Welcome! Log In Create A New Profile

Advanced

Problems with Stora MS2000/MS2110 NAND replacement

Posted by Gitsov 
Problems with Stora MS2000/MS2110 NAND replacement
February 01, 2018 01:58PM
Hello,

I got two units of Netgear Stora MS2110/2000 (same hardware, but 2110 are sold with 1TB drive inside). Second unit had dead flash with almost no good cells left and producing ECC errors, so I decided to replace NAND chip. And now story begins:
- tried to buy same Samsung K9F2G08U0C-SCB0 from Aliexpress - both 5 chips arrived DOA. Symptoms were - no TTL output, no LED lights/blinks, only one chip was recognized only one time from U-Boot via kwboot, but as 1MB/4KB pagesize. So I throw them.
- After few days investigation found that Samsung NAND chips of this type are EOL and it's no more on table for selling. Looked for compatible alternative and based on datasheets decided to order Cypress/Spansion S34ML02G100TFI000. On a paper both chips are similar and should be interchangeable, but when I replaced Samsung one with Spansion one problems began. Symptoms - when I load via kwboot/TTL original u-boot dump, chip is recognized with correct size, page size, eraseblock and so on. I can flash it with orifginal firmware files (nand dumps without ECC and OOB), flashing ends without any errors and complaints, but after reboot unit is completely dead - no TTL output from U-boot, no lights, just a spinning fan. Tried to boot unit via kwboot with original u-boot and unit is booting from NAND, tried to flash Bodhi's 2017.05 U-boot + recovery kernel/rootfs on USB for Stora - same problem - it boots via serial, but not in standalone. At this moment I am bit lost where to look and what to change - not sure if this is a problem of U-Boot/Kernel NAND support or just NAND flash controller is not recognizing NAND chip and refuses to initialize it.
For convenience datasheets are attached. Tomorrow I will get U-boot logs too. I really need advise where to look for clues and will be happy to share any progress which I will gain.
Attachments:
open | download - K9F2G08U0C-Samsung.pdf (525.2 KB)
open | download - S34ML01G1_S34ML02G1_S34ML04G1_1_Gbit_2_G-933041.zip.001 (900 KB)
open | download - S34ML01G1_S34ML02G1_S34ML04G1_1_Gbit_2_G-933041.zip.002 (226.2 KB)
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 01, 2018 03:29PM
Gitsov,

> I load via kwboot/TTL original u-boot dump, chip
> is recognized with correct size, page size,
> eraseblock and so on. I can flash it with
> orifginal firmware files (nand dumps without ECC
> and OOB), flashing ends without any errors and
> complaints, but after reboot unit is completely
> dead - no TTL output from U-boot, no lights, just
> a spinning fan.


> Tried to boot unit via kwboot with
> original u-boot and unit is booting from NAND,
> tried to flash Bodhi's 2017.05 U-boot + recovery
> kernel/rootfs on USB for Stora - same problem - it
> boots via serial, but not in standalone. At this
> moment I am bit lost where to look and what to
> change - not sure if this is a problem of
> U-Boot/Kernel NAND support or just NAND flash
> controller is not recognizing NAND chip and
> refuses to initialize it.

At this point, I would just make sure that you can boot with kwboot using the latest u-boot, and then boot the latest Debian rootfs.

NAND is nice to have, but once you decide to use USB or HDD rootfs, then the only inconvenience is when you reboot you need to use serial to load u-boot.

In any case, if you can get it to boot with Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2, then likely we will be able to see why that NAND does not work, and what to do about it.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 12:11AM
It's booting.
Log is provided in other Debian thread and it is attached here as well.
If I need to keep PC near to NAS to keep it booting via serial ... I will throw unit in trash bin and will install some NAS software on PC (OMV, FreeNAS, Nas4Free, vanilla FreeBSD with needed packages) :)

Goal is to make unit to be standalone and boot from flash (later will decide about SATA or USB rootfs). I need to know if problem is in hardware (NAND controller in SoC is having difficulties with initialization) or there is a compatibility problems with U-Boot and/or kernel. For now I am suspecting that controller have problems with NAND chip as your U-Boot should have support for NAND (at least Spansion/Cypress site said that 2017 dated U-boot code includes support for this chip).

Differences in u-boot "nand info" outputs which I noted are (second one is original Samsung chip):

Device 0: nand0, sector size 128 KiB

  Page size       2048 b

  OOB size          64 b

  Erase size    131072 b

  subpagesize      512 b

  options     0x4000101c

  bbt options 0x00008000





Device 0: nand0, sector size 128 KiB

  Page size       2048 b

  OOB size          64 b

  Erase size    131072 b

  subpagesize      512 b

  options     0x40001014

  bbt options 0x00008000


Attachments:
open | download - ms2000-U-boot.2017.05.Bootlog.txt (17.2 KB)
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 03:07AM
Gitsov,

Everything looks good to me.

Try flashing u-boot image and it's default env image. Please post the log of this flashing session.

And reboot with serial console running picocom/minicom. What does the boot log show?

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 03:26AM
I tried that already yesterday - nandflash just writes sectors from 0x0 to 0x100000 and no other errors are logged. This is for original mtd0 image, same for your u-boot, but addresses are less.
If I flash env image it's freezing when original flash chip is used (it's 1MB is still alive), while Linux is booting, but have TTL output.
Problem is when I flash either your u-boot or original mtd0 partition image and leave unit to boot/read u-boot from Spansion's flash instead of kwboot - then I have no serial output at all (totally blank screen) and no any LED lights at all. Just the fan is spinning, no other signs of life. Power, HDD1/2 and LAN LEDs are off. I am suspecting that problem is somewhere before U-Boot init. Maybe bootrom which is responsible for hardware initialization before TTL/COM connection is initialized, but need to be sure.
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 03:39AM
Gitsov,

> I am
> suspecting that problem is somewhere before U-Boot
> init. Maybe bootrom which is responsible for
> hardware initialization before TTL/COM connection
> is initialized, but need to be sure.

You are most likely correct. The bootROM might be choking on this NAND. Perhaps you need to look at the 6281 Reference Manual. If it can't understand this NAND device then nothing would hapen, i.e. blank screen.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 04:09AM
Excerpt from Ref Manual for 6281. Pardon the format! it was copy/pasted from PDF.


Quote

Boot from NAND Flash

In this boot method, a boot image must be located on the first page of the NAND flash. The main header must exist at offset 0, and an extension header is mandatory for this boot device, to perform DDR initialization (since the image must be copied to the DDR to be executed, and it cannot be executed directly from NAND flash).
In this boot mode, <NFActCEnBoot> field in the NAND Flash Control Register
(Table 613 p. 676) is set to 1, which enables the NAND flash controller to hold the CEn signal asserted throughout the entire read phase.
The source image must be located at the offset specified by the main header.
The main header, extension header, and source image must contain valid checksum values.
The source image is downloaded to the DDR byte-by-byte, using a NAND flash software protocol.
Since there are different types of NAND flash devices, with different read command sequences, the bootROM implements a detection mechanism, to support most of the NAND flash types. The bootROM tries to read the first 512 bytes in four different ways, and uses the main header checksum check as a success indication.
Following are the four types of NAND flash read commands used, listed in the order they are tried by the bootROM:
Table 79: Types of NAND Flash Read Commands Supported
Note

NAND Flash Type
Read Command Sequence
1
Large pages
5 address cycles with 0x30 command trailer
Command 0x00, Address 0–7, Address 8–11, Address 12–19, Address 20–27, Address 28 and above, Command 0x30 NOTE: For pages larger than 2K, the size should be indicated in
the main header of the BootROM.
2
512 byte pages 3 address cycles
Plane A (Address bit-8 = 0): Command 0x00, Address 0–7, Address 9–16, Address 17–24
Plane B (Address bit-8 = 1): Command 0x01, Address 0–7, Address 9–16, Address 17–24
3
Large pages
4 address cycles with 0x30 command trailer
Command 0x00, Address 0–7, Address 8–11, Address 12–19, Address 20–27, Command 0x30
NOTE: For pages larger than 2K, the size should be indicated in
the main header of the BootROM.
4
512 byte pages 4 address cycles
Plane A (Address bit-8 = 0): Command 0x00, Address 0–7, Address 9–16, Address 17–24, Address 25–26
Plane B (Address bit-8 = 1): Command 0x01, Address 0–7, Address 9–16, Address 17–24, Address 25–26
The bootROM tries to boot from four types of NAND flash devices four times (a total of 16 times). The first eight trials are performed with ECC calculation and the last eight trials are performed skipping ECC correction. A NAND flash reset (using the command 0xFF) is performed before each boot trial.
Copyright © 2008 Marvell Doc. No. MV-S104860-U0 Rev. C December 2, 2008, Preliminary Document Classification: Proprietary Information Page 301
88F6180/88F619x/88F6281 Functional Specifications
On each trial, the bootROM checks the 32-bit checksum on the image copied to the RAM. If the checksum fails, the bootROM registers the error, increments the retry count, and restarts the boot process. The bootROM supports both 4-bit RS ECC (Reed-Solomon Error Correcting Code) and 1-bit Hamming ECC (Error Correcting Code). For Large Page NAND flash devices, RS ECC is used, while for small page devices, Hamming ECC is used.
The following are the ECC algorithms supported per NAND flash types.
Table 80: Types of ECC Protocols Supported per Flash Type
Bad Block Management
The BootROM supports bad block skipping. Before reading from a block, it is verified to be a good block, by checking the appropriate OOB byte (or bytes) in the Spare area to be 0xFF.
For the 512B page devices, the number of pages per block is fixed at 32 (and thus block size is 16 KB).
For Large page devices (2 KB and over), the block size, pages per block number, and the technology used (cell type is MLC or SLC) are read at runtime using the READID command (in bytes 3 and 4).
The following are the OOB locations checked by the bootROM based on the type of NAND flash selected through the reset strap.
Table 81: Bad Block Indicators per NAND Flash Cell Type

NAND Flash Type
Read Command Sequence
1
Large pages
4 or 5 address cycles with 0x30 command trailer
RS-ECC with 4-bit detection/correction per 512B of data.
2
512 byte page
3 and 4 address cycles
Hamming with 2-bit detection, with 1-bit correction per 256B of data (23-bit ECC).
NAND Flash Type
Read Command Sequence
1
Large page MLC devices
Byte[0] of the spare area in the last page of the block (For a good block, the byte should be equal to 0xFF).
2
Large page SLC devices
Byte[0] and Byte[5] of the spare area in the first and second pages of the block (For a good block, both bytes should be equal to 0xFF).
3
512B page SLC devices
Byte[5] of the spare area in the first and second pages of the block (For a good block, the bytes should be equal to 0xFF).

-bodhi
===========================
Forum Wiki
bodhi's corner



Edited 1 time(s). Last edit at 02/02/2018 04:11AM by bodhi.
Re: Problems with Stora MS2000/MS2110 NAND replacement
February 02, 2018 10:58AM
Hello,

Likely the culprit is this:
For Large page devices (2 KB and over), the block size, pages per block number, and the technology used (cell type is MLC or SLC) are read at runtime using the READID command (in bytes 3 and 4).

Every manufacturer have it's own ID for copyright protection purposes and I am suspecting that bootROM is checking it. Depending what is predefined it can refuse to initialize and use that chip. Additionally I am not sure that "allowed" IDs can be read from it. Anyways ... I found that 512MB chip which I ordered for test is working and unit at the moment is revived with it. Little work and now unit have 512MB NAND onboard and it is 100% usable. Later will try to deploy either Debian or some Redhat based distro on NAND. For today I feel little bit tired to continue with this kind of fight.
Thanks for you time Bodhi and let me know if you need some logs from that "Frankenstein" unit.
I believe that have several unusable/incompatible NAND chips from Spansion/Cypress.
Author:

Your Email:


Subject:


Spam prevention:
Please, solve the mathematical question and enter the answer in the input field below. This is for blocking bots that try to post this form automatically.
Question: how much is 7 plus 16?
Message: