DSM-G600, DNS-3xx and NSA-220 Hack Forum

WARNING: While this uboot is fully featured and seems to boot fine, you should consider it Untested and Possibly Dangerous. Also it's impossible to use with the standard firmware.
Edit: Because the mtd partition table is hardcoded in the kernel, using mtdblock for the filesystem might overwrite the bootloader.

Major Changes that affect the device:
* MTD1 is overwritten with u-boot configuration on saveenv (Not entirely sure if the flash env configuration is correct in the include, but it seems to work)
* The image will have to be partially overwritten on the Filesystem partition. The loader starts at 0xffff0000 and jumps to 0xfff90000. The image itself starts from 0xfff80000. (I just used the default configuration and copied some over from linkstation u-boot layout, the dummy at the beginning probably isn't needed)

Some notes and issues:
* The ethernet address might have some strangeness attached now. As the bootloader configures it now, also it's embedded in the loader so if you want to change it you'll have to rebuild it or change them with a hex editor.
* It's entirely possible that configuration changes have changed the device configuration, so it's possible it might damage the hardware. But for anyone using jtag should probably know this anyway.

New features, Why use this:
* Loading kernel/initrd from the disk.
* Loading kernel/initrd over ethernet.

Compatible kernels:
This uses the correct march type for DNS323, so you should use kernels with appropriate configuration. The original fw kernel doesn't apply. You can change it back to the incorrect march if you like in /board/mv88fxx81/USP/mv_main.c: gd->bd->bi_arch_number = 1542; By changing it to 526. Changing it to 526 means that you'll have to patch vanilla kernels, or it won't boot.

I'm using 2.6.28.1 with the G760a driver added, running Debian sid armel.

G760a driver: (Fan controller driver, works with pwmconfig/fancontrol, otherwise it'll be disabled)
http://bugs.debian.org/cgi-bin/bugrepor … bug=503172

Edit: Patch so that the mtdblocks match the bootloader's new position:
http://maligor.googlepages.com/partitionmap.patch

Edit: Also don't enable Marvell PHY, it's broken.

How do I use it:
DNS323 A1 ONLY (B1 uses 5182 which is slightly different, and seems to use different code paths)
While it's probably possible to flash the loader without using jtag, I can't recommend it.

Also be sure that you have a TTL serial cable at hand also.

With jtag I've used:
Like with everything else, make sure you have the full flash backup somewhere before trying, also in some cases I've had trouble getting the device to halt, where the bootloader caused a error that shutdown the whole unit.(I did manage to get it by pressing power and calling halt at the same time)

flash write_image erase u-boot.bin 0xfff80000

After this boot with the serial cable attached and you should see a dns323> prompt come up. (The default doesn't set any bootcmd)

To boot from IDE, with root on /dev/sda2 and /boot on /dev/sda4 (DNS323 default map, beats me what sda4 is used in original fw) 1:2 refers to Device 1 Partition 2, they start from 0, so my drive is in the second slot (left slot).

setenv bootargs root=/dev/sda2 ro console=ttyS0,115200
ide reset;ext2load ide 1:2 400000 /uImage; bootm 400000

To make this default (It'll then autoboot on a 3 second timer, or with "boot"):
setenv bootargs root=/dev/sda2 ro console=ttyS0,115200
setenv bootcmd ide reset\;ext2load ide 1:2 400000 /uImage\; bootm 400000
saveenv

What's different in the sources:
* There were quite a few #if 0's in the common/*.c regarding lots of commands. Often it was accompanied with a //jack
* Lots of CMD_CMD_ definitions were commented out in include/cmd_confdefs.h
* The march ID, see above.
* The environment save area in flash in include/configs/db88f5181.h
* /board/mv88fxx81/USP/jump.S I removed some #if's to make sure it jumped to fff90000
* /board/mv88fxx81/db88f5181/u-boot.lds Changed the layout so it fits everything.
* /include/config.mk added some defines, not sure if they're necessary.
* Possibly other places: Feel free to run diff against the 1.7.3 sources from dlink.

How to compile:
* Set CROSS_COMPILE appropriately. I used the codesourvery 2005q3-2 arm-none-eabi, gcc version 3.4.4
* Optional: Change the march type to 526, see above.
* run make
* You'll need to append the resulting u-boot.bin with bytes from the original (The end of the original contains the Ethernet address) so that it fits the flash sector boundaries, in the default setup in my configuration it amounts to 0x80000

Fixed: u-boot binary: http://maligor.googlepages.com/u-boot-r2.bin.gz
Fixed: sources pre-configured: http://maligor.googlepages.com/uboot-1. … r2.tar.bz2

Last edited by maligor (2009-01-22 13:33:11)