So Bizarre - Netgear Stora with non-kirkwood CPU?

I will try to post the boot logs in a moment. Right now, I am getting environment overflow errors. That happened immediately after flashing Bodhi's Uboot. That, however, isn't the strange part. Boot Logs claim this Stora MS2110 has a Marvell Feroceon CPU @ 100 MHz!

Has anyone come across such a thing?

FWIW, when issuing a printenv from the serial console at boot, I get at least 6 screens full of the same non-ascii character. About 6 screens in, the ctl-c I pressed kicks-in...

My guess is the new uboot expects the env code at an earlier point the the old uboot, and the new is picking up "dead" code at the beginning, and by the time the real environment data comes up, the buffer is full?

Terminal output, from beginning of boot, almost to the end, is below:

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: ffffffff, Calculated CRC: 619d86db
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
## Error: environment overflow, "stdin" deleted
## Error: environment overflow, "stdout" deleted
## Error: environment overflow, "stderr" deleted

CPU : Marvell Feroceon (Rev 1)
## Error: environment overflow, "console" deleted
## Error: environment overflow, "mainlineLinux" deleted
## Error: environment overflow, "CASset" deleted
## Error: environment overflow, "enaMonExt" deleted
## Error: environment overflow, "enaCpuStream" deleted
## Error: environment overflow, "enaWrAllo" deleted
## Error: environment overflow, "pexMode" deleted
## Error: environment overflow, "disL2Cache" deleted
## Error: environment overflow, "setL2CacheWT" deleted
## Error: environment overflow, "disL2Prefetch" deleted
## Error: environment overflow, "enaICPref" deleted
## Error: environment overflow, "enaDCPref" deleted
## Error: environment overflow, "sata_dma_mode" deleted
## Error: environment overflow, "MALLOC_len" deleted
## Error: environment overflow, "ethprime" deleted
## Error: environment overflow, "netbsd_en" deleted
## Error: environment overflow, "vxworks_en" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "bootargs_end" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "standalone" deleted
## Error: environment overflow, "bootdelay" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ethmtu" deleted
## Error: environment overflow, "eth1addr" deleted
## Error: environment overflow, "eth1mtu" deleted
## Error: environment overflow, "mvPhoneConfig" deleted
## Error: environment overflow, "mvNetConfig" deleted
## Error: environment overflow, "usb0Mode" deleted
## Error: environment overflow, "yuk_ethaddr" deleted
## Error: environment overflow, "nandEcc" deleted
## Error: environment overflow, "hddPowerCtrl" deleted
## Error: environment overflow, "netretry" deleted
## Error: environment overflow, "rcvrip" deleted
## Error: environment overflow, "loadaddr" deleted
## Error: environment overflow, "autoload" deleted
## Error: environment overflow, "enaAutoRecovery" deleted

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: device mode
PEX 0: interface detected no Link.
Net:   ## Error: environment overflow, "ethact" deleted
egiga0, egiga1## Error: environment overflow, "ethact" deleted

USB:   scanning bus for devices... 1 USB Device(s) found
       scanning bus for storage devices... 0 Storage Device(s) found
Aquiring an IP address using DHCP...
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
*** ERROR: `eth1addr' not set
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
Failed to retreive an IP address assuming default (<NULL>)!
Starting the Recovery process to retreive the file...
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
*** ERROR: `eth1addr' not set
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
Failed
Power Button is pressed!
MPP Sel: 00000530, Data IN Enable: 00020058, Data In Polarity: 00000040, Data In: 00000011
Power Button is released!
MAC: 00:01:97:6E:97:B1, IP: 10.110.151.177
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ipaddr" deleted
## Error: environment overflow, "serverip" deleted
## Error: environment overflow, "netmask" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "console" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "rootpath" deleted
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted

More info, possibly relevant:

## Error: environment overflow, "bootargs" deleted
## Booting image at 00800000 ...
Bad Magic Number
Marvell>> printenv
������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������

.....

Marvell>> setenv bootargs 'xyz'
## Error: environment overflow, "bootargs" deleted
Marvell>> printenv bootargs
## Error: "bootargs" not defined

I thought I'd better stop and ask for help at this point. As my brother once pointed out:
"The first rune of holes is, as soon as you realize you're in one, QUIT DIGGING!!"
It is now 10:30 PM, I bid you good night.

aaronouthier,

It is a Kirkwood. When you see Feroceon, you can be certain that it is likely a Kirkwood. And SoC 88F6281 is a Kirkwood. There is no Netgear Stora model in the market that uses a different SoC.

> Soc: 88F6281 A0 (DDR2)
> CPU running @ 1000Mhz L2 running @ 333Mhz

> U-Boot 1.1.4 (Sep 4 2009 - 09:36:11) Marvell
> version: 3.4.14

The banner indicated that it is stock u-boot in NAND mtd0.

> CRC in Flash: ffffffff, Calculated CRC: 619d86db
> +++++++++++++++++++++++++++Checksum
> Error!++++++++++++++++++++++++++++++
...
..

> Error!++++++++++++++++++++++++++++++
> ## Error: environment overflow, "stdin" deleted

CRC in Flash: ffffffff means the envs area failed the checksum (because it was corrupted).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Quote

## Error: environment overflow, "bootargs" deleted

It is a symptom of a corrupted envs area in NAND.

So, since the log in the few post above indicated that the u-boot in NAND mtd0 is still a stock u-boot, it is best that you run kwboot to load the new u-boot image over UART to start the box. That will allow you to boot into the Debian rootfs on USB.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

kwboot seems to sit and do nothing, despite powering on the device. Running the 'md' command listed on the kwboot page gives 0x111. Drat!!

Currently creating a non-ftd uimage and uinitrd now. Took me a few unsuccessful tries to realize I'm supposed to boot first with the kernel included with the rootfs, and then upgrade the kernel from WITHIN the booted system. Trying it again, with a freshly extracted RootFS.

Hmm, no good. It doesn't pick up the USB correctly. Is there a manual uboot comand I can try to load uEnv.txt from USB?



Edited 1 time(s). Last edit at 03/20/2021 09:45AM by aaronouthier.

aaronouthier,

> Is there a manual uboot comand I can
> try to load uEnv.txt from USB?

Not in stock u-boot.

This is a bug in stock u-boot that you happened to trigger when you did something during trying to install new u-boot. Each step in the u-boot installation must be done as is. Substitute with different commands or missing a step could cause this problem.

Now only certain production series for the Stora lacks kwboot capabilty, most of the Stora boxes BootROM can accept kwboot handshake. Since you cannot run kwboot with this box current BootROM, it is semi-bricked.

Try

At u-boot prompt

printenv
setenv test_1 yes

If you can setenv then it is a good sign, try listing envs again

printenv

I suspect that you cannot. But if you can, stop here and post the result.

So we do the following when you cannot set env.

The command resetenv is go-for-broke command, usually should not be excuted casualy, if ever. The bug in this u-boot related to this, probably in this code.

resetenv

Hopefully u-boot will erase the NAND envs area correctly, and fix that bad checksum. Try listing env again.

printenv

Please post the entire serial console log here for the all of the above.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I have already tried issuing a setenv command, it does indeed fail.
I have also tried resetenv. No change.

My initial issue was that I forgot the login credentials, so I factory reset the Stora. Then, I couldn’t get in without the root password for stock firmware, so I used the TFTPBOOT instructions from the openwrt site, but modified to flash a new uboot.

Side note: My Dad/landlord is working on the house, and the living room is a mess. I’m typing this on my phone, and autocorrect is giving me a headache on this post.

Question: Could either the uboot or envs partition be written 1 byte or 1 block at a time from the serial console, since I am getting a Marvell >>> prompt?
If so, I would imagine the Envs partition would be safer?

Alternately, would a Pomona clip and a raspberry pi be helpful to rewrite an EEPROM or is there any way to rewrite the NAND chip directly?

Failing the above, is there any possible way to force update the boot rom, either via uboot, or via any method mentioned above?

aaronouthier,


> Question: Could either the uboot or envs partition
> be written 1 byte or 1 block at a time from the
> serial console, since I am getting a Marvell >>>
> prompt?
> If so, I would imagine the Envs partition would be
> safer?

OK, so now the last resort should be used: erase the NAND area where the envs are. Hopefully u-boot will not try to read NAND settings envs and use its internal settings. That way it will get a sane checksum error (if this u-boot will handle 0's checksum correctly). See the bottom of this post.

> Alternately, would a Pomona clip and a raspberry
> pi be helpful to rewrite an EEPROM or is there any
> way to rewrite the NAND chip directly?

I'm sure this box has JTAG, like all others, but you'll need to solder the header to the board. And then use either Bus Pirate, or a rPi. See Wiki thread:

Quote
https://forum.doozan.com/read.php?2,23630
Unbricking with Serial Console & JTAG console

How to unbrick your box using serial console with kwboot
Repair Pogo E02 with Raspberry PI (JTAG) and OpenOCD
Serial Port connector - what are people using to make it work
Serial Console hookup - GoFlex Net (external link)
Serial Console hookup - Pogoplug E02 and Pogoplug Pro V3 (external link)
OSX Serial/Net Console
Use Phone Jack - Phone Jack Serial Console Pics
Adding serial connector to Pogoplug Mobile (external link)
WD Mycloud EX2100/4100 Serial Console pic1, also pic2, pic3
Dreamplug Serial Console
kwboot on Mac OSX 10
Unbrick a Pogoplug Pro v3 OXNAS by flashing u-boot in serial console
Unbricking Synology Diskstation DS414 - See also the working thread for this unbricking session

> Failing the above, is there any possible way to
> force update the boot rom, either via uboot, or
> via any method mentioned above?

The BootROM cannot be updated. Not sure anyone has tried this.

====

To erase NAND envs area, try the command

nand

If that works, the subcommand "nand erase" or "nand.e" might be available. But be very careful here, you don't want to erase u-boot image, you only want to erase the NAND block somewhere after u-boot image.

So first we need to find it. Most of Marvell stock u-boot use the NAND address 0xa0000 for envs (640k location). You would want to erase 128K (1 block) from that location.

But before attempting to erase we should go back to a good Stora boot log and hopefully will find some indicator that 0xa0000 is correct. Most of the time, stock u-boot only use 512K or less. So erasing at 640K is quite safe. But if for whatever reason this educated guess is incorrect, it might be bricked for good and the only way to recover is JTAG.

And please post the serial console log whether you're successful or not, it will help others in the future.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)