MEDION P89634 MD 86783 (2x2 TB NAS): Backup Flash

Hello,

I'm new here - and please forgive me when I ask some newbie questions.

I also own such a NAS system (MEDION P89634 MD 86783, 2x2 TB NAS) as some of the users here have written of (helge and saschbear).

Before I start with installing a new uboot and or kernel etc., I'd like to completely backup the EEPROM (the environment is saved there, I suppose) and the flash (uboot, kernel, initrd).

Is there a safe and verified way to do so?
I think it was helge; I stumbled about some scripts dd'ing the mtd-devices (called raw backup) and another variant using nanddump (called nandbackup).

Is that the proven way to do a backup?
And when I have a backup: how can it be restored?



As I read in the other threads: after booting the kernel: it just stops without any further messages.
Just an idea: if it is the wrong/missing DTB: can it be taken from the existing initrd from the manufacturer?


Thanks in advance,
Peter2017

Peter2017,

> Before I start with installing a new uboot and or
> kernel etc., I'd like to completely backup the
> EEPROM (the environment is saved there, I suppose)
> and the flash (uboot, kernel, initrd).
>
> Is there a safe and verified way to do so?
> I think it was helge; I stumbled about some
> scripts dd'ing the mtd-devices (called raw backup)
> and another variant using nanddump (called
> nandbackup).

Use nanddump. Don't use dd.

> Is that the proven way to do a backup?

Yes.

> And when I have a backup: how can it be restored?

Use flash_erase and nandwrite just like when you flash new u-boot. See usage example in the u-boot release thread (fthis is for other Kirkwodd boxes, I dont have new u-boot for this box):

https://forum.doozan.com/read.php?3,12381


BTW, stock kernel is too old. It is not FDT kernel so no DTB.

------

Before you attempt to backup, list the commands you about to do and I'll verify that it's OK for you. When it comes to NAND related stuff, don't test before confirmation that they are OK to do.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 11/26/2017 01:39PM by bodhi.

Hello bodhi,

many thanks for your fast reply!


Ok, I'll send the commands I intend to run

# login via serial console
$ sudo -E -s
$ mkdir /tmp/usbstick
$ mount /dev/sda1 /tmp/usbstick
# see attached script
$ /tmp/usbstick/medion-nandbackup/nandbackup.sh



BTW: In dmesg output I read about bad blocks:
# NAND device: Manufacturer ID: 0xc8, Chip ID: 0xda (Zentel NAND 256MiB 3,3V 8-bit)
# Scanning device for bad blocks
# Bad eraseblock 16 at 0x000000200000
# Bad eraseblock 1521 at 0x00000be20000
# Bad eraseblock 1786 at 0x00000df40000
# Bad eraseblock 1959 at 0x00000f4e0000

Does it mean that blocks 16, 1521, 1786 and 1959 *are* bad,
or that they hold some info about *potential* bad blocks?

Your thankful,
Peter2017



Edited 1 time(s). Last edit at 11/27/2017 04:53AM by Peter2017.

Hi Peter,

That's a nice script! how an experienced Linux user would go about doing this.

However, we need something more concrete here to verify the correctness of the commands (the script added a layer of abstraction).

What are the MTDs? we'll find them in the following outputs.

dmesg               # to see the mtd definitions as the kernel detects them, and see where the bad blocks are
cat /proc/mtd     # to see the actual MTDs devices

And depending on the output of the above. We would do:

nanddump --noecc --omitoob -f mtd0 /dev/mtd0
nanddump --noecc --omitoob -f mtd1 /dev/mtd1

.....
And so on for the rest of the MTDs.

And then afterward, list them to see the files attributes:

ls -lh mtd*

Note:

1. here is where you can download later version of NAND flashing utilities:
https://forum.doozan.com/read.php?3,27280

2. These bad blocks are OK. They are kept tracked of in the flash partition and not used.

# Bad eraseblock 16 at 0x000000200000 
# Bad eraseblock 1521 at 0x00000be20000 
# Bad eraseblock 1786 at 0x00000df40000 
# Bad eraseblock 1959 at 0x00000f4e0000

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello bodhi,

> That's a nice script! how an experienced Linux user would go about doing this.

Thanks for the flowers. But it isn't my knowledge - I just adapted it.
It's originated here from this forum.

I'll send you the (as far I can see relevant) output for double checking.
If you miss anything, please correct my point of view!

$ cat /proc/mtd

# dev:    size   erasesize  name
# mtd0: 00100000 00020000 "u-boot"
# mtd1: 00600000 00020000 "uImage"
# mtd2: 0f900000 00020000 "rootfs"

$ dmesg

# NAND device: Manufacturer ID: 0xc8, Chip ID: 0xda (Zentel NAND 256MiB 3,3V 8-bit)
# Scanning device for bad blocks
[...]
# Using static partition definition
# Creating 3 MTD partitions on "nand_mtd":
# 0x000000000000-0x000000100000 : "u-boot"
# 0x000000100000-0x000000700000 : "uImage"
# 0x000000700000-0x000010000000 : "rootfs"
# UBI: attaching mtd2 to ubi0
# UBI: physical eraseblock size:   131072 bytes (128 KiB)
# UBI: logical eraseblock size:    126976 bytes
# UBI: smallest flash I/O unit:    2048
# UBI: sub-page size:              512
# UBI: VID header offset:          2048 (aligned 2048)
# UBI: data offset:                4096
# UBI: attached mtd2 to ubi0
# UBI: MTD device name:            "rootfs"
# UBI: MTD device size:            249 MiB
# UBI: number of good PEBs:        1989
# UBI: number of bad PEBs:         3
# UBI: max. allowed volumes:       128
# UBI: wear-leveling threshold:    4096
# UBI: number of internal volumes: 1
# UBI: number of user volumes:     1
# UBI: available PEBs:             0
# UBI: total number of reserved PEBs: 1989
# UBI: number of PEBs reserved for bad PEB handling: 38
# UBI: max/mean erase counter: 1/0
# UBI: image sequence number: 0

# Backup as you suggested:

$ nanddump --noecc --omitoob -f mtd0 /dev/mtd0

# Block size 131072, page size 2048, OOB size 64
# Dumping data starting at 0x00000000 and ending at 0x00100000...

# $ nanddump --noecc --omitoob -f mtd1 /dev/mtd1

# Block size 131072, page size 2048, OOB size 64
# Dumping data starting at 0x00000000 and ending at 0x00600000...

# $ nanddump --noecc --omitoob -f mtd2 /dev/mtd2

# Block size 131072, page size 2048, OOB size 64
# Dumping data starting at 0x00000000 and ending at 0x0f900000...



$ ls -lh mtd*

# -rwxr-xr-x 1 root root 1.0M Nov 28 10:17 mtd0
# -rwxr-xr-x 1 root root 5.9M Nov 28 10:17 mtd1
# -rwxr-xr-x 1 root root 249M Nov 28 10:19 mtd2

So, after having backuped the flash, I'd say I can advance to boot your new kernel.
Right?


Again thank you for your time,
Peter2017

---
moderator edit: please use code tags.



Edited 1 time(s). Last edit at 11/28/2017 03:47AM by bodhi.

Peter,

> advance to boot your new kernel.
> Right?

Right! everything looks good in your post.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello again bodhi,

so this is what I already dared to do:

Marvell>> usb start
# (Re)start USB...
# USB:   scanning bus for devices... 2 USB Device(s) found
# Waiting for storage device(s) to settle before scanning...
# 1 Storage Device(s) found

Marvell>> usb tree
# Device Tree:
#   1  Hub (480MBit/s, 0mA)
#   |  Marvell EHCI
#   |
#   +-2  Mass Storage (480MBit/s, 200mA)
#        Sony Storage Media $MYID
# 

Marvell>> usb info
# 1: Hub,  USB Revision 2.0
#  - Marvell EHCI
#  - Class: Hub
#  - PacketSize: 64  Configurations: 1
#  - Vendor: 0x0000  Product 0x0000 Version 1.0
#    Configuration: 1
#    - Interfaces: 1 Self Powered 0mA
#      Interface: 0
#      - Alternate Settings 0, Endpoints: 1
#      - Class Hub
#      - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms
# 
# 2: Mass Storage,  USB Revision 2.0
#  - Sony Storage Media $MYID
#  - Class: (from Interface) Mass Storage
#  - PacketSize: 64  Configurations: 1
#  - Vendor: 0x054c  Product 0x0243 Version 1.0
#    Configuration: 1
#    - Interfaces: 1 Bus Powered 200mA
#      Interface: 0
#      - Alternate Settings 0, Endpoints: 2
#      - Class Mass Storage, Transp. SCSI, Bulk only
#      - Endpoint 1 In Bulk MaxPacket 512
#      - Endpoint 2 Out Bulk MaxPacket 512

And this is what I cooked up from what I read at https://forum.doozan.com/read.php?2,40329,page=2 and at https://forum.doozan.com/read.php?2,32877,page=2

$ setenv mainlineLinux yes
$ setenv arcNumber 3960
$ setenv machid f78
$ setenv bootargs console=ttyS0,115200 root=LABEL=rootfs earlyprintk=serial
$ ext2load usb 0:1 0x800000 /boot/uImage
$ ext2load usb 0:1 0x1100000 /boot/uInitrd
$ bootm 0x800000 0x1100000

Where I don't get the magic is how the uImage and uInitrd are build.
I believe it's somewhat this way - please confirm since I'm stuck (adapted from here: https://forum.doozan.com/read.php?2,12096):

# at Linux-PC as root; this is just a rough sketch - details are missing (e.g. downloading files)
$ apt install u-boot-tools
$ mount /dev/sdc1 /media/rootfs
$ cd /media/rootfs
$ tar -xjf Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2
$ cd boot
$ tar -xjf linux-4.14.1-kirkwood-tld-1-bodhi.tar.bz2

# skipped FDT part; apearendly it didn't work for helge and saschbear; so using plain kernel instead!
$ mkimage -A arm -O linux -T kernel  -C none -a 0x00008000 -e 0x00008000 -n linux-4.14.1-kirkwood-tld-1-bodhi -d linux-4.14.1-kirkwood-tld-1-bodhi  uImage
$ mkimage -A arm -O linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 -n initramfs-4.12.1-kirkwood-tld-1   -d initrd.img-4.12.1-kirkwood-tld-1   uInitrd
$ cd /; sync; umount /media/rootfs

Special questions:
1) Where are arcNumber and machid from?
Maybe they need adjustment for this Medion machine?
May they be found somewhere in the booted stock kernel?

2) I belive -a and -e parameters for mkimage are memory addresses?
Shouldn't they match the addresses in ext2load command?

3) Helge and Saschbear didn't see any messages from earlyprintk, if I got it right.
On http://www.linuxtopia.org/online_books/linux_kernel/kernel_configuration/re05.html, I saw some further info about this parameter.
Do you think "earlyprintk=serial,ttyS0,115200,keep" would help?

4) When loading kernel and initrd from USB to RAM, stock environment and flash areas stay untouched?
So after a reboot, nothing is harmed?

Yours,
Peter2017



Edited 1 time(s). Last edit at 11/28/2017 05:19PM by Peter2017.

Peter,

Power up, Interrupt serial console and execute bdinfo. Hopefully this command will be available and show it in the output.

bdinfo

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 2 time(s). Last edit at 11/29/2017 06:35PM by bodhi.

Hello again,

so I did it - but as with the others without success.

usb start
setenv mainlineLinux yes
setenv arcNumber 3960
setenv machid f78
setenv bootargs console=ttyS0,115200 root=/dev/sda1 earlyprintk=serial,ttyS0,115200,keep
ext2load usb 0:1 0x800000 /boot/uImage
ext2load usb 0:1 0x1100000 /boot/uInitrd
bootm 0x800000 0x1100000

The kernel silently dies.

However I was able to load the stock kernel (without stock initrd!) but it seams to have another default initrd.

setenv bootargs console=ttyS0,115200 root=/dev/sda1 earlyprintk=serial,ttyS0,115200,keep
nand read.e 0x800000 0x100000 0x400000
bootm 0x800000

From there I mounted your prepared rootfs (on USB stick) but the stock kernel is too old...

mknod /dev/sda1 b 8 1
mount /dev/sda1 /newroot
umount /sys /proc
exec switch_root /newroot /sbin/init

FATAL: kernel too old
Kernel panic - not syncing: Attempted to kill init!
Backtrace:
[<c01b7224>] (dump_backtrace+0x0/0x114) from [<c00cf988>] (dump_stack+0x18/0x1c)
 r7:000000f8 r6:c8019c40 r5:c8019c40 r4:c0597090
[<c00cf970>] (dump_stack+0x0/0x1c) from [<c00cf9d8>] (panic+0x4c/0x114)
[<c00cf98c>] (panic+0x0/0x114) from [<c02065c4>] (do_exit+0x74/0x5ac)
 r3:c057029c r2:c8019c40 r1:c8021e0c r0:c0170068
[<c0206550>] (do_exit+0x0/0x5ac) from [<c0206b90>] (do_group_exit+0x94/0xc8)
[<c0206afc>] (do_group_exit+0x0/0xc8) from [<c0206bdc>] (sys_exit_group+0x18/0x24)
 r5:0000007f r4:4001e3a0
[<c0206bc4>] (sys_exit_group+0x0/0x24) from [<c00c16a0>] (ret_fast_syscall+0x0/0x2c)

Your thoughts will be very appreciated.

My "rescue plan" is that: try to rebuild the stock kernel;
if it's possible then compare the stock modifications to the mainstream kernel of the same version;
apply that modifications to your kernel.


Yours,
Peter2017

Peter,


> From there I mounted your prepared rootfs (on USB
> stick) but the stock kernel is too old...

You cannot run stock kernel in this rootfs. It is too old.


> if it's possible then compare the stock
> modifications to the mainstream kernel of the same
> version;
> apply that modifications to your kernel.

That's not possible. Too much works to do this. Kernel 2.6.x source is too different from modern kernels source.


I will take a look at the GPL (helge's upload) to see if I can find anything hard code in the kernel that this stock u-boot expects.

What really needs here is the GPL source for u-boot. But the Medion GPL tarball does not contain u-boot source. If you or helge can find it, then chance is that I find out something that will make it work booting new kernel.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Peter,

Power up, Interrupt serial console and execute bdinfo. Hopefully this command will be available and show it in the output.

bdinfo

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Peter,

Try booting this rootfs

Quote

Updated 02 Sept 2014 (rootfs):

Rootfs Debian-3.16.0-kirkwood-tld-2 was uploaded. This rootfs is to keep in sync with kernel Linux-3.16.0-kirkwood-tld-2 (and its new features).

Dropbox:
Debian-3.16.0-kirkwood-tld-2-rootfs-bodhi.tar.bz2

Now with bdinfo as I mentioned above we can set arcNumber to that value in serial console. Or try a different arcNumber too.


Looks like I've overlooked this info from pengu

Quote

https://forum.doozan.com/read.php?2,32877,33401#msg-33401


Starting kernel ...

The LEDs indicate that there is some more stuff going on as with kernel 3.18.5 ..

The green one keeps blinking for one second then .. the red one is lighting up ..
With Kernel 3.18.5 ... only the blue LEDs lights up

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 2 time(s). Last edit at 11/29/2017 07:22PM by bodhi.

Hi bodhi,

> bdinfo

sorry missed that. bdinfo is not available.

It's only:

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|
 ** MARVELL BOARD: DB6702A-GMtech LE

U-Boot 1.1.4 (Jun  5 2013 - 10:49:39) Marvell version: 3.6.0

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0
Marvell>> bdinfo
Unknown command 'bdinfo' - try 'help'
Marvell>> help
?       - alias for 'help'
SatR - sample at reset sub-system, relevent for DB only
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootext2    dev:boot_part1,boot_part2 addr boot_image linux_dev_name
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bubt    - Burn an image on the Boot Nand Flash.
chpart  - change active partition
cmp     - memory compare
cmpm    - Compare Memory
cp      - memory copy
cpumap - Display CPU memory mapping settings.
crc32   - checksum calculation
date    - get/set/reset date & time
dclk    - Display the MV device CLKs.
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo    - echo args to console
eeprom  - EEPROM sub-system
erase   - erase FLASH memory
ext2load- load binary file from a Ext2 filesystem
ext2ls  - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fi      - Find value in the memory.
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
g       - start application at cached address 'addr'(default addr 0x40000)
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imm[.b, .s, .w, .l]     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
ir      - reading and changing MV internal register values.
loop    - infinite loop on address range
ls      - list files in a directory (default /)
map     - Diasplay address decode windows
md      - memory display
me      - PCI master enable
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
mp      - map PCI BAR
mtdparts- define flash/nand partitions
mtest   - simple RAM test
mw      - memory write (fill)
nand                   - NAND sub-system
nboot   - boot from NAND device
nbubt   - Burn a boot loader image on the Boot Nand Flash.
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
phyRead - Read PCI-E Phy register
pciePhyWrite    - Write PCI-E Phy register
phyRead - Read Phy register
phyWrite        - Write Phy register
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
rcvr    - Satrt recovery process (Distress Beacon with TFTP server)
reset   - Perform RESET of the CPU
resetenv        - Return all environment variable to default.
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
se      - PCI Slave enable
setenv  - set environment variables
sflash  - read, write or erase the external SPI Flash.
sg      - scanning the PHYs status
sp      - Scan PCI bus.
switchRegRead   - Read switch register
switchRegWrite  - Write switch register
Temp    - read chip Tj temp
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version

> Debian-3.16.0-kirkwood-tld-2-rootfs-bodhi.tar.bz2

For me this kernel and initrd also dies silently.


When downloading the rescue FW (URL reconstructed from the script I've found here; http://recovery.medion.hipserv.com/downloads/recovery/get_firmware.php?mac=00:11:41:11:22:33&uname=2.6.31.8.Feb.19&dist=hipserv2_medion&method=getfile ) it's named "stora.ubi".

So I also tried the Stora-arcNumber - but without success.
I'll try other arcNumbers as well later.


Searching for Stora I found that: http://www.openstora.com/wiki/index.php?title=How_to_install_Debian_Linux_on_NETGEAR_Stora / download files from http://kom.aau.dk/~pmr/www/openstora .
But this kernel also dies silently.


In my despair I tried to contact Medion and asked for providing the U-Boot sources and patches.
I'm not confident to get hands on it, but at least I'm trying.


BTW: stock kernel and chroot'ing to your mounted Debian-3.16.0-kirkwood-tld-2-rootfs-bodhi rootfs does "start something" but no login is seen.

/ # exec switch_root /newroot /sbin/init
INIT: version 2.88 booting
[info] Using makefile-style concurrent boot in runlevel S.
[FAIL] udev requires a kernel >= 2.6.32, not started ... failed!
 failed!
[warn] Filesystem mounted on /dev/shm; setting up compatibility bind mount. ... (warning).
[warn] Please remove this mount from /etc/fstab; it is no longer needed, and it is preventing completion of the transition to /run/shm. ... (warning).
[ ok ] Activating swap...done.
[....] Checking root file system...fsck from util-linux 2.20.1
rootfs: clean, 27618/118560 files, 300875/473596 blocks
done.
EXT3 FS on sda1, internal journal
[ ok ] Cleaning up temporary files... /tmp /lib/init/rw.
[ ok ] Loading kernel modules...done.
[ ok ] Activating lvm and md swap...done.
[....] Checking file systems...fsck from util-linux 2.20.1
done.
[ ok ] Mounting local filesystems...done.
[ ok ] Activating swapfile swap...done.
[ ok ] Cleaning up temporary files....
[ ok ] Setting kernel variables ...done.
[....] Configuring network interfaces...Internet Systems Consortium DHCP Client 4.2.2
Copyright 2004-2011 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/eth0/00:11:41:3c:20:8a
Sending on   LPF/eth0/00:11:41:3c:20:8a
Sending on   Socket/fallback
DHCPREQUEST on eth0 to 255.255.255.255 port 67
DHCPREQUEST on eth0 to 255.255.255.255 port 67
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 10
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 20
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 15
No DHCPOFFERS received.
Trying recorded lease 192.168.0.15
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.

--- 192.168.0.1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms

No working leases in persistent database - sleeping.
done.
[....] Starting rpcbind daemon...rpcbind: cannot create socket for udp6
rpcbind: cannot create socket for tcp6
. ok
[ ok ] Starting NFS common utilities: statd idmapd.
[ ok ] Cleaning up temporary files....
[FAIL] startpar: service(s) returned failure: udev ... failed!
INIT: Entering runlevel: 2
[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting busybox' syslogd implementation : syslogdStarting /sbin/syslogd...
2111 (syslogd)
. ok
[ ok ] Starting system message bus: dbus.
[....] Starting busybox' klogd implementation : klogdStarting /sbin/klogd...
[ ok ] Starting Avahi mDNS/DNS-SD Daemon: avahi-daemon.
[ ok ] Starting NFS common utilities: statd idmapd.
[ ok ] Starting rpcbind daemon...[....] Already running..
[ ok ] Starting NTP server: ntpd.
[warn] Not starting NFS kernel daemon: no exports. ... (warning).
[ ok ] Starting OpenBSD Secure Shell server: sshd.
2109 (klogd)
. ok

INIT: Id "T0" respawning too fast: disabled for 5 minutes
INIT: no more processes left in this runlevel
INIT: Id "T0" respawning too fast: disabled for 5 minutes

So my thoughts are maybe - until being able to boot a newer kernel - I can use the stock kernel and an older Debian (not requiring udev).
This way I don't have an up to date system but a solid Debian one at last.
When not exposing it to "evil" internet, only using locally, it should be enough.

An updated kernel however (esp. with fixed security issues) would be much more appreciated...


Another two thoughts:
* What do you think: might a hardware debugger help?
There is an unsoldered connector 2x10 pins; similar to this one in the upper right corner https://images.anandtech.com/doci/4195/syn_06.JPG.
Chances are that they use an ARM JTAG pinout (http://3.bp.blogspot.com/-tZAu7bGYp-I/T60-DLhwuHI/AAAAAAAAARs/MxHjZmLMpUE/s1600/ARM-20.png ).
And I forgot where, but I recently found an article that a Raspberry PI served as JTAG debugger; similar article: https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle.

* After your kernel starts and freezes: when I press the reset switch for some time, I hear a beep once (pressing again - apparently nothing happens).
I suspect this is done by some micro controller accompanied to the main processor.
Maybe that µC also serves as a HW watchdog - and not triggered by your kernel it just halts the main processor?
I have no clue how to find out either in SW (uboot / kernel) or in HW (board is covered by metal shield - I think the risk of damaging is too high when unsoldering).
So it's just a thought...

Thanks,
Peter2017

Peter,

> sorry missed that. bdinfo is not available.

That's too bad.

The fact that earlyprintk did not give us any thing:

1. Perhaps the serial connection configuration is not correct.

setenv bootargs console=ttyS0,115200 root=/dev/sda1 earlyprintk=serial

However, this is stock configuration. And it told us that it is possible:

root@tldDebian:/usr/src/Medion_MD86783/kernel-2.6.31.8# grep -i console .config 
CONFIG_CMDLINE="console=ttyS0,115200"
# CONFIG_NETCONSOLE is not set
CONFIG_CONSOLE_TRANSLATIONS=y
CONFIG_VT_CONSOLE=y
CONFIG_HW_CONSOLE=y
# CONFIG_VT_HW_CONSOLE_BINDING is not set
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_CORE_CONSOLE=y

2. So I think stock u-boot did something bad that makes earlyprintk not possible. I think you should try with many different baudrates to see if any will work.

setenv bootargs console=ttyS0,baudrate root=/dev/sda1 earlyprintk=serial

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello bodhi,

> I think you should try with many different baudrates to see if any will work.

How can the baurate be changed automatically at PC side?
Stock uboot is at 115200 - this is needed to interrupt booting the stock kernel.

When baudrate is switched by kernel - how can the PC change it at the same time?


Another thought: can this older stock uboot load and run a newer uboot (copied to RAM only, loaded from USB e.g.)?
Could that newer uboot provide bdinfo out of the box?

Yours,
Peter2017

> Another thought: can this older stock uboot load
> and run a newer uboot (copied to RAM only, loaded
> from USB e.g.)?
> Could that newer uboot provide bdinfo out of the
> box?
>

It will not work chainloading the new u-boot from stock u-boot this old. That I am 99% positive. But you could try, it will not hurt anything.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello bodhi,

good news is: I'm sill alive.
Bad news is: at least until next weekend I won't have much time investigating.
But I'm still eager to get this done!

Meanwhile I'm still interested in your thoughts:

> What do you think: might a hardware debugger help? [...]

> [...] I suspect this is done by some micro controller accompanied to the main processor.
Maybe that µC also serves as a HW watchdog [...]

> When baudrate is switched by kernel - how can the PC change it at the same time?

> [...] chainloading the new u-boot [...]

Do you know the start address of the uboot?
Or can you give me an advise how to find it?

I mean when loading kernel/uboot/whatever to $ADDRESS does "bootm $ADDRESS" transfer control (change program counter, PC) to $ADDRESS or is there a data structure at $ADDRESS and new PC needs to be set to $ADDRESS+$OFFEST?

I don't know far too less - and despite having a very general imagination of how it works - I don't even have a clue how to ask a search machine for help.
I'm hoping you can push me in the right direction.

Yours,
Peter2017

Peter,

Can you find the GPL source for this u-boot? that would help greatly to solve this.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

> Can you find the GPL source for this u-boot? that would help greatly to solve this.

So far: no success.
No reply from distributor yet.
But I intent to ask again.


Yours,
Peter2017

Did Medion reply or do they just wanted to change your device as in my case?

Hi guys,

Sorry that I am hijacking conversation from nowhere.

Seems that this is a "stepbrother" of my Netgear Stora MS2110.
If you still need source code it can be easily obtained from Netgear opensource site and there is source tarball for MS2110 (newest one is unavailable):
https://www.downloads.netgear.com/files/ReadyNAS/stora_source_2.3.2.tar.bz2
There is separate tarball with U-Boot source code.

At least I managed to recover my Stora with Medion recovery files pulled from their recovery site, seems that both of them are using same Hipserv OS from Axentra , but this is other unrelated subject.
Let me know if you need some dumps from Stora - I have 2 - one fully working and one with dead flash due to cell wearing.

Hi Gitsov,

> Seems that this is a "stepbrother" of my Netgear
> Stora MS2110.

Thanks for this info! If it is indeed a clone of Netgear MS2110, then see here for the latest kernel and u-boot:

Debian rootfs and kernels:
https://forum.doozan.com/read.php?2,12096

U-boot:
https://forum.doozan.com/read.php?3,12381

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Not sure that it is exactly 100% clone, as board model number is a different I think. Tomorrow I can check on Stora what was model number exactly, but this Medion looks very similar to Stora's hardware. At least with kwbooted U-boot Stora boots Debian recovery distro from flash.

Gitsov Wrote:
-------------------------------------------------------
> Not sure that it is exactly 100% clone, as board
> model number is a different I think. Tomorrow I
> can check on Stora what was model number exactly,
> but this Medion looks very similar to Stora's
> hardware. At least with kwbooted U-boot Stora
> boots Debian recovery distro from flash.

Cool! that's how you would verify. If you can kwboot the Stora u-boot 2017.07-tld-1, and use the Stora DTB in Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2 and boot with it then you can tell.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

It's booting. I did not tried to resolve problem with environment variable space as for now I do not plan to use it on production. Mainly I am using it for flashing experiments with NAND. Boot log is attached in case it is needed. Let me know if it is required more commands to be issued.

Gitsov Wrote:
-------------------------------------------------------
> It's booting. I did not tried to resolve problem
> with environment variable space as for now I do
> not plan to use it on production. Mainly I am
> using it for flashing experiments with NAND. Boot
> log is attached in case it is needed. Let me know
> if it is required more commands to be issued.

this is a MD86783/P89634 with stock uboot?
AND
it managed to boot with kwboot with uboot.2017.07-tld-1.netgear_MS2110.mtd0.kwb?

I am asking because i can not reproduce your results. But maybe it's just me doing silly things.

It's a Netgear Stora MS2000/MS2110. It's booted via Serial/TTL with uboot.2017.07-tld-1.netgear_MS2110.mtd0.kwb and USB flash. Also it is worthy to check which board and revision you have - Stora have A0 and A1 revisions as far as I know. At least my "main, production" unit seems to be A0 and second one "for experiments" is A1.
I did not managed to get working (and I did not had enough free time to deal with it) u-boot environment so just booted it via TTL and USB.

About NAND backup - take it with nanddump as Bodhi said. Make sure that you backed up all mtd0, mtd1 and mtd2 partitions. Usually for returning to stock U-boot and maybe kernel are required (mtd0 + mtd1). mtd2 can be recovered via stock recovery, but I am not sure if your unit is exactly the same like mine. Take a backup of all partitions for safety.

Hello,

I'm trying to boot using kwboot, but it seems the special serial handshake is not working here, kwboot keeps sending it and the device never acknowledges it and just goes into normal booting. Here is the bootloader signature:

** MARVELL BOARD: DB6702A-GMtech LE

U-Boot 1.1.4 (Jun 5 2013 - 10:49:39) Marvell version: 3.6.0

U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000 size 256MB
DRAM Total size 256MB 16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash: 0 kB

CPU : Marvell Feroceon (Rev 1)

Damien,

Try with the latest ARM kwboot attached in this post:

https://forum.doozan.com/read.php?3,69499,72534#msg-72534

If there is any response (even with error) then there's a good chance it will work .

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thank you for your quick reply bodhi. Unfortunately, I do not have a arm board to run kwboot from. But there are some good news since I posted this morning. The board has a 20 pin jtag connector that I manage to connect to my jlink adapter and openocd with this config: https://gist.github.com/canatella/4d6e113e1a95ed715a04d3fae8a756a3#file-md86783-cfg. I managed to backup my nand and try the uboot images for netgear ms2110, nas 320, nas 310s and nas 310 but none of them booted. I also compiled uboot myself but it is getting stuck in the data_abort handler in vector.S . So the bad news is nothing is working as of now, the good news is I can run gdb over jtag and try to debug what's going on in there. Do you have any idea where in u-boot code I can break to catch the error before it goes into the exception handler ? Is there a way to get some traces of what is going on to get an idea where it is failing ?

Also I maybe can check some memory addresses with the original uboot but I have no idea what to look for.

I also asked Medion for the uboot and kernel sources, we'll see if I get better result.

Anyway thank you already for your help!