DSM-G600, DNS-3xx and NSA-220 Hack Forum

Hi, all!
I've got such problem. If anyone could help me that will be great.


I've got DNS-323 HW rev C1 bricked down due to power issues (power problems in my house). It started blinking with power LED. I restored all data from hard drives and now it's time to recover the device.

I've already made the serial cable and see the u-boot output. By default it is next:

** LOADER **
** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Feb 26 2009 - 11:33:03) Marvell version: 1.7.3.003

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
Detect phy 1118
[0kB@ff800000] ## Unknown FLASH at ff800000: Size = 0x00000000 = 0 MB
Flash:  0 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment


Soc: MV88F5182 Rev 2
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


USB 0: host mode
USB 1: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot:  0
## Booting image at ff820000 ...
   Image Name:   Linux-2.6.12.6-arm1
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1490204 Bytes =  1.4 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... Bad Data CRC
Marvell>>

The main that I don't understand is:
[0kB@ff800000] ## Unknown FLASH at ff800000: Size = 0x00000000 = 0 MB


Going next I've read on this forum that one can upload kernel and Ramdisk in the RAM and execute it to start the device (for updating firmware by standard methods)

I've noticed that uploading kernel, that is extracted from firmware image finishes with next messages:

Marvell>> loadb k
## Ready for binary (kermit) download to 0x00100000 at 115200 bps...

(Back at pavel-virtual-machine)
----------------------------------------------------
(/home/pavel/) C-Kermit>send uKernel
(/home/pavel/) C-Kermit>c
Connecting to /dev/ttyUSB0, speed 115200
Escape character: Ctrl-\ (ASCII 28, FS): enabled
Type the escape character followed by C to get back,
or followed by ? to see other options.
----------------------------------------------------
## Total Size      = 0x0016bd5c = 1490268 Bytes
## Start Addr      = 0x00100000
Erase Kernel from 0xff820000 to 0xff99ffff Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Error: start and/or end address not on sector boundary
Kernel Size = 1490268
Marvell>>

But if just use loadb without any params and then try to boot it outputs the next:

Marvell>> loadb
## Ready for binary (kermit) download to 0x00100000 at 115200 bps...

(Back at pavel-virtual-machine)
----------------------------------------------------
(/home/pavel/) C-Kermit>send uKernel
(/home/pavel/) C-Kermit>c
Connecting to /dev/ttyUSB0, speed 115200
Escape character: Ctrl-\ (ASCII 28, FS): enabled
Type the escape character followed by C to get back,
or followed by ? to see other options.
----------------------------------------------------
## Total Size      = 0x0016bd5c = 1490268 Bytes
## Start Addr      = 0x00100000
Kernel Size = 0
Marvell>> boot
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.12.6-arm1
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1490204 Bytes =  1.4 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux................................................................................................... done, booting the kernel.
Linux version 2.6.12.6-arm1 (tim@SWTEST2) (gcc version 3.3.3) #47 Mon Nov 30 12:06:02 CST 2009
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 512 (order: 9, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB 0MB 0MB 0MB = 64MB total
Memory: 61696KB available (2599K code, 462K data, 112K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

  Marvell Development Board (LSP Version 1.7.6_NAS)-- RD-88F5182-NAS-2

Detected Tclk 166000000 and SysClk 166000000
Marvell USB EHCI Host controller #0: c03e5b00
Marvell USB EHCI Host controller #1: c03e5a40
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
cesadev_init(c0012468)
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
inotify device minor=63
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
Initializing Cryptographic API
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
io scheduler noop registered
io scheduler deadline registered
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface 'egiga0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
physmap flash device: 800000 at ff800000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
Using physmap partition definition
Creating 5 MTD partitions on "phys_mapped_flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"
ehci_platform ehci_platform.20865: EHCI Host Controller
ehci_platform ehci_platform.20865: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.20865: irq 17, io mem 0x00000000
ehci_platform ehci_platform.20865: park 0
ehci_platform ehci_platform.20865: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.86401: EHCI Host Controller
ehci_platform ehci_platform.86401: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.86401: irq 12, io mem 0x00000000
ehci_platform ehci_platform.86401: park 0
ehci_platform ehci_platform.86401: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
mice: PS/2 mouse device common for all mice
md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: md driver 0.90.1 MAX_MD_DEVS=256, MD_SB_DISKS=27
device-mapper: 4.4.0-ioctl (2005-01-12) initialised: dm-devel@redhat.com
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)

Has anyone any idea how to fix it?

P.S. Broken firmware is 1.09