Bricked stora ms2100 -- need help

tiaderosa

Bricked stora ms2100 -- need help
October 05, 2025 03:08PM

Registered: 4 weeks ago
Posts: 17

Hi,
forgive me if I'm not very precise as I'm newbee in Uboot and embedded linux
My STORA with stock FW had broblem lately with flashing blu led and no connection. I've setup a serial connection to check what was wrong. I got NAND error PEB & LEB that prevented the UBIFS to be mounted to set and load /newroot. I got access to basic Linux system through serial connection in putty.

I then tried to boot from usb following the indication found in "https://github.com/evgkirov/stora-debian-install"; and I have modified the uboot env variables accordingly.

The new booting process started ok but ended with a crc error. Below the log I got.

__  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: 0fa09806, Calculated CRC: 0fa09806

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  3  2  1  0 
(Re)start USB...
USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
.
....
......
............
.
........................
.
.........................
........................
.
.........................
.........................
.........................
.......

1927896 bytes read
.
.
...
......
............
.
........................
.
.........................
........................
.
.........................
.........................
.........................
........................
.
.........................
.........................
.........................
.........................
.........................
.........................
.........................
........................
.
.........................
.........................
.........................
.........................
.........................
.........................
.........................
........................
.
.........................
.........................
.........................
........................

7338563 bytes read
## Booting image at 00200000 ...
   Image Name:   Linux-3.10.26-stora
   Created:      2014-01-13  20:27:45 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1927832 Bytes =  1.8 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
   Image Name:   initramfs-3.10.26-stora
   Created:      2014-01-13  20:27:54 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    7338499 Bytes =  7 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... Bad Data CRC

tried to set the uboot env variables back to the original to come back to the previous stage as I wanted to try another way. No success as the new booting was stopping with a Marvell >> prompt.

I looked into the Uboot command help and I found the command "resetenv" saying "Return all environment variable to default.". So I executed it and then gave a reset.

Marvell>> resetenv

Erase Env parameters offset 0xa0000... done
Warning: Default Environment Variables will take effect Only after RESET 
Marvell>> reset

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: ffffffff, Calculated CRC: 619d86db
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++
## Error: environment overflow, "stdin" deleted
## Error: environment overflow, "stdout" deleted
## Error: environment overflow, "stderr" deleted

CPU : Marvell Feroceon (Rev 1)
## Error: environment overflow, "console" deleted
## Error: environment overflow, "mainlineLinux" deleted
## Error: environment overflow, "CASset" deleted
## Error: environment overflow, "enaMonExt" deleted
## Error: environment overflow, "enaCpuStream" deleted
## Error: environment overflow, "enaWrAllo" deleted
## Error: environment overflow, "pexMode" deleted
## Error: environment overflow, "disL2Cache" deleted
## Error: environment overflow, "setL2CacheWT" deleted
## Error: environment overflow, "disL2Prefetch" deleted
## Error: environment overflow, "enaICPref" deleted
## Error: environment overflow, "enaDCPref" deleted
## Error: environment overflow, "sata_dma_mode" deleted
## Error: environment overflow, "MALLOC_len" deleted
## Error: environment overflow, "ethprime" deleted
## Error: environment overflow, "netbsd_en" deleted
## Error: environment overflow, "vxworks_en" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "bootargs_end" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "standalone" deleted
## Error: environment overflow, "bootdelay" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ethmtu" deleted
## Error: environment overflow, "eth1addr" deleted
## Error: environment overflow, "eth1mtu" deleted
## Error: environment overflow, "mvPhoneConfig" deleted
## Error: environment overflow, "mvNetConfig" deleted
## Error: environment overflow, "usb0Mode" deleted
## Error: environment overflow, "yuk_ethaddr" deleted
## Error: environment overflow, "nandEcc" deleted
## Error: environment overflow, "hddPowerCtrl" deleted
## Error: environment overflow, "netretry" deleted
## Error: environment overflow, "rcvrip" deleted
## Error: environment overflow, "loadaddr" deleted
## Error: environment overflow, "autoload" deleted
## Error: environment overflow, "enaAutoRecovery" deleted

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: device mode
PEX 0: interface detected no Link.
Net:   ## Error: environment overflow, "ethact" deleted
egiga0, egiga1## Error: environment overflow, "ethact" deleted

USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
Trying to load image from USB flash drive using FAT FS
reading /flashware.img

** Unable to read "/flashware.img" from usb 0:1 **
Trying to load image from USB flash drive using ext2 FS partition 0
Failed to mount ext2 filesystem...
** Bad ext2 partition or disk - usb 0:0 **
Trying to load image from USB flash drive using ext2 FS partition 1

** Unable to read "/flashware.img" from usb 0:1 **
Couldn't load recovery image from USB flash drive, Trying network interface
Aquiring an IP address using DHCP...
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
Failed to retreive an IP address assuming default (<NULL>)!
Starting the Recovery process to retreive the file...
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
Failed
Power Button is pressed!
MPP Sel: 00000530, Data IN Enable: 00020058, Data In Polarity: 00000040, Data In: 00000010
Power Button is released!
MAC: 00:01:8D:F6:7E:01, IP: 10.246.126.1
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ipaddr" deleted
## Error: environment overflow, "serverip" deleted
## Error: environment overflow, "netmask" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "console" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "rootpath" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `serverip' not set
## Error: environment overflow, "bootargs" deleted
## Booting image at 00800000 ...
   Image Name:   initramfs-3.10.26-stora
   Created:      2014-01-13  20:27:54 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    7338499 Bytes =  7 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... Bad Data CRC

The printenv command repleys with a lot of "ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ" characters on the screen and "Environment size: 131069/131068 bytes" at the end.

I try to restore the old env variable one by one (I have the output of the original "printenv results") but set env seems not to work. Below an example:

Marvell>> setenv baudrate=115200
Marvell>> saveenv
Saving Environment to NAND...
Erasing Nand...Writing to Nand... done
Marvell>> printenv baudrate
## Error: "baudrate" not defined

I've read a recovery procedures but I'm confused on what to do to recover my Stora.

Can you please help me ?

Thanks
Regards

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 05, 2025 04:00PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

Yes, Netgear Stora stock u-boot has this bug. When you do resetenv it messes up the envs area.

There are a few different posts about how to unbrick the Stora. But before doing anything, you should try to run UART booting to make sure that you can always recover.

Download the 2017.07 Stora u-boot

https://forum.doozan.com/read.php?3,12381

The tarball is uboot.2017.07-tld-1.netgear_ms2110.bodhi.tar. U-Boot image is

uboot.2017.07-tld-1.netgear_ms2110.mtd0.kwb

On Linux box that you're running serial console, run kwboot to load the u-boot over UART. See this example:

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

=====

After you can load and start the new u-boot over UART. You'll have many choices:

- reflash the stock Stora u-boot so you can run stock OS.
- boot into latest Debian rootfs on USB (and later migrate to HDD rootfs).

Let me know if you want to keep running stock Stora FW.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 05, 2025 08:58PM

Admin
Registered: 14 years ago
Posts: 19,916

And here is how to chainload u-boot a working stock u-boot version.

Unbricking Netgear Stora using chainload method

https://forum.doozan.com/read.php?3,123019,123579#msg-123579

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 05, 2025 11:01PM

Registered: 4 weeks ago
Posts: 17

Thank you for your clear indications. I let you know !

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 07, 2025 05:04PM

Registered: 4 weeks ago
Posts: 17

Hi,
I tried following your instructions, but so far I haven't been able to enable UART boot on my device.

I'll describe what I did just to make sure there are no errors, since this is my first time performing UART boot.

My Stora device is behaving strangely. It starts booting as soon as I plug in the power supply. There's no need to press the button on the back!!!
It's always been this way in the past. I thought there was a setting in the stock software that handled this issue, but I couldn't find it.

I'm not sure if this is important or not.

Anyway I ran all the tests on a Debian 12.7 virtual machine with a Windows 10 host. My PC has two COM ports, and I configured one of the COM ports on the virtual machine to have a physical connection to the host hardware. It can be accessed as /dev/tty/S0 on the virtual machine. I ran a few tests just to verify that the COM port was working properly with a putty connection and also with the picocom command, and I didn't encounter any problems. Everything seems fine on my virtual machine as far as COM port behavior goes.

I then installed "kwboot_2025.01-rc1_x86-64.tar.bz2" with "tar -xvjf kwboot_2025.01-rc1_x86-64.tar.bz2 - C /usr/bin" (I'm logged in as root in my Debian 12.7 virtual machine).

In a root terminal, I typed "kwboot -t -B 115200 /dev/ttyS0 -b uboot.2017.07-tld-1.netgear_ms2110.mtd0.kwb -p", but didn't press Enter.

Then I connected the power supply to my storage device and pressed Enter in the terminal. I tried several times to change the delay between powering on the storage device and pressing Enter in the terminal from about zero seconds, 1 second, 2 seconds, 3 seconds, 4 seconds, and 5 seconds.

I also started kwboot first and then turned on my Stora.

I always got this result in the terminal, no matter what I did.

kwboot version 2025.01-rc1-ge61ea9f2e5d2-dirty
Detected kwbimage v0 with NAND boot signature
Patching image boot signature to UART
Sending boot message. Please reboot the target...\

When the delay is short (up to about 1 second), I see the rdx LED on the "rs232 to ttl" board flash for about 40 seconds and then stop. The Stora appears to be freeze and not boot at all.

When the delay is greater than a second, the stock uboot boots and stops with a bad magic error and the "Marvel>>" prompt. To verify, I repeated the entire test with a putty terminal connected at the same time.
Since my Stora responds with ff00003c: 00000111, I also tried the procedure found at https://forum.doozan.com/read.php?3,7852,7852#:~:text=gz%20(7.1%C2%A0KB)-,openstoraU,Re%3A%20UART%20Booting%20HowTo%20for%20Selected%20Kirkwood%20Devices,-May%2007%2C%202012. I opened a root terminal and typed "picocom -b 115200 /dev/ttyS0", but I have modified the sequence C+a C+e to C+a C+s since I don't find any C+e command in my picocom.

Here is what I got:

root@debian:/# picocom -b 115200 /dev/ttyS0
picocom v3.1

port is        : /dev/ttyS0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
stopbits are   : 1
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
hangup is      : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv -E
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,
logfile is     : none
initstring     : none
exit_after is  : not set
exit is        : no

Type [C-a] [C-h] to see available commands
Terminal ready

*** file: uboot.kwb
$ sz -vv uboot.kwb

but then stock uboot starts again.

What am I doing wrong ?

Any suggestion on what to do ?

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 07, 2025 07:32PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

You might have a Stora box that does not support UART booting. Power up, interrupt u-boot count down and

md ff00003c

If the output is

ff00003c: 00000121 e3a00000 e59f222c e5921000  !.......,"......

If it is 00000121 then the version 1.2, but it is 000000110 or 000000111 then the BootROM version is 1.1.

The BooROM 1.2 supports UART booting, but the 1.1 does not.

======

Now if you can not kwboot, you can just go ahead and try this procedure. Starting from here

https://forum.doozan.com/read.php?3,123019,123579#msg-123579. Read this post and the next one.

I'll be back.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Edited 1 time(s). Last edit at 10/08/2025 12:26AM by bodhi.

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 07, 2025 11:01PM

Registered: 4 weeks ago
Posts: 17

Thankyou for your repley

Quote

You might have a Stora box that does not support UART booting. Power up, interrupt u-boot count down and

md ff00003c

If the output is
ff00003c: 00000121 e3a00000 e59f222c e5921000 !.......,"......

If it is not 00000121 then the version 1.2, but it is 000000110 or 000000111 then the BootROM version is 1.1.

The BooROM 1.2 supports UART booting, but the 1.1 does not.

Yes, I think that would be the case. I do get :

Marvell>> md ff00003c

ff00003c: 00000111 e3a00000 e59f222c e5921000    ........,"......
ff00004c: e2013008 e3530000 1a000002 e3811008    .0....S.........
ff00005c: e5821000 e5921000 e3a03000 ee2f3f1b    .........0...?/.
ff00006c: e59f2208 e5921000 e3c11cff e3c110ff    ."..............
ff00007c: e3710801 1a000003 e5921000 e3c114ff    ..q.............
ff00008c: e3c118ff e5821000 e59f21e0 e5922000    .........!... ..
ff00009c: e3a01902 e0112002 0a00000b e59f21d0    ..... .......!..
ff0000ac: e5921000 e3c11080 e5821000 e59f21c4    .............!..
ff0000bc: e5921000 e3c11080 e5821000 e59f21b8    .............!..
ff0000cc: e5921000 e3c1120f e5821000 e10f5000    .............P..
ff0000dc: e3c5501f e38550d3 e121f005 e3a05000    .P...P....!..P..
ff0000ec: ee075f17 ee075f16 ee075f15 ee085f17    ._..._..._..._..
ff0000fc: e59f2174 e3a03010 e5924000 e1c44003    t!...0...@...@..
ff00010c: e5824000 ee3f1f11 e3811505 ee2f1f11    .@....?......./.
ff00011c: e3a04003 ee034f10 e59f4160 ee024f10    .@...O..`A...O..
ff00012c: e3a03601 e3a02000 e3a01d06 e59f0150    .6... ......P...

So if there are no chance to get UART booting ok I''ll try what you suggested.

I'll let you know
Regards

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 11, 2025 11:15AM

Registered: 4 weeks ago
Posts: 17

Hi bodhi,
I still have hard time to get uboot working ok. I followed the procedure you were suggesting staring from here https://forum.doozan.com/read.php?3,123019,123579#msg-123579.

First I had to find an usb pen compatible with my Stora. I did several test and at the end I have found an old IMPEGA HWDS-512C pen (512MB) that was detected correctly by my Stora.

I have ext2 formatted the pen and put in the file named " uboot-3.14.16-512ram.bin" I've downloaded . I have renamed it "uboot.bin". That was the only file on the pen.

I have then inserted the pen on my Stora and power it up. The pen have been recognized correctly and I could even list the file on the pen.
I launched "ext2oad usb 0:1 0xf00000 /uboot.bin" .The file seemed to has been read ok.
I then launched "go 0xf00200" . The Stora started with the new booting procedure (you can see that in the below attachment where istead of ** MARVELL BOARD: RD-88F6281A LE" you can find "** MARVELL BOARD: SHEEVA PLUG LE ")
but I still got env variable errors. The other change I could see is that at the end the two HD leds turned on orange and the usb pen was not recognized anymore without a new reset.
**". Below the whole log (Sorry for a long one).

__  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: 619d86db, Calculated CRC: 619d86db
## Error: environment overflow, "stdin" deleted
## Error: environment overflow, "stdout" deleted
## Error: environment overflow, "stderr" deleted

CPU : Marvell Feroceon (Rev 1)
## Error: environment overflow, "console" deleted
## Error: environment overflow, "mainlineLinux" deleted
## Error: environment overflow, "CASset" deleted
## Error: environment overflow, "enaMonExt" deleted
## Error: environment overflow, "enaCpuStream" deleted
## Error: environment overflow, "enaWrAllo" deleted
## Error: environment overflow, "pexMode" deleted
## Error: environment overflow, "disL2Cache" deleted
## Error: environment overflow, "setL2CacheWT" deleted
## Error: environment overflow, "disL2Prefetch" deleted
## Error: environment overflow, "enaICPref" deleted
## Error: environment overflow, "enaDCPref" deleted
## Error: environment overflow, "sata_dma_mode" deleted
## Error: environment overflow, "MALLOC_len" deleted
## Error: environment overflow, "ethprime" deleted
## Error: environment overflow, "netbsd_en" deleted
## Error: environment overflow, "vxworks_en" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "bootargs_end" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "standalone" deleted
## Error: environment overflow, "bootdelay" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ethmtu" deleted
## Error: environment overflow, "eth1addr" deleted
## Error: environment overflow, "eth1mtu" deleted
## Error: environment overflow, "mvPhoneConfig" deleted
## Error: environment overflow, "mvNetConfig" deleted
## Error: environment overflow, "usb0Mode" deleted
## Error: environment overflow, "yuk_ethaddr" deleted
## Error: environment overflow, "nandEcc" deleted
## Error: environment overflow, "hddPowerCtrl" deleted
## Error: environment overflow, "netretry" deleted
## Error: environment overflow, "rcvrip" deleted
## Error: environment overflow, "loadaddr" deleted
## Error: environment overflow, "autoload" deleted
## Error: environment overflow, "enaAutoRecovery" deleted

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: device mode
PEX 0: interface detected no Link.
Net:   ## Error: environment overflow, "ethact" deleted
egiga0, egiga1## Error: environment overflow, "ethact" deleted

USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
Trying to load image from USB flash drive using FAT FS
reading /flashware.img

** Unable to read "/flashware.img" from usb 0:1 **
Trying to load image from USB flash drive using ext2 FS partition 0
Failed to mount ext2 filesystem...
** Bad ext2 partition or disk - usb 0:0 **
Trying to load image from USB flash drive using ext2 FS partition 1

** Unable to read "/flashware.img" from usb 0:1 **
Couldn't load recovery image from USB flash drive, Trying network interface
Aquiring an IP address using DHCP...
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
Failed to retreive an IP address assuming default (<NULL>)!
Starting the Recovery process to retreive the file...
## Error: environment overflow, "ethact" deleted
*** ERROR: `ethaddr' not set
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
Failed
Power Button is pressed!
MPP Sel: 00000530, Data IN Enable: 00020058, Data In Polarity: 00000040, Data In: 00000010
Power Button is released!
MAC: 00:01:31:39:F4:DE, IP: 10.57.244.222
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ipaddr" deleted
## Error: environment overflow, "serverip" deleted
## Error: environment overflow, "netmask" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "console" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "rootpath" deleted
## Error: environment overflow, "ethact" deleted
*** ERROR: `serverip' not set
## Error: environment overflow, "bootargs" deleted
## Booting image at 00800000 ...
Bad Magic Number
Marvell>> ext2load usb 0:1 0x800000 /uboot.bin

.
.
...
......
....
....
...
.
...................

471088 bytes read
## Error: environment overflow, "filesize" deleted
Marvell>> go x800200

## Starting application at 0x00800200 ...

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: SHEEVA PLUG LE 

U-Boot 1.1.4 (Jul 14 2009 - 06:46:57) Marvell version: 3.4.16

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CF120

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
## Error: environment overflow, "stdin" deleted
## Error: environment overflow, "stdout" deleted
## Error: environment overflow, "stderr" deleted

CPU : Marvell Feroceon (Rev 1)
## Error: environment overflow, "console" deleted
## Error: environment overflow, "mainlineLinux" deleted
## Error: environment overflow, "CASset" deleted
## Error: environment overflow, "enaMonExt" deleted
## Error: environment overflow, "enaCpuStream" deleted
## Error: environment overflow, "enaWrAllo" deleted
## Error: environment overflow, "pexMode" deleted
## Error: environment overflow, "disL2Cache" deleted
## Error: environment overflow, "setL2CacheWT" deleted
## Error: environment overflow, "disL2Prefetch" deleted
## Error: environment overflow, "enaICPref" deleted
## Error: environment overflow, "enaDCPref" deleted
## Error: environment overflow, "sata_dma_mode" deleted
## Error: environment overflow, "MALLOC_len" deleted
## Error: environment overflow, "ethprime" deleted
## Error: environment overflow, "netbsd_en" deleted
## Error: environment overflow, "vxworks_en" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "bootargs_end" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "standalone" deleted
## Error: environment overflow, "bootdelay" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ethmtu" deleted
## Error: environment overflow, "mvPhoneConfig" deleted
## Error: environment overflow, "mvNetConfig" deleted
## Error: environment overflow, "usb0Mode" deleted
## Error: environment overflow, "yuk_ethaddr" deleted
## Error: environment overflow, "nandEcc" deleted
## Error: environment overflow, "netretry" deleted
## Error: environment overflow, "rcvrip" deleted
## Error: environment overflow, "loadaddr" deleted
## Error: environment overflow, "autoload" deleted
## Error: environment overflow, "enaAutoRecovery" deleted

Streaming disabled 
Write allocate disabled


USB 0: device mode
PEX 0: interface detected no Link.
Net:   ## Error: environment overflow, "ethact" deleted
egiga0, egiga1## Error: environment overflow, "ethact" deleted

Marvell>>

What was wrong ?
What should I do ?
Regards,

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 11, 2025 02:23PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

Ok. Note that we have 2 different methods in the Wiki thread for unbricking Stora

Quote

Restore Netgear Stora FW
Unbricking Netgear Stora using chainload method

You have tried the chainload method. Now you should try the "Restore Netgear Stora FW" method.

After you erased the corrupt envs area like Stormy did, you will see the checksum error (next post), which is a good thing (the envs area has nothing on it so it cannot cause overflown).

CRC in Flash: 52235cfe, Calculated CRC: d2e69e2b 
+++++++++++++++++++++++++++Checksum Error!++++++++++++++++++++++++++++++

After you got to this point, you can proceed to try running Debian on USB

https://forum.doozan.com/read.php?2,139998

Once you can boot Debian on USB, come back and I'll explain what the alternatives you have.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 12, 2025 04:14AM

Registered: 4 weeks ago
Posts: 17

Hi bodhi,

First of all, thank you for your reply and for your patience and kindness in helping me.

Forgive me if i might ask a silly question.

I have read the "Restore Netgear Stora FW" post but it is not clear to me what flashware.img I should use.

what is it an where can I find it ?

Regards

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 12, 2025 06:18AM

Registered: 4 weeks ago
Posts: 17

Below is what I have understood reading several posts, I'd like to check if it is right before doing anything else.

1) copy on a formatted ext2 usb pen the 1mbyte file "u-boot.mtd0" which I have extracted from "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post).

2) rename it as "flashware.img"

3) insert the usb pen in the stora and power it up

4) let the stora to boot until it stops and shows the prompt "marvel>>"

5) check in the log if the file "flashware.img" has been read ok.

6) run "nand erase 0xA0000 0x60000"

7) run "nand write 0xA0000 0xA0000 0x60000"

8) run "reset"

At the new start the issue with env with the stock Uboot should be fixed. Am I right ?

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 13, 2025 12:24AM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

It's been a long time, I forgot most of what in these posts.

Yoyr writeup does look OK. But,

1) copy on a formatted ext2 usb pen the 1mbyte file "u-boot.mtd0" which I have extracted from "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post). 

2) rename it as "flashware.img" 

3) insert the usb pen in the stora and power it up 

4) let the stora to boot until it stops and shows the prompt "marvel>>" 

5) check in the log if the file "flashware.img" has been read ok.

Stop here and post the log. I'd like to see what it looks like.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 13, 2025 12:10PM

Registered: 4 weeks ago
Posts: 17

Hi bodhi, here is the log.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2025.10.13 19:02:45 =~=~=~=~=~=~=~=~=~=~=~=
��
         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: 619d86db, Calculated CRC: 619d86db
## Error: environment overflow, "stdin" deleted
## Error: environment overflow, "stdout" deleted
## Error: environment overflow, "stderr" deleted

CPU : Marvell Feroceon (Rev 1)
## Error: environment overflow, "console" deleted
## Error: environment overflow, "mainlineLinux" deleted
## Error: environment overflow, "CASset" deleted
## Error: environment overflow, "enaMonExt" deleted
## Error: environment overflow, "enaCpuStream" deleted
## Error: environment overflow, "enaWrAllo" deleted
## Error: environment overflow, "pexMode" deleted
## Error: environment overflow, "disL2Cache" deleted
## Error: environment overflow, "setL2CacheWT" deleted
## Error: environment overflow, "disL2Prefetch" deleted
## Error: environment overflow, "enaICPref" deleted
## Error: environment overflow, "enaDCPref" deleted
## Error: environment overflow, "sata_dma_mode" deleted
## Error: environment overflow, "MALLOC_len" deleted
## Error: environment overflow, "ethprime" deleted
## Error: environment overflow, "netbsd_en" deleted
## Error: environment overflow, "vxworks_en" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "bootargs_end" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "standalone" deleted
## Error: environment overflow, "bootdelay" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "disaMvPnp" deleted
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ethmtu" deleted
## Error: environment overflow, "eth1addr" deleted
## Error: environment overflow, "eth1mtu" deleted
## Error: environment overflow, "mvPhoneConfig" deleted
## Error: environment overflow, "mvNetConfig" deleted
## Error: environment overflow, "usb0Mode" deleted
## Error: environment overflow, "yuk_ethaddr" deleted
## Error: environment overflow, "nandEcc" deleted
## Error: environment overflow, "hddPowerCtrl" deleted
## Error: environment overflow, "netretry" deleted
## Error: environment overflow, "rcvrip" deleted
## Error: environment overflow, "loadaddr" deleted
## Error: environment overflow, "autoload" deleted
## Error: environment overflow, "enaAutoRecovery" deleted

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: device mode
PEX 0: interface detected no Link.
Net:   ## Error: environment overflow, "ethact" deleted
egiga0, egiga1## Error: environment overflow, "ethact" deleted

USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
Trying to load image from USB flash drive using FAT FS
reading /flashware.img

** Unable to read "/flashware.img" from usb 0:1 **
Trying to load image from USB flash drive using ext2 FS partition 0
Failed to mount ext2 filesystem...
** Bad ext2 partition or disk - usb 0:0 **
Trying to load image from USB flash drive using ext2 FS partition 1
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

1048576 bytes read
## Error: environment overflow, "filesize" deleted
Missing loadaddr environment variable assuming default (0x400000)!
Update bootcmd
## Error: environment overflow, "bootcmd" deleted
## Error: environment overflow, "console" deleted
Erasing Nand...Writing to Nand... done

bootcmd: setenv bootargs $(console) root=/dev/ram0 rootfstype=squashfs initrd=0x600000,0xffd00000 ramdisk_size=-3072 recovery=usb serverip=0.0.0.0; bootm 0x400000;
## Error: environment overflow, "bootcmd" deleted
Booting the image (@ 0x400000)...
Power Button is pressed!
MPP Sel: 00000530, Data IN Enable: 00020058, Data In Polarity: 00000040, Data In: 00000011
Power Button is released!
MAC: 00:01:A3:7E:4A:22, IP: 10.126.74.34
## Error: environment overflow, "ethaddr" deleted
## Error: environment overflow, "ipaddr" deleted
## Error: environment overflow, "serverip" deleted
## Error: environment overflow, "netmask" deleted
## Error: environment overflow, "image_name" deleted
## Error: environment overflow, "console" deleted
## Error: environment overflow, "bootargs_root" deleted
## Error: environment overflow, "rootpath" deleted
## Error: environment overflow, "ethact" deleted
egiga0 no link
## Error: environment overflow, "ethact" deleted
egiga1 no link
## Error: environment overflow, "ethact" deleted
*** ERROR: `serverip' not set
## Error: environment overflow, "bootargs" deleted
## Booting image at 00800000 ...
Bad Magic Number
Marvell>>

and here the result of nand bad command:

Marvell>> nand bad

Device 0 bad blocks:
  05a40000
Marvell>>

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 13, 2025 06:58PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

> Trying to load image from USB flash drive using
> FAT FS
> reading /flashware.img
>
> ** Unable to read "/flashware.img" from usb 0:1
> **

It seems the USB stick need to be formatted as FAT 16 (not FAT32 or exfat or ext2/ext3).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 13, 2025 11:47PM

Registered: 4 weeks ago
Posts: 17

bodhi,

I think it is reading the flashware.img ok. If I'm not mistakent it looks first for a fat formatted usb and obviously it fails and then for an ext2 partition. It finds the partition 1 and the file named "flashware.img" and it loads it. Below the part of the log that shows it. You can see the dots after "Trying to load image from USB flash drive using ext2 FS partition 1" and "1048576 bytes read" after the dots.

USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
Trying to load image from USB flash drive using FAT FS
reading /flashware.img

** Unable to read "/flashware.img" from usb 0:1 **
Trying to load image from USB flash drive using ext2 FS partition 0
Failed to mount ext2 filesystem...
** Bad ext2 partition or disk - usb 0:0 **
Trying to load image from USB flash drive using ext2 FS partition 1
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

1048576 bytes read

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 14, 2025 01:22PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

> I think it is reading the flashware.img ok. If I'm
> not mistakent it looks first for a fat formatted
> usb and obviously it fails and then for an ext2
> partition. It finds the partition 1 and the file
> named "flashware.img" and it loads it. Below the
> part of the log that shows it. You can see the
> dots after "Trying to load image from USB flash
> drive using ext2 FS partition 1" and "1048576
> bytes read" after the dots.

OK. It looks like the read was successful.

The key step here is the nand erase. The loading was to populate the RAM area with a correct set of envs that can be written to flash. This is to "heal" the env area on flash.

And be very careful! no typos (it could brick the box for good if you execute a wrong command).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 17, 2025 03:46AM

Registered: 4 weeks ago
Posts: 17

Hi bodhi,

before going ahead with the nandwrite command, I'd like to have a clarification.

With reference to the following steps:

1) copy on a formatted ext2 usb pen the 1mbyte file "u-boot.mtd0" which I have extracted from "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post).

2) rename it as "flashware.img"

3) insert the usb pen in the stora and power it up

4) let the stora to boot until it stops and shows the prompt "marvel>>"

5) check in the log if the file "flashware.img" has been read ok.

6) run "nand erase 0xA0000 0x60000"

7) run "nand write 0xA0000 0xA0000 0x60000"

8) run "reset"

is the loading of the "flashware.img necessary before running step 6, 7 and 8 ?

If yes which is the rigth file to be renamed as flashware.img and loaded in the usb pen?

a) "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post)

b) "uboot-3.14.16-512ram.bin" downloaded at the end of this post https://forum.doozan.com/read.php?3,123019,123579#msg-123579

Regards

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 17, 2025 03:55AM

Registered: 4 weeks ago
Posts: 17

Quote
tiaderosa
a) "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post)

sorry I meant "u-boot.mtd0" not the compressed one

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 22, 2025 02:18AM

Registered: 4 weeks ago
Posts: 17

HI, can you please replay ?
Regards

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 22, 2025 04:33PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

My bad. I thought I've answered all your questions.

Disclaimer: As I mentioned, I don't have this NAS and the unbricking sessions were done by others. So I'll do the best I can to read those posts and understand them. But there is no guarantee in my advice here. I could be mistaken and give you a wrong advice (or you could have a typo), that could hard brick this box, and then the only way to recover is to connect JTAG (lots of work).

Quote

With reference to the following steps:

1) copy on a formatted ext2 usb pen the 1mbyte file "u-boot.mtd0" which I have extracted from "u-boot_mtd0.gz" file downloaded at https://forum.doozan.com/read.php?3,33178,33184#msg-33184 (erik post).

2) rename it as "flashware.img"

Yes, it is the file should be used.

Quote

3) insert the usb pen in the stora and power it up

4) let the stora to boot until it stops and shows the prompt "marvel>>"

5) check in the log if the file "flashware.img" has been read ok.

Yes.

Quote

6) run "nand erase 0xA0000 0x60000"

7) run "nand write 0xA0000 0xA0000 0x60000"

8) run "reset"

Yes.

Quote

is the loading of the "flashware.img necessary before running step 6, 7 and 8 ?

The purpose of loading this mtd0 backup is to populate a RAM area, where good envs are in (part of the u-boot.mtd0 in memory). And the Step 7 above will populate the NAND flash at the right place using that RAM area.

Step 7 is only meaningful if you have loaded flashware.img. So don't do Step 7 if you skip the flashware.img loading.

But Step 7 is really not entirely neccessary, because nand erase in Step 6 above will wipe out the bad envs, and you should not see the overflownn errors again after reset.

As long as you don't have overfown errors, you can enter your own envs at the u-boot prompt and boot into Debian.

===========
bodhi edit: typo in text

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Edited 1 time(s). Last edit at 10/23/2025 02:33AM by bodhi.

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 22, 2025 11:07PM

Registered: 4 weeks ago
Posts: 17

Thank You bodhi,

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 23, 2025 08:23AM

Registered: 4 weeks ago
Posts: 17

Bodhi,
I'm sorry to be so long but since if something goes wrong the only way I have to resume my stora is jtag an as far as I understand it s complex and time consuming process, before going haed with the nand erase command I'd like to share what I have found up to now and some doubts I still have.

The doubts are not related to the procedure that is now thanks to you it is very clear but on what file I have to use.
There are two file that I have selected in the posts that should be possible candidate for the flashware.img.

(1) "uboot-3.14.16-512ram.bin" of 461 kb in size found here https://forum.doozan.com/read.php?3,123019,123579#msg-123579.
(2) "u-boot.mtd0" of 1024kb found here https://forum.doozan.com/read.php?3,33178,33184#msg-33184

If I load in ram at 0x80000 the file in (1) and then run "go 0x800200" the boot in ram starts ok (well, I still get env error as before)
If I load in ram at 0x80000 the file in (2) and then run "go 0x800200" my stora freezes at " ## Starting application at 0x00800200 ..."

I have done a first analisys of the first 0x300 bytes. They are very similar except few bytes.

Below the dump of the first 0x300 bytes of (1):

00000000: 8b00 0008 302e 0700 0000 0000 0002 0000  ....0...........
00000010: 0000 6000 0000 6700 0000 0000 0000 01c2  ..`...g.........
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: e000 d1ff 9b1b 1b1b 0014 d0ff 300c 0043  ............0..C
00000050: 0414 d0ff 0030 5437 0814 d0ff 5154 1222  .....0T7....QT."
00000060: 0c14 d0ff 330a 0000 1014 d0ff cc00 0000  ....3...........
00000070: 1414 d0ff 0000 0000 1814 d0ff 0000 0000  ................
00000080: 1c14 d0ff 520c 0000 2014 d0ff 4000 0000  ....R... ...@...
00000090: 2414 d0ff 7ff1 0000 2814 d0ff 2055 0800  $.......(... U..
000000a0: 7c14 d0ff 5285 0000 0415 d0ff f1ff ff0f  |...R...........
000000b0: 0815 d0ff 0000 0010 0c15 d0ff f5ff ff0f  ................
000000c0: 1415 d0ff 0000 0000 1c15 d0ff 0000 0000  ................
000000d0: 9414 d0ff 0000 0300 9814 d0ff 0000 0000  ................
000000e0: 9c14 d0ff 03e8 0000 8014 d0ff 0100 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 00e5  ................
00000200: 1200 00ea 14f0 9fe5 14f0 9fe5 14f0 9fe5  ................
00000210: 14f0 9fe5 14f0 9fe5 14f0 9fe5 14f0 9fe5  ................
00000220: a001 6000 0002 6000 6002 6000 c002 6000  ..`...`.`.`...`.
00000230: 2003 6000 8003 6000 e003 6000 efbe adde   .`...`...`.....
00000240: 0000 6000 0000 6000 f0ff 6700 20f1 6c00  ..`...`...g. .l.
00000250: 0000 0fe1 1f00 c0e3 d300 80e3 00f0 29e1  ..............).
00000260: 1700 00eb 6c00 4fe2 3010 1fe5 0100 50e1  ....l.O.0.....P.
00000270: 0700 000a 3820 1fe5 3830 1fe5 0220 43e0  ....8 ..80... C.
00000280: 0220 80e0 f807 b0e8 f807 a1e8 0200 50e1  . ............P.
00000290: fbff ffda 5c00 1fe5 8000 40e2 0cd0 40e2  ....\.....@...@.
000002a0: 6000 1fe5 6010 1fe5 0020 a0e3 0020 80e5  `...`.... ... ..
000002b0: 0400 80e2 0100 50e1 fbff ffda 04f0 1fe5  ......P.........
000002c0: ac13 6200 100f 10ee 2002 a0e1 6c13 9fe5  ..b..... ...l...
000002d0: 0100 00e0 6813 9fe5 0100 50e1 0300 000a  ....h.....P.....
000002e0: 0000 a0e3 170f 07ee 170f 08ee 0200 00ea  ................
000002f0: 0000 a0e3 150f 07ee 160f 07ee 100f 11ee  ................
00000300: 0700 c0e3 0200 80e3 100f 01ee 0000 a0e3  ................
00000310: 100f 01ee 0ec0 a0e1 d000 00eb 0ce0 a0e1  ................
00000320: 0ef0 a0e1 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0f10 2de9 1c20 1fe5 1c30 1fe5  ......-.. ...0..
00000340: 1c00 1fe5 1c10 1fe5 02c0 80e1 5ecf 07ee  ............^...
00000350: 03c0 4ce0 0200 1ce1 fbff ff1a 5ecf 07ee  ..L.........^...
00000360: 0100 50e0 f7ff ff5a 0f10 bde8 0ef0 a0e1  ..P....Z........
00000370: 0100 2de9 0000 a0e3 150f 07ee 0100 bde8  ..-.............
00000380: 0ef0 a0e1 0000 a0e1 0000 a0e1 0000 a0e1  ................
00000390: 0000 a0e1 0000 a0e1 0000 a0e1 0000 a0e1  ................
000003a0: 64d1 1fe5 01d6 4de2 88d0 4de2 00e0 8de5  d.....M...M.....
000003b0: 00e0 4fe1 04e0 8de5 13d0 a0e3 0df0 69e1  ..O...........i.
000003c0: 88d1 1fe5 0fe0 a0e1 0ef0 b0e1 48d0 4de2  ............H.M.
000003d0: ff1f 8de8 9821 1fe5 0126 42e2 8820 42e2  .....!...&B.. B.
000003e0: 0c00 92e8 4800 8de2 3450 8de2 0e10 a0e1  ....H...4P......
000003f0: 0f00 85e8 0d00 a0e1 1b84 00eb 0000 a0e1  ................
00000400: c4d1 1fe5 01d6 4de2 88d0 4de2 00e0 8de5  ......M...M.....

and here of (2)

00000000: 8b00 0008 d02c 0700 0000 0000 0002 0000  .....,..........
00000010: 0000 6000 0000 6700 0000 0000 0000 0160  ..`...g........`
00000020: 4000 0000 0000 0000 0000 0000 0000 0000  @...............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: e000 d1ff 9b1b 1b1b 0014 d0ff 300c 0043  ............0..C
00000050: 0414 d0ff 0030 5439 0814 d0ff 5154 1222  .....0T9....QT."
00000060: 0c14 d0ff 3308 0000 1014 d0ff 9900 0000  ....3...........
00000070: 1414 d0ff 0000 0000 1814 d0ff 0000 0000  ................
00000080: 1c14 d0ff 520c 0000 2014 d0ff 0400 0000  ....R... .......
00000090: 2414 d0ff 7ff1 0000 2814 d0ff 2055 0800  $.......(... U..
000000a0: 7c14 d0ff 5285 0000 0415 d0ff f1ff ff03  |...R...........
000000b0: 0815 d0ff 0000 0004 0c15 d0ff f5ff ff03  ................
000000c0: 1415 d0ff 0000 0000 1c15 d0ff 0000 0000  ................
000000d0: 9414 d0ff 1200 1200 9814 d0ff 0000 0000  ................
000000e0: 9c14 d0ff 0fe4 0000 8014 d0ff 0100 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 007b  ...............{
00000200: 1200 00ea 14f0 9fe5 14f0 9fe5 14f0 9fe5  ................
00000210: 14f0 9fe5 14f0 9fe5 14f0 9fe5 14f0 9fe5  ................
00000220: 8001 6000 e001 6000 4002 6000 a002 6000  ..`...`.@.`...`.
00000230: 0003 6000 6003 6000 c003 6000 efbe adde  ..`.`.`...`.....
00000240: 0000 6000 0000 6000 f0ff 6700 60ee 6c00  ..`...`...g.`.l.
00000250: 0000 0fe1 1f00 c0e3 d300 80e3 00f0 29e1  ..............).
00000260: 1700 00eb 6c00 4fe2 3010 1fe5 0100 50e1  ....l.O.0.....P.
00000270: 0700 000a 3820 1fe5 3830 1fe5 0220 43e8  ....8 ..80... C.
00000280: 0220 80e0 f807 b0e8 f807 a1e8 0200 50e1  . ............P.
00000290: fbff ffda 5c00 1fe5 8000 40e2 0cd0 40e2  ....\.....@...@.
000002a0: 6000 1fe5 6010 1fe5 0020 a0e3 0020 80e5  `...`.... ... ..
000002b0: 0400 80e2 0100 50e1 fbff ffda 04f0 1fe5  ......P.........
000002c0: 1815 6200 100f 10ee 2002 a0e1 4c13 9fe5  ..b..... ...L...
000002d0: 0100 00e0 4813 9fe5 0100 50e1 0300 000a  ....H.....P.....
000002e0: 0000 a0e3 170f 07ee 170f 08ee 0200 00ea  ................
000002f0: 0000 a0e3 150f 07ee 160f 07ee 100f 11ee  ................
00000300: 0700 c0e3 0200 80e3 100f 01ee 0ec0 a0e1  ................
00000310: ca00 00eb 0ce0 a0e1 0ef0 a0e1 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0f10 2de9  ..............-.
00000330: 1c20 1fe5 1c30 1fe5 1c00 1fe5 1c10 1fe5  . ...0..........
00000340: 02c0 80e1 5ecf 07ee 03c0 4ce0 0200 1ce1  ....^.....L.....
00000350: fbff ff1a 5ecf 07ee 0100 50e0 f7ff ff5a  ....^.....P....Z
00000360: 0f10 bde8 0ef0 a0e1 0100 2de9 0000 a0e3  ..........-.....
00000370: 150f 07ee 0100 bde8 0ef0 a0e1 0000 a0e1  ................
00000380: 44d1 1fe5 01d6 4de2 88d0 4de2 00e0 8de5  D.....M...M.....
00000390: 00e0 4fe1 04e0 8de5 13d0 a0e3 0df0 69e1  ..O...........i.
000003a0: 68d1 1fe5 0fe0 a0e1 0ef0 b0e1 48d0 4de2  h...........H.M.
000003b0: ff1f 8de8 7821 1fe5 0126 42e2 8820 42e2  ....x!...&B.. B.
000003c0: 0c00 92e8 4800 8de2 3450 8de2 0e10 a0e1  ....H...4P......
000003d0: 0f00 85e8 0d00 a0e1 7e84 00eb 0000 a0e1  ........~.......
000003e0: a4d1 1fe5 01d6 4de2 88d0 4de2 00e0 8de5  ......M...M.....
000003f0: 00e0 4fe1 04e0 8de5 13d0 a0e3 0df0 69e1  ..O...........i.
00000400: c8d1 1fe5 0fe0 a0e1 0ef0 b0e1 48d0 4de2  ............H.M.

Here are the difference I have found on the first 0x260 words

Offset 0x000004: 2e30 != 2cd0
Offset 0x00001E: c201 != 6001
Offset 0x000056: 3754 != 3954
Offset 0x000064: 0a33 != 0833
Offset 0x00006C: 00cc != 0099
Offset 0x00008C: 0040 != 0004
Offset 0x0000AE: 0fff != 03ff
Offset 0x0000B6: 1000 != 0400
Offset 0x0000BE: 0fff != 03ff
Offset 0x0000D4: 0000 != 0012
Offset 0x0000D6: 0003 != 0012
Offset 0x0000E4: e803 != e40f
Offset 0x000110: e500 != 7b00
Offset 0x000132: 01a0 != 0180
Offset 0x000136: 0200 != 01e0
Offset 0x00013A: 0260 != 0240
Offset 0x00013E: 02c0 != 02a0
Offset 0x000142: 0320 != 0300
Offset 0x000146: 0380 != 0360
Offset 0x00014A: 03e0 != 03c0
Offset 0x00015E: f120 != ee60
Offset 0x000190: e043 != e843
Offset 0x0001D2: 13ac != 1518
Offset 0x0001DE: 136c != 134c
Offset 0x0001E6: 1368 != 1348
Offset 0x00021E: 0000 != c00e
Offset 0x000220: e3a0 != e1a0
Offset 0x000222: 0f10 != 00ca
Offset 0x000224: ee01 != eb00
Offset 0x000226: c00e != e00c
Offset 0x00022A: 00d0 != f00e
Offset 0x00022C: eb00 != e1a0
Offset 0x00022E: e00c != 0000
Offset 0x000230: e1a0 != 0000
Offset 0x000232: f00e != 0000
Offset 0x000234: e1a0 != 0000
Offset 0x00023E: 0000 != 100f
Offset 0x000240: 0000 != e92d
Offset 0x000242: 0000 != 201c
Offset 0x000244: 0000 != e51f
Offset 0x000246: 100f != 301c
Offset 0x000248: e92d != e51f
Offset 0x00024A: 201c != 001c
Offset 0x00024E: 301c != 101c
Offset 0x000252: 001c != c002
Offset 0x000254: e51f != e180
Offset 0x000256: 101c != cf5e
Offset 0x000258: e51f != ee07
Offset 0x00025A: c002 != c003
Offset 0x00025C: e180 != e04c
Offset 0x00025E: cf5e != 0002
Offset 0x000260: ee07 != e11c

Do you think that u-boot.mtd0 does not starting on my stora being a problem as far as far as concerning the nand erase/ nand write commands ?

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 23, 2025 08:41AM

Registered: 4 weeks ago
Posts: 17

The bytes above are inverted......

Offset 0x000004: 0x302E != 0xD02C
Offset 0x00001E: 0x01C2 != 0x0160
Offset 0x000056: 0x5437 != 0x5439
Offset 0x000064: 0x330A != 0x3308
Offset 0x00006C: 0xCC00 != 0x9900
Offset 0x00008C: 0x4000 != 0x0400
Offset 0x0000AE: 0xFF0F != 0xFF03
Offset 0x0000B6: 0x0010 != 0x0004
Offset 0x0000BE: 0xFF0F != 0xFF03
Offset 0x0000D4: 0x0000 != 0x1200
Offset 0x0000D6: 0x0300 != 0x1200
Offset 0x0000E4: 0x03E8 != 0x0FE4
Offset 0x0001FE: 0x00E5 != 0x007B
Offset 0x000220: 0xA001 != 0x8001
Offset 0x000224: 0x0002 != 0xE001
Offset 0x000228: 0x6002 != 0x4002
Offset 0x00022C: 0xC002 != 0xA002
Offset 0x000230: 0x2003 != 0x0003
Offset 0x000234: 0x8003 != 0x6003
Offset 0x000238: 0xE003 != 0xC003
Offset 0x00024C: 0x20F1 != 0x60EE
Offset 0x00027E: 0x43E0 != 0x43E8
Offset 0x0002C0: 0xAC13 != 0x1815
Offset 0x0002CC: 0x6C13 != 0x4C13
Offset 0x0002D4: 0x6813 != 0x4813

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 23, 2025 03:27PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

> I'm sorry to be so long but since if something
> goes wrong the only way I have to resume my stora
> is jtag an as far as I understand it s complex and
> time consuming process, before going haed with the
> nand erase command I'd like to share what I have
> found up to now and some doubts I still have.

> The doubts are not related to the procedure that
> is now thanks to you it is very clear but on what
> file I have to use.

> (1) "uboot-3.14.16-512ram.bin" of 461 kb in size
> found here
> https://forum.doozan.com/read.php?3,123019,123579#msg-123579.
> (2) "u-boot.mtd0" of 1024kb found here
> https://forum.doozan.com/read.php?3,33178,33184#msg-33184
>
> If I load in ram at 0x80000 the file in (1) and
> then run "go 0x800200" the boot in ram starts ok

When you run this u-boot in RAM by executing "go 0x800200", this u-boot will go to NAND and read the envs. But the envs were bad, i.e. overflown by 1 byte, IIRC.

Remember the purpose of loading this u-boot bin to RAM. It's to populate the envs area in RAM with a good sets. Not to run it.

> (well, I still get env error as before)
> If I load in ram at 0x80000 the file in (2) and
> then run "go 0x800200" my stora freezes at " ##
> Starting application at 0x00800200 ..."

When it freezes like that, it means either:
- this mtd0 backup is for another board, not the Stora.
OR
- this mtd0 backup is for the Stora but the version is too different from one on flash. So it cannot be chain-loaded. Note that even if the version is different, the envs area should be at the same place, AFAIK.

Again, you don't want to run either of these 2 u-boots.

> Do you think that u-boot.mtd0 does not starting
> on my stora being a problem as far as far as
> concerning the nand erase/ nand write commands ?

Either uboot-3.14.16-512ram.bin or u-boot.mtd0 should work for the purpose of populating the envs. If one does not work, use the other.

====

In most Marvell very old stock u-boots (circa 2009 and before 2011), the env area is at 0xA0000 (640k).

In the procedure above, you are not writing to u-boot proper, you are writing to the env area. U-Boot image resides from 0x0 to 0xNNNNN, where 0xNNNNN is the size of the image. I'm overly cautious because you cannot run kwboot. But in my judgment these 2 NAND commands are OK.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 24, 2025 12:43AM

Registered: 4 weeks ago
Posts: 17

Thank you very much,
All clear now.
I'll go ahead and let you know.

Reply Quote

tiaderosa

Re: Bricked stora ms2100 -- need help
October 24, 2025 03:35AM

Registered: 4 weeks ago
Posts: 17

Hi,
It worked !!!
Now env are ok and the same as before (stock).
I've removed the sata Hard disks
Here is my log.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2025.10.24 09:37:31 =~=~=~=~=~=~=~=~=~=~=~=
��
         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: RD-88F6281A LE 

U-Boot 1.1.4 (Sep  4 2009 - 09:36:11) Marvell version: 3.4.14

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE60

Soc: 88F6281 A0 (DDR2)
CPU running @ 1000Mhz L2 running @ 333Mhz
SysClock = 333Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size  64MB 
DRAM CS[1] base 0x04000000   size  64MB 
DRAM Total size 128MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
CRC in Flash: 52235cfe, Calculated CRC: 52235cfe

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  3  2  1  0 

NAND read: device 0 offset 0x100000, size 0x300000


Reading data from 0x100000 --   0% complete.
Reading data from 0x107800 --   1% complete.
Reading data from 0x10f000 --   2% complete.
Reading data from 0x117000 --   3% complete.
Reading data from 0x11e800 --   4% complete.
Reading data from 0x126000 --   5% complete.
Reading data from 0x12e000 --   6% complete.
Reading data from 0x135800 --   7% complete.
Reading data from 0x13d000 --   8% complete.
Reading data from 0x145000 --   9% complete.
Reading data from 0x14c800 --  10% complete.
Reading data from 0x154000 --  11% complete.
Reading data from 0x15c000 --  12% complete.
Reading data from 0x163800 --  13% complete.
Reading data from 0x16b800 --  14% complete.
Reading data from 0x173000 --  15% complete.
Reading data from 0x17a800 --  16% complete.
Reading data from 0x182800 --  17% complete.
Reading data from 0x18a000 --  18% complete.
Reading data from 0x191800 --  19% complete.
Reading data from 0x199800 --  20% complete.
Reading data from 0x1a1000 --  21% complete.
Reading data from 0x1a8800 --  22% complete.
Reading data from 0x1b0800 --  23% complete.
Reading data from 0x1b8000 --  24% complete.
Reading data from 0x1bf800 --  25% complete.
Reading data from 0x1c7800 --  26% complete.
Reading data from 0x1cf000 --  27% complete.
Reading data from 0x1d7000 --  28% complete.
Reading data from 0x1de800 --  29% complete.
Reading data from 0x1e6000 --  30% complete.
Reading data from 0x1ee000 --  31% complete.
Reading data from 0x1f5800 --  32% complete.
Reading data from 0x1fd000 --  33% complete.
Reading data from 0x205000 --  34% complete.
Reading data from 0x20c800 --  35% complete.
Reading data from 0x214000 --  36% complete.
Reading data from 0x21c000 --  37% complete.
Reading data from 0x223800 --  38% complete.
Reading data from 0x22b800 --  39% complete.
Reading data from 0x233000 --  40% complete.
Reading data from 0x23a800 --  41% complete.
Reading data from 0x242800 --  42% complete.
Reading data from 0x24a000 --  43% complete.
Reading data from 0x251800 --  44% complete.
Reading data from 0x259800 --  45% complete.
Reading data from 0x261000 --  46% complete.
Reading data from 0x268800 --  47% complete.
Reading data from 0x270800 --  48% complete.
Reading data from 0x278000 --  49% complete.
Reading data from 0x27f800 --  50% complete.
Reading data from 0x287800 --  51% complete.
Reading data from 0x28f000 --  52% complete.
Reading data from 0x297000 --  53% complete.
Reading data from 0x29e800 --  54% complete.
Reading data from 0x2a6000 --  55% complete.
Reading data from 0x2ae000 --  56% complete.
Reading data from 0x2b5800 --  57% complete.
Reading data from 0x2bd000 --  58% complete.
Reading data from 0x2c5000 --  59% complete.
Reading data from 0x2cc800 --  60% complete.
Reading data from 0x2d4000 --  61% complete.
Reading data from 0x2dc000 --  62% complete.
Reading data from 0x2e3800 --  63% complete.
Reading data from 0x2eb800 --  64% complete.
Reading data from 0x2f3000 --  65% complete.
Reading data from 0x2fa800 --  66% complete.
Reading data from 0x302800 --  67% complete.
Reading data from 0x30a000 --  68% complete.
Reading data from 0x311800 --  69% complete.
Reading data from 0x319800 --  70% complete.
Reading data from 0x321000 --  71% complete.
Reading data from 0x328800 --  72% complete.
Reading data from 0x330800 --  73% complete.
Reading data from 0x338000 --  74% complete.
Reading data from 0x33f800 --  75% complete.
Reading data from 0x347800 --  76% complete.
Reading data from 0x34f000 --  77% complete.
Reading data from 0x357000 --  78% complete.
Reading data from 0x35e800 --  79% complete.
Reading data from 0x366000 --  80% complete.
Reading data from 0x36e000 --  81% complete.
Reading data from 0x375800 --  82% complete.
Reading data from 0x37d000 --  83% complete.
Reading data from 0x385000 --  84% complete.
Reading data from 0x38c800 --  85% complete.
Reading data from 0x394000 --  86% complete.
Reading data from 0x39c000 --  87% complete.
Reading data from 0x3a3800 --  88% complete.
Reading data from 0x3ab800 --  89% complete.
Reading data from 0x3b3000 --  90% complete.
Reading data from 0x3ba800 --  91% complete.
Reading data from 0x3c2800 --  92% complete.
Reading data from 0x3ca000 --  93% complete.
Reading data from 0x3d1800 --  94% complete.
Reading data from 0x3d9800 --  95% complete.
Reading data from 0x3e1000 --  96% complete.
Reading data from 0x3e8800 --  97% complete.
Reading data from 0x3f0800 --  98% complete.
Reading data from 0x3f8000 --  99% complete.
Reading data from 0x3ff800 -- 100% complete.
 3145728 bytes read: OK
## Booting image at 00800000 ...
   Image Name:   Linux-2.6.22.18-Netgear
   Created:      2010-06-13  23:54:53 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2788728 Bytes =  2.7 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux............................................................................................................................................................ done, booting the kernel.

Linux version 2.6.22.18-Netgear (mostafah@es5x86.axentra.com) (gcc version 4.2.1) #16 Sun Jun 13 19:54:46 EDT 2010
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 32512
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB 64MB 0MB 0MB = 128MB total
Memory: 124800KB available (4048K code, 268K data, 692K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size  64MB 
SDRAM_CS1 ....base 04000000, size  64MB 
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB 

  Marvell Development Board (LSP Version KW_LSP_4.2.7_patch21)-- RD-88F6281A  Soc: 88F6281 A0 LE

 Detected Tclk 200000000 and SysClk 333333333 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c063d600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
RTC has been updated!!!
RTC registered
Use the XOR engines (acceleration) for enhancing the following functions:
  o RAID 5 Xor calculation
  o kernel memcpy
  o kenrel memzero
Number of XOR engines to use: 4
cesadev_init(c000eed0)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
MV Buttons Driver Load
JFFS2 version 2.2. (NAND) Â© 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
serial8250.0: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Multi RX Queue support - 4 RX queues
  o Multi TX Queue support - 2 TX Queues
  o TCP segmentation offload enabled
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Network Fast Processing (NAT) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o Gateway support enabled
     o Using Marvell Header Mode
     o L2 IGMP support
  o Rx descripors: q0=128 q1=128 q2=128 q3=128
  o Tx descripors: q0=532 q1=532
  o Loading network interface(s):
    o eth0, ifindex = 1, GbE port = 0
    o eth1, ifindex = 2, GbE port = 1

mvFpRuleDb (c7977000): 1024 entries, 4096 bytes
Intel(R) PRO/1000 Network Driver - version 7.3.20-k2-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.17-k4-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
NAND device: Manufacturer ID: 0xec, Chip ID: 0xda (Samsung NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 722 at 0x05a40000
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00700000 : "uImage"
0x00700000-0x10000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI warning: ubi_eba_init_scan: cannot reserve enough PEBs for bad PEB handling, reserved 18, need 38
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "root"
UBI: MTD device size:            249 MiB
UBI: number of good PEBs:        1991
UBI: number of bad PEBs:         1
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 1991
UBI: number of PEBs reserved for bad PEB handling: 18
UBI: max/mean erase counter: 39/6
UBI: background thread "ubi_bgt0d" started, PID 285
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     81 MB/s
raid6: int32x2     95 MB/s
raid6: int32x4    102 MB/s
raid6: int32x8     92 MB/s
raid6: using algorithm int32x4 (102 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :   893.600 MB/sec
   8regs     :   629.200 MB/sec
   32regs    :   750.000 MB/sec
raid5: using function: arm4regs (893.600 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 8192 max)
mvFpNatDb (c7f7c000): 1024 entries, 4096 bytes
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NFP (fdb) init 256 entries, 1024 bytes
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
Freeing init memory: 692K
Reset button not pressed
Proceeding normally.
UBIFS: recovery needed
UBI error: ubi_io_read: error -74 while reading 73728 bytes from PEB 633:57344, read 73728 bytes
UBIFS error (pid 318): ubifs_recover_leb: corrupt empty space at LEB 114:53248
UBIFS error (pid 318): ubifs_scanned_corruption: corrupted data at LEB 114:53248
UBIFS error (pid 318): ubifs_recover_leb: LEB 114 scanning failed
mount: mounting ubi0:rootfs on /newroot failed: Structure needs cleaning
Failed to switch_root, dropping to a shell
sh: can't access tty; job control turned off
/ # Attempt to report boot fail...
udhcpc (v1.16.1) started
eth0: link down
eth0: started
Sending discover...
eth0: link up, full duplex, speed 100 Mbps
Sending discover...
Sending select for 192.168.0.126...
Lease of 192.168.0.126 obtained, lease time 43200
/sbin/bootfail_script: line 1: syntax error: unexpected newline

/ # ls
bin   etc   lib   newroot   sbin   usr
dev   init  linuxrc  proc   sys
/ #

can see I got this error:

As you UBIFS: recovery needed
UBI error: ubi_io_read: error -74 while reading 73728 bytes from PEB 633:57344, read 73728 bytes
UBIFS error (pid 318): ubifs_recover_leb: corrupt empty space at LEB 114:53248
UBIFS error (pid 318): ubifs_scanned_corruption: corrupted data at LEB 114:53248
UBIFS error (pid 318): ubifs_recover_leb: LEB 114 scanning failed
mount: mounting ubi0:rootfs on /newroot failed: Structure needs cleaning
Failed to switch_root, dropping to a shell

That was present even before. It happend after a power failure with Nas working.
So now I'm back to the starting.

What would be your suggestions ?

Personally I'd like to:
1) Recover the stock firmware
2) make a backup of the mtd partitions so I can always go back to stock if I want to
3) load your new firmware first from usb pen
4) when I'm happy with the new Fw configurations and services make it as default system boot.

regards

Reply Quote

bodhi

Re: Bricked stora ms2100 -- need help
October 24, 2025 08:45PM

Admin
Registered: 14 years ago
Posts: 19,916

tiaderosa,

Congrats!

> Personally I'd like to:
> 1) Recover the stock firmware
> 2) make a backup of the mtd partitions so I can
> always go back to stock if I want to

I would skip this. Later, you can hopefully install OpenWRT. And use it as rescue system.

It's more productive if you can work on booting Debian on USB rootfs. That should be the end goal.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Reply Quote