Successful unbricking DNS-323-rev-B1 story

[João Cardoso]

Hi,

John-Paul bricked his DNS-323-rev-B1 box running D-Link fw-1.08 while trying to flash Alt-F on it.

The following are excerpts from private conversations, with John-Paul approval.

I've managed to create a serial cable.  The serial output shows

a CRC error.  See below.  The problem is that the Rev-B1 does not see

or accept key strokes via the serial cable, so I cannot interrupt the

boot sequence.  Perhaps there is a cable issue, but I've measured the

connection with an Ohm meter and the wires seem to be fine.

As instructed in the web site http://dns323.kood.org/hardware:serial

I only connected pins 2, 3, and 4 (RX, TX, and GND).

 ** LOADER **

 ** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

DRAM CS[0] base 0x00000000   size  64MB

DRAM Total size  64MB

[8192kB@ff800000] Flash:  8 MB

Addresses 20M - 0M are saved for the U-Boot usage.

Mem malloc Initialization (20M - 16M): Done

*** Warning - bad CRC, using default environment

Soc: MV88F5182 Rev 2

CPU: ARM926 (Rev 0) running @ 500Mhz

SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode

USB 1: host mode

PCI 0: PCI Express Root Complex Interface

PCI 1: Conventional PCI, speed = 33000000

Hit any key to stop autoboot:  0

## Booting image at ff820000 ...

   Image Name:   Alt-F-0.1RC3, kernel 2.6.35.14

   Image Type:   ARM Linux Kernel Image (uncompressed)

   Data Size:    1383068 Bytes =  1.3 MB

   Load Address: 00008000

   Entry Point:  00008000

   Verifying Checksum ... OK

OK

## Loading Ramdisk Image at ff9a0000 ...

   Image Name:   Alt-F-0.1RC3, initrd

   Image Type:   ARM Linux RAMDisk Image (uncompressed)

   Data Size:    6385664 Bytes =  6.1 MB

   Load Address: 00800000

   Entry Point:  00800000

   Verifying Checksum ... Bad Data CRC

OK

 ** LOADER **

 ** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

(and it keeps repeating)

@you have to be really fast typing the "space", followed by "1" keys right after poweron.

Keep typing them several times.

 

@YES!!! It worked.

That was fantastic advice. <SPACE>1 did the trick. I now have the "Marvell>>" prompt! 

 

Latter on: 

I have the rev-B1 unit un-bricked.  During this process I ran into one

major difficulty (which partly explains why the unit got bricked in

the first place).

As the output (I emailed you earlier) showed, the Alt-F kernel CRC

was still fine; the unit complained about the ramdisk image CRC.

So I uploaded via the serial port, using kermit, the Alt-F ramdisk image.

After the ramdisk image got uploaded (no errors), the unit erased its

flash blocks and then gave me an error before it started to copy the

ramdisk image to flash.  The error was:

Ramdisk Size = 6385728

error,Ramdisk size > 005e0000 byesMarvell>>

Note: 005e0000 == 6160384, which is not enough space to fit 6385728 in.

Then I retried loading the Dlink vendor 1.08 firmware, both kernel

and ramdisk.  This version was on the unit before I flashed Alt-F.

Same error:

Ramdisk Size = 6475178

error,Ramdisk size > 005e0000 byesMarvell>>

Again, 005e0000 == 6160384, which is not enough space to fit 6475178 in.

Then finally I loaded the Dlink vendor 1.03 firmware (kernel and

ramdisk), which has a ramdisk size of 5966369.  This succeeded and the

unit booted the firmware without any issues.  I can reach its web GUI.

Apparently, the Dlink firmware version 1.08, as well as Alt-F, do not

fit.  And no: I do not have an explanation why the Dlink firmware version 

1.08 worked fine, when flashed from an older Dlink firmware version... 

latter on:

My previously bricked rev-B1 now runs Alt-F.  I followed this procedure:

Starting with Dlink firmware 1.03, reset to defaults, reboot, upgrade

to 1.04, reset to defaults, reboot, upgrade to 1.05, reset to defaults,

reboot, upgrade to 1.06, reset to defaults, reboot, upgrade to 1.07,

reset to defaults, reboot, upgrade to 1.08, reset to defaults, reboot,

shutdown, power-off, power-on, upgrade to Alt-F 0.1RC3, shutdown,

power-off, power-on, worked!  Reset to defaults, reboot, still works.

All upgrade were performed via the web GUI. 

Some more hints:

Currently, I don't have a shell on the 1.03 firmware, since:

a. via the console (/dev/ttyS0) I cannot enter any commands; the ^C

keystroke simply shows:

   Starting pid 2539, console /dev/ttyS0: '/bin/sh'

   BusyBox v1.00-pre1 (2006.07.17-10:17+0000) Built-in shell (ash)

   Enter 'help' for a list of built-in commands.

But nothing I enter results in any output.  (Is this normal?)

 

@Yes, you have to type '5784468' to "unlock" it! D-Link stuff, like the <space><1> key u-boot break sequence 

A non-fulfilled explanation for the brick/unbrick:

@As you show in your email, it's a bootloader (u-boot) bug -- later on, somewhere in the process of the several upgrades of the D-Link firmware a new u-boot must have been flashed. 

Can you check your current u-boot version, and try to identify where in 

the flash sequence was it upgraded?

According to http://dns323.kood.org/, there was several upgrades, can 

you confirm that?

At the time of the brick you had

    U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

 

@Sounds very reasonable, but sadly it's not the case.  The console boot

logs of all versions show U-Boot 1.1.1:

% grep U-boot boot_10[345678] boot_alt-f

boot_103:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_103:Addresses 20M - 0M are saved for the U-Boot usage.

boot_103:0x007d0000-0x00800000 : "u-boot"

boot_104:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_104:Addresses 20M - 0M are saved for the U-Boot usage.

boot_104:0x007d0000-0x00800000 : "u-boot"

boot_105:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_105:Addresses 20M - 0M are saved for the U-Boot usage.

boot_105:0x007d0000-0x00800000 : "u-boot"

boot_106:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_106:Addresses 20M - 0M are saved for the U-Boot usage.

boot_106:0x007d0000-0x00800000 : "u-boot"

boot_107:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_107:Addresses 20M - 0M are saved for the U-Boot usage.

boot_107:0x007d0000-0x00800000 : "u-boot"

boot_108:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_108:Addresses 20M - 0M are saved for the U-Boot usage.

boot_108:0x007d0000-0x00800000 : "u-boot"

boot_alt-f:U-Boot 1.1.1 (Dec 20 2006 - 15:49:31) Marvell version: 1.7.3

boot_alt-f:Addresses 20M - 0M are saved for the U-Boot usage.

boot_alt-f:0x0000007d0000-0x000000800000 : "u-boot"

[Eric Meallier]

Hi,

similar problem but solution a bit different:
1. uboot console: erase 0xff800000 0xFFFCFFFF => to flush flash memory entirely, except uboot part
2. loadb kernel + ramdisk from 1.10 official firmware
3. upgrade to altf RC4 from the webui

[sprinterrro]

Hi,

I've got some problem with my DNS-323 A1. After upgrade to 0.1RC4 device worked couple of days then I needed to change UPS battery and powered it down. From that moment it's just blinking fast and not starting up.

Made some soldering with my original Nokia DKU-5 cable and that's what I see in terminal:

** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: MV88F5181 Rev 3

CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

 Init usb device.

PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000

It hangs without message "Hit any key to stop autoboot: 0". I can't get Marvell command line...

Any tips ? Is this some kind of hardware problem ?

Regards,
Adam

[João Cardoso]

On Wednesday, December 17, 2014 6:42:25 PM UTC, sprinterrro wrote:

Hi,

I've got some problem with my DNS-323 A1. After upgrade to 0.1RC4

from D-Link fw or a previous Alt-F release?

 

device worked couple of days

Did you reboot the box afterwards? You did it at least after flashing RC4, so the flash run OK, or the box wouldn't even reboot to Alt-F.

 

then I needed to change UPS battery and powered it down. From that moment it's just blinking fast and not starting up.

Made some soldering with my original Nokia DKU-5 cable and that's what I see in terminal:

** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

This is "normal", it also appears on my DNS-323-rev-B1 board.

Soc: MV88F5181 Rev 3
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


 Init usb device.
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000

It hangs without message "Hit any key to stop autoboot: 0". I can't get Marvell command line.

You should see (you already know that, just for reference) something similar to (apart from rev-A1/B1 differences)

  ** LOADER **                                        

 ** MARVELL BOARD: RD-88F5182-NAS-2 LE               

U-Boot 1.1.1 (Oct 12 2007 - 17:19:14) Marvell version: 1.7.3.001

DRAM CS[0] base 0x00000000   size  64MB 

DRAM Total size  64MB                   

[8192kB@ff800000] Flash:  8 MB          

Addresses 20M - 0M are saved for the U-Boot usage.

Mem malloc Initialization (20M - 16M): Done       

*** Warning - bad CRC, using default environment  

Soc: MV88F5182 Rev 2

CPU: ARM926 (Rev 0) running @ 500Mhz 

SysClock = 166Mhz , TClock = 166Mhz  

USB 0: host mode

USB 1: host mode

PCI 0: PCI Express Root Complex Interface

PCI 1: Conventional PCI, speed = 33000000

Hit any key to stop autoboot:  0         

## Booting image at ff820000 ...         

   Image Name:   Linux-2.6.12.6-arm1     

   Image Type:   ARM Linux Kernel Image (uncompressed)

   Data Size:    1455992 Bytes =  1.4 MB              

   Load Address: 00008000                             

   Entry Point:  00008000                             

   Verifying Checksum ... OK                          

OK                                                    

## Loading Ramdisk Image at ff9a0000 ...              

   Image Name:   Ramdisk                              

   Image Type:   ARM Linux RAMDisk Image (gzip compressed)

   Data Size:    6462441 Bytes =  6.2 MB                  

   Load Address: 00800000                                 

   Entry Point:  00800000                                 

   Verifying Checksum ... OK                              

Starting kernel ...

..

Any tips ?

No disks plugged?

Have you pressed the <space>+<1> or <space> followed by <1> keys *rapidly* after boot? If you can't get to u-boot cmd line you are doomed.

 

Is this some kind of hardware problem ?

In the worst case scenario the u-boot flash "partition" is damaged, which has no possible cure. Someone in the DNS-323 forum reported using a JTAG to flash u-boot, but that is a very advanced topic.

Regards,
Adam

[sprinterrro]

On Wednesday, December 17, 2014 8:43:57 PM UTC+1, João Cardoso wrote:

On Wednesday, December 17, 2014 6:42:25 PM UTC, sprinterrro wrote:

Hi,

I've got some problem with my DNS-323 A1. After upgrade to 0.1RC4

from D-Link fw or a previous Alt-F release?

From previous Alt-F 0.1RC3.

 

 

device worked couple of days

Did you reboot the box afterwards? You did it at least after flashing RC4, so the flash run OK, or the box wouldn't even reboot to Alt-F.

Yes, I did reboot. Twice or something, first time DNS showed me still 0.1RC3 but flashed again and after reboot it was 0.1RC4. All worked fine.

 

 

then I needed to change UPS battery and powered it down. From that moment it's just blinking fast and not starting up.

Made some soldering with my original Nokia DKU-5 cable and that's what I see in terminal:

** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000   size  64MB
DRAM Total size  64MB
[8192kB@ff800000] Flash:  8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

This is "normal", it also appears on my DNS-323-rev-B1 board.

Soc: MV88F5181 Rev 3
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


 Init usb device.
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000

It hangs without message "Hit any key to stop autoboot: 0". I can't get Marvell command line.

You should see (you already know that, just for reference) something similar to (apart from rev-A1/B1 differences)

Yes, I was expecting something similar.

No disks, I've got dns on the table without housing, just powered board with soldered dku cable. I think no disk needed for reflashing ?  

I tried <space>+<1> and other combinations but no effect...

 

 

Is this some kind of hardware problem ?

In the worst case scenario the u-boot flash "partition" is damaged, which has no possible cure. Someone in the DNS-323 forum reported using a JTAG to flash u-boot, but that is a very advanced topic.

Oh, I need to look at that, I've got jtag programmer for ARM microcontrollers and some other tools. Thanks for this tip.

 

Regards,
Adam