DSM-G600, DNS-3xx and NSA-220 Hack Forum

Sharp Rock · 2009-07-04 23:09:04

Greetings to the firmware group,

My title says it all. I'm embarresed to say the least, as this was a stupid mistake.

What I did, and why...

I've recently been active in the chkbutton2 thread. Things were working great, until I made a small configuration change with the web GUI. Then I started having the same issues that kimb1 has. I tried reflashing to older ver. FW trying to over write what ever I had mucked up. Nothing worked, and I kept going back. Well, you can probably guess I went to far back, to an unsupported FW for my hardware version B1. So now I have a brick. Thankfully, I have two of these boxes, so I still have storage on my network. My guess is that the Uboot (and / or the SATA controller) is not supported with FW 1.02. And this is my problem.

Where I'm at now...

I have just ordered all needed parts to install a serial port. Is this enough, or should I be doing JTAG? The serial looks pretty easy. Next, I'm not a complete linux noob, but pretty green. I can get around a command line very well (an old DOS hound), and google is my friend. Would the group be willing to "point" me in the right direction? I am not asking for a complete step by step. I guess that would be nice, but I can figure out a lot. I would greatly appreciate a direction to head.

Anything would be helpful at this point. Thanks very much in advance.

Jerry

Sharp Rock · 2009-07-05 06:30:09

I think I have step one down.

I use Putty. Set it up for Serial connection, speed, baud rate, etc. I can get the port number from Windoze Device manager. And then the unlock code. This came from the Wiki.

Step two: I'll keep at it with Google, and forum searches.

Jerry

jcard · 2009-07-05 19:24:49

I use linux and kermit as the communication program.
The bootloader, uboot, uses the kermit protocol for file transfers. I read that some win implementations are faulty, use the real thing

- After having a serial connection working, which is the most difficult part (but is covered in the wiki), you establish a connection and perform a power-on at the dns.
- You have 3 secs to type two keys to abort the boot sequence: <space> and <1>; as the unit is bricked you might be at the uboot prompt right after poweron, it depends.
- you can now see the available uboot commands by typing <?>
- Then, at the uboot prompt, issue the command "loadb k", change to the comm program prompt (<ctrl>+<\> <c> in kermit), and issue the command to send the kernel file, "send <filename>". This can take a couple of minutes. When finish, the file is automaticaly flashed.
- You might have to reconnect to uboot again, key <c>, to see the progress and issue more commands
-Then, again at the uboot prompt, "loadb r", repeat the above sequence, but now for the filesystem ramdisk. This can take 10 to 15 minutes (transfer is at 115000bps which translates to +/- 8/9KBs
- That's all, do a reboot.

See http://dns323.kood.org/dsmg600/howto:kernel_upload

To get the kernel and filesystem ramdisk, the easiest is to use your other dns box. After connecting to it issue the commands:

dd if=/dev/mtdblock2 of=mtd2-kernel
dd if=/dev/mtdblock3 of=mtd3-ramdisk

and transfer the mtd2-kernel and mtd3-ramdisk files to your host computer; needless to say, those are the files that you will serial-transfer and flash.

Sharp Rock · 2009-07-06 00:31:19

jcard,

You have gone well beyond my hopes. Thank you. I now have more than just a starting point. I do expect bumps in the road, but that is how I'll learn. Now, I wait for my serial parts to arrive. Funny, I did order parts to port both boxes.

A concern that will slow things before attempting the reload, more research:

My 2nd DNS will be the "doner" for flash and ramdisk. But there are at least 2 distinct items that I know of in the flash of these boxes. One is their internal serial number, perhaps of little worry. Second is the MAC address, perhaps of much greater concern. I'll do more reading. I jumped off the bridge once, and it was enough!

Again, Thank you!

Jerry

jcard · 2009-07-06 05:52:09

Sharp Rock wrote:
My 2nd DNS will be the "doner" for flash and ramdisk. But there are at least 2 distinct items that I know of in the flash of these boxes. One is their internal serial number, perhaps of little worry. Second is the MAC address, perhaps of much greater concern. I'll do more reading.

The flashed kernel and filesystem don't have that information.

Code:

kernel-2.6.30, arch/arm/mach-orion5x/dns323-setup.c:
static int __init dns323_read_mac_addr(void)
{
        u_int8_t addr[6];
        int i;
        char *mac_page;

        /* MAC address is stored as a regular ol' string in /dev/mtdblock4
         * (0x007d0000-0x00800000) starting at offset 196480 (0x2ff80).
         */

mtdblock4 is the bootloader, uboot, dont' mess with it, or you will need a JTAG:

Code:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00002000 "MTD1"
mtd1: 00010000 00010000 "MTD2"
mtd2: 00180000 00010000 "Linux Kernel"
mtd3: 00630000 00010000 "File System"
mtd4: 00030000 00010000 "u-boot"

and watching the boot messages with "dmesg":

Creating 5 MTD partitions on "phys_mapped_flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"

But to complete your readings, see:

http://www.hezmatt.org/~mpalmer/blog/ge … s_323.html (history)
http://curvedbrain.org/tag/dns-323/ (first known attempt)
http://www.cyrius.com/debian/orion/d-link/dns-323/ (debian fash/runtime)

and, the most important,

http://theshed.hezmatt.org/dns323-firmware-tools/

With this last utility you can disassembly a stock vendor firmware into the kernel and filesystem components that you need to flash your box.
You can even dissassemble the vendor firmware file that you used to flash your 2nd box and compare the resulting files with "my" method files (read elsewhere in this forum, confirmed with further readings, like you, and finally tested with crossed fingers -- no JTAG here)

I jumped off the bridge once, and it was enough!

To assemble the serial link you will do skydiving :-)

Last edited by jcard (2009-07-06 06:02:56)

Sharp Rock · 2009-07-06 07:04:21

jcard wrote:
Sharp Rock wrote:
My 2nd DNS will be the "doner" for flash and ramdisk. But there are at least 2 distinct items that I know of in the flash of these boxes. One is their internal serial number, perhaps of little worry. Second is the MAC address, perhaps of much greater concern. I'll do more reading.
The flashed kernel and filesystem don't have that information.

That is great to know. Less to be concerned with. Thank you.

jcard wrote:
But to complete your readings, see:

http://www.hezmatt.org/~mpalmer/blog/ge … s_323.html (history)
http://curvedbrain.org/tag/dns-323/ (first known attempt)
http://www.cyrius.com/debian/orion/d-link/dns-323/ (debian fash/runtime)

and, the most important,

http://theshed.hezmatt.org/dns323-firmware-tools/

With this last utility you can disassembly a stock vendor firmware into the kernel and filesystem components that you need to flash your box.
You can even dissassemble the vendor firmware file that you used to flash your 2nd box and compare the resulting files with "my" method files (read elsewhere in this forum, confirmed with further readings, like you, and finally tested with crossed fingers -- no JTAG here)

At my age, I LOVE homework. Thank you! A concern regarding Uboot. When I went that far back on FW, I did load an older Uboot. At some point, it needs upgrading too. But with all this info, I have lots to try before going with JTAG. Excellent stuff!

Sharp Rock wrote:
I jumped off the bridge once, and it was enough!
jcard wrote:
To assemble the serial link you will do skydiving :-)

Now that's a good one! But actually, this (the wiring) should be the easy stuff for me. I was an electronics major in college (long time ago), and currently an Amateur Radio Operator. I look forward to this challenge. And with all the info you have given me, I have much to digest, and try. I am getting a bad feeling about that older Uboot that was loaded. If I must do JTAG, I'll do the deed.

Thank you so much! You have given me great direction.

Jerry

Sharp Rock · 2009-08-06 04:17:22

Update...

Lots has happened over the last month, and this project got pushed back a few times.
Before I begin, a huge thanks to jcard for the information provided. I would have never gotten this far!

Current progress...

Serial connection successful. I can access Uboot. And it appears to me that I do have the newer Uboot intact on the box.

jcard wrote:
Sharp Rock wrote:
I jumped off the bridge once, and it was enough!
To assemble the serial link you will do skydiving :-)

After this little exchange, I bragged about how easy this would be. HAH, it ended up being like stepping off the space shuttle. Those are tiny wires, and I learned that my skills are good down to about 24 ga. wire. But not the 30 ga. wire used. I found a work around, and will post that later.

Results of loading the kernel, and ramdisk borrowed from my second box have ended in failure due to a reported "Bad Data CRC" error reported on the kernel. Odd thing is, it will boot if told to boot from the memory just loaded, but not from flash. If I issue the bootm command (without arguments) right after uploading the kernel, it will attempt a boot without the CRC error. But once flashed and booted from power down, no go. No errors are noted during the kermit upload session. I just doesn't work when completed.

Next I've tried out the tools at:

http://theshed.hezmatt.org/dns323-firmware-tools/

This took more learning, but again succeeded in mastering it, and produced files for all versions from 1.04 through 1.08 beta. This also ended in failure due to the error noted above (CRC).

My un-educated guesses...

1. While uboot appears to work right, perhaps it is damaged, and will not properly flash the box.

2. I have somehow damaged the flash ROM chip, resulting in the errors.

3. Perhaps I'm doing something wrong that I'm not aware of, but this seems simple enough.

I've spent a lot of time on this, and really don't want to give up, but I'm out of things to try. If anyone (jcard?) has a suggestion, please point me in that direction.

And once again, a huge thanks for all that has been given. It has been an education getting to this point, even if it has failed.

Jerry

jcard · 2009-08-06 23:23:36

Good job.

1-So, after you send the kernel using u-boot and kermit, you only see a CRC error and *don't* see messages saying "erasing block #1, block #2, ...flashing...", right?
This is odd, because the firmware split tool checks the extracted kernel and initramfs images checksums against the u-boot header; on the other side, when you do a "bootm" from the load address the kernel starts, which means that at least it was partially well transmited.
This seems to indicate transmission errors. Have you set kermit settings according to http://dns323.kood.org/dsmg600/howto:kernel_upload ?

set line /dev/ttyS0 # jc: might be different
set speed 9600 # jc: wrong! 115200?
set carrier-watch off
set handshake none
set flow-control none # jc: really? looks odd...
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5

I am away from home, in hollydays, my .kermrc is different, so I can't give you advice on this. Anybody can?

2-The same thing happens when you try to flash the initramfs? You must flash both, no special order needed.

3-When you do a "bootm" from the kernel load address, does it produces lots of messages, stopping with something like "VFS PANIC, rootfs not found...." or similar?

4-And if you do a "bootm" right after power on, using the addresses obtained from u-boot "printenv" command, what happens? Does the kernel also starts and then stops with the PANIC message, or does u-boot complains with a CRC/checksum error? Only on the kernel or also on the ramdisk?
One possibiltiy, if the kernel in flash is OK, is to load only the ramdisk and try to bootm, and after that use the web interface firmware tool to try to flash the vendor firmware. So, if either the kernel or initramfs are OK, you only need to loadb the other and try to boot (with the load address of one and the boot address of the other)
Another possibility, which didn't work when I attempted it, is to load the kernel, them use u-boot "cp" command to copy it to another address, then load the ramdisk, and try a bootm; then use the web interface to flash the vendor fw.

When you bricked your box, what fw was you trying to flash? According to the wiki, fw 1.0.4 and 1.0.5 introduced a new u-boot version. If u-boot was incorrectly flashed than you might have a problem.
And perhaps you should try to flash only the version that failed, and not a later one?

No more ideas... but keep trying and share the results

Sharp Rock · 2009-08-09 06:13:54

jcard,

Thanks so much for your reply. You are on Holiday. Enjoy! Have fun!

I will start working on detailed responses to your questions.

Jerry

Sharp Rock · 2009-08-09 08:00:15

A very long reply...

jcard wrote:
Good job.

1-So, after you send the kernel using u-boot and kermit, you only see a CRC error and *don't* see messages saying "erasing block #1, block #2, ...flashing...", right?

No, I DO SEE the "erasing block #1, block #2, etc..., Flashing. No errors noted during the flashing proccess.

I get the Bad Data CRC when booting only.

Here is what I see when booting...

Marvell>> ** LOADER **
** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Oct 12 2007 - 17:19:14) Marvell version: 1.7.3.001

DRAM CS[0] base 0x00000000 size 64MB
DRAM Total size 64MB
[8192kB@ff800000] Flash: 8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: MV88F5182 Rev 2
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
USB 1: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot: 0
## Booting image at ff820000 ...
Image Name: Linux-2.6.12.6-arm1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1455992 Bytes = 1.4 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... Bad Data CRC <-----<<THIS IS THE BAD BOY THAT KEEPS KILLING ME>>
Marvell>>
Communications disconnect (Back at jerry-ubuntu-desktop)

Note the newer Uboot version seems to be intact.

jcard wrote:
This is odd, because the firmware split tool checks the extracted kernel and initramfs images checksums against the u-boot header; on the other side, when you do a "bootm" from the load address the kernel starts, which means that at least it was partially well transmited.
This seems to indicate transmission errors. Have you set kermit settings according to http://dns323.kood.org/dsmg600/howto:kernel_upload ?
set line /dev/ttyS0 # jc: might be different
set speed 9600 # jc: wrong! 115200?
set carrier-watch off
set handshake none
set flow-control none # jc: really? looks odd...
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5

I used this same post to set up my kermit session. I do:

set line /dev/tty"?" To determine the "?" I do a "dmesg" to see where the USB device mounted. It's usually on USB0, but every once in a while, it will be on USB1. I don't assume, and always check. I just takes a second to KNOW where it is.

set speed 115200
set carrier-watch off
set flow-control none
robust
etc...

I've tried it both ways doing the rest; ie rec pack 1000, send pack 1000. This adjusts the size of the packets, and does slow things down some with the smaller packets.

jcard wrote:
2-The same thing happens when you try to flash the initramfs? You must flash both, no special order needed.

I always flash both the kernel and initramfs to the same version. No errors seen during the uploading session.

jcard wrote:
3-When you do a "bootm" from the kernel load address, does it produces lots of messages, stopping with something like "VFS PANIC, rootfs not found...." or similar?

Not quite. Mine always stops at the EHCI Host Controller entry. Like this... These are only the last few lines.

Creating 5 MTD partitions on "phys_mapped_flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"
ehci_platform ehci_platform.20865: EHCI Host Controller

However, since I have a "working" DNS-323, I went to see how it acted on boot up. And it would "hang" at the same place. EXCEPT ONCE, it did proceed to the Kernel Panic entry that you mention. This I found confusing. I did not keep trying, but with 10 trys, it only once made it to the Kernel Panic stop point on the "working" DNS.

jcard wrote:
4-And if you do a "bootm" right after power on, using the addresses obtained from u-boot "printenv" command, what happens? Does the kernel also starts and then stops with the PANIC message, or does u-boot complains with a CRC/checksum error? Only on the kernel or also on the ramdisk?
One possibiltiy, if the kernel in flash is OK, is to load only the ramdisk and try to bootm, and after that use the web interface firmware tool to try to flash the vendor firmware. So, if either the kernel or initramfs are OK, you only need to loadb the other and try to boot (with the load address of one and the boot address of the other)
Another possibility, which didn't work when I attempted it, is to load the kernel, them use u-boot "cp" command to copy it to another address, then load the ramdisk, and try a bootm; then use the web interface to flash the vendor fw.

When you bricked your box, what fw was you trying to flash? According to the wiki, fw 1.0.4 and 1.0.5 introduced a new u-boot version. If u-boot was incorrectly flashed than you might have a problem.
And perhaps you should try to flash only the version that failed, and not a later one?

No more ideas... but keep trying and share the results

I've never made it past the Bad Data CRC kernel error when booting from flash at the address ff820000, so have no idea if the initramfs is loaded ok. I thought the same thing about just getting it up on ANYTHING and then using the web interface. But I just can't seem to get there. As noted above, it appears I do still have the newer Uboot on the box. I'm nervous about defining my own load address at this point. I need to learn how to understand the mapping, or I could overwrite Uboot. More to study! I'll try some more tomorrow.

jcard wrote:
I am away from home, in hollydays.

Finish your Holiday, and have fun! And thanks much!

Jerry

Sharp Rock · 2009-08-13 00:53:58

2nd update...

Some success, some failure. Lot's of sky diving!

In my mind, I have eliminated the question of bad communications. Why? I can get the box to boot to a point using the memory copy (cp) command to move the uploaded code, but it WILL NOT boot from anything (Kernel or Ramdisk) loaded into flash. Let me show what I've done, and the results...

So, I boot into Uboot, and issue commands:

loadb r

After this finishes, I do:

cp 00100000 03000000 00629c29 <-- first numbers are location to copy from, 2nd is location to copy to, 3rd is length of the code to be copied. This completes without error.

Next I do:

loadb k

Then when this finishes, I do:

cp 00100000 02000000 001637b8

Next I issue the command:

bootm 02000000 03000000

Here are the results of the booting that follow, but ALWAYS ends with a hang at the end...

bootlog wrote:
Marvell>> bootm 02000000 03000000
## Booting image at 02000000 ...
Image Name: Linux-2.6.12.6-arm1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1455992 Bytes = 1.4 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 03000000 ...
Image Name: Ramdisk
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 6462441 Bytes = 6.2 MB
Load Address: 00800000
Entry Point: 00800000
Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux................................................................................................. done, booting the kernel.
Linux version 2.6.12.6-arm1 (tim@SWTEST2) (gcc version 3.3.3) #31 Mon Mar 23 19:39:43 CST 2009
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 512 (order: 9, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB 0MB 0MB 0MB = 64MB total
Memory: 55324KB available (2520K code, 455K data, 112K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 6310K
NET: Registered protocol family 16

Marvell Development Board (LSP Version 1.7.6_NAS)-- RD-88F5182-NAS-2

Detected Tclk 166000000 and SysClk 166000000
Marvell USB EHCI Host controller #0: c03b9bc0
Marvell USB EHCI Host controller #1: c03b9a40
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
cesadev_init(c0012498)
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
inotify device minor=63
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.3 (2007/10/31) Phillip Lougher
Initializing Cryptographic API
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
io scheduler noop registered
io scheduler deadline registered
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
o Ethernet descriptors in DRAM
o DRAM SW cache-coherency
o Checksum offload enabled
o Loading network interface 'egiga0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
physmap flash device: 800000 at ff800000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
Using physmap partition definition
Creating 5 MTD partitions on "phys_mapped_flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"
ehci_platform ehci_platform.20865: EHCI Host Controller <-- always stops here!

So now I go back to my working DNS-323, running FW 1.08beta. It does exactly the same thing. I tried 10 times, and it would not get past this point. Once before when I tried this, it did (once) go past, to the Kernel Panic spot. But now I can't get either box to do so. Is there a trick here that I don't know?

I also tried going back to the older version that originally crashed the box (1.02). I will not boot this at all, giving a "Bad Magic number" error. It truly is too old for my box.

Other things tried...

Using erase, and cp to manually flash the box. It seems the D-Link, in their great wisdom have nuetered Uboot (cut it's balls off). The cp command would not copy to the protected sections of flash. I wandered around looking for a "hidden" command to un-protect, but found none.

Looked at the "printenv" for anything interesting...

Marvell>> printenv
bootargs=root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
bootcmd=bootm FF820000 FF9A0000
baudrate=115200
loads_echo=0
ipaddr=172.16.136.73
serverip=172.16.136.32
rootpath=/home/tmp/jack/ARM_FS/armfs
stdin=serial
stdout=serial
stderr=serial
cpuName=926
CASset=min
enaMonExt=no
enaCpuStream=no
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:egiga0:none
image_name=uImage
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootdelay=3
disaMvPnp=no
ethaddr=00:00:00:00:51:81
overEthAddr=no
usb0Mode=host
usb1Mode=host

I'm intriged by the first entry "bootargs". The console pointing to ttyS0. That is not where I'm attached to. I'm using ttyUSB0. So I tried to change this (changes do not hold over a reboot). When I issue the command...

set bootargs=root=/dev/ram console=ttyUSB0,115200 :::DB88FXX81:egiga0:none

Then check what I got with...
printenv

I get... bootargs=root=/dev/ram=console=ttyUSB0,115200 :::DB88FXX81:egiga0:none

Note the "=" that I get between the words "ram and console". That wasn't there before, so not so sure I was getting what I wanted out of this. The results of another loading, copying, and booting session were no different, and still booted to the hang point at the EHCI Host Controller.

Help!!!

Really, if the box is a brick, so be it. And I have no one to blame but myself. It really has been an education getting to here. So far, I've been attemping to reload 1.08beta (and 1.02 once). I may give 1.06 a try.

Any suggestions are welcome!

Thanks much.

Jerry

Sharp Rock · 2009-08-20 07:38:55

jcard,

I want to thank you for all the help. It was a great education! Alas, the box is a brick. However, I have replaced it with a new DNS-323 from Amazon.com for $127.00. There is a sale on right now, with a mail in rebate giving the deal. This is a considerable savings from the price I paid for the first one. My second DNS I bought used for $125. I believe they may be clearing out stock of the B1 hardware, preparing for the release of the new C1 hardware.

Some time in the future, when I have more time (this winter perhaps) I will try getting a JTAG cable, and see if I can recover the box that way. I just hooked up the new box, and saved off all the flash sections to files, including mtd4 (Uboot). This little project is on the shelf for a while.

Best wishes!

Jerry

The UnDead Kai · 2009-09-07 09:41:50

Hi Sharp,

Maybe if you can boot a kernel using uboot from ram and load over nfs.
Then use /dev/mtd to try and write the kernel back to flash ?

Bricked by 1.04 ( sorta ) fixed it by extracting the kernel image and re flashing it.
http://dns323.kood.org/forum/viewtopic.php?id=1594

The UnDead Kai · 2009-09-08 03:58:53

Replicated exactly your situation last night Sharp ( by accident ).
Corrupted my fs image and a loadb r returned image to large, with a crc issue when booting the kernel and loading the fs image.

Using NFS I was able to use the kernel to flash mtdblock3 with a valid image.

bhouse · 2010-02-25 11:50:37

Dear Sharp Rock,

I have un-bricked my DNS -323

It seems that loadb r and loadb k always load to address 0x10000.
Hence your trick with the cp command helped me. Thanks

I did the following:
- loadb r (sending kernel from firmware 1.7)
- cp ramdisk to a higher address for example 0x2000000 (by the way, this address seems out of the 8 MB Flash ROM. I do not understand where it is. Do you ?)
- loadb k
- bootm 100000 2000000

Then the DNS 323 boots alright, but hangs at "ehci_platform ehci_platform.20865: EHCI Host Controller" for 31 mn. You just have to wait that long!

I was then able to update the firmware using the standard web interface!!!

bhouse · 2010-02-26 12:01:59

A few more words after reading and testing http://dns323.kood.org/forum/viewtopic.php?id=5180)

The 31 mn hang at "ehci_platform ehci_platform.20865: EHCI Host Controller" can be eliminated by unpluging the serial cable. Repluging is as easy a relaunching kermit and reconnecting.

Updating the firmware using the standard web interface only worked with the serial cable unplugged.

Cheers

PS: I just updated firmware to revision 1.8, all works well :-)

clefranc · 2010-07-26 18:46:54

Hi,
Can you help me recover my DNS323?

I've flashed firmware 1.00, then 1.01 with kermit, but the device always report cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error

Here is firmware 1.01

Code:

 ** LOADER **
 ** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment


Soc: MV88F5181 Rev 3
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


 Init usb device.
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot:  0
## Booting image at ff820000 ...
   Image Name:   Linux-2.6.6-arm2
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1232348 Bytes =  1.2 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at ff9a0000 ...
   Image Name:   Ramdisk
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    5639349 Bytes =  5.4 MB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux.............................................................
....................... done, booting the kernel.
Linux version 2.6.6-arm2 (jack@SWTEST2) (gcc version 3.3.3) #19 Fri Jul 28 11:38
:16 CST 2006
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
CPU: D VIPT write-back cache
CPU: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000


- Warning - This LSP release was tested only with U-Boot release 1.4.2

Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 16384
  DMA zone: 16384 pages, LIFO batch:4
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 512 (order 9: 4096 bytes)
Console: colour dummy device 80x30
Memory: 64MB 0MB 0MB 0MB = 64MB total
Memory: 56688KB available (2149K code, 437K data, 88K init)
Calibrating delay loop... 331.77 BogoMIPS
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
POSIX conformance testing by UNIFIX
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 5507K
NET: Registered protocol family 16

        Marvell DB-88f5x81 Development Board (LSP Version 1.3.1) -- POS-NAS

 Detected Tclk 166000000 and SysClk 166000000
Marvell USB EHCI Host controller
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers disabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface 'egiga0'
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi2 : Marvell SCSI to SATA adapter
scsi3 : Marvell SCSI to SATA adapter
Using anticipatory io scheduler
physmap flash device: 800000 at ff800000
 Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
Using physmap partition definition
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"
ehci_platform ehci_platform143610: at 0xf1050100, irq 17
ehci_platform ehci_platform143610: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform143610: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-2
9
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
mice: PS/2 mouse device common for all mice
md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 88K
init started:  BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary
init started:  BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary
Starting pid 132, console /dev/ttyS0: '/etc/rc.sh'
Check MTD block device V2.01.05162006
        MTDC: Mount MTD1 done.
Bad inode number on dev mtdblock0: 65535 is out of range

cp: internal error: unrecognized file type
cp: internal error: unrecognized file type
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
        MTDC: File not exist in MTD1.
        MTDC: Mount MTD2 done.
        MTDC: File not exist in MTD2.
        MTDC: Copy default files to MTD1.
cp: /default/*: No such file or directory
        MTDC: Mount MTD2 done.
        Error: Can't open file /sys/mtd1/group in mtd1.
        MTDC: Backup files from MTD1 to MTD2.
cp: /sys/mtd1: omitting directory
cp: internal error: unrecognized file type
cp: internal error: unrecognized file type
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
cp: /sys/mtd1/ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ: Input/output error
** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /image.cfs: not mounted
umount: /image.cfs: not mounted
** copy default config files
default version > mtd1 version
rm: cannot remove `/sys/mtd1/v*': No such file or directory
buf=touch /sys/mtd1/ v2.4

cp: unable to open `/sys/mtd1/v2.4': No space left on device
cp: unable to open `/sys/mtd1/Certs.info': No space left on device
cp: unable to open `/sys/mtd1/cacert.pem': No space left on device
cp: unable to open `/sys/mtd1/cakey.pem': No space left on device
cp: unable to open `/sys/mtd1/codepage': No space left on device
cp: unable to open `/sys/mtd1/email.conf': No space left on device
cp: unable to open `/sys/mtd1/group': No space left on device
cp: unable to open `/sys/mtd1/hosts': No space left on device
cp: unable to open `/sys/mtd1/language.conf': No space left on device
cp: unable to open `/sys/mtd1/log.conf': No space left on device
cp: unable to open `/sys/mtd1/mt-daapd.conf': No space left on device
cp: unable to open `/sys/mtd1/mt-daapd.playlist': No space left on device
cp: unable to open `/sys/mtd1/mtdversion': No space left on device
cp: unable to open `/sys/mtd1/newftp': No space left on device
cp: unable to open `/sys/mtd1/passwd': No space left on device
cp: unable to open `/sys/mtd1/quota': No space left on device
cp: unable to open `/sys/mtd1/rc.init.sh': No space left on device
cp: unable to open `/sys/mtd1/resolv.conf': No space left on device
cp: unable to open `/sys/mtd1/rtc.conf': No space left on device
cp: unable to open `/sys/mtd1/server.pem': No space left on device
cp: unable to open `/sys/mtd1/shadow': No space left on device
cp: unable to open `/sys/mtd1/sib.conf': No space left on device
cp: unable to open `/sys/mtd1/sib2.conf': No space left on device
cp: unable to open `/sys/mtd1/sib_ap.conf': No space left on device
cp: unable to open `/sys/mtd1/smb.default': No space left on device
cp: unable to open `/sys/mtd1/smbpasswd': No space left on device
cp: unable to open `/sys/mtd1/udhcpd.conf': No space left on device
cp: unable to open `/sys/mtd1/udhcpd.conf.def': No space left on device
cp: unable to open `/sys/mtd1/version.txt': No space left on device
cp: unable to open `/sys/mtd1/version2.txt': No space left on device
cp: unable to open `/sys/mtd1/mtdversion': No space left on device
Segmentation fault
** check raid Config version
eve test - /sys/mtd1/raidtab2web:No such file or directory
Update raidtab2web
eve test - /sys/mtd1/raidtab2web:No such file or directory
eve test - buf:cp /tmp/raidtab_temp /sys/mtd1/raidtab2web
cp: unable to open `/sys/mtd1/raidtab2web': No space left on device
** copy mtd1 files
cp: /sys/mtd1/hosts: No such file or directory
cp: /sys/mtd1/rc.init.sh: No such file or directory
cp: /sys/mtd1/resolv.conf: No such file or directory
cp: /sys/mtd1/passwd: No such file or directory
cp: /sys/mtd1/shadow: No such file or directory
cp: /sys/mtd1/group: No such file or directory
cp: /sys/mtd1/sib.conf: No such file or directory
cp: /sys/mtd1/sib2.conf: No such file or directory
cp: /sys/mtd1/sib_ap.conf: No such file or directory
cp: /sys/mtd1/smbpasswd: No such file or directory
cp: /sys/mtd1/smb.default: No such file or directory
cp: /sys/mtd1/rtc.conf: No such file or directory
cp: /sys/mtd1/email.conf: No such file or directory
cp: /sys/mtd1/log.conf: No such file or directory
cp: /sys/mtd1/language.conf: No such file or directory
cp: internal error: unrecognized file type
cp: /sys/mtd1/firmwareupdate: No such file or directory
cp: /sys/mtd1/raidtab: No such file or directory
cp: /sys/mtd1/raidtab2web: No such file or directory
cp: /sys/mtd1/ftpaccess: No such file or directory
cp: /sys/mtd1/mt-daapd.conf: No such file or directory
cp: /sys/mtd1/mt-daapd.playlist: No such file or directory
cp: /sys/mtd1/codepage: No such file or directory
cp: /sys/mtd1/udhcpd.conf: No such file or directory
mv: /sys/mtd1/restore: No such file or directory
mv: /sys/mtd1/pls_sync: No such file or directory
mv: /sys/mtd1/pls_chmod_a2: No such file or directory
mv: /sys/mtd1/pls_chmod_b2: No such file or directory
cp: /sys/mtd1/ftpgroup: No such file or directory
** link lib **
** link web **
** link /usr/bin **
** link /usr/sbin **
** link /usr/local/LPRng **
<rtc>: getRTC time= 10/7/26 Mon 15:28:37
<fan script start>
** set loopback interface
MAC = 00:19:5B:8C:81:C4
egiga0: mac address changed
** Activate Gigabit Interface
** execute rc.init.sh
Segmentation fault
SIOCDELRT: No such process
*****8192.168.0.101
info, udhcpc (v0.9.9-pre) started
egiga0: link down
get IP = [NONE SET]
debug, Sending discover...
debug, Sending discover...
egiga0: link up<5>, full duplex<5>, speed 1 Gbps<5>
debug, Sending discover...
debug, Sending select for 192.168.1.21...
info, Lease of 192.168.1.21 obtained, lease time 86400
deleting routers
SIOCDELRT: No such process
adding dns 192.168.1.1
get IP = 192.168.1.21
SIOCADDRT: Network is unreachable
Setting hostname .... DNS-323
get IP = 192.168.1.21
Segmentation fault
1.Set Date & time ...(command: sntp -r ntp1.dlink.com &)
sntp: using NTP server ntp1.dlink.com (207.232.83.70)
NTP Server connected successfully!!!
System time: 2010/7/26 Mon 15:28:49
Jul 26 15:28:49 crond[487]: crond 2.3.2 dillon, started, log level 8

check button V2.16.10182006
1.01(1.01.1018.2006)
10/18/2006
op_server v2.01.06012006
mfg_search
create /tmp/fatmount script file
mount FAT storage devices
kill: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]

UPnP AV / MediaServer v1.02.0317.2006.

Open CodePage Error
** Get MAC Addr
mount: /dev/sda is not a valid block device
mount: /dev/sdb is not a valid block device
mount: /dev/sdc is not a valid block device
UPNPAV_MGR: lock resource.
UPNPMGR: Can not open upnpav.conf.
UPNPAV_MGR: unlock resource.
upnpav_path=-------------------------
Starting pid 526, console /dev/ttyS0: '/bin/sh'


BusyBox v1.00-pre1 (2006.07.17-10:17+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Is the device dead?

RoganDawes · 2010-07-26 22:41:56

The error message suggests that your "settings" partition (mtd1) has become corrupted. This partition contains a Minix filesystem, which stores your customisations.

One thing you could try doing is to hold in the Reset button when booting, so clear that partition, and boot from scratch.

If that doesn't help, I have built a new U-Boot boot image, which even has network support. You could use it to boot a new kernel and root filesystem from the network, and you could recover that partition manually. I haven't been through all of those additional steps yet, so would need to work through them myself before I could help you.

I'd certainly try the Reset button first, though.

clefranc · 2010-07-27 02:37:20

Hi RoganDawes,

RoganDawes wrote:
The error message suggests that your "settings" partition (mtd1) has become corrupted. This partition contains a Minix filesystem, which stores your customisations.

The only acccess I have is through the RS232 port. There is no files in /sys/mtd1 or /sys/mdt2.

RoganDawes wrote:
One thing you could try doing is to hold in the Reset button when booting, so clear that partition, and boot from scratch.

The reset button was tried thoroughly.

RoganDawes wrote:
If that doesn't help, I have built a new U-Boot boot image, which even has network support. You could use it to boot a new kernel and root filesystem from the network, and you could recover that partition manually. I haven't been through all of those additional steps yet, so would need to work through them myself before I could help you.

Can I do the same via RS232?

Thanks for your help

RoganDawes · 2010-07-27 09:52:04

clefranc wrote:
Hi RoganDawes,

RoganDawes wrote:
The error message suggests that your "settings" partition (mtd1) has become corrupted. This partition contains a Minix filesystem, which stores your customisations.
The only acccess I have is through the RS232 port. There is no files in /sys/mtd1 or /sys/mdt2.

Sorry, I didn't read to the end of the log that you posted. I see now that you actually do manage to boot the whole way to a BusyBox prompt. If you follow the instructions on the wiki, pasting the access code to enable your BusyBox shell:

http://dns323.kood.org/hardware:serial. wrote:
* Magic code to break into shell is 5784468 followed by the enter key

Then you should be able to run:

Code:

mkfs.minix /dev/mtd1
mkfs.minix /dev/mtd2

to reinitialise your mtd1 and mtd2 partitions.

You shouldn't need to go down to the U-boot level as I was suggesting previously, since you do actually boot to a shell.

Good luck!

clefranc · 2010-07-27 15:48:06

RoganDawes wrote:
Then you should be able to run:
Code:
mkfs.minix /dev/mtd1
mkfs.minix /dev/mtd2
to reinitialise your mtd1 and mtd2 partitions.

Perharps I've forgot to tell that I know nothing about Linux.

The commands above do nothing, I must do a CTRL+C to exit to the # prompt.
Is there some paramaters like filename or blocks I must provide?
BTW, there is a /dev/mtd1 /dev/mtd2 already.

Code:

crw-r--r--    1 root     root      90,   0 Dec 27  2005 mtd0
crw-r--r--    1 root     root      90,   2 Dec 27  2005 mtd1

Code:

# fdisk /dev/mtd1
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklab
el
Building a new DOS disklabel. Changes will remain in memory only,
until you decide to write them. After that, of course, the previous
content won't be recoverable.

You must set cylinders.
You can do this from the extra functions menu.
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
Segmentation fault

Last edited by clefranc (2010-07-27 16:01:05)

RoganDawes · 2010-07-27 15:53:29

clefranc wrote:
RoganDawes wrote:
Then you should be able to run:
Code:
mkfs.minix /dev/mtd1
mkfs.minix /dev/mtd2
to reinitialise your mtd1 and mtd2 partitions.
Perharps I've forgot to tell that I know nothing about Linux.

The commands above do nothing, I must do a CTRL+C to exit to the # prompt.
Is there some paramaters like filename or blocks I must provide?
BTW, there is a /dev/mtd1 /dev/mtd2 already.
Code:
crw-r--r--    1 root     root      90,   0 Dec 27  2005 mtd0
crw-r--r--    1 root     root      90,   2 Dec 27  2005 mtd1

Sorry, I think I should have used:

Code:

mkfs.minix /dev/mtdblock1
mkfs.minix /dev/mtdblock2

Or maybe:

Code:

dd if=/dev/zero of=/dev/mtdblock1

clefranc · 2010-07-27 16:05:41

RoganDawes wrote:
Sorry, I think I should have used:
Code:
mkfs.minix /dev/mtdblock1
mkfs.minix /dev/mtdblock2

OK, now I get this

Code:

 ** LOADER **
 ** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment


Soc: MV88F5181 Rev 3
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


 Init usb device.
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot:  0
## Booting image at ff820000 ...
Bad Magic Number
Marvell>> <INTERRUPT>
Marvell>>

I will dump firmware 1.01 again...

RoganDawes · 2010-07-27 16:16:01

clefranc wrote:

Code:

PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot:  0
## Booting image at ff820000 ...
Bad Magic Number
Marvell>> <INTERRUPT>
Marvell>>

I will dump firmware 1.01 again...

Oops, sorry! I guess I told you to overwrite your kernel by mistake.

You should be able to flash it back (with the associated ramdisk) by following the instructions here.

Hopefully your mtd1 problems should be gone, though.

clefranc · 2010-07-27 16:42:19

Back to my first post, same errors...

Which firmware version I must use?

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2009-07-04 23:09:04

I have bricked my DNS-323... Please point me in a direction...

#2 2009-07-05 06:30:09

Re: I have bricked my DNS-323... Please point me in a direction...

#3 2009-07-05 19:24:49

Re: I have bricked my DNS-323... Please point me in a direction...

#4 2009-07-06 00:31:19

Re: I have bricked my DNS-323... Please point me in a direction...

#5 2009-07-06 05:52:09

Re: I have bricked my DNS-323... Please point me in a direction...

Sharp Rock wrote:

Code:

Code:

#6 2009-07-06 07:04:21

Re: I have bricked my DNS-323... Please point me in a direction...

jcard wrote:

Sharp Rock wrote:

jcard wrote:

Sharp Rock wrote:

jcard wrote:

#7 2009-08-06 04:17:22

Re: I have bricked my DNS-323... Please point me in a direction...

jcard wrote:

Sharp Rock wrote:

#8 2009-08-06 23:23:36

Re: I have bricked my DNS-323... Please point me in a direction...

#9 2009-08-09 06:13:54

Re: I have bricked my DNS-323... Please point me in a direction...

#10 2009-08-09 08:00:15

Re: I have bricked my DNS-323... Please point me in a direction...

jcard wrote:

jcard wrote:

jcard wrote:

jcard wrote:

jcard wrote:

jcard wrote:

#11 2009-08-13 00:53:58

Re: I have bricked my DNS-323... Please point me in a direction...

bootlog wrote:

#12 2009-08-20 07:38:55

Re: I have bricked my DNS-323... Please point me in a direction...

#13 2009-09-07 09:41:50

Re: I have bricked my DNS-323... Please point me in a direction...

#14 2009-09-08 03:58:53

Re: I have bricked my DNS-323... Please point me in a direction...

#15 2010-02-25 11:50:37

Re: I have bricked my DNS-323... Please point me in a direction...

#16 2010-02-26 12:01:59

Re: I have bricked my DNS-323... Please point me in a direction...

#17 2010-07-26 18:46:54

Re: I have bricked my DNS-323... Please point me in a direction...

Code:

#18 2010-07-26 22:41:56

Re: I have bricked my DNS-323... Please point me in a direction...

#19 2010-07-27 02:37:20

Re: I have bricked my DNS-323... Please point me in a direction...

RoganDawes wrote:

RoganDawes wrote:

RoganDawes wrote:

#20 2010-07-27 09:52:04

Re: I have bricked my DNS-323... Please point me in a direction...

clefranc wrote:

RoganDawes wrote:

http://dns323.kood.org/hardware:serial. wrote:

Code:

#21 2010-07-27 15:48:06

Re: I have bricked my DNS-323... Please point me in a direction...

RoganDawes wrote:

Code:

Code:

Code:

#22 2010-07-27 15:53:29

Re: I have bricked my DNS-323... Please point me in a direction...

clefranc wrote:

RoganDawes wrote:

Code:

Code:

Code: