How to unbrick the Netgear Ready NAS Duo v2

Hi All !

Yesterday I bricked my oldest Netgear ReadyNas Duo v2 and need help for repair her.
I was try to upgrade u-boot loader to 2017.07 (https://forum.doozan.com/read.php?3,12381) and NAS going to die.

What I done:
1) Download tools to NAS (https://forum.doozan.com/read.php?3,27280)
2) Download firmware for Stora Netgear (beacouse I think this similar vendor of NAS hardware) uboot.2017.07-tld-1.netgear_ms2110.bodhi.tar
3) And finally download uboot.2016.05-tld-1.environment.bodhi.tar

I have TTL interface to direct connect to device

Firstly I look into my system:

 ** MARVELL BOARD: DB-88F6282A-BP LE 

U-Boot 1.1.4 (Jun  29 2012 - 16:06:46) Marvell version: 3.4.27
Netgear version: Uboot-1_1_4-NetgearDUOV3-V1009

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006D0120

Soc: MV88F1155 Rev 1 (DDR3)
CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz 

DRAM unknown CAL  tRP = 8 tRAS = 20 tRCD=8
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Plug On and Power down, Please Switch On !

root@storage:~# cat /proc/cpuinfo 
Processor  : Feroceon 88FR131 rev 1 (v5l)
BogoMIPS  : 1599.07
Features  : swp half thumb fastmult edsp 
CPU implementer  : 0x56
CPU architecture: 5TE
CPU variant  : 0x2
CPU part  : 0x131
CPU revision  : 1
Hardware  : Feroceon-KW
Revision  : 0000
Serial    : 0000000000000000

Kernel on the board was very oldest “Linux 2.6.31.8.duov2”

root@storage:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00180000 00020000 "u-boot"
mtd1: 001a0000 00020000 "u-boot-env"
mtd2: 00800000 00020000 "uImage"
mtd3: 01800000 00020000 "minirootfs"
mtd4: 06800000 00020000 "jffs2"

root@storage:~#./fw_printenv ethaddr
Warning: Bad CRC, using default enviroment

…..
and Im goes to steps in upgrade steps in post:
Make dump of mtd0

root@storage:~#nanddump --noecc --omitoob -l 0x80000 -f mtd0 /dev/mtd0
root@storage:~#fw_printenv > current_envs.txt

root@storage:~#dmesg | grep -i 'bad'
Scanning device for bad blocks
Bad eraseblock 726 at 0x000005ac0000

root@storage:~#flash_erase /dev/mtd0 0 4
Erase Total 4 Units 
Performing Flash Erase of length 131072 at offset 0x60000 done

root@storage:~#nandwrite /dev/mtd0 uboot.2017.07-tld-1.netgear_ms2110.mtd0.kwb
Writing data to block 0 at offset 0x0 
Writing data to block 1 at offset 0x20000 
Writing data to block 2 at offset 0x40000 
Writing data to block 3 at offset 0x60000

froot@storage:~#fw_printenv > current_envs.txt
froot@storage:~#flash_erase /dev/mtd0 0xc0000 1
Erase Total 1 Units
Performing Flash Erase of length 131072 at offset 0xc0000 done

root@storage:~#nandwrite -s 786432 /dev/mtd0 uboot.2016.05-tld-1.environment.img
Writing data to block 6 at offset 0xc0000

root@storage:~#fw_setenv arcNumber 2743
root@storage:~#fw_setenv machid
root@storage:~#fw_setenv ethaddr 'xx:xx:xx:xx:xx:xx'
root@storage:~#fw_setenv bootcmd_uenv 'run uenv_load; if test $uenv_loaded -eq 1; then run uenv_import; fi; sleep 3'
root@storage:~#fw_setenv dtb_file
root@storage:~#reboot

…...AND NOTHING….
TTL CONSOLE in silent,
Ethernet connection is dead… (

Please, help to unbricked my lovely and and upgrade it (if possible)....

BR,
Yury



Edited 1 time(s). Last edit at 12/16/2018 02:04AM by yury_minsk.

yuri_minsk,

The Netgear Stora uboot cannot be used for the Netgear Ready NAS Duo. It has a different Marvell SoC.

So basically your box needs to be unbricked with UART booting. Since you have saved mt0, and have serial console, this image can be used in kwboot command to rescue your box. Most of the Marvell SoC can be unbricked this way.

See this post for an example how to run kwboot to unbrick the NSA320S:

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

The kwboot command that you should run is:

kwboot  -t -B 115200 /dev/ttyUSB0 -b mtd0  -p

mtd0 is the file name for the mtd0 dump that you have saved while installing the Stora uboot.

Quote

root@storage:~#nanddump --noecc --omitoob -l 0x80000 -f mtd0 /dev/mtd0

Please post serial console log of your kwboot run here.

Note that if you use x86 box to run serial console, then you need x86 kwboot version (let me know and I will find the post that I have uploaded this version).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 2 time(s). Last edit at 12/16/2018 06:24AM by bodhi.

bodhi,

[yury@x200:~] > sudo apt install u-boot-tools 

[yury@x200:~] > kwboot -t -B 115200 /dev/ttyUSB0 -b mtd0 -p
Sending boot message. Please reboot the target...\
Sending boot image...
  0 % [+++++++++++++++++xmodem: Bad message

I try some times with connected console plug-unplug powerc supply... only bad message =(

yury_minsk,


-------------------------------------------------------
> bodhi,
>
>

> [yury@x200:~] > sudo apt install u-boot-tools 
> 
> [yury@x200:~] > kwboot -t -B 115200 /dev/ttyUSB0
> -b mtd0 -p
> Sending boot message. Please reboot the
> target...\
> Sending boot image...
>   0 % [+++++++++++++++++xmodem: Bad message
>

>
> I try some times with connected console
> plug-unplug powerc supply... only bad message =(

When you see “xmodem: bad message” it is actuall good sign!

Up arrow to recall the kwboot command and run it again. Repeat this several times until the handshake occurs and it will be loaded.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

After many times trying to make kwboot compleate, Im upgrade my linux kernel from 4.4 to 4.20rc8, and all was done.

[yury@x200:~] > kwboot -t -B 115200 /dev/ttyUSB0 -b mtd0 -p                                            
Sending boot message. Please reboot the target.../
Sending boot image...
  0 % [......................................................................]
  1 % [......................................................................]
  3 % [......................................................................]
  5 % [......................................................................]
  6 % [......................................................................]
  8 % [......................................................................]
 10 % [......................................................................]
 11 % [......................................................................]
 13 % [......................................................................]
 15 % [......................................................................]
 17 % [......................................................................]
 18 % [......................................................................]
 20 % [......................................................................]
 22 % [......................................................................]
 23 % [......................................................................]
 25 % [......................................................................]
 27 % [......................................................................]
 29 % [......................................................................]
 30 % [......................................................................]
 32 % [......................................................................]
 34 % [......................................................................]
 35 % [......................................................................]
 37 % [......................................................................]
 39 % [......................................................................]
 41 % [......................................................................]
 42 % [......................................................................]
 44 % [......................................................................]
 46 % [......................................................................]
 47 % [......................................................................]
 49 % [......................................................................]
 51 % [......................................................................]
 53 % [......................................................................]
 54 % [......................................................................]
 56 % [......................................................................]
 58 % [......................................................................]
 59 % [......................................................................]
 61 % [......................................................................]
 63 % [......................................................................]
 64 % [......................................................................]
 66 % [......................................................................]
 68 % [......................................................................]
 70 % [......................................................................]
 71 % [......................................................................]
 73 % [......................................................................]
 75 % [......................................................................]
 76 % [......................................................................]
 78 % [......................................................................]
 80 % [......................................................................]
 82 % [......................................................................]
 83 % [......................................................................]
 85 % [......................................................................]
 87 % [......................................................................]
 88 % [......................................................................]
 90 % [......................................................................]
 92 % [......................................................................]
 94 % [......................................................................]
 95 % [......................................................................]
 97 % [......................................................................]
 99 % [....................................]
[Type Ctrl-\ + c to quit]

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: DB-88F6282A-BP LE 

U-Boot 1.1.4 (Jun 29 2012 - 16:06:40) Marvell version: 3.4.27
Netgear version: Uboot-1_1_4-NetgearDUOV3-V1009

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006D0120

Soc: MV88F1155 Rev 1 (DDR3)
CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz 

DRAM unknown CAL  tRP = 8 tRAS = 20 tRCD=8
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Plug On and Power down, Please Switch On !

What next I do ?

yury_minsk,

> After many times trying to make kwboot compleate,
> Im upgrade my linux kernel from 4.4 to 4.20rc8,
> and all was done.

Excellent!

Please post these info:

1. Run kwboot and interrupt serial console at countdown, and

printenv
help

2. Go ahead and boot all the way into kernel 4.20rc8. Login to Debian and

cat /proc/mtd

And post the entire serial console log here (from kwboot command to the output of cat /proc/mtd).

The mtd info in the log will tell us how to flash your backup mtd0 file to the mtd0 device.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 12/16/2018 04:28PM by bodhi.

bodhi,

I can't do anything... Power on button do nothing, but after my bricking after push power button I see countdown and can go to Marvell shell... but right now I can't do anything...
last line:

Plug On and Power down, Please Switch On !

I have my old cat /proc/mtd

root@storage:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00180000 00020000 "u-boot"
mtd1: 00020000 00020000 "u-boot-env"
mtd2: 00600000 00020000 "uImage"
mtd3: 01000000 00020000 "minirootfs"
mtd4: 06800000 00020000 "jffs2"

Can it's help me to flash mtd ?


> Please post these info:
>
> 1. Run kwboot and interrupt serial console at
> countdown, and



Edited 1 time(s). Last edit at 12/16/2018 04:44PM by yury_minsk.

yury_minsk,

I see. So you are stuck at this point and not getting the countdown.

> Plug On and Power down, Please Switch On !

Try pressing the Power button once here. See if it will get out of the hang.

> I have my old cat /proc/mtd
>

> root@storage:~# cat /proc/mtd 
> dev:    size   erasesize  name
> mtd0: 00180000 00020000 "u-boot"
> mtd1: 00020000 00020000 "u-boot-env"
> mtd2: 00600000 00020000 "uImage"
> mtd3: 01000000 00020000 "minirootfs"
> mtd4: 06800000 00020000 "jffs2"
>

>
> Can it's help me to flash mtd ?

Definetely helps. But first you need to be able to interrupt u-boot at count down. At u-boot prompt, you can flash mtd0 back to NAND and things get back to normal. Or if you can boot into stock OS, then flash it there (this is the preferred approach).

And then preferably boot into Debian on a USB drive in the future after unbricking. This Ready NAS Duo has mainline support already.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

I trying many times press power button on nas, pressing backup button, power+backup.... but nothing ((

> Try pressing the Power button once here. See if it
> will get out of the hang.

Try repeatedly press a key (eg. contrl-C) while uboot is starting, keep doing that until a few seconds after you got stuckwith that line.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I trying ctrl-c on u-boot loading, pressing all buttons on nas, but nothing.
My friend have this model of nas too. He can dump all mtd flash.
Maybe in my dump I dont have keybindings on nas (eg. Power and backup).
And I can disassembly nas and look on motherboard additional powerup pins

yury_minsk,

I believe you are stuck because the wrong state of the Power button, so the box is waiting for a key or WOL packet.

Try again and do these, see if which one works.

1. Press the Power button repeatedly (don't hold it) while u-boot starting after kwboot has loaded.

2. If number 1 does not work and you are stuck at that line. Let it sit there. On another Linux box, use etherwake to send WOL packet to this box MAC address.

apt-get install ethtool etherwake
etherwake xx:xx::xx

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

Nothing good....
Not working pressing power button many times after-before starting kwboot, Iam stuck at the line about "Please, Switch On!"
Iam installed and tryed etherwake , but nothing

[yury@x200:~] > sudo etherwake e0:46:9a:a0:3f:b3
SIOCGIFHWADDR on eth0 failed: No such device

p.s. tcpdump on my laptop interface connected to nas show only outcoming requests to nas

yury_minsk,

> Nothing good....
> Not working pressing power button many times
> after-before starting kwboot, Iam stuck at the
> line about "Please, Switch On!"
> Iam installed and tryed etherwake , but nothing

Bummer :)

I've also found and looked at what nastibad did for this box. And this is the recommendation

Quote

Then, we get access to the console and then plug the power cord without powering the device. The following appears:

arno@small$ screen /dev/ttyUSB0 115200

__ __ _ _
| \/ | __ _ _ ____ _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| | | | (_| | | \ V / __/ | |
|_| |_|\__,_|_| \_/ \___|_|_|
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__|
** MARVELL BOARD: DB-88F6282A-BP LE

U-Boot 1.1.4 (Feb 6 2012 - 14:40:46) Marvell version: 3.4.27
Netgear version: Uboot-1_1_4-NetgearDUOV3-V1008

U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006D0120

Soc: MV88F1155 Rev 1 (DDR3)
CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz

DRAM unknown CAL tRP = 8 tRAS = 20 tRCD=8
DRAM CS[0] base 0x00000000 size 256MB
DRAM Total size 256MB 16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash: 0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Plug On and Power down, Please Switch On !


We can then power on the device. This will present a 3 seconds countdown which allow us to interrupt the boot process and access u-boot, simply by hitting a key. Let's do just that.

Net: egiga0 [PRIME]
Hit any key to stop autoboot: 0

Marvell>>

So basically nastibad say: plug in the power cord, but don't press Power button, and then press Power button when this message presented.

Does the box power up when you plug in the power cord, or did you have to press Power button?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi ,

> Does the box power up when you plug in the power
> cord, or did you have to press Power button?

No, before bricking device I testing the marvall ttl console connection and after plug power cord to device on screen TTL I saw this message about powering on. After pressing the power button on device, i have countdown, hit enter and uboot console welcome me.

maybe after big uptime (more than 300 days) I dont remember normal startup mode....
maybe inside battery 2023 is over? i can replace her

yury_minsk,

> No, before bricking device I testing the marvall
> ttl console connection and after plug power cord
> to device on screen TTL I saw this message about
> powering on. After pressing the power button on
> device, i have countdown, hit enter and uboot
> console welcome me.
>

That's the normal behavior.

We are running the same u-boot image in mtd0 that is loaded into memory. The difference is u-boot envs (its NAND was replaced with the Stora's which are no good), I would expect it to give out errors, and then fallback to u-boot internal envs, and then start counting down. But apparently we did not get to that point.

This box seems to go into standby mode when you power down too long. So the Power button is what kicks off the box out of this mode.

> maybe after big uptime (more than 300 days) I dont
> remember normal startup mode....
> maybe inside battery 2023 is over? i can replace
> her

Perhaps you should try 2 different things:

1. Removing the battery before running kwboot, to see if the behavior is different. It would change the logic where u-boot reads the clock and stops at the message. But I am not sure what the value in the RTC at that point, hopefully sometime in the future (we would trick it to think the box has not been down too long).

2. Hold the Power button down all the time when kwboot starts until the message appears. This is so that in case the button read logic tries to detect the press-and-hold (not a brief press).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Bodhi,

I try all possible things: hold button , pushing button, change ttl converter (pl2302-ch341a), use mtd0 file from my friends readynas duo v2, remove battery, replace battery.... but nothing good. Only after showing logo u-boot power light blinking and i again show "lovely" message about powering on this brick.

On motherboard i see 10-pins unsoldering jtag connector. Maybe this can help me?

Maybe try different u-boot file from similary device if you know once?

yury_minsk,

> On motherboard i see 10-pins unsoldering jtag
> connector. Maybe this can help me?

There must be a key sequence to break out of this hang on serial console, that we don't know about.

JTAG is a bigger effort, it wil take a lot of time.


> Maybe try different u-boot file from similary
> device if you know once?

The only u-boot that is closest to this box is the NSA325 that I've released:

https://forum.doozan.com/read.php?3,12381

Quote

uboot.2017.07-tld-1.nsa325.bodhi.tar
md5
102be464341ec77de08725998dfca00b
sha256
93968d24efbe9fa1641f93340a4d3c476475c9d63f61573b365976d0770937ad

I expect that you can kwboot with this NSA325 u-boot, however, it will not run very far becasue the memory size is different (less is OK, but the NSA325 has 512MB). Try kwboot with this image, just to confirm that it can start running.

If you can find the GPL source for this u-boot, I might be able look into it to figure out some way to break through that message hanging.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi Wrote:
-------------------------------------------------------
> If you can find the GPL source for this u-boot, I
> might be able look into it to figure out some way
> to break through that message hanging.

GPL Source for almost all Netgear products is available at NETGEAR Open Source Code for Programmers. There are 13 versions of the source available for the Duo V2 and u-boot source code is included.

Ray

bodhi,
Thanks for help. Im going to start investigating sources of uboot

Ray,
thanks for link.

I will write after rebuild uboot and test all variants to fix my brick

Bodhi,

1) I'am downloaded last official firmware for my Netgear ReadyNas Duo V2 on https://kb.netgear.com/2649/NETGEAR-Open-Source-Code-for-Programmers-GPL]NETGEAR Open Source Code for Programmers (GPL)[/url] - RND_5.3.13_WW.src.zip

2)Downloaded toolchain from readynas site - cross-sdk3.2rc1-ct-ng-1.4.1-arm-mv5sft-linux-gnueabi-1107-12-07-2009.tar.bz2

3) Extract and add to my zsh $PATH bin directory of toolchain and extract for research sources.

4)

yury@x200:~/>cd u-boot/
yury@x200:~/>grep -r 'Plug On and Power down'
board/mv_feroceon/mv_hal/usibootup/usibootup.c:         printf("Plug On and Power down, Please Switch On !\n\n");

5) Fix bootflag to 1 in powerup by plug on (like a reboot signal):

--- orig/board/mv_feroceon/mv_hal/usibootup/usibootup.c 2018-12-18 17:24:59.885924338 +0300
+++ fixid/board/mv_feroceon/mv_hal/usibootup/usibootup.c        2018-12-18 17:38:22.417597477 +0300
@@ -488,7 +488,7 @@
                puts("Error reading the RS5C372a.\n");

        /*justify plug on or switch on*/
-       if( (bootflag == 0) && (!env || (strcmp(env,"close") == 0) || ((strcmp(env,"open") == 0) && ((value & BIT5) == 0))))    //power plug in firstly
+       if( (bootflag == 1) && (!env || (strcmp(env,"close") == 0) || ((strcmp(env,"open") == 0) && ((value & BIT5) == 0))))    //power plug in firstly
        {

                /*force 1000M to 100M and wait WOL for power consideration */

6) Compile the uboot:

yury@x200:~/>make db88f6282abp_config LE=1 NBOOT=1 DIAG=1 BAY=2 

Configuring for mv_kw board...
** MV_88F6282 image ** config 
** DB 88F6282A BP ** config 
** With USB ** config 
** Boot from NAND support image ** config 
** diagnostic tests support image ** config 
** USI Build Board DUOV3

yury@x200:~/>make

make[1]: Leaving directory '/home/yrybnikov/Downloads/RDN-D2/u-boot/common'
UNDEF_SYM=`arm-mv5sft-linux-gnueabi-objdump -x lib_generic/libgeneric.a board/mv_feroceon/config_kw/libconfig_kw.a cpu/arm926ejs/libarm926ejs.a lib_arm/libarm.a fs/cramfs/libcramfs.a fs/fat/libfat.a fs/fdos/libfdos.a fs/jffs2/libjffs2.a fs/reiserfs/libreiserfs.a fs/ext2/libext2fs.a net/libnet.a disk/libdisk.a rtc/librtc.a dtt/libdtt.a drivers/libdrivers.a drivers/nand/libnand.a drivers/usb/libusb.a drivers/sk98lin/libsk98lin.a diag/libdiag.a post/libpost.a post/cpu/libcpu.a common/libcommon.a |sed  -n -e 's/.*\(__u_boot_cmd_.*\)/-u\1/p'|sort|uniq`;\
        arm-mv5sft-linux-gnueabi-ld -Bstatic -T /home/yrybnikov/Downloads/RDN-D2/u-boot/board/mv_feroceon/config_kw/u-boot.lds -Ttext 0x00600000  $UNDEF_SYM cpu/arm926ejs/start.o \
                --start-group lib_generic/libgeneric.a board/mv_feroceon/config_kw/libconfig_kw.a cpu/arm926ejs/libarm926ejs.a lib_arm/libarm.a fs/cramfs/libcramfs.a fs/fat/libfat.a fs/fdos/libfdos.a fs/jffs2/libjffs2.a fs/reiserfs/libreiserfs.a fs/ext2/libext2fs.a net/libnet.a disk/libdisk.a rtc/librtc.a dtt/libdtt.a drivers/libdrivers.a drivers/nand/libnand.a drivers/usb/libusb.a drivers/sk98lin/libsk98lin.a diag/libdiag.a post/libpost.a post/cpu/libcpu.a common/libcommon.a --end-group -L /home/yrybnikov/Downloads/cross/bin/../lib/gcc/arm-mv5sft-linux-gnueabi/4.3.2 -lgcc \
                -Map u-boot.map -o u-boot
arm-mv5sft-linux-gnueabi-objcopy --gap-fill=0xff -O srec u-boot u-boot.srec
cp -f u-boot.srec u-boot-db88f6282abp.srec
arm-mv5sft-linux-gnueabi-objcopy --gap-fill=0xff -O binary u-boot u-boot.bin
cp -f u-boot.bin u-boot-db88f6282abp.bin
./tools/doimage -T nand -D 0x600000 -E 0x670000 -P 2048 -R dramregs_533ddr3db_A.txt u-boot-db88f6282abp.bin u-boot-db88f6282abp_533ddr3db_nand.bin
u-boot-db88f6282abp_533ddr3db_nand.bin was created 
./tools/doimage -T uart -D 0x600000 -E 0x670000 -R dramregs_533ddr3db_A.txt u-boot-db88f6282abp.bin u-boot-db88f6282abp_533ddr3db_uart.bin
u-boot-db88f6282abp_533ddr3db_uart

7) Try to load from patched uboot

yury@x200:~/>kwboot -t -B 115200 /dev/ttyUSB0 -b u-boot-db88f6282abp_533ddr3db_nand.pached.bin -p

8) WIN !!!

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: DB-88F6282A-BP LE 

U-Boot 1.1.4 (Dec 18 2018 - 17:21:21) Marvell version: 3.4.27
Netgear version: Uboot-1_1_4-NetgearDUOV3-V1008

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFD40

Soc: MV88F1155 Rev 1 (DDR3)
CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz 

DRAM unknown CAL  tRP = 8 tRAS = 20 tRCD=8
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Switch On !

Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 

Marvell>> help
?       - alias for 'help'
SatR - sample at reset sub-system, relevent for DB only
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootext2    dev:boot_part1,boot_part2 addr boot_image linux_dev_name 
bootm   - boot application image from memory
bootp	- boot image via network using BootP/TFTP protocol
bubt	- Burn an image on the Boot Nand Flash.
chpart	- change active partition
cmp     - memory compare
cmpm	- Compare Memory
cp      - memory copy
cpumap - Display CPU memory mapping settings.
crc32   - checksum calculation
date    - get/set/reset date & time
dclk	- Display the MV device CLKs.
dhcp	- invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo    - echo args to console
eeprom  - EEPROM sub-system
erase   - erase FLASH memory
ext2load- load binary file from a Ext2 filesystem
ext2ls  - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fi	- Find value in the memory.
flinfo  - print FLASH memory information
fsinfo	- print information about filesystems
fsload	- load binary file from a filesystem image
g	- start application at cached address 'addr'(default addr 0x40000)
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imm[.b, .s, .w, .l]     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
ir	- reading and changing MV internal register values.
loop    - infinite loop on address range
ls	- list files in a directory (default /)
map	- Diasplay address decode windows
md      - memory display
me	- PCI master enable
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
mp	- map PCI BAR
mtdparts- define flash/nand partitions
mtest   - simple RAM test
mv_diag - perform board diagnostics
mv_diag - run all available tests
mv_diag [1|2|...]
        - run specified test number
mw      - memory write (fill)
nand                   - NAND sub-system
nboot   - boot from NAND device
nbubt	- Burn a boot loader image on the Boot Nand Flash.
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
phyRead	- Read PCI-E Phy register
pciePhyWrite	- Write PCI-E Phy register
phyRead	- Read Phy register
phyWrite	- Write Phy register
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
rcvr	- Satrt recovery process (Distress Beacon with TFTP server)
reset   - Perform RESET of the CPU
resetenv	- Return all environment variable to default.
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
se	- PCI Slave enable
setenv  - set environment variables
sflash	- read, write or erase the external SPI Flash.
sg	- scanning the PHYs status
sp	- Scan PCI bus.
switchRegRead	- Read switch register
switchRegWrite	- Write switch register
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
usimemtest [start] [end] - USI Memory Test Tool
version - print monitor version
Marvell>> printenv 
baudrate=115200
loads_echo=0
ipaddr=192.168.58.21
serverip=192.168.58.135
rootpath=/mnt/ARM_FS/
netmask=255.255.255.0
run_diag=no
console=console=ttyS0,115200
CASset=min
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
ethmtu=1500
mvPhoneConfig=mv_phone_config=dev0:fxs,dev1:fxs
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
ethaddr=e0:46:9a:a0:3f:b3
bootcmd=nand read.e 0x1200000 0x200000 0x600000;nand read.e 0x2000000 0x800000 0x1000000;bootm 0x1200000 0x2000000
stdin=serial
stdout=serial
stderr=serial
mainlineLinux=no
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
bootdelay=3
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no
ethact=egiga0
bootargs=console=ttyS0,115200 reason=normal mtdparts=nand_mtd:0x180000@0(u-boot),0x20000@0x180000(u-boot-env),0x600000@0x200000(uImage),0x1000000@0x800000(minirootfs),0x6800000@0x1800000(jffs2);

Environment size: 1325/131068 bytes
Marvell>>

So, it's not full version of my manipulations and trys, but, this all steps can help to load from kwboot

What I need to write newest uboot (if its possible) and upgrde kernel (to make multiboot NAND of USB without system on HDD)...



Edited 2 time(s). Last edit at 12/18/2018 01:31PM by yury_minsk.

yury_minsk,

Excellent works :)

I think first you should try to look at the envs again. See if you can set them permanently to a good state using the new compiled u-boot.

bootflag
close
open

And then kwboot the mtd0 image. If you can get pass that hangup with these envs set correctly, then use the old mtd0. That way you don't bypass the standby feature they have implemented.

OTOH, if you try the new u-boot and the standby feature is still intact then it's good to have new u-boot.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

I load into my linux on NAS via kwboot (fixed bootflag), how can I write my compiled fresh u-boot ? what params of nandwrite I need use ?
my partition on NAND is

[root@STORAGE:~] > cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00180000 00020000 "u-boot"
mtd1: 00020000 00020000 "u-boot-env"
mtd2: 00600000 00020000 "uImage"
mtd3: 01000000 00020000 "minirootfs"
mtd4: 06800000 00020000 "jffs2"

yury_minsk Wrote:
-------------------------------------------------------
> bodhi,
>
> I load into my linux on NAS via kwboot (fixed
> bootflag), how can I write my compiled fresh
> u-boot ? what params of nandwrite I need use ?
> my partition on NAND is
>

> [root@STORAGE:~] > cat /proc/mtd 
> dev:    size   erasesize  name
> mtd0: 00180000 00020000 "u-boot"
> mtd1: 00020000 00020000 "u-boot-env"
> mtd2: 00600000 00020000 "uImage"
> mtd3: 01000000 00020000 "minirootfs"
> mtd4: 06800000 00020000 "jffs2"
>

I also need to see dmesg output for this boot. Please post that, or better yet post the entire serial console and cat /proc/mtd.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

Im attached boot output , and dmesg out. Look at this files

yury_minsk,

I see. You have not been able to boot into Debian yet. Let me come back and write some u-boot envs for you to do that.

In the mean time, look at the kernel and rootfs release thread:

https://forum.doozan.com/read.php?2,12096

You need to create a USB rootfs using Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2.

Scroll down to this section

Quote

Updated 24 Jul 2017:

Basic Debian stretch Kirkwood rootfs for most Kirwood plugs:

- tarball size: 188M
- install size: 488M
- The init system used in this rootfs is sysvinit . To boot with systemd, see note 2 below.
- Installed packages: nano, avahi, ntp, busybox-syslogd (log to RAM), htop, isc-dhcp-client, dialog, bzip2, nfs server/client, iperf, ethtool, sysvinit-core, sysvinit, and sysvinit-utils.
- see LED controls in /etc/rc.local, and /etc/init.d/halt
- see some useful aliases in /root/.profile
- root password: root

Download at Dropbox:

Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2

md5:
bf3d29569943875df348fb5ca03b348c
sha256:
4ed5714fdb123cdb40e973f3d0754e91cd199b75a9874018f2b5dc9cfa8ae8bb

And remember to check the hash of what you download, as always.

Note: since you will boot with stock u-boot, you need to do Step 4, using the kirkwood-netgear_readynas_duo_v2.dtb.

Once you got the USB rootfs ready, we'll work on the envs to boot that.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

Ok. I created rootfs USB flash with Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2
Use ext3 (because my uboot is old version) and done all steps.
What is next ?
I try to boot via my pachded uboot (kwboot) but all loading from HDD RAID (usb is lpuged but ignored by loading)

Let me take a look at your envs.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

yury_minsk,

kwboot like you did before

Quote

yury@x200:~/>kwboot -t -B 115200 /dev/ttyUSB0 -b u-boot-db88f6282abp_533ddr3db_nand.pached.bin -p

Interrupt serial console and

setenv mainlineLinux yes
setenv load_uimage 'ext2load usb 0:1 0x800000 /boot/uImage'
setenv load_initrd 'ext2load usb 0:1 0x2100000 /boot/uInitrd'
setenv set_bootargs 'setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10  mtdparts=orion_nand:0x180000@0(u-boot),0x20000@0x180000(u-boot-env),0x600000@0x200000(uImage),0x1000000@0x800000(minirootfs),0x6800000@0x1800000(jffs2) earlyprintk=serial'
setenv bootcmd_exec 'echo Booting Debian... ; usb start; run set_bootargs; run load_uimage; run load_initrd; bootm 0x800000 0x2100000'
setenv bootcmd_stock 'echo Booting Stock...; nand read.e 0x1200000 0x200000 0x600000;nand read.e 0x2000000 0x800000 0x1000000;bootm 0x1200000 0x2000000'
setenv bootcmd 'run bootcmd_exec; run bootcmd_stock; reset'
boot

And post the entire serial console log here.

Note that we need a little more adjustment to boot stock as a fall back. We'll do that later.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi,

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: DB-88F6282A-BP LE 

U-Boot 1.1.4 (Dec 18 2018 - 17:21:21) Marvell version: 3.4.27
Netgear version: Uboot-1_1_4-NetgearDUOV3-V1008

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFD40

Soc: MV88F1155 Rev 1 (DDR3)
CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz 

DRAM unknown CAL  tRP = 8 tRAS = 20 tRCD=8
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Switch On !

Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 
Marvell>> setenv mainlineLinux yes
Marvell>> setenv load_uimage 'ext2load usb 0:1 0x800000 /boot/uImage'
Marvell>> setenv load_initrd 'ext2load usb 0:1 0x2100000 /boot/uInitrd'
Marvell>> setenv set_bootargs 'setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10  mtdparts=orion_nand:0x180000@0(u-boot),0x20000@0x180000(u-boot-env),0x600000@0x200000(uImage),0x1000000@0x800000(minirootfs),0x6800000@0x1800000(jffs2) earlyprintk=serial'
Marvell>> setenv bootcmd_exec 'echo Booting Debian... ; usb start; run set_bootargs; run load_uimage; run load_initrd; bootm 0x800000 0x2100000'
** Too many args (max. 16) **
Marvell>> setenv bootcmd_stock 'echo Booting Stock...; nand read.e 0x1200000 0x200000 0x600000;nand read.e 0x2000000 0x800000 0x1000000;bootm 0x1200000 0x2000000'
Marvell>> setenv bootcmd 'run bootcmd_exec; run bootcmd_stock; reset'
Marvell>> boot
Booting Debian...
(Re)start USB...
USB:   scanning bus for devices... 1 USB Device(s) found
Waiting for storage device(s) to settle before scanning...
0 Storage Device(s) found
** Bad partition 1 **
** Bad partition 1 **
## Booting image at 00800000 ...
Bad Magic Number
Booting Stock...

NAND read: device 0 offset 0x200000, size 0x600000

Reading data from 0x7ff800 -- 100% complete.
 6291456 bytes read: OK

NAND read: device 0 offset 0x800000, size 0x1000000

Reading data from 0x17ff800 -- 100% complete.
 16777216 bytes read: OK
## Booting image at 01200000 ...
   Image Name:   Linux-2.6.31.8.duov2
   Created:      2013-04-18  10:25:25 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3442360 Bytes =  3.3 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 02000000 ...
   Image Name:   initrd
   Created:      2013-04-19   3:06:56 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    4382833 Bytes =  4.2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux................................................................................................................................................................................................................... done, booting the kernel.

after last message about uncompressing Linux.... I have nothing, olny sound of poweringdown HDD's.