u-boot image for DNS-327L

Karips s

unread,

Nov 2, 2020, 3:25:40 PM11/2/20

to Alt-F

Hi folks.

Seems my 327L get u-boot loader corrupted.

Is there any way to restore it?

Search gives me guides about u-boot.kwb for DNS-325.

Is it possible to find u-boot.kwb for DNS-327L?

João Cardoso

unread,

Nov 3, 2020, 1:13:51 PM11/3/20

to Alt-F

Searching for "u-boot.kwb armada", where armada is the SoC used on the dns-327l, takes me to https://github.com/ARM-software/u-boot/blob/master/tools/kwboot.c, whose comments says

* Boot a Marvell SoC, with Xmodem over UART0.
* supports Kirkwood, Dove, Armada 370, Armada XP

So it looks like Marvell keep the protocol active in the Armada SoC and you might have expectations to find (or build, which is complex but possible) a compatible .kwb.

I have followed Lentin's 320/325 pages when I bricked my DNS-320L, and it worked.

You might want to take a look at Necromant's pages on the DNS-327l: https://ncrmnt.org/2015/02/15/debian-dlink-dns-327l-the-guide/ https://ncrmnt.org/2014/10/28/dlink-dns-327l-how-you-should-not-make-a-nas/

PS: I don't know of a DNS-327L compatible kwboot (of which there are several versions), sorry

Message has been deleted

Karips s

unread,

Nov 3, 2020, 5:03:36 PM11/3/20

to Alt-F

I Had some proress:
1. Get another working DNS-327L unit.
2. Backup u-boot from it with command nanddump -f /tmp/mtd0-dump.bin /dev/mtd0
3. Prepared Ubuntu server virtual machine
4. get connected it to broken DNS-327L unit via USB-UART 3.3V PL2303 converter
5. Load broken DNS-327L with command kwboot -p -b mtd0-dump.bin -B115200 -t /dev/ttyUSB0
6. Default D-Link firmware successfuly started, web interface is accessible
7. Replaced default firmware with Alt-F hoping that u-boot will be rewrited (no luck)
8. Trying to rewrite it with command nandwrite -mp /dev/mtd0 /mnt/USB/mtd0-dump.bin
   getting this error:
           nandwrite: error!: /dev/mtd0
           error 13 (Permission denied)

any ideas, how to fix it?

вторник, 3 ноября 2020 г. в 21:13:51 UTC+3, João Cardoso:

Joao Cardoso

unread,

Nov 3, 2020, 6:01:46 PM11/3/20

to Alt-F

On Tuesday, November 3, 2020 at 10:03:36 PM UTC, Karips s wrote:

I Had some proress:
1. Get another working DNS-327L unit.
2. Backup u-boot from it with command nanddump -f /tmp/mtd0-dump.bin /dev/mtd0
3. Prepared Ubuntu server virtual machine
4. get connected it to broken DNS-327L unit via USB-UART 3.3V PL2303 converter
5. Load broken DNS-327L with command kwboot -p -b mtd0-dump.bin -B115200 -t /dev/ttyUSB0

I didn't knew (or remember) that kwboot accepted a standard nandump image. Good to know.

6. Default D-Link firmware successfuly started, web interface is accessible
7. Replaced default firmware with Alt-F hoping that u-boot will be rewrited (no luck)
8. Trying to rewrite it with command nandwrite -mp /dev/mtd0 /mnt/USB/mtd0-dump.bin
   getting this error:
           nandwrite: error!: /dev/mtd0
           error 13 (Permission denied)

I'm afraid that Alt-F marks mtd0 as read-only, try 'nandinfo /dev/mtd0'. Excessively cautious?

That is hardcoded on the kernel dts file, and I don't know if that can be circumvented, other then changing and recompiling the dts itself and rebooting

the kernel with it. See https://sourceforge.net/p/alt-f/code/HEAD/tree/tags/Release-1.0/toolchain/kernel-headers/linux-4.4.86-dns327l.patch

Follow that track.

Other hipotesis is to break into u-boot directly by breaking the u-boot booting (<SPACE>+1) and flash from within u-boot.

Yet another hipotesis is to flash the d-link stock firmware back and verify if there is some cmd line server such as telnets, or be able to break into the serial console, then use it to run nandwrite (hellas you will need several Alt-F shared libraries... or instead get a statically compiled nandwrite)

In the last case, with some time and effort I might be able to supply you with a non.read-only mtd0 kernel or dts.

Karips s

unread,

Nov 3, 2020, 6:18:57 PM11/3/20

to Alt-F

mtdinfo /dev/mtd0
Device is writable: false

So, not possible under Alt-F.

There is no nandwrite, nandtest in stock firmware. How can I copy it (with libraries) from Alt-F to stock?

среда, 4 ноября 2020 г. в 02:01:46 UTC+3, Joao Cardoso:

Joao Cardoso

unread,

Nov 3, 2020, 7:59:40 PM11/3/20

to Alt-F Group

tomorrow I will build and post a static build of nandwrite. You should be able to run it in stock fw. That's the easiest solution

--
You received this message because you are subscribed to the Google Groups "Alt-F" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/alt-f/a239e5cf-ef94-4850-8ed6-c5593beb464fn%40googlegroups.com.

Karips s

unread,

Nov 4, 2020, 9:09:59 AM11/4/20

to Alt-F

João, sorry my mistake. Stock firmware has nandwrite

but still no luck.

nandwrite -mp /dev/mtd0 mnt/USB/USB1_a1/mtd0-dump.bin
Writing data to block 0
Writing data to block 20000
Writing data to block 40000
Writing data to block 60000
Writing data to block 80000
Writing data to block a0000
Writing data to block c0000
Writing data to block e0000

.......

but after reboot I get:

BootROM 1.08
Booting from NAND flash
BootROM: Bad header at offset 00000000
BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000
BootROM: Bad header at offset 00030000
BootROM: Bad header at offset 00040000
BootROM: Bad header at offset 00050000
BootROM: Bad header at offset 00060000
BootROM: Bad header at offset 00070000

.....

Any thoughts on getting out of here?

среда, 4 ноября 2020 г. в 03:59:40 UTC+3, João Cardoso:

Joao Cardoso

unread,

Nov 4, 2020, 10:02:12 AM11/4/20

to Alt-F Group

A qua, 4/11/2020, 14:10, Karips s <kar...@gmail.com> escreveu:

João, sorry my mistake. Stock firmware has nandwrite

Of course. Otherwise it couldnt flash new firmware.

but still no luck.
nandwrite -mp /dev/mtd0 mnt/USB/USB1_a1/mtd0-dump.bin

Are you are erasing (flash_erase /dev/mtd0 0 0) before writing? You have to.

To view this discussion on the web visit https://groups.google.com/d/msgid/alt-f/afa55485-a633-42d8-a370-10bafd990e12n%40googlegroups.com.

Karips s

unread,

Nov 4, 2020, 10:11:55 AM11/4/20

to Alt-F

there is no flash_erase command in default fw, but flash_eraseall (looks like the same).

# flash_eraseall /dev/mtd0 0 0

Erasing 128 Kibyte @ 4e0000 -- 97 % complete.
#

than

#nandwrite -mp /dev/mtd0 mnt/USB/USB1_a1/mtd0-dump.bin

with same result:

Restarting system.
Reseting...

BootROM 1.08
Booting from NAND flash

BootROM: Invalid header checksum

BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000
BootROM: Bad header at offset 00030000
BootROM: Bad header at offset 00040000
BootROM: Bad header at offset 00050000
BootROM: Bad header at offset 00060000
BootROM: Bad header at offset 00070000

среда, 4 ноября 2020 г. в 18:02:12 UTC+3, João Cardoso:

João Cardoso

unread,

Nov 4, 2020, 1:25:37 PM11/4/20

to Alt-F

On Wednesday, 4 November 2020 15:11:55 UTC, Karips s wrote:

there is no flash_erase command in default fw, but flash_eraseall (looks like the same).

# flash_eraseall /dev/mtd0 0 0
Erasing 128 Kibyte @ 4e0000 -- 97 % complete.
#
than
#nandwrite -mp /dev/mtd0 mnt/USB/USB1_a1/mtd0-dump.bin

with same result:

Not exactly, in the previous attempt

Booting from NAND flash

BootROM: Bad header at offset 00000000

BootROM: Bad header at offset 00010000

while now

Booting from NAND flash
BootROM: Invalid header checksum
BootROM: Bad header at offset 00010000

The flash_eraseall output looks suspicious...

Erasing 128 Kibyte @ 4e0000 -

@ 4e0000? It should be @ 00000 (guessing) or are the numbers rapidly changing from 0 to 4e0000 (5MiB, the mtd0 size minus 128KiB the last erase block size). hmmm, yes, that must be it.

The erasing must be failing, or something else is missing. After a successful flash_erase and nandwrite, a nandump to a file should produce a file with the same contents as the file that you are writing, 'cmp initial_file nandump_file_after_erase_and_nanwrite' should output nothing, meaning that both files are equal.

Do the box has mtdinfo? What is the output of 'mtdinfo -a'?

What's the output of 'cat /proc/mtd'?

Please post the full log from device power up (including any u-boot messages)

I have no clues other than flash_erase not working properly or the nand being bad.

How did the initial mtd0 corruption occurred? Are both DNS-327L of the same hardware version (look at the box bottom label, H/W... )

João Cardoso

unread,

Nov 4, 2020, 1:32:23 PM11/4/20

to Alt-F

For completeness I attach my DNS-327L mtd0 dump:

/ # cat /tmp/board
DNS-327L-Ax

/ # nanddump -f dns-327L-mtd0.bin /dev/mtd0
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00500000...

dns-327L-mtd0.bin

Karips s

unread,

Nov 5, 2020, 2:04:30 AM11/5/20

to Alt-F

I think NAND must be reformated with bad blocks recover/remap

Both units have labels H/W Ver.:A1 F/W Ver.:1.00
Broken unit didn't boot after power outage.

NAND dump from broken unit (after nand erase, write):
nanddump -f mtd0-dump-broken.bin /dev/mtd0

ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00500000...

Comparing show problems
# cmp mtd0-dump.bin mtd0-dump-broken.bin
mtd0-dump.bin mtd0-dump-broken.bin differ: char 1048577, line 7876

# cat /proc/mtd
dev:    size   erasesize name
mtd0: 00500000 00020000 "u-Boot"
mtd1: 00500000 00020000 "uImage"
mtd2: 00500000 00020000 "ramdisk"
mtd3: 04e00000 00020000 "image.cfs"
mtd4: 00f00000 00020000 "rescue firmware"
mtd5: 00a00000 00020000 "config"
mtd6: 00a00000 00020000 "mydlink"

# mtdinfo -a
Count of MTD devices:           7
Present MTD devices:            mtd0, mtd1, mtd2, mtd3, mtd4, mtd5, mtd6
Sysfs interface supported:      yes

mtd0
Name:                           u-Boot
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:0
Bad blocks are allowed:         true
Device is writable:             false

mtd1
Name:                           uImage
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:2
Bad blocks are allowed:         true
Device is writable:             true

mtd2
Name:                           ramdisk
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:4
Bad blocks are allowed:         true
Device is writable:             true

mtd3
Name:                           image.cfs
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          624 (81788928 bytes, 78.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:6
Bad blocks are allowed:         true
Device is writable:             true

mtd4
Name:                           rescue firmware
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          120 (15728640 bytes, 15.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:8
Bad blocks are allowed:         true
Device is writable:             true

mtd5
Name:                           config
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          80 (10485760 bytes, 10.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:10
Bad blocks are allowed:         true
Device is writable:             true

mtd6
Name:                           mydlink
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          80 (10485760 bytes, 10.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:12
Bad blocks are allowed:         true
Device is writable:             true

# mtdinfo /dev/mtd0 -M
mtd0
Name:                           u-Boot
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:0
Bad blocks are allowed:         true
Device is writable:             false
Eraseblock map:
0: 00000000          1: 00020000          2: 00040000          3: 00060000
4: 00080000          5: 000a0000          6: 000c0000          7: 000e0000
8: 00100000          9: 00120000         10: 00140000         11: 00160000
12: 00180000         13: 001a0000         14: 001c0000         15: 001e0000
16: 00200000         17: 00220000         18: 00240000         19: 00260000
20: 00280000         21: 002a0000         22: 002c0000         23: 002e0000
24: 00300000         25: 00320000         26: 00340000         27: 00360000
28: 00380000         29: 003a0000         30: 003c0000         31: 003e0000
32: 00400000         33: 00420000         34: 00440000         35: 00460000
36: 00480000         37: 004a0000         38: 004c0000         39: 004e0000

boot log including u-boot is in attach

среда, 4 ноября 2020 г. в 21:32:23 UTC+3, João Cardoso:

boot.log

João Cardoso

unread,

Nov 5, 2020, 1:48:43 PM11/5/20

to al...@googlegroups.com

On Thursday, 5 November 2020 07:04:30 UTC, Karips s wrote:

I think NAND must be reformated with bad blocks recover/remap

That is best done in u-boot.

After kwboot loads the u-boot image and starts running it, a u-boot shortly displayed message says "Hit any key to stop autoboot:", and you have to press the space key followed by the '1' key (before the message is displayed, I start typing when I see the NAND message :). If you are fast enough you will be presented with marvell's u-boot prompt. My full system boot (not from kwboot):

BootROM 1.08
Booting from NAND flash

BootROM: Image checksum verification PASSED
** LOADER **

U-Boot 2009.08-00043-gcfe3b76-dirty (Dec 03 2012 - 15:27:58)Marvell version: 1.1.2 NQ.DNS-327.01
U-Boot Addressing:
      Code:            00600000:006AFFF0
      BSS:             006F8E40
      Stack:           0x5fff70
      PageTable:       0x8e0000
      Heap address:    0x900000:0xe00000
Board: RD6710_Alpha
SoC:   MV6710 A1
CPU:   Marvell PJ4B v7 UP (Rev 1) LE
      CPU @ 1200Mhz, L2 @ 600Mhz
      DDR @ 600Mhz, TClock @ 200Mhz
      DDR 16Bit Width, FastPath Memory Access
PEX 0: Root Complex Interface, Detected Link X1
PEX 1: Detected No Link.
DRAM: 512 MB
      CS 0: base 0x00000000 size 512 MB
      Addresses 14M - 0M are saved for the U-Boot usage.
Failed to initialize SPI flash at 0:0
NAND: NAND_dev_ID=0xf1ad Start typing <space>+1
find device ID, index=0
128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x000003b20000
FPU not initialized
USB 0: Host Mode
USB 1: Host Mode
Shutting down unused interfaces:
      SDIO
      AUDIO
      TDM
Modules/Interfaces Detected:
      RGMII1 Phy
      PEX0 (Lane 0)
      PEX1 (Lane 1)
      SATA0 (Lane 2)
      SATA1 (Lane 3)
MMC:   MRVL_MMC: 0
Net:   egiga1 [PRIME]
Hit any key to stop autoboot: 0
Marvell>>

You can now type '?' to view the u-boot available commands. I'm not an expert in u-boot, better ask for further help at https://forum.doozan.com or similar.

Notice that 'scrub'ing NAND erases factory marked bad blocks, and all NANDs have a couple of them. u-boot does not have the mtd0/1/2... concept, so offsets and lengths in the device should be given. 'mtdparts' does not have the same "partition" layout as the linux mtd device, etc, etc. E.g:

Marvell>> nand
nand - NAND sub-system

Usage:
nand info - show available NAND devices
nand device [dev] - show or set current device
nand read - addr off|partition size
nand write - addr off|partition size
   read/write 'size' bytes starting at offset 'off'
   to/from memory address 'addr', skipping bad blocks.
nand erase [clean] [off size] - erase 'size' bytes from
   offset 'off' (entire device if not specified)
nand bad - show bad blocks
nand dump[.oob] off - dump page
nand scrub - really clean NAND erasing bad blocks (UNSAFE)
nand markbad off [...] - mark bad block(s) at offset (UNSAFE)
nand biterr off - make a bit error at offset (UNSAFE)
nand pattern addr comp_addr chunk_size
   will write chunk_size from addr all over the nand and
   compare the write to the read using the comp_addr as a helper memory for cmp

You can use USB fat or ext2 filesystems to write files to the NAND (after erasing it at the correct offset and length in hexadecimal, eg, mtd0 has offset 0 and lenght 5MiB, which is 0x0500000)

I would kwboot the stock firmware, which hasn't mtd0 read-only, and use the attached statically linked subset of mtdutils to mildly test-torture mtd0 using 'nandtest' (NANDs have a limited number of write cycles, so be carefull). Remember to specify the full path for the attached mtd-utils after extracting them, otherwise you will be using the system older ones, e.g. use './nandtest' or './flash_erase' instead of 'nandtest' or 'flash_erase'.

Usually no bad blocks are allowed in the boot loader, so mtd0 should be bad blocks free; however, the SoC BootROM specs says that bad blocks are taken into account except for the 1st block, which should be good. Not sure if the spec is followed by the manufacturer. Modern hardware is really too complex.

More comments bellow

Both units have labels H/W Ver.:A1 F/W Ver.:1.00
Broken unit didn't boot after power outage.

NAND dump from broken unit (after nand erase, write):
nanddump -f mtd0-dump-broken.bin /dev/mtd0
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00500000...

Looks go, no error correcting errors (ECC) nor bad blocks in mtd0. And you now have the offset and length of mtd0 to use in u-boot.

Comparing show problems
# cmp mtd0-dump.bin mtd0-dump-broken.bin
mtd0-dump.bin mtd0-dump-broken.bin differ: char 1048577, line 7876

Interesting enough 1048577 is 1MiB, which are 8 erase blocks. The erase/write had sucess in the first 8 erase blocks and failed at block 9. Perhaps block 9 should be marked bad.

Using the option

-m, --markbad Mark blocks bad if write fails

to nandwrite or nandtest might do it

.

# cat /proc/mtd
dev: size erasesize name
mtd0: 00500000 00020000 "u-Boot"
mtd1: 00500000 00020000 "uImage"
mtd2: 00500000 00020000 "ramdisk"
mtd3: 04e00000 00020000 "image.cfs"
mtd4: 00f00000 00020000 "rescue firmware"
mtd5: 00a00000 00020000 "config"
mtd6: 00a00000 00020000 "mydlink"

...

# mtdinfo /dev/mtd0 -M
mtd0
Name:                           u-Boot
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:0
Bad blocks are allowed:         true
Device is writable:             false
Eraseblock map:
0: 00000000          1: 00020000          2: 00040000          3: 00060000
4: 00080000          5: 000a0000          6: 000c0000          7: 000e0000
8: 00100000          9: 00120000         10: 00140000         11: 00160000
12: 00180000         13: 001a0000         14: 001c0000         15: 001e0000
16: 00200000         17: 00220000         18: 00240000         19: 00260000
20: 00280000         21: 002a0000         22: 002c0000         23: 002e0000
24: 00300000         25: 00320000         26: 00340000         27: 00360000
28: 00380000         29: 003a0000         30: 003c0000         31: 003e0000
32: 00400000         33: 00420000         34: 00440000         35: 00460000
36: 00480000         37: 004a0000         38: 004c0000         39: 004e0000

Perhaps block 8 should be marked BAD, as in

[root@DNS-325]# mtdinfo -M /dev/mtd1

mtd1
Name:                           uImage
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          40 (5242880 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes

Sub-page size: 512 bytes

OOB size:                       64 bytes
Character device major/minor:   90:2
Bad blocks are allowed:         true
Device is writable:             true

Eraseblock map:
0: 00000000 1: 00020000 2: 00040000 3: 00060000

4: 00080000 5: 000a0000 6: 000c0000 7: 000e0000 BAD

8: 00100000 9: 00120000 10: 00140000 11: 00160000
12: 00180000 13: 001a0000 14: 001c0000 15: 001e0000

boot log including u-boot is in attach

Everything looks OK there. But notice u-boot

NAND: NAND_dev_ID=0xf1ad
find device ID, index=0
128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x0000074a0000

...

and the kernel bad bloks:

...

nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64

pxa3xx-nand d00d0000.nand: ECC strength 16, ECC step size 2048

Bad block table found at page 65472, version 0x01

Bad block table found at page 65408, version 0x01

nand_read_bbt: bad block at 0x0000074a0000

...

Creating 7 MTD partitions on "pxa3xx_nand-0":
0x000000000000-0x000000500000 : "u-Boot"
0x000000500000-0x000000a00000 : "uImage"
0x000000a00000-0x000000f00000 : "ramdisk"
0x000000f00000-0x000005d00000 : "image.cfs"
0x000005d00000-0x000006c00000 : "rescue firmware"
0x000006c00000-0x000007600000 : "config"
0x000007600000-0x000008000000 : "mydlink"

The first two are factory marked badblocks, the last one is in mtd5. Perhaps 'nandtest' will reveal some more ('nandtest -h')

luck and keep us informed

PS-A full boot log *without* kwboot can give insights where the error is in the boot process.

mtd-utils-static.tgz

Karips s

unread,

Nov 5, 2020, 2:55:33 PM11/5/20

to Alt-F

João thank you for mtd-utils.

Today I was trying to copy mtd0-dump to NAND via TFTD in u-boot:

tftpd 0xa00000 mtd0-dump.bin

nand write 0xa00000 0x000000 0x0100000

with no luck (I think I forget nand erase before nand write or missed some with addressing).

Also I tried u-boot command bubt (- bubt - Burn an image on the Boot Nand Flash.)

Marvell>> bubt
Using default filename "u-boot.bin"
Using egiga1 device
TFTP from server 10.1.1.11; our IP address is 10.1.1.22
Filename 'mtd0-dump.bin'.
Load address: 0x2000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################
done
Bytes transferred = 5242880 (500000 hex)
Checking file size:     [Done]
Override Env parameters to default? [y/N] y
Erasing 0x100000 - 0x400000:    [Done]
Erasing 0x0 - 0x100000:         [Done]
Writing image to NAND: [Done]

also with no luck

than I tried

dd if=mtd0-dump.bin of=/dev/mtd0

under default fw, with no luck.

Now I`m in u-boot shell, info about bad blocks:

Marvell>> nand bad
Device 0 bad blocks:
       74a0000
       7f00000
       7f20000
       7f40000
       7f60000
       7f80000
       7fa0000
       7fc0000
       7fe0000

Later will check NAND with nandtest under default fw, and repeat some attempts.

четверг, 5 ноября 2020 г. в 21:48:43 UTC+3, João Cardoso:

Karips s

unread,

Nov 6, 2020, 4:50:57 AM11/6/20

to Alt-F

did some testing and writing to NAND

nandtest from your build
# ./nandtest -m -p1 /dev/mtd0
ECC corrections: 0
ECC failures   : 0
Bad blocks     : 0
BBT blocks     : 0
004e0000: checking...of 4)...
Finished pass 1 successfully
(I repeated test 3 times with same results)

run flush_erase from your build
# ./flash_erase /dev/mtd0 0 0
libmtd: error!: ECCGETLAYOUT ioctl request failed
        error 25 (Inappropriate ioctl for device)
Erasing 128 Kibyte @ 4e0000 -- 100 % complete

run flush_eraseall included in d-link fw

# flash_eraseall /dev/mtd0 0 0
Erasing 128 Kibyte @ 4e0000 -- 97 % complete.

run nandwrite from your build with my mtd0-dump
# ./nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/mtd0-dump.bin
libmtd: error!: ECCGETLAYOUT ioctl request failed
error 25 (Inappropriate ioctl for device)
no luck

run nandwrite from d-link fw with my mtd0-dump
# nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/mtd0-dump.bin
no luck

run your nandwrite with your dump
# ./nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/dns-327L-mtd0.bin
libmtd: error!: ECCGETLAYOUT ioctl request failed
error 25 (Inappropriate ioctl for device)

no luck

I think its time to give up or at least change approach (change/resolder NAND chip?)

четверг, 5 ноября 2020 г. в 22:55:33 UTC+3, Karips s:

João Cardoso

unread,

Nov 6, 2020, 1:02:33 PM11/6/20

to Alt-F

On Friday, 6 November 2020 09:50:57 UTC, Karips s wrote:

did some testing and writing to NAND

nandtest from your build
# ./nandtest -m -p1 /dev/mtd0
ECC corrections: 0
ECC failures   : 0
Bad blocks     : 0
BBT blocks     : 0
004e0000: checking...of 4)...
Finished pass 1 successfully
(I repeated test 3 times with same results)

I would use several reads per cycle ( -r <n>, --reads=<n> Read & check <n> times per pass) and several tens of passes. The number of erase cycles is at minimum 10000, most likely 100000 at the NAND is an older one SLC

run flush_erase from your build
# ./flash_erase /dev/mtd0 0 0
libmtd: error!: ECCGETLAYOUT ioctl request failed
error 25 (Inappropriate ioctl for device)
Erasing 128 Kibyte @ 4e0000 -- 100 % complete

Not sure about the error. You can verify if it's performing well by doing a nandump after the erase; the produced file should have only 0xFF. You can use 'od -x <file>' for that, the output should be similar to

[root@DNS-320L]# od -x dns-320l-mtd6-erased.bin
0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
10000000

Where the '*' means several identical lines were found and omitted

run flush_eraseall included in d-link fw
# flash_eraseall /dev/mtd0 0 0
Erasing 128 Kibyte @ 4e0000 -- 97 % complete.

run nandwrite from your build with my mtd0-dump
# ./nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/mtd0-dump.bin
libmtd: error!: ECCGETLAYOUT ioctl request failed
error 25 (Inappropriate ioctl for device)
no luck

run nandwrite from d-link fw with my mtd0-dump
# nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/mtd0-dump.bin
no luck

run your nandwrite with your dump
# ./nandwrite -mp /dev/mtd0 /mnt/USB/USB1_a1/dns-327L-mtd0.bin
libmtd: error!: ECCGETLAYOUT ioctl request failed
error 25 (Inappropriate ioctl for device)

no luck

With whatever nandwrite you use, you could do a nandump afterwards and a 'cmp -l ' to show in decimal the address and contents of different bytes.

You can then convert to hexadecimal 'cmp -l file1 file2 | awk '{printf "0x%x\n", $1}' and then in u-boot mark that block address as bad.

You might need u-boot 'nand erase off size' before 'nand markbad'. 'nand bad' should display then, but there are reports that they disappear after a reboot... some say that the whole NAND should be erased before using markbad...

I'm not sure if the offset argument to 'nand markbad' in in u-boot is expressed in erase block numbers or in device addresses...

If in block number, divide the first column by the erase block size and to identify the faulty erase block.

'nand bad' should display the new entered blocks, and after a reboot and kwboot linux boot, 'mtdinfo -M /dev/mtd0' should display also the bad blocks. You can then try erase/write/dump/cmp again :-|

I think its time to give up or at least change approach (change/resolder NAND chip?)

To resolder you will need very special tools and ability. It's really difficult as you can easily damage the circuit board. There are several youtube videos about that and someone at has described how it changed the RAM chips http://dns323.kood.org/forum/viewtopic.php?id=2388

You still have the u-boot 'scrub' command, you have nothing to loose... some say that in the absence of a bad block table (BBT) some u-boot implementations will rescan all chip blocks to reconstruct the BBT.

Luck and perseverance, if you have the time and inclination!

Karips s

unread,

Nov 8, 2020, 9:38:50 AM11/8/20

to Alt-F

Hi, get few attempts

I would use several reads per cycle ( -r <n>, --reads=<n> Read & check <n> times per pass) and several tens of passes. The number of erase cycles is at minimum 10000, most likely 100000 at the NAND is an older one SLC

Done:
/mnt/USB/USB1_a1/nandutils # ./nandtest -p 30 -r 10 /dev/mtd0

ECC corrections: 0
ECC failures   : 0
Bad blocks     : 0
BBT blocks     : 0

004e0000: checking... of 10)...
Finished pass 1 successfully
004e0000: checking... of 10)...
Finished pass 2 successfully
....
004e0000: checking... of 10)...
Finished pass 29 successfully
004e0000: checking... of 10)...
Finished pass 30 successfully

Not sure about the error. You can verify if it's performing well by doing a nandump after the erase; the produced file should have only 0xFF. You can use 'od -x <file>' for that, the output should be similar to

    [root@DNS-320L]# od -x dns-320l-mtd6-erased.bin
    0000000 ffff ffff ffff ffff ffff ffff ffff ffff
    *
    10000000

Where the '*' means several identical lines were found and omitted

Done:
did flash_eraseall and nanddump broken.dump

#od -x broken.dump

0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*

24000000

seems ok,

than nandwrite dns-327L-mtd0.bin (from you)
than nanddump broken2.dump

seems strange, all files are different:
-rwxrwxrwx    1 root     root       5242880 Nov 8 12:54 broken.dump (dump right after erase)
-rwxrwxrwx    1 root     root       5406720 Nov 8 13:07 broken2.dump (dump after nandwrite dns-327L-mtd0.bin)
-rwxrwxrwx    1 root     root       5242880 Nov 6 11:27 dns-327L-mtd0.bin (dns-327L-mtd0.bin itself)

You can then convert to hexadecimal 'cmp -l file1 file2 | awk '{printf "0x%x\n", $1}' and then in u-boot mark that block address as bad.

# cmp -l broken2.dump dns-327L-mtd0.bin | awk '{printf "0x%x\n", $1
}'
gives me huge ammount of records
0x801
0x802
0x804
0x805
0x807
0x808
.....
0x18bfba
0x18bfbb
0x18bfbc
0x18bfbd
0x18bfbe
0x18bfbf
0x18bfc0

пятница, 6 ноября 2020 г. в 21:02:33 UTC+3, João Cardoso:

Karips s

unread,

Nov 8, 2020, 10:06:49 AM11/8/20

to Alt-F

Some black magic happen with equipment today

My second DNS-327L stop working after reboot (after I changed hdd).

Nothing help to make it alive, I was forced to use UART.

Same error, as on the first DNS-327L ((((:

BootROM 1.08
Booting from NAND flash

BootROM: Invalid header checksum
BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000

After booting via kwboot it stuck on this:

i2c /dev entries driver
orion_wdt: Initial timeout 229 sec
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
NET: Registered protocol family 17
ata1: SATA link down (SStatus 0 SControl F300)
ata2: SATA link down (SStatus 0 SControl F300)
input: gpio-keys as /devices/platform/gpio-keys/input/input0
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 2997KiB [1 disk] into ram disk... done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing unused kernel memory: 204K
pre-init started, pid=1
pre-init: squash-rd
init started: BusyBox v1.20.2 (2017-09-22 20:15:53 WEST)
/etc/init.d/rcS: eval: line 1: syntax error: unexpected "&"
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory

Alt-F doesnt boot ((

воскресенье, 8 ноября 2020 г. в 17:38:50 UTC+3, Karips s:

João Cardoso

unread,

Nov 9, 2020, 3:18:11 PM11/9/20

to Alt-F

On Sunday, 8 November 2020 15:06:49 UTC, Karips s wrote:

Some black magic happen with equipment today
My second DNS-327L stop working after reboot (after I changed hdd).
Nothing help to make it alive, I was forced to use UART.
Same error, as on the first DNS-327L ((((:

Hell!

Or have you mixed the two boxes and flashed the wrong one?

Now you have to use u-boot to flash, which isn't necessary bad, by the contrary (the ECC code used by u-boot BootROM might be different than the one use by linux)

-kwboot my dns-327L-mtd0.bin file and break into uboot.

-As you have a tftp server, use it to load the dns-327L-mtd0.bin into memory at 0xa00000

as you are using my u-boot dump, it has defined a environment variable named 'af' that I use for development using tftp to load and run images. study it using 'printenv af'

setup the box ip address and server ip address (your will be different)

-setenv ipaddr 192.168.1.100

-setenv serverip 192.168.1.1

-tftp 0xa00000 dns-327L-mtd0.bin

-nand erase 0x000000 0x0500000

-nand write 0xa00000 0x000000 0x0500000

-reset

At the next boot the BootROM: Invalid header checksum and BootROM: Bad header at offset 00010000 should have disappeared if flashing went OK and I didn't get anything wrong (I haven't actually tried that myself). But you still have to break info uboot, as the other nand areas are damaged and linux booting will fail)

Please post the full logs of the above commands (copy/paste everything) and the boot log.

If all this performs OK we will proceed on how to flash a kernel and root fs.

BootROM 1.08
Booting from NAND flash
BootROM: Invalid header checksum
BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000

After booting via kwboot it stuck on this:

...

Karips s

unread,

Nov 12, 2020, 7:14:04 AM11/12/20

to Alt-F

Hi!

Tried few attempts (with my and you mtd0-dump).

Always same result:

Marvell>> printenv af
af=setenv bootargs console=ttyS0,115200 root=/dev/ram0 init=/init tftpargs=192.168.1.100:192.168.1.1;setenv ipaddr 192.168.1.100;setenv serverip 192.168.1.1;tftp 0xa00000 uImage-DNS-327L-rev-Ax;tftp 0xf00000 urootfs-dns327;bootm 0xa00000 0xf00000

Marvell>> setenv ipaddr 172.16.0.2
Marvell>> setenv serverip 172.16.0.1
Marvell>> tftp 0xa00000 dns-327L-mtd0.bin
Using egiga1 device
TFTP from server 172.16.0.1; our IP address is 172.16.0.2
Filename 'dns-327L-mtd0.bin'.
Load address: 0xa00000

Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################
done
Bytes transferred = 5242880 (500000 hex)

Marvell>> nand erase 0x000000 0x0500000

NAND erase: device 0 offset 0x0, size 0x500000
Erasing at 0x4e0000 -- 100% complete.
OK
Marvell>> nand write 0xa00000 0x000000 0x0500000

NAND write: device 0 offset 0x0, size 0x500000
5242880 bytes written: OK
Marvell>>

NAND write: device 0 offset 0x0, size 0x500000
5242880 bytes written: OK
Marvell>> reset▒

BootROM 1.08
Booting from NAND flash
BootROM: Invalid header checksum
BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000

BootROM: Bad header at offset 00030000
BootROM: Bad header at offset 00040000
BootROM: Bad header at offset 00050000
BootROM: Bad header at offset 00060000

понедельник, 9 ноября 2020 г. в 23:18:11 UTC+3, João Cardoso:

João Cardoso

unread,

Nov 12, 2020, 1:43:00 PM11/12/20

to Alt-F

I don't have any other clues for you, sorry.

The first message, "BootROM: Invalid header checksum" means that the first 32 bytes from the NAND (the first BootRom header) does not has a correct checksum.

My box displays at that stage "BootROM: Image checksum verification PASSED".

So probably your's two box NANDs becomes defective at its very start.

Just academic, but you can compare the first 32 bytes of the NAND right after a "nand erase" -- you should get 'ff' everywhere, and after the 'nand write' you should have the same values as a 'hexdump -C dns-327L-mtd0.bin' on your host linux VM.

If you want to always boot using kwboot and then from NAND, and keep the box always on, I have a solution for you.

Compile on your linux VM the dns323-fw.c program, which is part of Alt-F:

wget -O dns323-fw.c https://sourceforge.net/p/alt-f/code/HEAD/tree/trunk/alt-f/package/alt-f-utils/alt-f-utils-0.1.11/dns323-fw.c?format=raw
cc dns323-fw.c -o dns323-fw # you might have to install the gcc package

This will generate dns323-fw, a program that can split a D-Link fw file into its components. Do

wget https://sourceforge.net/projects/alt-f/files/Releases/1.0/Alt-F-1.0-DNS-327L-rev-Ax.bin
./dns323-fw -s Alt-F-1.0-DNS-327L-rev-Ax.bin

This will generate four files: kernel, initramfs, sqimage, defaults

Put the kernel and initramfs ones in the your tftp server, then use kwboot to boot into u-boot and

setenv ipaddr desired-box-ip
setenv serverip tftp-server-ip
setenv bootargs console=ttyS0,115200 root=/dev/ram0 init=/init

tftp 0xa00000 kernel
tftp 0xf00000 initramfs
bootm 0xa00000 0xf00000

This will boot from memory a minimum Alt-F from memory, and it should be enough to flash Alt-F of the stock fw to the box using the webUI (if the NAND other areas are fine).

After flashing and rebooting you only need to kwboot into u-boot and boot from nand using the 'run bootcmd' command, without the need to setenv, tftf, etc

Better then nothing, I guess.

Karips s

unread,

Nov 14, 2020, 6:18:46 PM11/14/20

to Alt-F

Hi
Comparing dump and NAND gives me the same results (at least in first 32 bytes)

I have no explanation...

Have a look:

Marvell>> nand erase 0x000000 0x0500000

NAND erase: device 0 offset 0x0, size 0x500000
Erasing at 0x4e0000 -- 100% complete.
OK

Marvell>> nand dump 0
Page 00000000 dump:
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB:
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff

Marvell>> tftp 0xa00000 dns-327L-mtd0.bin
Using egiga1 device
TFTP from server 172.16.0.1; our IP address is 172.16.0.2
Filename 'dns-327L-mtd0.bin'.
Load address: 0xa00000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################
done

Bytes transferred = 5242880 (500000 hex)

Marvell>> nand write 0xa00000 0x000000 0x0500000
NAND write: device 0 offset 0x0, size 0x500000
5242880 bytes written: OK

Marvell>> nand dump 0
Page 00000000 dump:
        8b 00 00 00 d0 4f 0a 00 01 00 00 c0 00 c0 00 00
        00 00 60 00 00 00 6a 00 00 02 01 00 00 00 01 f1
        02 00 30 b9 02 00 00 00 5b 00 00 00 00 00 00 00
        ff 5f 2d e9 22 00 00 fa 00 00 a0 e3 ff 9f bd e8
        fe 1f 2d e9 36 0f 07 ee fe 1f bd e8 1e ff 2f e1
        fe 1f 2d e9 ba 0f 07 ee 3e 0f 07 ee 9a 0f 07 ee
        fe 1f bd e8 1e ff 2f e1 fe 1f 2d e9 5f f0 7f f5
        3e 0f 07 ee 4f f0 7f f5 fe 1f bd e8 1e ff 2f e1
        10 1f 11 ee 02 1a c1 e3 00 10 81 e1 10 1f 01 ee
        4f f0 7f f5 1e ff 2f e1 00 10 0f e1 01 1c c1 e3
        00 10 81 e1 01 f0 22 e1 1e ff 2f e1 80 b5 84 b0
        00 af 78 60 7b 68 1b 68 fb 60 fb 68 18 1c bd 46
        04 b0 80 bd b0 b5 d8 4c a5 44 0a af d7 4c 7c 44
        00 23 9c 20 80 00 c0 19 03 60 00 23 a6 21 89 00
        c9 19 0b 60 01 23 a7 22 92 00 d2 19 13 60 00 23
        a8 20 80 00 c0 19 03 60 00 23 a9 21 89 00 c9 19
        0b 60 00 23 aa 22 92 00 d2 19 13 60 00 23 ab 20
        80 00 c0 19 03 60 00 23 ad 21 89 00 c9 19 0b 60
        00 f0 56 fb 03 1c 9e 22 92 00 d2 19 13 60 02 f0
        df fc 01 f0 3d fc be 4b 18 1c ff f7 b7 ff 02 1c
        18 23 13 40 db 08 a0 20 80 00 c0 19 03 60 a0 21
        89 00 c9 19 0b 68 01 2b 0f d0 01 2b 13 d3 03 2b
        17 d1 b4 4b b3 4a 11 68 10 22 0a 43 1a 60 b2 4b
        b1 4a 11 68 10 22 0a 43 1a 60 b0 4b af 4a 11 68
        10 22 0a 43 1a 60 ae 4b ad 4a 11 68 10 22 0a 43
        1a 60 00 23 9b 22 92 00 d2 19 13 60 1e e0 9b 23
        9b 00 db 19 1d 68 9b 20 80 00 c0 19 03 68 a5 49
        5b 18 9a 00 a4 4b 13 43 18 1c ff f7 77 ff 01 1c
        8a 22 92 00 bb 18 aa 00 d1 50 9b 20 80 00 c0 19
        03 68 01 33 9b 21 89 00 c9 19 0b 60 9b 22 92 00
        d2 19 13 68 0b 2b da d9 98 4b 18 1c ff f7 5e ff
        02 1c 97 4b 13 40 9c 20 80 00 c0 19 03 60 93 4b
        9c 21 89 00 c9 19 0a 68 1a 60 00 f0 cb fa 03 1c
        9d 22 92 00 d2 19 13 60 00 f0 da fa 03 1c 9e 20
        80 00 c0 19 03 60 9e 21 89 00 c9 19 0b 68 15 2b
        04 d9 14 23 9e 22 92 00 d2 19 13 60 9e 23 9b 00
        db 19 19 68 9d 20 80 00 c0 19 02 68 81 4b e3 18
        c9 00 8a 18 92 00 d3 58 96 21 89 00 c9 19 0b 60
        9e 22 92 00 d2 19 11 68 9d 23 9b 00 db 19 1a 68
        79 4b e3 18 c9 00 8a 18 92 00 d3 58 9f 24 a4 00
        e4 19 23 60 96 20 80 00 c0 19 03 68 00 2b 05 d0
        9f 21 89 00 c9 19 0b 68 00 2b 01 d1 01 23 61 e2
        00 23 a3 22 92 00 d2 19 13 60 80 23 5b 04 a4 24
        a4 00 e4 19 23 60 96 20 80 00 c0 19 03 68 09 2b
        05 d0 96 21 89 00 c9 19 0b 68 0a 2b 04 d1 01 23
        a8 22 92 00 d2 19 13 60 10 23 99 24 a4 00 e4 19
        23 60 00 23 9a 20 80 00 c0 19 03 60 5b 4b 18 1c
        ff f7 dc fe 02 1c 80 23 5b 01 13 40 00 2b 01 d0
        00 23 2f e2 56 4b 18 1c ff f7 d0 fe 03 1c 00 2b
        01 d0 01 23 00 e0 00 23 9c 21 89 00 c9 19 0b 60
        a7 22 92 00 d2 19 13 68 00 2b 16 d0 00 f0 e0 fb
        08 23 a1 24 a4 00 e4 19 23 60 07 23 a2 20 80 00
        c0 19 03 60 01 23 97 21 89 00 c9 19 0b 60 01 23
        98 22 92 00 d2 19 13 60 dc e0 88 24 a4 00 3b 19
        00 22 1a 60 88 20 80 00 3b 18 00 22 5a 60 88 21
        89 00 7b 18 18 1c 00 f0 51 fc 03 1c a5 22 92 00
        d2 19 13 60 a5 24 a4 00 e4 19 23 68 00 2b 01 d1
        01 23 e7 e1 3b 1c 18 1c 00 21 00 f0 49 fc 21 20
        01 21 00 f0 31 fc 03 1c 00 2b 07 d1 2d 4b ae 20
        80 00 c0 19 c2 18 84 23 01 21 d1 50 29 4b ae 21
        89 00 c9 19 ca 18 84 23 d2 58 01 23 13 43 97 22
        92 00 d2 19 13 60 23 4b ae 24 a4 00 e4 19 e2 18
        84 23 d2 58 01 23 13 43 98 20 80 00 c0 19 03 60
        a5 21 89 00 c9 19 0b 68 01 2b 3f d9 19 4b ae 24
        a4 00 e4 19 e2 18 ca 23 5b 00 d3 58 01 2b 2b d9
        98 20 80 00 c0 19 02 68 0c 23 13 43 98 21 89 00
        c9 19 0b 60 2a e0 c0 46 20 fd ff ff 42 b8 00 00
        34 82 01 d0 00 1b 02 d0 00 1a 02 d0 00 19 02 d0
        00 18 02 d0 14 80 00 00 00 00 00 d0 80 87 01 d0
        ff ff ff fd 0c d5 ff ff 6c d2 ff ff d0 82 01 d0
        8c 01 02 d0 48 fd ff ff 98 23 9b 00 db 19 1a 68
        04 23 13 43 98 24 a4 00 e4 19 23 60 bc 4b ae 20
        80 00 c0 19 c2 18 84 23 d2 58 a5 23 9b 00 db 19
        19 68 0b 1c 53 43 97 24 a4 00 e4 19 23 60 38 1c
        9a 22 92 00 d2 19 11 68 9f 23 9b 00 db 19 1a 68
        97 24 a4 00 e4 19 23 68 98 24 a4 00 e4 19 24 68
        a4 46 64 46 00 94 00 f0 b1 fd 03 1c a1 20 80 00
        c0 19 03 60 a6 4b ae 21 89 00 c9 19 ca 18 86 23
        5b 00 d3 58 a2 22 92 00 d2 19 13 60 9a 24 a4 00
        e4 19 23 68 00 2b 08 d0 9d 4b ae 20 80 00 c0 19
        c2 18 b0 23 d3 58 00 2b 04 d1 00 23 9a 21 89 00
        c9 19 0b 60 97 4a 80 23 5b 00 13 60 96 4b 06 22
        1a 60 99 22 92 00 d2 19 13 68 40 2b 0f d1 93 4b
        18 1c ff f7 bb fd 02 1c 80 23 1b 02 13 40 00 2b
        05 d0 8c 4b 8e 4a 1a 60 8b 4b 07 22 1a 60 a8 24
        a4 00 e4 19 23 68 00 2b 58 d0 00 f0 0f fa 96 21
        89 00 c9 19 08 68 9a 22 92 00 d2 19 11 68 97 23
        9b 00 db 19 1a 68 98 24 a4 00 e4 19 23 68 99 24
        a4 00 e4 19 24 68 a4 46 64 46 00 94 a1 24 a4 00
        e4 19 24 68 a4 46 64 46 01 94 a2 24 a4 00 e4 19
        24 68 a4 46 64 46 02 94 00 24 a4 46 64 46 03 94
        01 24 a4 46 64 46 04 94 a3 24 a4 00 e4 19 24 68
        a4 46 64 46 05 94 a4 24 a4 00 e4 19 24 68 a4 46
        64 46 06 94 a9 24 a4 00 e4 19 24 68 a4 46 64 46
        07 94 aa 24 a4 00 e4 19 24 68 a4 46 64 46 08 94
        ab 24 a4 00 e4 19 24 68 a4 46 64 46 09 94 02 f0
        d1 fa 03 1c 00 2b 6c d0 01 23 ab e0 5d 4b 01 22
        1a 60 5c 4b 18 1c ff f7 49 fd 02 1c 01 23 13 40
        9c 20 80 00 c0 19 03 60 9c 21 89 00 c9 19 0b 68
        00 2b ee d1 96 22 92 00 d2 19 10 68 9a 23 9b 00
        db 19 19 68 97 24 a4 00 e4 19 22 68 98 24 a4 00
        e4 19 23 68 99 24 a4 00 e4 19 24 68 a4 46 64 46
        00 94 a1 24 a4 00 e4 19 24 68 a4 46 64 46 01 94
        a2 24 a4 00 e4 19 24 68 a4 46 64 46 02 94 00 24
        a4 46 64 46 03 94 00 24 a4 46 64 46 04 94 a3 24
        a4 00 e4 19 24 68 a4 46 64 46 05 94 a4 24 a4 00
        e4 19 24 68 a4 46 64 46 06 94 a9 24 a4 00 e4 19
        24 68 a4 46 64 46 07 94 aa 24 a4 00 e4 19 24 68
        a4 46 64 46 08 94 ab 24 a4 00 e4 19 24 68 a4 46
        64 46 09 94 02 f0 66 fa 03 1c 00 2b 01 d0 01 23
        40 e0 00 23 9b 20 80 00 c0 19 03 60 1b e0 9b 21
        89 00 c9 19 0b 68 24 4a 9b 18 9a 00 23 4b 13 43
        9b 24 a4 00 e4 19 21 68 8a 20 80 00 3a 18 89 00
        8a 58 1a 60 9b 21 89 00 c9 19 0b 68 01 33 9b 22
        92 00 d2 19 13 60 9b 24 a4 00 e4 19 23 68 0b 2b
        dd d9 17 4b 17 4a 1a 60 17 4b 18 4a 1a 60 18 4b
        18 1c ff f7 b3 fc 03 1c 9c 20 80 00 c0 19 03 60
        13 4a 9c 23 9b 00 db 19 19 68 80 23 5b 01 0b 43
        13 60 00 23 18 1c bd 46 ae 23 9b 00 9d 44 b0 bd
        48 fd ff ff a8 14 00 d0 20 02 02 d0 24 15 00 d0
        01 01 00 00 80 14 00 d0 14 80 00 00 00 00 00 d0
        e8 00 02 d0 00 0e ff 1f 84 01 02 d0 e1 ff ff 1f
        d0 82 01 d0 80 b5 82 b0 00 af 08 4b 18 1c ff f7
        7d fc 03 1c 3b 60 3a 68 f0 23 db 01 13 40 db 0a
        7b 60 7b 68 18 1c bd 46 02 b0 80 bd 30 82 01 d0
        80 b5 82 b0 00 af 08 4b 18 1c ff f7 67 fc 03 1c
        3b 60 3a 68 f8 23 1b 03 13 40 db 0b 7b 60 7b 68
        18 1c bd 46 02 b0 80 bd 30 82 01 d0 80 b5 84 b0
OOB:
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff

@ubuntu:~$ hexdump -C dns-327L-mtd0.bin
00000000 8b 00 00 00 d0 4f 0a 00 01 00 00 c0 00 c0 00 00 |.....O..........|
00000010 00 00 60 00 00 00 6a 00 00 02 01 00 00 00 01 f1 |..`...j.........|
00000020 02 00 30 b9 02 00 00 00 5b 00 00 00 00 00 00 00 |..0.....[.......|
00000030 ff 5f 2d e9 22 00 00 fa 00 00 a0 e3 ff 9f bd e8 |._-."...........|
00000040 fe 1f 2d e9 36 0f 07 ee fe 1f bd e8 1e ff 2f e1 |..-.6........./.|
00000050 fe 1f 2d e9 ba 0f 07 ee 3e 0f 07 ee 9a 0f 07 ee |..-.....>.......|
00000060 fe 1f bd e8 1e ff 2f e1 fe 1f 2d e9 5f f0 7f f5 |....../...-._...|
00000070 3e 0f 07 ee 4f f0 7f f5 fe 1f bd e8 1e ff 2f e1 |>...O........./.|
00000080 10 1f 11 ee 02 1a c1 e3 00 10 81 e1 10 1f 01 ee |................|
00000090 4f f0 7f f5 1e ff 2f e1 00 10 0f e1 01 1c c1 e3 |O...../.........|
000000a0 00 10 81 e1 01 f0 22 e1 1e ff 2f e1 80 b5 84 b0 |......".../.....|
000000b0 00 af 78 60 7b 68 1b 68 fb 60 fb 68 18 1c bd 46 |..x`{h.h.`.h...F|
000000c0 04 b0 80 bd b0 b5 d8 4c a5 44 0a af d7 4c 7c 44 |.......L.D...L|D|
000000d0 00 23 9c 20 80 00 c0 19 03 60 00 23 a6 21 89 00 |.#. .....`.#.!..|
000000e0 c9 19 0b 60 01 23 a7 22 92 00 d2 19 13 60 00 23 |...`.#.".....`.#|
000000f0 a8 20 80 00 c0 19 03 60 00 23 a9 21 89 00 c9 19 |. .....`.#.!....|
00000100 0b 60 00 23 aa 22 92 00 d2 19 13 60 00 23 ab 20 |.`.#.".....`.#. |
00000110 80 00 c0 19 03 60 00 23 ad 21 89 00 c9 19 0b 60 |.....`.#.!.....`|
00000120 00 f0 56 fb 03 1c 9e 22 92 00 d2 19 13 60 02 f0 |..V....".....`..|
00000130 df fc 01 f0 3d fc be 4b 18 1c ff f7 b7 ff 02 1c |....=..K........|
00000140 18 23 13 40 db 08 a0 20 80 00 c0 19 03 60 a0 21 |.#.@... .....`.!|
00000150 89 00 c9 19 0b 68 01 2b 0f d0 01 2b 13 d3 03 2b |.....h.+...+...+|
00000160 17 d1 b4 4b b3 4a 11 68 10 22 0a 43 1a 60 b2 4b |...K.J.h.".C.`.K|
00000170 b1 4a 11 68 10 22 0a 43 1a 60 b0 4b af 4a 11 68 |.J.h.".C.`.K.J.h|
00000180 10 22 0a 43 1a 60 ae 4b ad 4a 11 68 10 22 0a 43 |.".C.`.K.J.h.".C|
00000190 1a 60 00 23 9b 22 92 00 d2 19 13 60 1e e0 9b 23 |.`.#.".....`...#|
000001a0 9b 00 db 19 1d 68 9b 20 80 00 c0 19 03 68 a5 49 |.....h. .....h.I|
000001b0 5b 18 9a 00 a4 4b 13 43 18 1c ff f7 77 ff 01 1c |[...
...................

четверг, 12 ноября 2020 г. в 21:43:00 UTC+3, João Cardoso:

João Cardoso

unread,

Nov 14, 2020, 9:04:55 PM11/14/20

to Alt-F

On Saturday, November 14, 2020 at 11:18:46 PM UTC kar...@gmail.com wrote:

Hi
Comparing dump and NAND gives me the same results (at least in first 32 bytes)
I have no explanation...

Neither me. It seems not possible to write to (or erase) nand page 0. Is some protection mechanism there? An error should be displayed in that case.

You can try to do a nand dump right after power up with kwboot, to see what is page 0 contents. You can try to erase/write/dump to another page (2048 bytes) or erase block (128KiB), to see if after power up the contents is preserved. But we can't continue trying to debug this way, it's too lengthy.

I tried even to look at D-Link u-boot source code released in their GPL source code, but hellas, u-boot is not there (GPL violation!).

I have thinking in the BootROM initial error messages, it looks like it is trying to load the header from subsequent addresses 0x10000, 0x20000, etc, but its specs says that page 0 (or is it block 0?) should not be damage; and it is trying at 64KiB intervals, the chip has a 128KiB erase block... but it is some think you could try, flashing at address 0x20000 instead of address 0... there are several thinks I could try until finally gave-up.

Some more comments intermixed bellow.

Have a look:

Marvell>> nand erase 0x000000 0x0500000

NAND erase: device 0 offset 0x0, size 0x500000
Erasing at 0x4e0000 -- 100% complete.
OK

Marvell>> nand dump 0
Page 00000000 dump:
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

...

ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
OOB:
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff
        ff ff ff ff ff ff ff ff

If you reboot at this point and repeat the dum, is it ff stil there?

...

BootROM 1.08
Booting from NAND flash
BootROM: Invalid header checksum
BootROM: Bad header at offset 00010000
BootROM: Bad header at offset 00020000

You can try to flash at this address, and at each 128KiB interval

BootROM: Bad header at offset 00030000
BootROM: Bad header at offset 00040000
BootROM: Bad header at offset 00050000
BootROM: Bad header at offset 00060000

I don't have any other clues for you, sorry.

The first message, "BootROM: Invalid header checksum" means that the first 32 bytes from the NAND (the first BootRom header) does not has a correct checksum.
My box displays at that stage "BootROM: Image checksum verification PASSED".
So probably your's two box NANDs becomes defective at its very start.
Just academic, but you can compare the first 32 bytes of the NAND right after a "nand erase" -- you should get 'ff' everywhere, and after the 'nand write' you should have the same values as a 'hexdump -C dns-327L-mtd0.bin' on your host linux VM.

If you want to always boot using kwboot and then from NAND, and keep the box always on, I have a solution for you.

Can you flash mtd2/mtd3 as per the next instructions and boot from kwboot?

I really don't have any more clues, you have to dig it yourself. But if you reach any conclusion please let us know,

Karips s

unread,

Nov 15, 2020, 1:24:08 PM11/15/20

to Alt-F

If you reboot at this point and repeat the dum, is it ff stil there?

Yes after reset ff still there, without changes.
After nand write dns-327L-mtd0.bin, nand dump 0, reset and nand dump 0 again - dumps are similar.

You can try to flash at this address, and at each 128KiB interval

What command should I use to this?

Maybe problem related to u-boot environment?
Marvell>> printenv
bootargs=root=/dev/ram console=ttyS0,115200
bootdelay=1
baudrate=115200
loads_echo=0
rootpath=/mnt/ARM_FS/
console=console=ttyS0,115200
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:4m(boot),-(rootfs)
sata_delay_reset=0
enaExtDisk=no
MALLOC_len=5
ethprime=egiga1
bootargs_root=root=/dev/nfs rw
bootargs_end=:10.4.50.254:255.255.255.0:KW40:eth0:none
image_name=uImage
load_addr=0x02000000
bootcmd=nand read.e 0xa00000 0x500000 0x400000;nand read.e 0xf00000 0xa00000 0x300000;bootm 0xa00000 0xf00000
standalone=fsload $load_addr $image_name;setenv bootargs $console $mtdparts root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm $load_addr;
ethaddr=00:50:43:00:02:02
eth1addr=00:50:43:00:02:02
ethmtu=1500
eth1mtu=1500
mvNetConfig=mv_net_config1=1,(00:50:43:11:11:11,0:1:2:3:4),mtu=1500
usb0Mode=host
usb1Mode=host
usbActive=1
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
eeeEnable=no
ethact=egiga1
filesize=500000
fileaddr=A00000
netmask=255.255.255.0
ipaddr=172.16.0.2
serverip=172.16.0.1
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
pexMode=RC
setL2CacheWT=no
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no
Environment size: 1245/524284 bytes

seen in some forum:
Marvell>> setenv mtdparts 'mtdparts=orion_nand:896k(u-boot),128k(u-boot-env),-(root)' (seen it in some forum)
Marvell>> saveenv

воскресенье, 15 ноября 2020 г. в 05:04:55 UTC+3, João Cardoso:

João Cardoso

unread,

Nov 15, 2020, 2:51:34 PM11/15/20

to Alt-F

On Sunday, November 15, 2020 at 6:24:08 PM UTC kar...@gmail.com wrote:

If you reboot at this point and repeat the dum, is it ff stil there?
Yes after reset ff still there, without changes.

So erase succeed. To be paranoid I would repeat unplugging also the power cord.

After nand write dns-327L-mtd0.bin, nand dump 0, reset and nand dump 0 again - dumps are similar.

"similar" is not enough.

Unfortunately u-boot seems to not have a command to upload flash or memory contents to a PC or a USB pen.

You can try to flash at this address, and at each 128KiB interval
What command should I use to this?

Too complex, as the image size must be shrinked, although in a first attempt it shouldn't matter.

Address or offset is the same, so repeat all the procedure each time and in the nand erase/write/dump commands replace 0000 with 00010000, then 00020000, then 00030000, ...all the addresses that the bootrom seems to be attempting

Maybe problem related to u-boot environment?

If you have not changed it, it is not the cause of the problem. My mtd0.bin posted file has a pristine environment (so you can compare it with yours after a kwboot) with the exception of the added 'af' variable. I have never touched any of them, and you should do the same if you know (don't know) what you are doing.

,,,

seen in some forum:
Marvell>> setenv mtdparts 'mtdparts=orion_nand:896k(u-boot),128k(u-boot-env),-(root)' (seen it in some forum)
Marvell>> saveenv

For the purpose of doing what? That are no magic receipts to "solve them all"!

'saveenv' saves the curretn environment (which is currently in memory) to flash. Once you boot with kwboot the env loaded will be used.

There is also a resetenv command: - earse environment sector to reset all variables to default. I don't know if it is wise to do that, because as D-Link modified u-boot might rely on changed values.

And in any case u-boot is *not* booting. The boot process is: at power up the processor start executing existing code in the SoC itself, it is called the BootROM, and the bootrom tries to load a bootloader (u-boot) from nand. It is at that point that everything fails, bootrom does not find a valid signature in nand to load u-boot from, so u-boot never gets executed. Unless you use kwboot, that is a saveguard mechanism that bootrom always tries to use at first, even before nand (or disk or serial flash, etc). Bootrom does not even know what nand, if any, is on the system, it does several tries to find one, etc, etc.

As I told in the first post I'm not a u-boot expert. I'm just experienced (on old hardware)

we are not going anywhere this way. Do you live in Europe/EU?

Did you test the procedure bellow? It does not solve the booting issue and will always require kwboot to boot an otherwise fine system, as long as you always keep the box on.

Karips s

unread,

Nov 17, 2020, 1:09:51 PM11/17/20

to Alt-F

Address or offset is the same, so repeat all the procedure each time and in the nand erase/write/dump commands replace 0000 with 00010000, then 00020000, then 00030000, ...all the addresses that the bootrom seems to be attempting

Will do few more attempts in a couple of days.
I will try:
tftp 0xa00000 dns-327L-mtd0.bin
nand erase 0x000000 0x0500000

nand write 0xa00000 0x000000 0x0500000

than trying to change addresses like this:
nand write 0xa00000 0x100000 0x0500000
nand write 0xa00000 0x200000 0x0500000
nand write 0xa00000 0x200000 0x0500000
etc...

is it correct?

Do you live in Europe/EU?

I live in Russia.

воскресенье, 15 ноября 2020 г. в 22:51:34 UTC+3, João Cardoso:

Karips s

unread,

Dec 30, 2021, 3:07:03 AM12/30/21

to Alt-F

Hi!

I haven't been here for a long time

For a whole year the broken NASs lay on the shelf and waited to be thrown to garbage or fixed.

Suddenly find a solution with u-boot image (u-boot was ok, problem was not there).

Problem with u-boot disappeared without serial adapter connected. NAS got stuck in the BooROM when serial is connected. So I have to wait 1 sec. after power on and than connect serial adapter.

Now, next problem:

NAS stuck with this error (see full log):

Marvell>> setenv ipaddr x.x.x.x
Marvell>> setenv serverip x.x.x.x
Marvell>> tftp 0xa00000 uKernel
Using egiga1 device
TFTP from server x.x.x.x; our IP address is x.x.x.x
Filename 'uKernel'.

Load address: 0xa00000
Loading: #################################################################
#################################################################
########

done
Bytes transferred = 2018875 (1ece3b hex)
Marvell>> tftp 0xf00000 uRamdisk
Using egiga1 device
TFTP from server x.x.x.x; our IP address is x.x.x.x
Filename 'uRamdisk'.
Load address: 0xf00000
Loading: #################################################################
#################################################################
#################################################################
###############
done
Bytes transferred = 3072064 (2ee040 hex)
Marvell>> bootm 0xa00000 0xf00000
## Booting image at 00a00000 ...
## Booting kernel from Legacy Image at 00a00000 ...
Image Name: Alt-F-1.0, kernel 4.4.86
Created: 2017-10-13 14:01:40 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2018811 Bytes = 1.9 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 00f00000 ...
Image Name: Alt-F-1.0, initrd
Created: 2017-10-13 14:01:38 UTC
Image Type: ARM Linux RAMDisk Image (uncompressed)
Data Size: 3072000 Bytes = 2.9 MB
Load Address: 00800000
Entry Point: 00800000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.4.86 (jcard@silver) (gcc version 4.3.3 (GCC) ) #1 Fri Sep 22 207
CPU: ARMv7 Processor [561f5811] revision 1 (ARMv7), cr=10c5387d
CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
Machine model: D-Link DNS-327L-rev-Ax
bootconsole [earlycon0] enabled
Memory policy: Data cache writeback
CPU: All CPU(s) started in SVC mode.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048
Kernel command line: console=ttyS0,115200 root=/dev/ram0 init=/init earlyprintk0
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 511144K/524288K available (4335K kernel code, 146K rwdata, 720K rodata,)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xe0800000 - 0xff800000 ( 496 MB)
lowmem : 0xc0000000 - 0xe0000000 ( 512 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.text : 0xc0008000 - 0xc04f8054 (5057 kB)
.init : 0xc04f9000 - 0xc052c000 ( 204 kB)
.data : 0xc052c000 - 0xc0550800 ( 146 kB)
.bss : 0xc0550800 - 0xc0567d60 ( 94 kB)
NR_IRQS:16 nr_irqs:16 16
L2C: DT/platform modifies aux control register: 0x12086300 -> 0x1a086302
Aurora cache controller enabled, 4 ways, 256 kB
Aurora: CACHE_ID 0x00000100, AUX_CTRL 0x1a086302
Switching to timer-based delay loop, resolution 53ns
sched_clock: 32 bits at 18MHz, resolution 53ns, wraps every 114532461029ns
clocksource: armada_370_xp_clocksource: mask: 0xffffffff max_cycles: 0xffffffffs
Calibrating delay loop (skipped), value calculated using timer frequency.. 37.5)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x8240 - 0x8298
mvebu-soc-id: MVEBU SoC ID=0x6710, Rev=0x1
mvebu-pmsu: Initializing Power Management Service Unit
VFP support v0.3: implementor 56 architecture 2 part 20 variant 9 rev 6
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 191s
futex hash table entries: 16 (order: -5, 192 bytes)
xor: measuring software checksum speed
arm4regs : 1075.200 MB/sec
8regs : 855.200 MB/sec
32regs : 837.200 MB/sec
xor: using function: arm4regs (1075.200 MB/sec)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
raid6: int32x1 gen() 143 MB/s
raid6: int32x1 xor() 167 MB/s
raid6: int32x2 gen() 186 MB/s
raid6: int32x2 xor() 158 MB/s
raid6: int32x4 gen() 175 MB/s
raid6: int32x4 xor() 122 MB/s
raid6: int32x8 gen() 169 MB/s
raid6: int32x8 xor() 103 MB/s
raid6: using algorithm int32x2 gen() 186 MB/s
raid6: .... xor() 158 MB/s, rmw enabled
raid6: using intx1 recovery algorithm
reg-fixed-voltage regulators:regulator@1: could not find pctldev for node /soc/e
reg-fixed-voltage regulators:regulator@2: could not find pctldev for node /soc/e
reg-fixed-voltage regulators:regulator@3: could not find pctldev for node /soc/e
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
clocksource: Switched to clocksource armada_370_xp_clocksource
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 3004K
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
aufs 4.4-20170130
async_tx: api initialized (async)
io scheduler noop registered
io scheduler cfq registered (default)
armada-370-pinctrl d0018000.pin-ctrl: registered pinctrl driver
irq: Cannot allocate irq_descs @ IRQ41, assuming pre-allocated
irq: Cannot allocate irq_descs @ IRQ73, assuming pre-allocated
irq: Cannot allocate irq_descs @ IRQ105, assuming pre-allocated
mvebu-pcie soc:pcie-controller: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x1000-0xfffff]
pci_bus 0000:00: root bus resource [mem 0xf8000000-0xffdfffff]
pci_bus 0000:00: root bus resource [bus 00-ff]
PCI: bus0: Fast back to back transfers disabled
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
PCI: bus1: Fast back to back transfers disabled
PCI: bus2: Fast back to back transfers enabled
pci 0000:00:01.0: BAR 8: assigned [mem 0xf8000000-0xf80fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0xf8000000-0xf8001fff 64bit]
pci 0000:00:01.0: PCI bridge to [bus 01]
pci 0000:00:01.0: bridge window [mem 0xf8000000-0xf80fffff]
pci 0000:00:02.0: PCI bridge to [bus 02]
pcieport 0000:00:01.0: enabling device (0140 -> 0142)
mv_xor d0060800.xor: Marvell shared XOR driver
mv_xor d0060800.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
mv_xor d0060900.xor: Marvell shared XOR driver
mv_xor d0060900.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
console [ttyS0] disabled
d0012000.serial: ttyS0 at MMIO 0xd0012000 (irq = 20, base_baud = 12500000) is aA
console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [earlycon0] disabled
bootconsole [earlycon0] disabled
d0012100.serial: ttyS1 at MMIO 0xd0012100 (irq = 21, base_baud = 12500000) is aA
brd: module loaded
loop: module loaded
sata_mv d00a0000.sata: slots 32 ports 2
scsi host0: sata_mv
scsi host1: sata_mv
ata1: SATA max UDMA/133 irq 29
ata2: SATA max UDMA/133 irq 29
pxa3xx-nand d00d0000.nand: This platform can't do DMA on this device
nand: device found, Manufacturer ID: 0xad, Chip ID: 0xf1
nand: Hynix H27U1G8F2BTR-BC

nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
pxa3xx-nand d00d0000.nand: ECC strength 16, ECC step size 2048
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01

7 ofpart partitions found on MTD device pxa3xx_nand-0

Creating 7 MTD partitions on "pxa3xx_nand-0":
0x000000000000-0x000000500000 : "u-Boot"
0x000000500000-0x000000a00000 : "uImage"
0x000000a00000-0x000000f00000 : "ramdisk"
0x000000f00000-0x000005d00000 : "image.cfs"
0x000005d00000-0x000006c00000 : "rescue firmware"
0x000006c00000-0x000007600000 : "config"
0x000007600000-0x000008000000 : "mydlink"

libphy: Fixed MDIO Bus: probed
libphy: orion_mdio_bus: probed
mvneta d0074000.ethernet eth0: Using hardware mac address 00:50:43:00:02:02
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
ehci-orion: EHCI orion driver
orion-ehci d0050000.usb: EHCI Host Controller
orion-ehci d0050000.usb: new USB bus registered, assigned bus number 1
orion-ehci d0050000.usb: irq 27, io mem 0xd0050000
orion-ehci d0050000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
xhci_hcd 0000:01:00.0: xHCI Host Controller
xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 2
xhci_hcd 0000:01:00.0: hcc params 0x014051cf hci version 0x100 quirks 0x00000090
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
xhci_hcd 0000:01:00.0: xHCI Host Controller
xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 3
usb usb3: We don't know the algorithms for LPM for this host, disabling LPM.
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 2 ports detected
usbcore: registered new interface driver usb-storage

i2c /dev entries driver
orion_wdt: Initial timeout 229 sec
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
NET: Registered protocol family 17
ata1: SATA link down (SStatus 0 SControl F300)
ata2: SATA link down (SStatus 0 SControl F300)
input: gpio-keys as /devices/platform/gpio-keys/input/input0
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 2997KiB [1 disk] into ram disk... done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing unused kernel memory: 204K
pre-init started, pid=1
pre-init: squash-rd
init started: BusyBox v1.20.2 (2017-09-22 20:15:53 WEST)

/etc/init.d/rcS: eval: line 1: syntax error: unterminated quoted string

can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory
can't open /dev/ttyS0: No such file or directory

.......... and this error never ends

Any help how to fix would be appreciated!

вторник, 17 ноября 2020 г. в 21:09:51 UTC+3, Karips s:

Reply all

Reply to author

Forward