DSM-G600, DNS-3xx and NSA-220 Hack Forum

wow! that's great !! I'm soooo excited :-)

I have the JTAG working - I can now read and write memory
See JTAG WIKI documentation for details http://dns323.kood.org/hardware:jtag

Last edited by magore (2007-03-04 11:29:36)

What did you do to get openocd to write to flash?

I know the commands, it's just not working - probing works, info is fine if you modify the size calculation in cfi.c (ignore bus_width), operations don't seem to have any effect, and some sectors claim to be protected.

I'm trying to put uboot back on the flash after it erased itself when it was supposed to be loading a kernel over the serial line...

Any help would be greatly appreciated.

maligor wrote:

I guess you're trying to use something like:
flash write_bank 0 uboot.bin 0x7d0000

I seem to get the same results, it appears to do something but nothing is written. The protect states for the flash seem strangely random too, and flash protect is missing mode 2.

Yep, pretty much.

From further reading, I get the impression that if those sectors are infact protected, and openocd isn't just screwy, we may need to apply VID (11.5-12.5V) to RESET# on the flash chip as well as write our own cfi_spansion_protect function to unprotect those areas (although it should be possible to write to 'protected' sectors while VID is applied). There's 11.7V available on the SATA pins....

Of course, the openocd flash code may not be accessing the spansion flash properly...

I'm not overly keen on applying 12V (through a resistor of course) without being much more sure that openocd isn't at fault.

EDIT: forget the RESET# nonsense, it's definitely openocd, I've got the protection status read correctly, currently testing erase/write.

Last edited by pseudonym404 (2008-12-16 06:01:08)

pseudonym404 wrote:

Attached patch uses 8bit writes for bus_width 2 when x16_as_x8 is added to the end of the flash bank line in the config file, reads work without patching. In other words, flashing works.

Code:

svn checkout svn://svn.berlios.de/openocd/trunk -r1193 openocd-r1193
cd openocd-r1193
patch -p1 -i <path to patch>
./bootstrap
....etc.

make sure your config file contains:

Code:

flash bank cfi      0xff800000 0x800000 1           2          0        x16_as_x8

Yes, this does seem to work, I've now successfully broken my bootloader and reflashed it back with the dns-323 original bootloader.

Some notes:
If you have a broken bootloader use:
reset halt
instead of: reset run / halt

pseudonym404: I hope you have a copy of the uboot if you're trying to restore it? It stores the mac address at the last flash block, that contains a part of the bootloader.

Well, I've managed to build a working u-boot image now from the sources. There's something strange with the jtag now tho.

I think I'm only able to write using 'flash write_image', 'flash write_sector' seems to give a lot of noise to the write and always get corrupted results.

Edit:
The Marvell u-boot is painful. Adding anything useful will make it overflow past the start segment which is at 0xffff0000.

Edit2:
I've now modified the u-boot orion5x to boot on dns-323, it seems to read flash, memory is initialized. Currently the power led stays lit when it starts and the orange one aswell so clearly not everything is correct

Also not too sure about the ram settings, but I can read and write the first 64mb
And there's something strange in flinfo, but it seems to read it fine. It checksums the images on the flash.

Edit3:
Heh, now both orange leds get lit and the power led flashes.

Last edited by maligor (2008-12-20 03:36:35)

@pseudonym404:

How did you managed to control the powerbutton and Powerled ? Does your DNS323 poweroff if you tell it to do so?
I am currently using Debian Lenny + Debian 2.6.30-rc5-experimental
from Martin Michlmayr / http://www.cyrius.com/journal/debian/or … k/dns-323.
If you got scripts or deb-pakets please share them .
Debian runs very well but GPIO control seems not to be supported very well (userland tools)

Hi, many thanks for the information on JTAG here. One question should the SMD resistors be 47K or 4K7? On dns323.randomhacking.net it mentions they should be 47K but on Mike's diagram on dns323.kood.org it says 4K7. I'd be grateful if this could be clarified.

cheers,
Will

Hi folks,

I'm looking for an updated u-boot for my DNS323 Rev B1. Have any of you JTAG hackers managed to successfully build and boot your own U-boot?

I'm hoping for network support primarily, but things like booting from ext2 would also be great!