ebd33a1d95fce82224
[ 189.334997][ T1] Hardware name: Marvell Kirkwood (Flattened Device Tree)
[ 189.341999][ T1] Call trace:
[ 189.342014][ T1] unwind_backtrace from show_stack+0x10/0x14
[ 189.351236][ T1] show_stack from vpanic+0xc0/0x29c
[ 189.356423][ T1] vpanic from panic+0x28/0x2c
[ 189.361080][ T1] panic from do_exit+0x204/0x8ec
[ 189.366007][ T1] do_exit from sys_exit_group+0x0/0x14
[ 189.371457][ T1] sys_exit_group from sys_exit_group+0x10/0x14
[ 189.377604][ T1] sys_exit_group from ret_fast_syscall+0x0/0x44
[ 189.383838][ T1] Exception stack(0x90819fa8 to 0x90819ff0)
[ 189.389626][ T1] 9fa0: 006575a0 00000004 00000002 00000000 00000002 00657190
[ 189.398555][ T1] 9fc0: 006575a0 00000004 00000001 000000f8 00000000 76effd80 00000000 005544a8
[ 189.407481][ T1] 9fe0: 00555acc 7ecee9e8 004ce8c4 76e02544
[ 189.413271][ T1] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200 ]---
ices to configure
/init: .: line 384: can't open '/run/net-*.conf': No such file or directory

Is it wrong made a boot usb or is it a wrong u-boot env configuration?

Re: Any tips for getting a PA-220 to boot Linux?

rayknight — Sun, 08 Mar 2026 23:51:47 -0500

Google search seems to indicate that this device is based on a Cavium Octeon CN7130 SOC. If this is correct then Linux support is possible. The Cavium Octeon devices are supported by OpenWrt, so you should start there. Look at the approach used for the Ubiquiti Edgerouter which makes use of the device tree file supplied by U-Boot.

Ray

Any tips for getting a PA-220 to boot Linux?

duress — Sun, 08 Mar 2026 19:54:38 -0500

I recently bought a retired Palo Alto PA-220 hardware firewall, it appears not to have a working copy of the factory OS on it, but I understand these are supposed to be uBoot based devices.
I'm not very experienced with hacking SoC devices like this. I'm wondering if it's possible to get this thing to boot Linux, but I'm not quite sure where to start.
Does anyone have experience with these machines, or any pointers about how to get started on a project like this?

Re: Pogo V3 Pro internal Dual SD Card (USB 2.0) using mPCIe slot

bodhi — Sun, 08 Mar 2026 15:07:28 -0500

echowarrior108,

> I am recovering well and happy to report that! Have
> a great day!

Happy to hear that! wishing you the best of good health.

Re: Pogo V3 Pro internal Dual SD Card (USB 2.0) using mPCIe slot

echowarrior108 — Sun, 08 Mar 2026 11:46:44 -0500

Hi, It has been a long while, the duel drives are still running and operational, my sebatical was due to a heart issue, I had an aortic valve replacement last year and focused on that, however the pogoplug with the safe drives ran 24/7 lol. I am recovering well and happy to report that! Have a great day!

Re: Iomega ix4-200d U-Boot

bodhi — Sat, 07 Mar 2026 15:45:43 -0600

Sash,

OK. It seems there is some problem in mainline with using the controller Marvell 88SE6121 for Kirwood SoC. I'm reading a related u-boot patch to see what was done.

Let's switch gear. Could you try booting Debian rootfs on USB?

1. Create the USB rootfs using Debian-6.5.7-kirkwood-tld-1-rootfs-bodhi.tar.bz2 (01 Nov 2023).

2. Copy the boot script in the u-boot tarball uboot.2025.10-tld-1.ix4_200d.bodhi.260305.tar to the rootfs

cd /media/sdb1/boot   # assuming the USB drive was mounted as /media/sdb1
cp -a uboot.2025.10-tld-1.ix4_200d.boot.scr boot.scr
sync

3.Unmount and bring the USB rootfs to this box. Attach it to the same port you were using for testing.

4. Repeat the kwboot with uboot.2025.10-tld-1.ix4_200d.kwb. This time just let it boot automatically.

See if it will boot all the way to the Debian login prompt.

Please post the entire serial console log here.

Re: Iomega ix4-200d U-Boot

Sash — Sat, 07 Mar 2026 05:25:59 -0600

@bodhi

nope. also freezes.

IX4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 scsi          0  [   ]   ahci_scsi             |                   `-- ahci_scsi
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [   ]   ehci_mvebu            |   |-- usb@50000
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [   ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [   ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 bootstd       0  [   ]   bootstd_drv           |-- bootstd
 bootmeth      0  [   ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [   ]   bootmeth_script       |   |-- script
 bootmeth      2  [   ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d> scsi scan
scanning bus for devices...
Target spinup took 0 ms.
Target spinup took 0 ms.
SATA link 2 timeout.
AHCI 0001.0000 32 slots 3 ports 3 Gbps 0x7 impl SATA mode
flags: 64bit ncq stag led pmp slum part

port 1

X4-200d> mdio list
ethernet-controller@72000:
8 - Marvell 88E1118R <--> ethernet-controller@72000
ethernet-controller@76000:
IX4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00, 100baseT, FDX
IX4-200d> setenv ipaddr 192.168.2.33
IX4-200d> setenv ethact egiga0
IX4-200d> ping 192.168.2.222
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Using ethernet-controller@72000 device

ARP Retry count exceeded; starting again
ping failed; host 192.168.2.222 is not alive
IX4-200d> setenv ipaddr 192.168.2.33
IX4-200d> setenv ethact egiga1
IX4-200d> ping 192.168.2.222
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Using ethernet-controller@72000 device

ARP Retry count exceeded; starting again
ping failed; host 192.168.2.222 is not alive
IX4-200d> mdio list
ethernet-controller@72000:
8 - Marvell 88E1118R <--> ethernet-controller@72000
ethernet-controller@76000:
IX4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00, 100baseT, FDX
IX4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 scsi          0  [   ]   ahci_scsi             |                   `-- ahci_scsi
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [   ]   ehci_mvebu            |   |-- usb@50000
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [   ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [   ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 bootstd       0  [   ]   bootstd_drv           |-- bootstd
 bootmeth      0  [   ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [   ]   bootmeth_script       |   |-- script
 bootmeth      2  [   ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d>

port 2

X4-200d> mdio list
ethernet-controller@72000:
8 - Marvell 88E1118R <--> ethernet-controller@72000
ethernet-controller@76000:
IX4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00, 100baseT, FDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
IX4-200d> setenv ipaddr 192.168.2.44
IX4-200d> setenv ethact egiga0
IX4-200d> ping 192.168.2.222
Using ethernet-controller@72000 device
host 192.168.2.222 is alive
IX4-200d> mdio list
ethernet-controller@72000:
8 - Marvell 88E1118R <--> ethernet-controller@72000
ethernet-controller@76000:
IX4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00, 100baseT, FDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
IX4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 scsi          0  [   ]   ahci_scsi             |                   `-- ahci_scsi
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [   ]   ehci_mvebu            |   |-- usb@50000
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [   ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [   ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 bootstd       0  [   ]   bootstd_drv           |-- bootstd
 bootmeth      0  [   ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [   ]   bootmeth_script       |   |-- script
 bootmeth      2  [   ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d>

Re: Iomega ix4-200d U-Boot

bodhi — Fri, 06 Mar 2026 21:58:46 -0600

Sash,

Could you repeat these tests.

Instead of reset, do scsi scan (preferably with 4 HDDs, but individually is OK)

dm tree
scsi scan
scsi part

And then redo egiga0 test because it was not done correctly

Quote

port 1
IX4-200d> setenv ipaddr 192.168.2.33
Unknown command 'setenv' - try 'help'
IX4-200d> setenv ethact egiga0
IX4-200d> ping 192.168.2.222
*** ERROR: `ipaddr' not set

mdio list
mii info
setenv ipaddr 192.168.2.33
setenv ethact egiga0
ping 192.168.2.222
mdio list
mii info
dm tree

Re: Iomega ix4-200d U-Boot

Sash — Fri, 06 Mar 2026 16:18:13 -0600

@bodhi


root@OpenWrt:~# lspci -vv
00:01.0 PCI bridge: Marvell Technology Group Ltd. 88F6281 [Kirkwood] ARM SoC (rev 03) (prog-if 00 [Normal decode])
	Subsystem: Marvell Technology Group Ltd. Device 11ab
	Device tree node: /sys/firmware/devicetree/base/mbus@f1000000/pcie@82000000/pcie@1,0
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- TAbort- Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: [40] Subsystem: Marvell Technology Group Ltd. Device 11ab
	Capabilities: [60] Express (v1) Root Port (Slot+), IntMsgNum 0
		DevCap:	MaxPayload 128 bytes, PhantFunc 0
			ExtTag- RBE+ TEE-IO-
		DevCtl:	CorrErr- NonFatalErr- FatalErr- UnsupReq-
			RlxdOrd- ExtTag- PhantFunc- AuxPwr- NoSnoop-
			MaxPayload 128 bytes, MaxReadReq 512 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend-
		LnkCap:	Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <256ns, L1 unlimited
			ClockPM- Surprise- LLActRep+ BwNot- ASPMOptComp-
		LnkCtl:	ASPM Disabled; RCB 128 bytes, LnkDisable- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt- FltModeDis-
		LnkSta:	Speed 2.5GT/s, Width x1
			TrErr- Train- SlotClk+ DLActive+ BWMgmt- ABWMgmt-
		SltCap:	AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug- Surprise-
			Slot #1, PowerLimit 0W; Interlock- NoCompl-
		SltCtl:	Enable: AttnBtn- PwrFlt- MRL- PresDet- CmdCplt- HPIrq- LinkChg-
			Control: AttnInd Unknown, PwrInd Unknown, Power- Interlock-
		SltSta:	Status: AttnBtn- PowerFlt- MRL- CmdCplt- PresDet+ Interlock-
			Changed: MRL- PresDet- LinkState-
		RootCap: CRSVisible-
		RootCtl: ErrCorrectable- ErrNon-Fatal- ErrFatal- PMEIntEna- CRSVisible-
		RootSta: PME ReqID 0000, PMEStatus- PMEPending-
	Capabilities: [100 v1] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-
			ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
			PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-
			ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
			PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
		UESvrt:	DLP+ SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+
			ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
			PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr- CorrIntErr- HeaderOF-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+ CorrIntErr- HeaderOF-
		AERCap:	First Error Pointer: 00, ECRCGenCap- ECRCGenEn- ECRCChkCap- ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 4a000001 01000004 01080000 27010000
		RootCmd: CERptEn- NFERptEn- FERptEn-
		RootSta: CERcvd- MultCERcvd- UERcvd- MultUERcvd-
			 FirstFatal- NonFatalMsg- FatalMsg- IntMsgNum 0
		ErrorSrc: ERR_COR: 0000 ERR_FATAL/NONFATAL: 0000
lspci: Unable to load libkmod resources: error -2

01:00.0 IDE interface: Marvell Technology Group Ltd. 88SE6111/6121 SATA II / PATA Controller (rev b2) (prog-if 8f [PCI native mode controller, supports both channels switched to ISA compatibility mode, supports bus mastering])
	Subsystem: Marvell Technology Group Ltd. 88SE6111/6121 1/2 port SATA II + 1 port PATA Controller
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- 






        __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__|  ** uboot_ver:v1.1.0 **

 ** MARVELL BOARD: IX4-110 LE 

U-Boot 1.1.4 (Oct 15 2009 - 17:28:22) Marvell version: 3.4.18

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CF600

Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB 
DRAM CS[1] base 0x10000000   size 256MB 
DRAM Total size 512MB  16bit width
Found 0x20 i2c device
Toggle power status
Set Power State as Always On
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:32 MB
Found ADT7473, program LED ...(led_volt=90)  OK
Found ADT7473, program thermal/Fan ...(pwm_min=0) (pwm_max=130) (therm=67) (temp_min=60)  OK

Marvell Serial ATA Adapter
Integrated Sata device found
[0 0 0]: Enable DMA mode (6)
  Device 0 @ 0 0:
Model: SAMSUNG MZ7LN512HCHP-000L1               Firm: EMT05L0Q Ser#: S1ZKNXAGB13711      
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 488386.3 MB = 476.9 GB (1000215216 x 512)
[0 1 0]: Enable DMA mode (6)
  Device 1 @ 0 1:
Model: Crucial_CT512MX100SSD1                   Firm: MU03     Ser#:         15010E434D49
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 488386.3 MB = 476.9 GB (1000215216 x 512)


CPU : Marvell Feroceon (Rev 1)
Found initrd at 0x2d4000

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is RGMII

USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
SCSI:  AHCI 0001.0000 32 slots 3 ports 3 Gbps 0x7 impl IDE mode
flags: 64bit ncq stag led pmp slum part 
scanning bus for devices...
  Device 0: (0:0) Vendor: ATA Prod.: Samsung SSD 870 Rev: SVT0
            Type: Hard Disk
            Capacity: 953869.7 MB = 931.5 GB (1953525168 x 512)
  Device 1: (1:0) Vendor: ATA Prod.: FUJITSU MHY2040B Rev: 0084
            Type: Hard Disk
            Capacity: 38154.3 MB = 37.2 GB (78140160 x 512)
Net:   egiga0 [PRIME], egiga1
Hit any key to stop autoboot:  0 
Marvell>>

Re: Iomega ix4-200d U-Boot

bodhi — Fri, 06 Mar 2026 16:07:45 -0600

Sash,

> U-Boot 2025.10-tld-1 (Mar 05 2026 - 11:43:35
> -0800)
> Iomega ix4-200d
>

> IX4-200d> md.l 0xF1010000 8
> f1010000: 01111111 00003311 33331140 33003333
> .....3..@.3333.3
> f1010010: 00000033 00000000 00000000 00000000
> 3...............
> IX4-200d> md.l 0xF1010100 1
> f1010100: 1000d080
> ....
> IX4-200d> md.l 0xF1010140 1
> f1010140: 0001000c

OK, looks good!

> X4-200d> dm tree

> `-- pcie@82000000
> pci 0 [ + ] pcie_mvebu |
> `-- pcie0.0
> pci 1 [ + ] pci_bridge_drv |
> `-- pci_0:0.0
> ahci 1 [ ] ahci_pci |
> `-- ahci_pci
> scsi 0 [ ] ahci_scsi |
> `-- ahci_scsi

This also looks good for the 2 SATA slots (iirc slot 1 and 2). But not enough.

> 4-200d> sata init
> IX4-200d> sata part
>
> no sata partition table available
> IX4-200d> sata init
> IX4-200d> sata part
>
> no sata partition table available

Does stock u-boot see these 2 SATA slots (iirc, slot 3 and 4)? It's like no power to the port.

> scsi reset freezed the box! but there is
> something...
>
>

> IX4-200d> scsi reset
> 
> Reset SCSI
> scanning bus for devices...
> Target spinup took 0 ms.
> Target spinup took 0 ms.
> SATA link 2 timeout.
> AHCI 0001.0000 32 slots 3 ports 3 Gbps 0x7 impl
> SATA mode
> flags: 64bit ncq stag led pmp slum part 
>

Right! that's a good sign. I wish we can see this lspci output in stock OS. We don't know which lane the SATA controller Marvell88SE6121 is attached to in this box.

If you coud, log in to stock OS or OpenWrt, and

lspci -v

> IX4-200d> setenv ipaddr 192.168.2.33
> Unknown command 'setenv' - try 'help'
> IX4-200d> ping 192.1
> IX4-200d> setenv ethact egiga0
> IX4-200d> ping 192.168.2.222
> ethernet-controller@72000 Waiting for PHY auto
> negotiation to complete......... TIMEOUT !
> *** ERROR: `ipaddr' not set
> ping failed; host 192.168.2.222 is not alive
> IX4-200d> setenv ethact egiga1
> IX4-200d> ping 192.168.2.222
> ethernet-controller@72000 Waiting for PHY auto
> negotiation to complete......... TIMEOUT !
> *** ERROR: `ipaddr' not set
> ping failed; host 192.168.2.222 is not alive

The above was not a good test. The env ipaddr was not assigned. Please try again.

> port 2
>
> X4-200d> setenv ipaddr 192.168.2.44
> IX4-200d> setenv ethact egiga1
> IX4-200d> ping 192.168.2.222
> Using ethernet-controller@72000 device
> host 192.168.2.222 is alive
> IX4-200d> setenv ethact egiga0
> IX4-200d> ping 192.168.2.222
> Using ethernet-controller@72000 device
> host 192.168.2.222 is alive
> IX4-200d>

So at least we can use one port for Ethernet.

=====

Is there GPL source for this ix4-200d?

Also I forgot you have OpenWrt running, I'll take a look at their source code to see if I can find some clue in their DTS.

Re: Iomega ix2-200ng U-boot needed

bodhi — Fri, 06 Mar 2026 15:33:22 -0600

Lewis65,

> I 've try many times but Kirkwood seem don't
> listen file tranfer; In picocom I receive alway
> same stranges chars and I used to select .kwb file

> bootloade mode but I don't know specific code
> 3dfw show that device is ready to receive file
> firmware

The 3dfw indicated that it is waiting for handshake in xmodem mode, iirc. So if you run picocom and power up the box and see these 3dfw characters coming out, then your serial header/wires have too much noise that the BootROM detected as a signal for handshake from the other end.

So try running kwboot with a u-boot image like the ix4-200d. It won't run because the RAM difference, but at least you can see if kwboot works.

When you run kwboot, did it return with any error? or just frozen? If there is any error return, use keyboard up-arrow to recall the kwboot command and run it again. And try doing this several times.

Re: Iomega ix2-200ng U-boot needed

Lewis65 — Fri, 06 Mar 2026 04:30:36 -0600

HI Bodhi,

sorry but I'm sure for pin contacts because I've used the same adapter with other ix2-200 unit correctly with same pinouts....

I 've try many times but Kirkwood seem don't listen file tranfer; In picocom I receive alway same stranges chars and I used to select .kwb file by options (ctrl-a ctrl-s to select file) but error 126 has reported...

My linux user is insedted in dialout

I know that

echo "firmware-code" | picocom -b 115200 /dev/ttyUSB0 --imap lfcrlf --echo

can send a particular code to starting kirkwood in bootloade mode but I don't know specific code
3dfw show that device is ready to receive file firmware

I research for another way...

Thanks too much.

Re: Iomega ix4-200d U-Boot

Sash — Fri, 06 Mar 2026 03:45:34 -0600

@bodhi


U-Boot 2025.10-tld-1 (Mar 05 2026 - 11:43:35 -0800)
Iomega ix4-200d

SoC:   Kirkwood 88F6281_A1
MPP:   Variant 88F6281
DRAM:  512 MiB
Core:  20 devices, 14 uclasses, devicetree: separate
NAND:  32 MiB
MMC:   
Loading Environment from NAND... *** Warning - bad CRC, using default environment

Resetting console stdin/stdout/stderr to serial...
In:    serial
Out:   serial
Err:   serial
pcie0.0: Link up
Net:   
Warning: ethernet-controller@72000 (eth0) using random MAC address - 72:c1:37:f6:4b:5d
eth0: ethernet-controller@72000
Warning: ethernet-controller@76000 (eth1) using random MAC address - de:dd:ed:9e:64:96
, eth1: ethernet-controller@76000
Hit any key to stop autoboot: 0

IX4-200d> md.l 0xF1010000 8
f1010000: 01111111 00003311 33331140 33003333  .....3..@.3333.3
f1010010: 00000033 00000000 00000000 00000000  3...............
IX4-200d> md.l 0xF1010100 1
f1010100: 1000d080                             ....
IX4-200d> md.l 0xF1010140 1
f1010140: 0001000c

X4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 scsi          0  [   ]   ahci_scsi             |                   `-- ahci_scsi
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [   ]   ehci_mvebu            |   |-- usb@50000
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [   ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [   ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 bootstd       0  [   ]   bootstd_drv           |-- bootstd
 bootmeth      0  [   ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [   ]   bootmeth_script       |   |-- script
 bootmeth      2  [   ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d>

X4-200d> usb start
starting USB...
USB EHCI 1.00
Bus usb@50000: 3 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
IX4-200d> usb part

Partition Map for usb device 0  --   Partition Type: DOS

Part	Start Sector	Num Sectors	UUID		Type
  1	2048      	8380416   	495ad83f-01	06
IX

4-200d> sata init
IX4-200d> sata part

no sata partition table available
IX4-200d> sata init
IX4-200d> sata part

no sata partition table available
IX4-200d>

scsi reset freezed the box! but there is something...

IX4-200d> scsi reset

Reset SCSI
scanning bus for devices...
Target spinup took 0 ms.
Target spinup took 0 ms.
SATA link 2 timeout.
AHCI 0001.0000 32 slots 3 ports 3 Gbps 0x7 impl SATA mode
flags: 64bit ncq stag led pmp slum part

X4-200d> mdio list
ethernet-controller@72000:
ethernet-controller@76000:

port 1


IX4-200d> setenv ipaddr 192.168.2.33
Unknown command 'setenv' - try 'help'
IX4-200d> ping 192.1
IX4-200d> setenv ethact egiga0
IX4-200d> ping 192.168.2.222
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
*** ERROR: `ipaddr' not set
ping failed; host 192.168.2.222 is not alive
IX4-200d> setenv ethact egiga1
IX4-200d> ping 192.168.2.222  
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
*** ERROR: `ipaddr' not set
ping failed; host 192.168.2.222 is not alive

port 2

X4-200d> setenv ipaddr 192.168.2.44
IX4-200d> setenv ethact egiga1
IX4-200d> ping 192.168.2.222
Using ethernet-controller@72000 device
host 192.168.2.222 is alive
IX4-200d> setenv ethact egiga0
IX4-200d> ping 192.168.2.222  
Using ethernet-controller@72000 device
host 192.168.2.222 is alive
IX4-200d>

X4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00, 100baseT, FDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
I

IX4-200d> mdio list
ethernet-controller@72000:
8 - Marvell 88E1118R <--> ethernet-controller@72000
ethernet-controller@76000:
IX4

X4-200d> dm tree  
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [ + ]   ehci_mvebu            |   |-- usb@50000
 usb_hub       0  [ + ]   usb_hub               |   |   `-- usb_hub
 usb_hub       1  [ + ]   usb_hub               |   |       `-- usb_hub
 usb_mass_s    0  [ + ]   usb_mass_storage      |   |           `-- usb_mass_storage
 blk           2  [ + ]   usb_storage_blk       |   |               |-- usb_mass_storage.lun0
 partition     0  [ + ]   blk_partition         |   |               |   `-- usb_mass_storage.lun0:1
 bootdev       2  [ + ]   usb_bootdev           |   |               `-- usb_mass_storage.lun0.bootdev
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 blk           0  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           1  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           3  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           4  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           5  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           6  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           7  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           8  [   ]   sata_mv_blk           |       `-- sata@80000.blk
 bootstd       0  [ + ]   bootstd_drv           |-- bootstd
 bootmeth      0  [ + ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [ + ]   bootmeth_script       |   |-- script
 bootmeth      2  [ + ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4

Re: Iomega ix4-200d U-Boot

bodhi — Thu, 05 Mar 2026 16:03:44 -0600

Attached here is the new u-boot for ix4-200d.

uboot.2025.10-tld-1.ix4_200d.bodhi.260305.tar

sha256:
c90d7f5c772d4c7cb3ace96be82652df65d2c77dd586eebd43001e691bd94323

This tarball contains 4 files

uboot.2025.10-tld-1.ix4_200d.kwb
uboot.2025.10-tld-1.ix4_200d.boot.cmd
uboot.2025.10-tld-1.ix4_200d.boot.scr
README.txt

From another Linux box, connect serial console to this NAS, and use kwboot to load and run the kwb image.

kwboot -t -a -B 115200 /dev/ttyUSB0 -b uboot.2025.10-tld-1.ix4_200d.kwb

After u-boot started, interrupt the countdown, dump the registers and check various devices

Note:
1. each Ethernet test needs the cable connected to the right port (egiga0, or egiga1). So if you have 2 cables connect them both. And repeat the ping a couple times to be sure. I think the timeout need to be adjusted longer, but not sure how much yet.
2. If you have 4 HDDs, attach all 4 to the slots. And make a note about which SATA slot is working (I expect at least 2).

md.l 0xF1010000 8
md.l 0xF1010100 1
md.l 0xF1010140 1
dm tree
usb start
usb part
sata init
sata part
scsi reset
scsi part
setenv ipaddr 
setenv ethact egiga0
ping 
setenv ethact egiga1
ping 
mdio list
mii info
dm tree

Please post the entire serial console log here.

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

bodhi — Wed, 04 Mar 2026 18:42:55 -0600

Sash,

> U-Boot 2025.10-tld-1 (Mar 03 2026 - 12:01:44
> -0800)
> Iomega ix4-200d

> md.l 0xF1010000 8
> 
> f1010000: 01111111 00003311 33331140 33003333 
> .....3..@.3333.3
> f1010010: 00000033 00000000 00000000 00000000 
> 3...............
> 
>

>
>

> md.l 0xF1010100 1 
> f1010100: 00000000    
>

>
>

> IX4-200d> md.l 0xF1010140 1
> f1010140: 00000000    
>

That was bad! no GPIO got populated. I'll need to take a look at the code again.

UPDATE: Yes. Cut/paste error! will make another build.

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

Sash — Wed, 04 Mar 2026 15:41:47 -0600

@bodhi


U-Boot 2025.10-tld-1 (Mar 03 2026 - 12:01:44 -0800)
Iomega ix4-200d

SoC:   Kirkwood 88F6281_A1
MPP:   Variant 88F6281
DRAM:  512 MiB
Core:  20 devices, 14 uclasses, devicetree: separate
NAND:  32 MiB
MMC:   
Loading Environment from NAND... *** Warning - bad CRC, using default environment

Resetting console stdin/stdout/stderr to serial...
In:    serial
Out:   serial
Err:   serial
pcie0.0: Link up
Net:   
Warning: ethernet-controller@72000 (eth0) using random MAC address - b6:e1:0e:98:c9:8b
eth0: ethernet-controller@72000
Warning: ethernet-controller@76000 (eth1) using random MAC address - f2:de:50:3a:7a:03
, eth1: ethernet-controller@76000
Hit any key to stop autoboot: 0
Scanning for bootflows in all bootdevs
Seq  Method       State   Uclass    Part  Name                      Filename
---  -----------  ------  --------  ----  ------------------------  ----------------
Hunting with: mmc
Hunting with: ahci
scanning bus for devices...
Rescanning SATA bus for devices...
Hunting with: scsi
scanning bus for devices...
Hunting with: usb
USB EHCI 1.00
Bus usb@50000: 3 USB Device(s) found
Scanning bootdev 'usb_mass_storage.lun0.bootdev':
Hunting with: ethernet
Scanning bootdev 'ethernet-controller@72000.boo':
Scanning bootdev 'ethernet-controller@76000.boo':
No more bootdevs
---  -----------  ------  --------  ----  ------------------------  ----------------
(0 bootflows, 0 valid)
IX4-200d>

md.l 0xF1010000 8

f1010000: 01111111 00003311 33331140 33003333  .....3..@.3333.3
f1010010: 00000033 00000000 00000000 00000000  3...............

md.l 0xF1010100 1 
f1010100: 00000000

IX4-200d> md.l 0xF1010140 1
f1010140: 00000000

X4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [ + ]   ehci_mvebu            |   |-- usb@50000
 usb_hub       0  [ + ]   usb_hub               |   |   `-- usb_hub
 usb_hub       1  [ + ]   usb_hub               |   |       `-- usb_hub
 usb_mass_s    0  [ + ]   usb_mass_storage      |   |           `-- usb_mass_storage
 blk           2  [ + ]   usb_storage_blk       |   |               |-- usb_mass_storage.lun0
 partition     0  [ + ]   blk_partition         |   |               |   `-- usb_mass_storage.lun0:1
 bootdev       2  [ + ]   usb_bootdev           |   |               `-- usb_mass_storage.lun0.bootdev
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 blk           0  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           1  [   ]   sata_mv_blk           |       `-- sata@80000.blk
 bootstd       0  [ + ]   bootstd_drv           |-- bootstd
 bootmeth      0  [ + ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [ + ]   bootmeth_script       |   |-- script
 bootmeth      2  [ + ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d>

IX4-200d> sata init
IX4-200d> sata part

no sata partition table available
IX4-200d> scsi reset

Reset SCSI
scanning bus for devices...
IX4-200d> scsi part 

no scsi partition table available
IX4-200d>

X4-200d> mdio list
ethernet-controller@72000:
ethernet-controller@76000:

IX4-200d> mii info
PHY 0x08: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
PHY 0x09: OUI = 0x5043, Model = 0x24, Rev = 0x00,  10baseT, HDX
IX4-200d>

port1

setenv ethact egiga0
IX4-200d> ping 192.168.2.222  
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Using ethernet-controller@72000 device

ARP Retry count exceeded; starting again
ping failed; host 192.168.2.222 is not alive
IX4-200d> setenv ethact egiga1
IX4-200d> ping 192.168.2.222  
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Using ethernet-controller@72000 device

ARP Retry count exceeded; starting again
ping failed; host 192.168.2.222 is not alive
IX4-200d>

port 2

IX4-200d> ping 192.168.2.222  
Using ethernet-controller@72000 device
host 192.168.2.222 is alive
IX4-200d> setenv ethact egiga1
IX4-200d> ping 192.168.2.222  
Using ethernet-controller@72000 device
host 192.168.2.222 is alive
IX4-200d>

X4-200d> dm tree
 Class     Seq    Probed  Driver                Name
-----------------------------------------------------------
 root          0  [ + ]   root_driver           root_driver
 simple_bus    0  [ + ]   simple_bus            |-- mbus@f1000000
 misc          0  [ + ]   pcie_mvebu_base       |   `-- pcie@82000000
 pci           0  [ + ]   pcie_mvebu            |       `-- pcie0.0
 pci           1  [ + ]   pci_bridge_drv        |           `-- pci_0:0.0
 ahci          1  [   ]   ahci_pci              |               `-- ahci_pci
 simple_bus    1  [ + ]   simple_bus            |-- ocp@f1000000
 gpio          0  [   ]   gpio_mvebu            |   |-- gpio@10100
 gpio          1  [   ]   gpio_mvebu            |   |-- gpio@10140
 timer         0  [ + ]   orion_timer           |   |-- timer@20300
 usb           0  [ + ]   ehci_mvebu            |   |-- usb@50000
 usb_hub       0  [ + ]   usb_hub               |   |   `-- usb_hub
 usb_hub       1  [ + ]   usb_hub               |   |       `-- usb_hub
 usb_mass_s    0  [ + ]   usb_mass_storage      |   |           `-- usb_mass_storage
 blk           2  [ + ]   usb_storage_blk       |   |               |-- usb_mass_storage.lun0
 partition     0  [ + ]   blk_partition         |   |               |   `-- usb_mass_storage.lun0:1
 bootdev       2  [ + ]   usb_bootdev           |   |               `-- usb_mass_storage.lun0.bootdev
 ethernet      0  [ + ]   mvgbe                 |   |-- ethernet-controller@72000
 bootdev       0  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@72000.boo
 ethernet      1  [ + ]   mvgbe                 |   |-- ethernet-controller@76000
 bootdev       1  [ + ]   eth_bootdev           |   |   `-- ethernet-controller@76000.boo
 rtc           0  [   ]   rtc-mv                |   |-- rtc@10300
 ahci          0  [   ]   sata_mv_ahci          |   `-- sata@80000
 blk           0  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           1  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           3  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           4  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           5  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           6  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           7  [   ]   sata_mv_blk           |       |-- sata@80000.blk
 blk           8  [   ]   sata_mv_blk           |       `-- sata@80000.blk
 bootstd       0  [ + ]   bootstd_drv           |-- bootstd
 bootmeth      0  [ + ]   bootmeth_extlinux     |   |-- extlinux
 bootmeth      1  [ + ]   bootmeth_script       |   |-- script
 bootmeth      2  [ + ]   bootmeth_pxe          |   `-- pxe
 serial        0  [ + ]   ns16550_serial        `-- serial@12000
IX4-200d>

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

bodhi — Tue, 03 Mar 2026 14:47:27 -0600

Attached here is the new u-boot for ix4-200d.

uboot.2025.10-tld-1.ix4_200d.bodhi.260303.tar

sha256:
a54ce9f9361b8f20e37daf1cd9219e519918b48a9ac87f28d6c76f0d1b2b0976

This tarball contains 4 files

uboot.2025.10-tld-1.ix4_200d.kwb
uboot.2025.10-tld-1.ix4_200d.boot.cmd
uboot.2025.10-tld-1.ix4_200d.boot.scr
README.txt

From another Linux box, connect serial console to this NAS, and use kwboot to load and run the kwb image.

kwboot -t -a -B 115200 /dev/ttyUSB0 -b uboot.2025.10-tld-1.ix4_200d.kwb

Note: the serial device ttyUSB0 is typical for Debian-based distro. On other distro it might be different (see detailed kwboot example here).

After u-boot started, interrupt the countdown, dump the registers and check various devices

Note: each Ethernet test needs the cable connected to the right port (egiga0, or egiga1). And repeat the ping a couple times to be sure.

md.l 0xF1010000 8
md.l 0xF1010100 1
md.l 0xF1010140 1
dm tree
sata init
sata part
scsi reset
scsi part
setenv ipaddr 
setenv ethact egiga0
ping 
setenv ethact egiga1
ping 
mdio list
mii info
dm tree

Please post the entire serial console log here.

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

bodhi — Tue, 03 Mar 2026 13:53:25 -0600

Sash,

> IX4-200d> usb start
> starting USB...
> USB EHCI 1.00
> Bus usb@50000: 3 USB Device(s) found
> scanning usb for storage devices... 1
> Storage Device(s) found
> IX4-200d> usb part
>
> Partition Map for usb device 0 -- Partition
> Type: DOS
>
> Part Start Sector Num Sectors UUID Type
> 1 2048 8380416 495ad83f-01 06
> IX4-200d>

Cool! Now we have a storage device for booting Debian.

> but no sata. even when i replug the hdd to the
> last unused port.

OK.

> ok, eth port 2 IS working! port 1 is not.

Cool!

> IX4-200d> setenv ipaddr 192.168.88.11
> IX4-200d> ping 192.168.88.22
> ethernet-controller@72000 Waiting for PHY auto
> negotiation to complete......... TIMEOUT !
> Using ethernet-controller@72000 device
>
> ARP Retry count exceeded; starting again
> ping failed; host 192.168.88.22 is not alive
> IX4-200d> setenv ipaddr 192.168.88.33
> IX4-200d> ping 192.168.88.22
> Using ethernet-controller@72000 device
> host 192.168.88.22 is alive
> IX4-200d>

It's the ethact env that controls which ethernet port is being used.

printenv ethact

If ethact=egiga0, change it to egiga1 (and vice versa),

setenv ethact egiga1

And then switch the ethernet cable to the other port, and ping the router. I expect the ethernet-controller@76000 will be used.

====

The fact that you had to do a ping a second time to get ethernet, I think the ARP time out is too short.

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

Sash — Tue, 03 Mar 2026 06:56:15 -0600

@bodhi

u r right! fixed

Sash Wrote:
-------------------------------------------------------
> also kwb doenst work every time on this unit.
> often i start kwboot an the units fan spins to
> max,, jsut stits there and nothing else happens.
> also tried wir debian kwbooot

the solution for this is quiet easy: stop/cancel the kwboot process. restart the kwboot process!

now with an attached USB stick:

IX4-200d> usb start
starting USB...
USB EHCI 1.00
Bus usb@50000: 3 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
IX4-200d> usb part

Partition Map for usb device 0  --   Partition Type: DOS

Part	Start Sector	Num Sectors	UUID		Type
  1	2048      	8380416   	495ad83f-01	06
IX4-200d>

but no sata. even when i replug the hdd to the last unused port.

IX4-200d> sata init
IX4-200d> sata part

no sata partition table available
IX4-200d> sata init
IX4-200d> 
IX4-200d> 
IX4-200d> sata part

no sata partition table available
IX4-200d>

ok, eth port 2 IS working! port 1 is not.

IX4-200d> setenv ipaddr 192.168.88.11
IX4-200d> ping 192.168.88.22
ethernet-controller@72000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Using ethernet-controller@72000 device

ARP Retry count exceeded; starting again
ping failed; host 192.168.88.22 is not alive
IX4-200d> setenv ipaddr 192.168.88.33
IX4-200d> ping 192.168.88.22         
Using ethernet-controller@72000 device
host 192.168.88.22 is alive
IX4-200d>

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

bodhi — Tue, 03 Mar 2026 02:30:45 -0600

> i already switched to openwrt but i posted the
> orig bootlog in the openwrt wiki:
> https://openwrt.org/toh/iomega/ix4-200d#original_iomega_bootlog

You've misspelled Bodhi :)

Debian Brodhi bootlog

Re: Iomega ix2-200ng U-boot needed

bodhi — Tue, 03 Mar 2026 02:24:10 -0600

Lewis,

You don't need to run any script, just run picocom

picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0'

The garbage output seems to indicate that there are too much noise. If the wires are unshielded, make sure they are away from any power source, and away from Wifi antenna.

Re: Iomega ix4-200d U-Boot - 2025.10-tld-1

Sash — Mon, 02 Mar 2026 14:46:46 -0600

i tested port 1 and 2

the ip is the boxes IP and the ping should work to the local ip, too.
there is a very different network on the ethernet which is a vlan that blocks access without registration (corporate network). it was just connected for "link up" purposes

i already switched to openwrt but i posted the orig bootlog in the openwrt wiki: https://openwrt.org/toh/iomega/ix4-200d#original_iomega_bootlog

i can test the empty slot tomorrow. maybe i´ll find an usb stick, too.