DNR-322L debrick

408 views

Skip to first unread message

Viktor

unread,

Oct 23, 2019, 1:18:52 AM10/23/19

to Alt-F

I have a DNR-322L rev. A2, that's been bricked for a while now. Initially, I installed Alt-F-1.0-DNR-322L-rev-Ax.bin. This worked fine for a while, the only issue being that the MAC address would change every time the unit rebooted.

At some point, I tried to flash back to the latest stock D-Link firmware.I don't really remember if the D-Link firmware was successfully flashed, since I fully intended to go back to Alt-F after the flash. Eventually, the unit ended up bricking, presumably from all the flashing attempts.

Anyway, I've connected a serial cable to it in an attempt to unbrick the device. Here's the complete boot log:


 ** MARVELL BOARD: DB-88F6281A-BP LE

U-Boot 1.1.4 (May  7 2013 - 16:35:27) Marvell version: 3.4.14.DNR-322.02

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE80

Soc: MV88F6281 Rev 3 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=5
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
*** Warning - bad CRC or NAND, using default environment


CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x100000, size 0x300000
load addr ....  =a00000

 3145728 bytes read: OK

NAND read: device 0 offset 0x600000, size 0x300000
load addr ....  =f00000

 3145728 bytes read: OK
## Booting image at 00a00000 ...
   Image Name:   Alt-F-1.0, kernel 4.4.86
   Created:      2018-11-21  17:10:50 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1849131 Bytes =  1.8 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00f00000 ...
   Image Name:   Alt-F-1.0, initrd
   Created:      2018-11-21  17:10:45 UTC
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    3072000 Bytes =  2.9 MB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... Bad Data CRC

NAND read: device 0 offset 0x6f00800, size 0x500000
load addr ....  =a00000

Bad block at 0x7140000 in erase block from 0x7140000 will be skipped
 5242880 bytes read: OK
## Loading Ramdisk Image at 00d00000 ...
   Image Name:   Ramdisk
   Created:      2013-05-10   2:58:55 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    1764445 Bytes =  1.7 MB
   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.4.86 (jcard@silver) (gcc version 4.3.3 (GCC) ) #1 Tue Nov 20 21:20:24 WET 2018
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=0005397f
CPU: VIVT data cache, VIVT instruction cache
Machine model: D-Link DNS-320-rev-Ax NAS
bootconsole [earlycon0] enabled
Memory policy: Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: console=ttyS0,115200n8 root=/dev/ram0 init=/init earlyprintk root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 253004K/262144K available (3943K kernel code, 132K rwdata, 672K rodata, 184K init, 92K bss, 9140K reserved, 0K cma-reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xd0800000 - 0xff800000   ( 752 MB)
    lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc0489f94   (4616 kB)
      .init : 0xc048a000 - 0xc04b8000   ( 184 kB)
      .data : 0xc04b8000 - 0xc04d9200   ( 133 kB)
       .bss : 0xc04d9200 - 0xc04f0300   (  93 kB)
NR_IRQS:16 nr_irqs:16 16
clocksource: orion_clocksource: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
Calibrating delay loop... 1185.38 BogoMIPS (lpj=5926912)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x8200 - 0x823c
mvebu-soc-id: MVEBU SoC ID=0x6281, Rev=0x3
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 16 (order: -5, 192 bytes)
xor: measuring software checksum speed
   arm4regs  :  1079.200 MB/sec
   8regs     :   800.000 MB/sec
   32regs    :   874.400 MB/sec
xor: using function: arm4regs (1079.200 MB/sec)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor menu
Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.
[Firmware Info]: /ocp@f1000000/ethernet-controller@72000/ethernet0-port@0: local-mac-address is not set
raid6: int32x1  gen()   109 MB/s
raid6: int32x1  xor()    77 MB/s
raid6: int32x2  gen()   137 MB/s
raid6: int32x2  xor()    86 MB/s
raid6: int32x4  gen()   117 MB/s
raid6: int32x4  xor()    75 MB/s
raid6: int32x8  gen()   116 MB/s
raid6: int32x8  xor()    70 MB/s
raid6: using algorithm int32x2 gen() 137 MB/s
raid6: .... xor() 86 MB/s, rmw enabled
raid6: using intx1 recovery algorithm
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
clocksource: Switched to clocksource orion_clocksource
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (compression method gzip not configured); looks like an initrd
Freeing initrd memory: 1724K
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
aufs 4.4-20170130
async_tx: api initialized (async)
io scheduler noop registered
io scheduler cfq registered (default)
kirkwood-pinctrl f1010000.pin-controller: registered pinctrl driver
irq: Cannot allocate irq_descs @ IRQ34, assuming pre-allocated
irq: Cannot allocate irq_descs @ IRQ66, assuming pre-allocated
mv_xor f1060800.xor: Marvell shared XOR driver
mv_xor f1060800.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
mv_xor f1060900.xor: Marvell shared XOR driver
mv_xor f1060900.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
console [ttyS0] disabled
f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 25, base_baud = 12500000) is a 16550A
console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [earlycon0] disabled
bootconsole [earlycon0] disabled
f1012100.serial: ttyS1 at MMIO 0xf1012100 (irq = 26, base_baud = 12500000) is a 16550A
brd: module loaded
loop: module loaded
sata_mv f1080000.sata: slots 32 ports 2
scsi host0: sata_mv
scsi host1: sata_mv
ata1: SATA max UDMA/133 irq 33
ata2: SATA max UDMA/133 irq 33
nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1
nand: Samsung NAND 128MiB 3,3V 8-bit
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
Scanning device for bad blocks
Bad eraseblock 126 at 0x000000fc0000
Bad eraseblock 906 at 0x000007140000
6 ofpart partitions found on MTD device orion_nand
Creating 6 MTD partitions on "orion_nand":
0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000600000 : "uImage"
0x000000600000-0x000000b00000 : "ramdisk"
0x000000b00000-0x000007100000 : "image"
0x000007100000-0x000007b00000 : "mini firmware"
0x000007b00000-0x000008000000 : "config"
libphy: orion_mdio_bus: probed
mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4
mv643xx_eth_port mv643xx_eth_port.0 eth0: port 0 with MAC address 00:50:43:30:30:01
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
ehci-orion: EHCI orion driver
orion-ehci f1050000.ehci: EHCI Host Controller
orion-ehci f1050000.ehci: new USB bus registered, assigned bus number 1
orion-ehci f1050000.ehci: irq 30, io mem 0xf1050000
orion-ehci f1050000.ehci: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver usb-storage
rtc-mv f1010300.rtc: rtc core: registered f1010300.rtc as rtc0
i2c /dev entries driver
gpio-fan gpio_fan: GPIO fan initialized
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
NET: Registered protocol family 17
input: gpio_keys as /devices/platform/gpio_keys/input/input0
ata1: SATA link down (SStatus 0 SControl F300)
ata2: SATA link down (SStatus 0 SControl F300)
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
RAMDISK: gzip image found at block 0
RAMDISK: gzip decompressor not configured!
Invalid ramdisk decompression routine.  Select appropriate config option.
Kernel panic - not syncing: Could not decompress initial ramdisk image.
---[ end Kernel panic - not syncing: Could not decompress initial ramdisk image.

Hoping to unbrick, and in the process, help João determine the differences between the DNR-322L and DNS-320.

João Cardoso

unread,

Oct 23, 2019, 1:43:46 PM10/23/19

to al...@googlegroups.com

Comments intermixed:

At this point you have to type <space> rapidly followed by '1' to enter u-boot command line prompt.

As it has to be done very fast, I usually type it as soon as u-boot displays "NAND:"

NAND read: device 0 offset 0x100000, size 0x300000

reading 0x300000 bytes located in NAND address 0x100000. This is the mtd1 device, containing the linux kernel image, as seen later

load addr .... =a00000

loading it at RAM at memory address 0xa00000. You will have to use that load address later for the kernel

3145728 bytes read: OK NAND read: device 0 offset 0x600000, size 0x300000 load addr .... =f00000

The same for the root filesystem (initrd/initramfs), in mtd2. You will have to use the 0xf00000 load address later.

3145728 bytes read: OK ## Booting image at 00a00000 ... Image Name: Alt-F-1.0, kernel 4.4.86

Here is is, the loaded image from NAND is the Alt-F kernel

Created: 2018-11-21 17:10:50 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1849131 Bytes = 1.8 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK

OK

At it was fine

## Loading Ramdisk Image at 00f00000 ... Image Name: Alt-F-1.0, initrd Created: 2018-11-21 17:10:45 UTC Image Type: ARM Linux RAMDisk Image (uncompressed)

here the Alt-F rootfs is loaded

Data Size: 3072000 Bytes = 2.9 MB Load Address: 00800000 Entry Point: 00800000 Verifying Checksum ... Bad Data CRC

hellas, it was found to not be OK,

NAND read: device 0 offset 0x6f00800, size 0x500000 load addr .... =a00000

so u-bot tries to load a rescue rootfs, from what should be mtd4 (Alt-F has this in error, for Alt-F-1.0 mtd4 starts at 0x7100000

Bad block at 0x7140000 in erase block from 0x7140000 will be skipped 5242880 bytes read: OK ## Loading Ramdisk Image at 00d00000 ... Image Name: Ramdisk

It's a d-link rootfs, not Alt-F

Created: 2013-05-10 2:58:55 UTC Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 1764445 Bytes = 1.7 MB Load Address: 00e00000 Entry Point: 00e00000 Verifying Checksum ... OK

And it loads OK.

Now running the loaded Alt-F kernel and D-link rootfs. It all goes OK until

hellas, to save space the Alt-F kernel does not supports gzip compressed rootfs, and the boot fails

Kernel panic - not syncing: Could not decompress initial ramdisk image. ---[ end Kernel panic - not syncing: Could not decompress initial ramdisk image.

Hoping to unbrick, and in the process, help João determine the differences between the DNR-322L and DNS-320.

I should probably add support for gzip compressed initramfs/initrd (the rootfs). Is should not increase the kernel size significantly, and will allow booting the rescue firmware.

I now need to have the u-boot environment. Break into u-boot as instructed above, <space> followed by '1' as "NAND:" is displayed, and type and post all the output of command 'printenv'

Next we will try to load both the D-Link rescue kernel and initramfs/initrd (the rootfs). If that does not works, you will have to split the D-Link or Alt-F firmware file into its components, store them in a FAT formatted USB pen and use it from u-boot.

But we should try first to load the rescue firmware, as it is much simpler.

Viktor

unread,

Oct 23, 2019, 11:10:00 PM10/23/19

to Alt-F

Fascinating stuff. Does that mean I ended up having a kind of hybrid Alt-F/D-Link firmware?

Here is the output for printenv:

Marvell>> printenv
bootargs=root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
bootcmd=nand read.e 0xa00000 0x100000 0x300000;nand read.e 0xf00000 0x600000 0x300000;bootm 0xa00000 0xf00000
baudrate=115200
loads_echo=0
ipaddr=2.66.66.201
serverip=2.66.66.32
rootpath=/mnt/ARM_FS/
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
console=console=ttyS0,115200 mtdparts=nand_mtd:0xc0000@0(uboot)ro,0x7f00000@0x100000(root)
mainlineLinux=no
CASset=min
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
MALLOC_len=1
ethprime=egiga0
netbsd_en=no
vxworks_en=no
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
bootdelay=1
disaMvPnp=no
ethaddr=00:50:43:ec:28:2c
ethmtu=1500
mvPhoneConfig=mv_phone_config=dev0:fxs,dev1:fxs
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
enaAutoRecovery=yes
ethact=egiga0

Environment size: 1239/131068 bytes

Viktor

unread,

Oct 24, 2019, 2:39:44 AM10/24/19

to Alt-F

I did a lot of reading around these forums and some others, and went ahead to use dns323-firmware-tools on Alt-F-1.0-DNR-322L-rev-Ax.bin.

After splitting this Alt-F firmware into kernel and initrd, the box finally managed to boot Alt-F once again. Although from what I understand, this is just temporary, since the kernel and initrd were just being loaded from the USB drive.

I tried flashing Alt-F-1.0-DNR-322L-rev-Ax.bin through the Alt-F web interface, but it wouldn't accept the file, throwing this error message: This firmware file has signature "1821" and does not seem compatible with supported firmware.

Now that I think about it, this was likely the reason why I had tried to flash back and forth from Alt-F to stock D-Link, and back to Alt-F, many months ago. For now, I will wait for further instructions on how to proceed.

Joao Cardoso

unread,

Oct 24, 2019, 9:02:30 PM10/24/19

to Alt-F

On Thursday, October 24, 2019 at 7:39:44 AM UTC+1, Viktor wrote:

I did a lot of reading around these forums and some others, and went ahead to use dns323-firmware-tools on Alt-F-1.0-DNR-322L-rev-Ax.bin.

After splitting this Alt-F firmware into kernel and initrd, the box finally managed to boot Alt-F once again. Although from what I understand, this is just temporary, since the kernel and initrd were just being loaded from the USB drive.

Yes, if you have followed Andrew's recipe as in https://groups.google.com/d/msg/alt-f/vbDtHa8cjpU/PGM-rpO4GU4J

I would like to know if you can start the recovery kernel and initrd from within u-boot, before you try to flash Alt-F again.

The idea is to use the commands listed in the u-boot 'bootcmd' environment variable you sent above,

nand read.e 0xa00000 0x100000 0x300000;nand read.e 0xf00000 0x600000 0x300000;bootm 0xa00000 0xf00000

but replacing the nand read address (the second argument to the two nand read.e command) with the ones from the (possible?) recovery kernel and initrd.

I think the command should be

nand read.e 0xa00000 0x6f00800 0x300000;nand read.e 0xf00000 0x7200800 0x300000;bootm 0xa00000 0xf00000

If the numbers are correct you should see the "Loading Ramdisk" twice, then the "Start kernel" message and the kernel booting messages. Please post the full output.

The above commands will not write anything to the flash, so it is not dangerous, and if the kernel boots ok it will be the d-link one, which should start a minimal flash-only web page (the box IP will most likely be changed, and you also have to clear the browser cache).

You should do this before flashing from within Alt-F, because an error in the Alt-F-1.0 DNR-322L flash layout will erase some information from the flash.

The error is in the length of the mtd3 partition, which makes that at flashing time some data on the following mtd4 partition will be erased (the MAC address and part of the recovery firmware), nothing very dramatic.

If the recovery step runs OK, it is your choice to flash either the D-Link firmware or Alt-F. For further debugging, I would prefer you to flash the D-Link one, because with your serial adapter further details could be extracted from the box (that was never done before, the DNR-322L Alt-F firmware was built blindy, using the assumption that it should be equal to the one in the DNS-320-rev-A, thus the error in the mtd3 flash partition)

I tried flashing Alt-F-1.0-DNR-322L-rev-Ax.bin through the Alt-F web interface, but it wouldn't accept the file, throwing this error message: This firmware file has signature "1821" and does not seem compatible with supported firmware.

Yes, that is a know fact, as the release README said: see https://groups.google.com/d/msg/alt-f/G-ct1HAv1GI/08VGKJ3OBgAJ

This is an untested experimental version of Alt-F-1.0 for the D-Link
DNR-322L-rev-A.

It is based on the fact that the DNS-320-rev-A circuit board is
*visually* identical to the DNR-322L-rev-A circuit board, which is a
very weak evidence of compatibility. No other check or verification was
made, so flashing it might brick your box and make it unusable.

This firmware might be flashed using D-Link DNR-322L own firmware
upgrader, and after a reboot, if successful it will appear as a DNS-320
box running Alt-F-1.0. After the reboot the box IP and name can change,
so you need to consult in your router DHCP server the current client/IP
leases, or use a network scanner to find its new IP. The browser cache
should also be cleared after the flashing.

The Alt-F webUI will be able to flash only other DNS-320-rev-A firmware,
so to be able reflash the original vendors firmware further
modifications are needed.

So Alt-F on the DNR-322L only accepts firmware build for the DNS-320-rev-A.

Of course I have that already fixed, but a new (if/when) Alt-F release is needed. With your help, who knows? :-)

Anyway you now have the tools and knowledge to boot whichever you want (but beware with flashing)

Now that I think about it, this was likely the reason why I had tried to flash back and forth from Alt-F to stock D-Link, and back to Alt-F, many months ago. For now, I will wait for further instructions on how to proceed.

hmm, if you don't remember this "small" detail than unlikely you have not flashed it back and forth. Your initial flash has probably failed halfway between the kernel and the initrd flash step, so you ended up with a hybrid non-bootable system. This has also happened a few times to other Alt-F users.

Viktor

unread,

Oct 25, 2019, 2:03:44 AM10/25/19

to Alt-F

On Thursday, 24 October 2019 21:02:30 UTC-4, Joao Cardoso wrote:

On Thursday, October 24, 2019 at 7:39:44 AM UTC+1, Viktor wrote:
I did a lot of reading around these forums and some others, and went ahead to use dns323-firmware-tools on Alt-F-1.0-DNR-322L-rev-Ax.bin.

After splitting this Alt-F firmware into kernel and initrd, the box finally managed to boot Alt-F once again. Although from what I understand, this is just temporary, since the kernel and initrd were just being loaded from the USB drive.

Yes, if you have followed Andrew's recipe as in https://groups.google.com/d/msg/alt-f/vbDtHa8cjpU/PGM-rpO4GU4J

I didn't follow Andrew's recipe. I followed this: https://groups.google.com/forum/#!searchin/alt-f/dns323-firmware-tools|sort:date/alt-f/_eC-EIMAa1w/XdchEE6SGAAJ

Using usb drive instead of tftp.

I might have messed it up, somehow. Last night, I split the latest stock D-Link firmware for the DNR-322L, then when I booted it, this was the result:

Marvell>> bootm 0xa00000 0xf00000

## Booting image at 00a00000 ...

   Image Name:   Linux-2.6.31.8
   Created:      2014-06-10   7:37:08 UTC

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 2551516 Bytes = 2.4 MB

   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

## Loading Ramdisk Image at 00f00000 ...

   Image Name:   Ramdisk
   Created:      2014-06-10   8:29:25 UTC

Image Type: ARM Linux RAMDisk Image (gzip compressed)

Data Size: 1584662 Bytes = 1.5 MB

   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux.............................................................                                                                                                                                                             ................................................................................                                                                                                                                                             ....................... done, booting the kernel.
Linux version 2.6.31.8 (jack@swtest6) (gcc version 4.3.2 (sdk3.3-ct-ng-1.4.1) )                                                                                                                                                              #6 Tue Jun 10 15:37:06 CST 2014
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977

CPU: VIVT data cache, VIVT instruction cache

Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 65024
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 1024 (order: 10, 4096 bytes)

Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)

Memory: 256MB = 256MB total
Memory: 246528KB available (4808K code, 353K data, 136K init, 0K highmem)
Hierarchical RCU implementation.
NR_IRQS:128
Console: colour dummy device 80x30
Calibrating delay loop... 1196.03 BogoMIPS (lpj=5980160)
Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

NET: Registered protocol family 16

Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PEX1_MEM ....no such
PEX1_IO ....no such
INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB

  Marvell Development Board (LSP Version KW_LSP_5.1.3_patch29)-- DB-88F6281A-BP                                                                                                                                                               Soc: 88F6281 A1 LE

 Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c8040740
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
mvPexLocalBusNumSet: ERR. Invalid PEX interface 1
bio: create slab <bio-0> at 0

SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb

NET: Registered protocol family 2

IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered

NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...

rootfs image is not initramfs (no cpio magic); looks like an initrd
Freeing initrd memory: 1544K
rtc mv_rtc: rtc core: registered kw-rtc as rtc0
RTC registered
cpufreq: Init kirkwood cpufreq driver
XOR registered 4 channels
XOR 2nd invalidate WA enabled
cesadev_init(c000ed5c)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.2

Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher

Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.12)
msgmni has been set to 485
alg: No test for cipher_null (cipher_null-generic)
alg: No test for ecb(cipher_null) (ecb-cipher_null)
alg: No test for digest_null (digest_null-generic)
alg: No test for compress_null (compress_null-generic)
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
alg: No test for hmac(digest_null) (hmac(digest_null-generic))
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler anticipatory registered (default)
Initializing ths8200_init
Initializing dove_adi9889_init
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
console [ttyS0] enabled
serial8250.1: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A

brd: module loaded
loop: module loaded

Integrated Sata device found
IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi 0:0:0:0: Direct-Access     Seagate  ST340014AS       8.12 PQ: 0 ANSI: 5
scsi 0:0:0:0: Attached scsi generic sg0 type 0
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o 2 Giga ports supported
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload (TSO) supported
  o Large Receive offload (LRO) supported
  o Receive checksum offload supported
  o Transmit checksum offload supported
  o Network Fast Processing (Routing) supported - (Disabled)
  o Driver ERROR statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported - (Disabled)
  o SKB Recycle supported - (Disabled)
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
     o register under mv88fx_eth platform
     o egiga0, ifindex = 2, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c83f4000): 2048 entries, 8192 bytes
Counter=0, opIdx=6, overhead=16
Counter=1, opIdx=2, overhead=0
Counter=2, opIdx=1, overhead=18
Counter=3, opIdx=2, overhead=0
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bi                                                                                                                                                             t)

Scanning device for bad blocks
Bad eraseblock 126 at 0x000000fc0000
Bad eraseblock 906 at 0x000007140000

Using static partition definition
Creating 8 MTD partitions on "nand_mtd":

0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000600000 : "uImage"
0x000000600000-0x000000b00000 : "ramdisk"

0x000000b00000-0x000005100000 : "image"
0x000006f00000-0x000007900000 : "mini firmware"
0x000007900000-0x000007e00000 : "config"
0x000007e00000-0x000008000000 : "my-dlink"
0x000005100000-0x000006f00000 : "nuuo package"

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver

ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice

hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected

ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
uhci_hcd: USB Universal Host Controller Interface driver
mice: PS/2 mouse device common for all mice
i2c /dev entries driver

md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1

device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised: dm-d...@redhat.com

usbcore: registered new interface driver usbhid

usbhid: v2.6:USB HID core driver
TCP cubic registered

NET: Registered protocol family 17

RPC: Registered udp transport module.
RPC: Registered tcp transport module.
rtc mv_rtc: setting system clock to 2019-10-25 04:05:41 UTC (1571976341)
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...
md: ... autorun DONE.

RAMDISK: gzip image found at block 0

usb 1-1: new high speed USB device using ehci_marvell and address 2
VFS: Mounted root (ext2 filesystem) on device 1:0.
Freeing init memory: 136K
init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST)
starting pid 539, tty '': '/etc/rc.sh'
** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /usr/local/modules: not mounted
usb 1-1: configuration #1 chosen from 1 choice
first good block is 0
image len = 1835626867 , image checksum = 5f656761
image size error .(size can not > 128M)
Erase kernel
Erasing 128 Kibyte @ 4e0000 -- 97 % complete.
The system is going down NOW!
Sending SIGTERM to all processes
Sending SIGKILL to all processes
Requesting system reboot
md: stopping all md devices.
Restarting system.
Reseting !!

It seems just by booting the stock kernel and initrd, it created 8 mtd partitions on nand (?)

I would like to know if you can start the recovery kernel and initrd from within u-boot, before you try to flash Alt-F again.

The idea is to use the commands listed in the u-boot 'bootcmd' environment variable you sent above,
nand read.e 0xa00000 0x100000 0x300000;nand read.e 0xf00000 0x600000 0x300000;bootm 0xa00000 0xf00000

but replacing the nand read address (the second argument to the two nand read.e command) with the ones from the (possible?) recovery kernel and initrd.
I think the command should be

nand read.e 0xa00000 0x6f00800 0x300000;nand read.e 0xf00000 0x7200800 0x300000;bootm 0xa00000 0xf00000

If the numbers are correct you should see the "Loading Ramdisk" twice, then the "Start kernel" message and the kernel booting messages. Please post the full output.

The above commands will not write anything to the flash, so it is not dangerous, and if the kernel boots ok it will be the d-link one, which should start a minimal flash-only web page (the box IP will most likely be changed, and you also have to clear the browser cache).

I have tried both the unmodified nand read and your new nand read offsets. Both seemed to output a similar result. Here's the result with your new addresses:

Marvell>> nand read.e 0xa00000 0x6f00800 0x300000;nand read.e 0xf00000 0x7200800 0x300000;bootm 0xa00000 0xf00000

NAND read: device 0 offset 0x6f00800, size 0x300000
load addr ....  =a00000

Bad block at 0x7140000 in erase block from 0x7140000 will be skipped

 3145728 bytes read: OK

NAND read: device 0 offset 0x7200800, size 0x300000
load addr ....  =f00000

 3145728 bytes read: OK
## Booting image at 00a00000 ...

   Image Name:   Linux-2.6.22.18
   Created:      2011-06-27  10:22:38 UTC

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 2173684 Bytes = 2.1 MB

   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

## Loading Ramdisk Image at 00f00000 ...

Bad Magic Number


NAND read: device 0 offset 0x6f00800, size 0x500000
load addr ....  =a00000

Bad block at 0x7140000 in erase block from 0x7140000 will be skipped
 5242880 bytes read: OK
## Loading Ramdisk Image at 00d00000 ...
   Image Name:   Ramdisk

   Created:      2013-05-10   2:58:55 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    1764445 Bytes =  1.7 MB
   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux........................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (jack@swtest4) (gcc version 4.2.1) #3 Mon Jun 27 18:22:35 CST 2011
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 65024
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 1024 (order: 10, 4096 bytes)
Console: colour dummy device 80x30

Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)

Memory: 256MB 0MB 0MB 0MB = 256MB total
Memory: 253568KB available (4080K code, 247K data, 124K init)
Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

NET: Registered protocol family 16

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB

  Marvell Development Board (LSP Version KW_LSP_4.3.4_patch30)-- DB-88F6281A-BP  Soc: 88F6281 A1 LE

 Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c06ba600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled

SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb

NET: Registered protocol family 2

Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 1723K
cpufreq: Init kirkwood cpufreq driver
XOR registered 1 NET_DMA over 4 channels
XOR 2nd invalidate WA enabled
cesadev_init(c00119d8)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.1

Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)

squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
JFFS2 version 2.2. (NAND) Â© 2001-2006 Red Hat, Inc.
SGI XFS with large block numbers, no debug enabled
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.7 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
serial8250.0: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload enabled
  o LRO support supported
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported
  o SKB Recycle supported
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
    o  register under egiga0 platform
    o egiga0, ifindex = 1, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c0d62000): 2048 entries, 8192 bytes
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.1.1.1 $, nftlmount.c $Revision: 1.1.1.1 $
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)

Scanning device for bad blocks

Bad eraseblock 126 at 0x00fc0000
Bad eraseblock 906 at 0x07140000
Using static partition definition
Creating 7 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00600000 : "uImage"
0x00600000-0x00b00000 : "ramdisk"
0x00b00000-0x06f00000 : "image"
0x06f00000-0x07900000 : "mini firmware"
0x07900000-0x07e00000 : "config"
0x07e00000-0x08000000 : "my-dlink"
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice

hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected

USB Universal Host Controller Interface driver v3.0
mice: PS/2 mouse device common for all mice
i2c /dev entries driver

md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1

device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-d...@redhat.com
dm_crypt using the OCF package.
usb 1-1: new high speed USB device using ehci_marvell and address 2
usb 1-1: configuration #1 chosen from 1 choice

usbcore: registered new interface driver usbhid

drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
TCP cubic registered

NET: Registered protocol family 1

NET: Registered protocol family 17

md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
EXT2-fs warning: maximal mount count reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 124K
init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST)
starting pid 286, tty '': '/etc/rc.sh'
** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /usr/local/modules: not mounted
first good block is 0
image len = 1835626867 , image checksum = 5f656761
image size error .(size can not > 128M)
umount: /usr/local/tmp: not mounted
**** Dump Mini Image ****
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 1
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00a00000...
mount cmd:mount -t squashfs -o loop /usr/local/tmp/image.cfs /usr/local/modules
ln: /usr/sbin/system_init: File exists
rm: cannot remove '/usr/sbin/megatec_usb': No such file or directory
rm: cannot remove '/usr/sbin/tripplite_usb': No such file or directory
rm: cannot remove '/usr/sbin/usbhid-ups': No such file or directory
rm: cannot remove '/usr/sbin/bcmxcp_usb': No such file or directory
/usr/sbin/system_init: line 96: mtd_check: not found
** copy config files
chmod: /etc/mt-daapd.conf: No such file or directory
cp: cannot stat '/usr/local/config/user.log': No such file or directory
cp: cannot stat '/usr/local/config/user.log.old': No such file or directory
cp: cannot stat '/usr/local/modules/files/codepage': No such file or directory
cp: cannot stat '/usr/local/modules/files/model': No such file or directory
cp: cannot stat '/usr/local/modules/files/addons_run_list': No such file or directory
insmod: can't read '/usr/local/modules/driver/sd_mod.ko': No such file or directory
insmod: can't read '/usr/local/modules/driver/usblp.ko': No such file or directory
cat: can't open '/etc/model': No such file or directory
** set loopback interface
first good block is 0
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 1
Number of bbt blocks: 0
Block sizeegiga0: mac address changed
 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...
mac = 28:10:7B:1D:74:6A
egiga0: link down
egiga0: started
egiga0: link up, full duplex, speed 1 Gbps
    mode:         16384
-o  offset:       0
-f  frequency:    0
    maxerror:     16384000
    esterror:     16384000
    status:       64 (UNSYNC)
-p  timeconstant: 2
    precision:    1
    tolerance:    33554432
-t  tick:         9960
    time.tv_sec:  14
    time.tv_usec: 352644
    return value: 5 (clock not synchronized)
/usr/sbin/system_init: line 177: rtc: not found
** execute rc.init.sh
/usr/sbin/system_init: line 187: /etc/rc.d/rc.init.sh: not found

Module IPC SERVER Version:(1.00.20090706)

crond[643]: crond (busybox 1.11.2) started, log level 8

chk_io V1.00.10272010
support usb storage unmount
firmware error
** Get MAC Addr
Start Lighttpd Daemon

Please press Enter to activate this console. 1970-01-01 00:00:15: (../../src/log.c.166) server started
LED_POWER_ON

You should do this before flashing from within Alt-F, because an error in the Alt-F-1.0 DNR-322L flash layout will erase some information from the flash.

The error is in the length of the mtd3 partition, which makes that at flashing time some data on the following mtd4 partition will be erased (the MAC address and part of the recovery firmware), nothing very dramatic.

If the recovery step runs OK, it is your choice to flash either the D-Link firmware or Alt-F. For further debugging, I would prefer you to flash the D-Link one, because with your serial adapter further details could be extracted from the box (that was never done before, the DNR-322L Alt-F firmware was built blindy, using the assumption that it should be equal to the one in the DNS-320-rev-A, thus the error in the mtd3 flash partition)

The problem is, I can't get to the web UI for the recovery mode, if it's even loading up. I assume some web UI is available, as evidenced by Start Lighttpd Daemon. I cannot get the box to communicate with my computer, directly connected by ethernet. Also, I was trying to login to the console, but it's asking for a password for admin. I tried my old Alt-F password, and some other common ones, but none worked.

I tried flashing Alt-F-1.0-DNR-322L-rev-Ax.bin through the Alt-F web interface, but it wouldn't accept the file, throwing this error message: This firmware file has signature "1821" and does not seem compatible with supported firmware.

Yes, that is a know fact, as the release README said: see https://groups.google.com/d/msg/alt-f/G-ct1HAv1GI/08VGKJ3OBgAJ

This is an untested experimental version of Alt-F-1.0 for the D-Link
DNR-322L-rev-A.

It is based on the fact that the DNS-320-rev-A circuit board is
*visually* identical to the DNR-322L-rev-A circuit board, which is a
very weak evidence of compatibility. No other check or verification was
made, so flashing it might brick your box and make it unusable.

This firmware might be flashed using D-Link DNR-322L own firmware
upgrader, and after a reboot, if successful it will appear as a DNS-320
box running Alt-F-1.0. After the reboot the box IP and name can change,
so you need to consult in your router DHCP server the current client/IP
leases, or use a network scanner to find its new IP. The browser cache
should also be cleared after the flashing.

The Alt-F webUI will be able to flash only other DNS-320-rev-A firmware,
so to be able reflash the original vendors firmware further
modifications are needed.

So Alt-F on the DNR-322L only accepts firmware build for the DNS-320-rev-A.
Of course I have that already fixed, but a new (if/when) Alt-F release is needed. With your help, who knows? :-)

Anyway you now have the tools and knowledge to boot whichever you want (but beware with flashing)

Right now, only Alt-F boots up properly, from a USB drive. It gets its own IP, and the web UI is accessible. Trying to boot D-Link stock from both nand and USB drive seems to work, but I cannot connect to the box outside of the serial connection. For now, I just need to get to recovery mode, so that I can flash the full D-Link stock firmware and help out with the (hopefully) next version of Alt-F.

Now that I think about it, this was likely the reason why I had tried to flash back and forth from Alt-F to stock D-Link, and back to Alt-F, many months ago. For now, I will wait for further instructions on how to proceed.

hmm, if you don't remember this "small" detail than unlikely you have not flashed it back and forth. Your initial flash has probably failed halfway between the kernel and the initrd flash step, so you ended up with a hybrid non-bootable system. This has also happened a few times to other Alt-F users.

Probably.. Will try again tomorrow.

Ronaldo Antoni

unread,

Oct 25, 2019, 1:48:04 PM10/25/19

to al...@googlegroups.com

I watch the discussion with interest, because I have 3 boxes of these, all running Alt-f (one unused inclusive).
I remember João work to port Alt-F to the 320L, which I had the privilege of helping with some tests!
My knowledge is small, but I am available to assist if necessary and within my reach!

Ronaldo Antoni

--
You received this message because you are subscribed to the Google Groups "Alt-F" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/alt-f/88793fa3-a379-43d6-852c-bd1c37144e05%40googlegroups.com.

Joao Cardoso

unread,

Oct 25, 2019, 10:07:43 PM10/25/19

to Alt-F

On Friday, October 25, 2019 at 7:03:44 AM UTC+1, Viktor wrote:

On Thursday, 24 October 2019 21:02:30 UTC-4, Joao Cardoso wrote:

On Thursday, October 24, 2019 at 7:39:44 AM UTC+1, Viktor wrote:
I did a lot of reading around these forums and some others, and went ahead to use dns323-firmware-tools on Alt-F-1.0-DNR-322L-rev-Ax.bin.

After splitting this Alt-F firmware into kernel and initrd, the box finally managed to boot Alt-F once again. Although from what I understand, this is just temporary, since the kernel and initrd were just being loaded from the USB drive.

Yes, if you have followed Andrew's recipe as in https://groups.google.com/d/msg/alt-f/vbDtHa8cjpU/PGM-rpO4GU4J

I didn't follow Andrew's recipe. I followed this: https://groups.google.com/forum/#!searchin/alt-f/dns323-firmware-tools|sort:date/alt-f/_eC-EIMAa1w/XdchEE6SGAAJ
Using usb drive instead of tftp.

I might have messed it up, somehow. Last night, I split the latest stock D-Link firmware for the DNR-322L, then when I booted it, this was the result:

Several hints:

-After loading, remove the USB stick before executing the bootm command. Perhaps removing the stick is not the appropriate thing to do, perhaps a usb stop command or similar exists, don't know, try "usb help". As "usb start" exists, mightbe a "usb stop" also exists, after that remove the stick before the loadm -- I'm away from my boxes, can't check).

-Try the recovery without the USB stick attached (but I might have made a mistake on the rescue initramfs NAND address)

-To bypass the D-Link login/password prompt when in recovery, type just 5784468 (not sure, will verify when back at home)

-you can flash the Alt-F-1.0-DNS-320-rev-A firmware while in Alt-F using its the webUI, it's identical to the DNR-322L (the electronic boards are identical). But you will lose the MAC address (it's printed in the box bottom or back label anyway), and the recovery image.

-while in Alt-F you can manually flash a splitted d-link fw, bypassing the webUI. But I can only give further details when I'm back at home. The manual flashing will flash the kernel (mtd1), initramfs (mtd2) and "image" (mtd3), but has to have a special handcraft flash-erase command to not erase the mini-firmware (mtd4, where the MAC and recovery is stored).

More comments intermixed. some very technical, some personal for future reference, just glimpse.

Thanks for your continued support and attention

...

NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bi t) Scanning device for bad blocks Bad eraseblock 126 at 0x000000fc0000 Bad eraseblock 906 at 0x000007140000 Using static partition definition Creating 8 MTD partitions on "nand_mtd":

There are no changes to the NAND. "creating" just means "create internally for kernel usage", those are predefined values that the kernel uses, as the line before says: "using static partitions definitions".

NAND does not have a partition table, partitions in NAND are just a handy way to avoid usage of the long hexadecimal numbers -- its easy to say and use "first byte of mtd3" then byte at offset 0x0600000. You will see different partitions depending on which kernel you use, it's predefined in each kernel.

0x000000000000-0x000000100000 : "u-boot" 0x000000100000-0x000000600000 : "uImage" 0x000000600000-0x000000b00000 : "ramdisk" 0x000000b00000-0x000005100000 : "image" 0x000006f00000-0x000007900000 : "mini firmware" 0x000007900000-0x000007e00000 : "config" 0x000007e00000-0x000008000000 : "my-dlink" 0x000005100000-0x000006f00000 : "nuuo package"

Never heard about that nuuo package. Notice that it is physically next to the "image" partition

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci_marvell ehci_marvell.70059: Marvell Orion EHCI ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1 ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100 ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver

...

RAMDISK: gzip image found at block 0 usb 1-1: new high speed USB device using ehci_marvell and address 2 VFS: Mounted root (ext2 filesystem) on device 1:0. Freeing init memory: 136K init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST) starting pid 539, tty '': '/etc/rc.sh' ** Mounting /etc/fstab umount: proc: not mounted umount: proc: not mounted umount: /usr/local/modules: not mounted usb 1-1: configuration #1 chosen from 1 choice first good block is 0 image len = 1835626867 , image checksum = 5f656761

are you using a 2GB stick? It looks like that the d-link fw is trying to open and use it, perhaps a development facility. Try removing the USB stick before bootm.

image size error .(size can not > 128M) Erase kernel Erasing 128 Kibyte @ 4e0000 -- 97 % complete.

hmmm, that is worrying... we don't know what NAND partition is being used in that erase.

The system is going down NOW! Sending SIGTERM to all processes Sending SIGKILL to all processes Requesting system reboot md: stopping all md devices. Restarting system. Reseting !!

init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST)

It seems just by booting the stock kernel and initrd, it created 8 mtd partitions on nand (?)

No, see comments above

I would like to know if you can start the recovery kernel and initrd from within u-boot, before you try to flash Alt-F again.

The idea is to use the commands listed in the u-boot 'bootcmd' environment variable you sent above,
nand read.e 0xa00000 0x100000 0x300000;nand read.e 0xf00000 0x600000 0x300000;bootm 0xa00000 0xf00000

but replacing the nand read address (the second argument to the two nand read.e command) with the ones from the (possible?) recovery kernel and initrd.
I think the command should be

nand read.e 0xa00000 0x6f00800 0x300000;nand read.e 0xf00000 0x7200800 0x300000;bootm 0xa00000 0xf00000

If the numbers are correct you should see the "Loading Ramdisk" twice, then the "Start kernel" message and the kernel booting messages. Please post the full output.

The above commands will not write anything to the flash, so it is not dangerous, and if the kernel boots ok it will be the d-link one, which should start a minimal flash-only web page (the box IP will most likely be changed, and you also have to clear the browser cache).

I have tried both the unmodified nand read and your new nand read offsets. Both seemed

Ah, "seems", the untrained eye says :)

to output a similar result. Here's the result with your new addresses:

Marvell>> nand read.e 0xa00000 0x6f00800 0x300000;nand read.e 0xf00000 0x7200800 0x300000;bootm 0xa00000 0xf00000 NAND read: device 0 offset 0x6f00800, size 0x300000 load addr .... =a00000 Bad block at 0x7140000 in erase block from 0x7140000 will be skipped

That might be worrying... if the error developed after the image was flashed, it will be faulty and it checksum will not match.

3145728 bytes read: OK NAND read: device 0 offset 0x7200800, size 0x300000 load addr .... =f00000 3145728 bytes read: OK ## Booting image at 00a00000 ... Image Name: Linux-2.6.22.18 Created: 2011-06-27 10:22:38 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2173684 Bytes = 2.1 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK

Seems like the bad block was a manufacturer marked one, so skipping it was OK.

## Loading Ramdisk Image at 00f00000 ... Bad Magic Number

Well, the initramfs/initrd was not there at 0x7200800. My mistake (or a NAND error?). I educately "guessed" it using Ronaldo's mtd3/mtd4 flash dump and searching for the u-boot signature, but I might have done made a mistake. Will check it again when at home. ah... wait, one bad block has been spiked, just before when reading the kernel image. Must the second nand read account for that? No, it does not make sense. but. Don't worry, I'm just talking to myself.

NAND read: device 0 offset 0x6f00800, size 0x500000

and because of the error u-boot enter rescue mode.

again, for my own future reference... ah, it does not reads the kernel and initramfs separately, it uses one big read of 0x500000 instead of two of 0x300000.

load addr .... =a00000 Bad block at 0x7140000 in erase block from 0x7140000 will be skipped 5242880 bytes read: OK ## Loading Ramdisk Image at 00d00000 ... Image Name: Ramdisk Created: 2013-05-10 2:58:55 UTC Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 1764445 Bytes = 1.7 MB Load Address: 00e00000 Entry Point: 00e00000 Verifying Checksum ... OK Starting kernel ...

...................................................... done, booting the kernel.

...deleting, the original is above

Scanning device for bad blocks Bad eraseblock 126 at 0x00fc0000 Bad eraseblock 906 at 0x07140000 Using static partition definition Creating 7 MTD partitions on "nand_mtd": 0x00000000-0x00100000 : "u-boot" 0x00100000-0x00600000 : "uImage" 0x00600000-0x00b00000 : "ramdisk" 0x00b00000-0x06f00000 : "image" 0x06f00000-0x07900000 : "mini firmware" 0x07900000-0x07e00000 : "config" 0x07e00000-0x08000000 : "my-dlink"

Notice how this table is different? This is what I was expecting, it looks like a DNS-320L.

first good block is 0 image len = 1835626867 , image checksum = 5f656761 image size error .(size can not > 128M)

I guess that you don't remember if the USB stick was plugged at this time, do you?

umount: /usr/local/tmp: not mounted **** Dump Mini Image ****

recovery is trying to do something... dumping

ECC failed: 0 ECC corrected: 0 Number of bad blocks: 1 Number of bbt blocks: 0 Block size 131072, page size 2048, OOB size 64 Dumping data starting at 0x00000000 and ending at 0x00a00000...

...

** copy config files

...

first good block is 0 ECC failed: 0 ECC corrected: 0 Number of bad blocks: 1 Number of bbt blocks: 0 Block sizeegiga0: mac address changed 131072, page size 2048, OOB size 64 Dumping data starting at 0x00000000 and ending at 0x00000800...

...

support usb storage unmount firmware error

hmmm recovery failed at some point

** Get MAC Addr Start Lighttpd Daemon Please press Enter to activate this console.

I think that is at this point that you should enter the "high tech trade secret" code 5784468

You should do this before flashing from within Alt-F, because an error in the Alt-F-1.0 DNR-322L flash layout will erase some information from the flash.
The error is in the length of the mtd3 partition, which makes that at flashing time some data on the following mtd4 partition will be erased (the MAC address and part of the recovery firmware), nothing very dramatic.

If the recovery step runs OK, it is your choice to flash either the D-Link firmware or Alt-F. For further debugging, I would prefer you to flash the D-Link one, because with your serial adapter further details could be extracted from the box (that was never done before, the DNR-322L Alt-F firmware was built blindy, using the assumption that it should be equal to the one in the DNS-320-rev-A, thus the error in the mtd3 flash partition)

The problem is, I can't get to the web UI for the recovery mode, if it's even loading up. I assume some web UI is available, as evidenced by Start Lighttpd Daemon. I cannot get the box to communicate with my computer, directly connected by ethernet. Also, I was trying to login to the console, but it's asking for a password for admin. I tried my old Alt-F password, and some other common ones, but none worked.

you shouldn't try to login, nor enter enter "admin" etc, just type the breakin code

...

Right now, only Alt-F boots up properly, from a USB drive. It gets its own IP, and the web UI is accessible. Trying to boot D-Link stock from both nand and USB drive seems to work, but I cannot connect to the box outside of the serial connection. For now, I just need to get to recovery mode, so that I can flash the full D-Link stock firmware

You can't do that, flash the *full* firmware. you can only flash the kernel (mtd1), ramdisk (mtd2) and image (mtd3) .. that's all that a fw file contains. The recovery (what d-link call "mini-firmware" partition) or u-boot (mtd0) is not in the distributed firmware. I don't known, but I suspect that the "my-dlink" (mtd6) partition is also unique to each box, as mtd4 is (it contains the MAC and the recovery)

and help out with the (hopefully) next version of Alt-F.

...

Viktor

unread,

Oct 26, 2019, 12:10:49 AM10/26/19

to Alt-F

On Friday, 25 October 2019 22:07:43 UTC-4, Joao Cardoso wrote:

On Friday, October 25, 2019 at 7:03:44 AM UTC+1, Viktor wrote:

On Thursday, 24 October 2019 21:02:30 UTC-4, Joao Cardoso wrote:

On Thursday, October 24, 2019 at 7:39:44 AM UTC+1, Viktor wrote:
I did a lot of reading around these forums and some others, and went ahead to use dns323-firmware-tools on Alt-F-1.0-DNR-322L-rev-Ax.bin.

After splitting this Alt-F firmware into kernel and initrd, the box finally managed to boot Alt-F once again. Although from what I understand, this is just temporary, since the kernel and initrd were just being loaded from the USB drive.

Yes, if you have followed Andrew's recipe as in https://groups.google.com/d/msg/alt-f/vbDtHa8cjpU/PGM-rpO4GU4J

I didn't follow Andrew's recipe. I followed this: https://groups.google.com/forum/#!searchin/alt-f/dns323-firmware-tools|sort:date/alt-f/_eC-EIMAa1w/XdchEE6SGAAJ
Using usb drive instead of tftp.

I might have messed it up, somehow. Last night, I split the latest stock D-Link firmware for the DNR-322L, then when I booted it, this was the result:

I'm kinda stuck with no progress tonight...

Several hints:

-After loading, remove the USB stick before executing the bootm command. Perhaps removing the stick is not the appropriate thing to do, perhaps a usb stop command or similar exists, don't know, try "usb help". As "usb start" exists, mightbe a "usb stop" also exists, after that remove the stick before the loadm -- I'm away from my boxes, can't check).

I tried safely removing the USB drive, which is an old 512MB drive, but there's no change to the boot log. Also, even without any usb or internal hard drives attached, the boot sequence remains unchanged (to my admittedly untrained eye). It still contains these lines:

image len = 1835626867 , image checksum = 5f656761

image size error .(size can not > 128M)

-Try the recovery without the USB stick attached (but I might have made a mistake on the rescue initramfs NAND address)

-To bypass the D-Link login/password prompt when in recovery, type just 5784468 (not sure, will verify when back at home)

This code did not work for me. I tried it several times, carefully entering the numbers, but it alwas says "Login incorrect".

-you can flash the Alt-F-1.0-DNS-320-rev-A firmware while in Alt-F using its the webUI, it's identical to the DNR-322L (the electronic boards are identical). But you will lose the MAC address (it's printed in the box bottom or back label anyway), and the recovery image.

-while in Alt-F you can manually flash a splitted d-link fw, bypassing the webUI. But I can only give further details when I'm back at home. The manual flashing will flash the kernel (mtd1), initramfs (mtd2) and "image" (mtd3), but has to have a special handcraft flash-erase command to not erase the mini-firmware (mtd4, where the MAC and recovery is stored).

As much as I would like to have Alt-F back up and running, I wouldn't want to lose the recovery image, especially if it's important for further development of Alt-F on the DNR-322L. I would rather wait for the manual flash of the split D-Link file. I already have the kernel and initrd pairs for the 2 latest firmware versions. Where do we get the image/mtd3 file? Is that the whole firmware .bin file?

More comments intermixed. some very technical, some personal for future reference, just glimpse.

Thanks for your continued support and attention

...

NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bi t) Scanning device for bad blocks Bad eraseblock 126 at 0x000000fc0000 Bad eraseblock 906 at 0x000007140000 Using static partition definition Creating 8 MTD partitions on "nand_mtd":

There are no changes to the NAND. "creating" just means "create internally for kernel usage", those are predefined values that the kernel uses, as the line before says: "using static partitions definitions".
NAND does not have a partition table, partitions in NAND are just a handy way to avoid usage of the long hexadecimal numbers -- its easy to say and use "first byte of mtd3" then byte at offset 0x0600000. You will see different partitions depending on which kernel you use, it's predefined in each kernel.

I see, thanks for the explanation. I would like to point out, though, that after the first time I booted up the split D-Link firmware, I have not seen the Alt-F kernel boot. I'm talking about a straight boot, without stopping u-boot and modifying boot parameters. Prior to this, the Alt-F kernel would load, together with the D-Link initrd, then stop at a kernel panic because it doesn't support gzip. Now, it just boots both kernel and initrd from D-Link.

0x000000000000-0x000000100000 : "u-boot" 0x000000100000-0x000000600000 : "uImage" 0x000000600000-0x000000b00000 : "ramdisk" 0x000000b00000-0x000005100000 : "image" 0x000006f00000-0x000007900000 : "mini firmware" 0x000007900000-0x000007e00000 : "config" 0x000007e00000-0x000008000000 : "my-dlink" 0x000005100000-0x000006f00000 : "nuuo package"

Never heard about that nuuo package. Notice that it is physically next to the "image" partition

I noticed this too, and a quick search of "nuuo" revealed a company involved with surveillance cameras and NVRs. Which makes sense since the DNR-322L is marketed as an NVR instead of just a NAS.

I don't think it matters, since it throws that image size error regardless.

Unfortunately, the secret code didn't work for me :(

...
Right now, only Alt-F boots up properly, from a USB drive. It gets its own IP, and the web UI is accessible. Trying to boot D-Link stock from both nand and USB drive seems to work, but I cannot connect to the box outside of the serial connection. For now, I just need to get to recovery mode, so that I can flash the full D-Link stock firmware

You can't do that, flash the *full* firmware. you can only flash the kernel (mtd1), ramdisk (mtd2) and image (mtd3) .. that's all that a fw file contains. The recovery (what d-link call "mini-firmware" partition) or u-boot (mtd0) is not in the distributed firmware. I don't known, but I suspect that the "my-dlink" (mtd6) partition is also unique to each box, as mtd4 is (it contains the MAC and the recovery)

I understand. I'll just wait for the instructions to flash the D-Link split firmware through Alt-F.

João Cardoso

unread,

Oct 28, 2019, 3:20:48 PM10/28/19

to al...@googlegroups.com

>This code did not work for me. I tried it several times, carefully entering the numbers, but it alwas says "Login incorrect".

Looks like the magic 5784468 is no longer in use, according to Firmware: 2.03 release notes dated 2012/9/13, in http://support.dlink.com.au/download/download.aspx?product=dns-320&revision=rev_a&filetype=setupguides

Change admin password input from console or telnet. Admin password for console or telnet admin password is now set by ui instead of 5784468

This means that without that even if you have serial access, you will not be able to break into the system; you have to try again after setting a password.

>As much as I would like to have Alt-F back up and running, I wouldn't want to lose the recovery image, especially if it's important for further development of Alt-F on the DNR-322L. I would rather wait for the manual flash of the split D-Link file. I already have the kernel and initrd pairs for the 2 latest firmware versions. Where do we get the image/mtd3 file? Is that the whole firmware .bin file?

I think that the tools you are using are dated and only supports splitting the dns-323/321. For other models firmware you have to use Alt-F own 'dns323-fw':

-Split a vendor firmware file into its components:
       dns323-fw -s [-q (quiet)]
       [-k kernel_file] [-i initramfs_file] [-a sqimage_file] [-d defaults_file] firmware_file
-Merge a kernel and initramfs into a firmware compatible vendor firmware file:
       dns323-fw -m [-q (quiet)]
       -k kernel_file -i initramfs_file [-a sqimage_file] [-d defaults_file]
       [-p product_id] [-c custom_id] [-l model_id ] [-u sub_id] [-v new_version]
       [-t type (0-FrodoII, 1-Chopper, 2-Gandolf, 3-DNS-325-Ax, 4-DNS-320-Ax, 5-DNS-320-Bx,
               6-DNS-320L-Ax, 7-DNS-327L-Ax, 8-DNR-322L-Ax)] firmware_file
-Print information from a firmware file:
       dns323-fw -f firmware_file

I attach the binary to be run on the box, as the one contained in Alt-F-1.0 firmware does not recognizes the DNR-322L

When applied to DNR-322L_REVA_FIRMWARE_2.40.B03, it shows:

product_id=1;
custom_id=8;
model_id=2;
sub_id=1;
NewVersion=1;
signature="DNR-322";

sig_num=8 header=128 Next_offset=52105708
ko=128          kl=2551580      kr=0    kc=2977216790   next=2551708 # kernel ~2.5MB
io=2551708      il=1584728      ir=0    ic=2452063467   next=4136436 # initramfs ~1.5MB
so=4136436      sl=47962112     sr=0    sc=47960064     next=52098548 # image ~48MB
do=52098548     dl=7160         dr=0    dc=4003845539   next=52105708 # defaults
filesz=58145356 compsz=52105708
Next header at 52105708: dir=/mnt/HD_a4/install file=DNR-322L-nuuo_package
       off=52105804 len=6039552 checksum=3931040870 next_offset=0

dns323-fw does not extracts the DNR-322L-nuuo_package, but with some magic I was able see it is a CRAM filesystem and extracting and mounting it it contains:

-rwxr-xr-x 1 root root   653936 jan 1 1970 ACTi.so*
-rwxr-xr-x 1 root root   785588 jan 1 1970 Alpha2.so*
-rwxr-xr-x 1 root root   350964 jan 1 1970 Alpha.so*
-rwxr-xr-x 1 root root   515496 jan 1 1970 Arecont.so*
-rwxr-xr-x 1 root root    19316 jan 1 1970 autodect2.js*
-rwxr-xr-x 1 root root    19316 jan 1 1970 autodect.js*
-rwxr-xr-x 1 root root       89 jan 1 1970 DevicePack.conf*
-rwxr-xr-x 1 root root   799040 jan 1 1970 Hunt.so*
-rwxr-xr-x 1 root root   465528 jan 1 1970 libcgi_funcs.so*
-rwxr-xr-x 1 root root   406908 jan 1 1970 libdpessential.so*
-rwxr-xr-x 1 root root   389572 jan 1 1970 libdpinterface.so*
-rwxr-xr-x 1 root root    21596 jan 1 1970 libpanashared.so*
-rwxr-xr-x 1 root root   817920 jan 1 1970 libRTSPClient.so*
-rwxr-xr-x 1 root root 11004476 jan 1 1970 Onvif.so*
-rwxr-xr-x 1 root root 1023776 jan 1 1970 Vivotek.so*

which are dynamic libraries.

They might not be needed for normal operation, but it can't be flashed from within Alt-F, as it requires mtds, the "nuuo package" partition.

>I would like to point out, though, that after the first time I booted up the split D-Link firmware, I have not seen the Alt-F kernel boot. I'm talking about a straight boot, without stopping u-boot and modifying boot parameters. Prior to this, the Alt-F kernel would load, together with the D-Link initrd, then stop at a kernel panic because it doesn't support gzip. Now, it just boots both kernel and initrd from D-Link.

That means that recovery has done at least part of its job, and it has flashed at least a new kernel (and perhaps an initramfs), but it couldn't flash the "image", that is too large, ~50MB, and does not fit in the recovery partition, which only has ~10MB. It also explains why the "erase" and other NAND related messages while recovery was running.

What I find strange is that its webui does not appears -- have you performed a network scan? At what point does the plain boot to d-link fw now stops?

So, you can only flash mtd1, mtd2 and mtd3 and hope that it is enough for the D-Link webUI to appear and allow you to flash the whole thing (this is, the "nuuo package" and recreate "config"; the "d-link" partition is gone).

So, flashing...

-bootm into Alt-F and use its webUI

-probably its config have gone, if so, reconfigure as needed

-unzip and transfer the d-link firmware to the box, e.g. to /Public/RW, as well as the dns323-fw attached binary. If you are working with no disks, transfer directly to /tmp

-telnet or ssh the box (if sshing you might have a warning, as the ssh host key has probably been changed)

cd /tmp
cp /Public/RW/dns323-fw . # yes, its a dot
chmod +x dns323-fw # make the binary executable, depending on transfer methods it might be needed
./dns323-fw -s /Public/RW/DNR-322L_REVA_FIRMWARE... # split the fw file creating the following files: kernel initramfs sqimage defaults
rm DNR-322L_REVA_FIRMWARE... # if you have the fw file in /tmp, save memory space

flash_erase /dev/mtd1 0 0; echo $? # erase whole mtd1 flash partition. This has to be done before writing to it
nandwrite -mp /dev/mtd1 kernel; echo $? # flash the kernel, marking as a bad block when a block write fails

flash_erase /dev/mtd2 0 0; echo $? # same for initramfs
nandwrite -mp /dev/mtd2 initramfs; echo $? 

es=$(cat /sys/class/mtd/mtd3/erasesize) # flash erase block size
count=$(expr $(stat -t sqimage | cut -d" " -f2) / $es + 20) # number of erase blocks to erase, allow for an extra 20 blocks. 
echo $count # this should print about 385, it nothing is printed or is too big (near 800) stop!
flash_erase /dev/mtd3 0 $count; echo $? # only erase the minimum needed for sqimage
nandwrite -mp /dev/mtd3 sqimage; echo $? 

reboot

The 'echo $?' at the end of each command should print a '0' if the command returns success or other value if there was an error. If it does no returns a '0', check the command and repeat it before going to the next one. With verbose output the error origin/message is not necessary near the output end, you might have to scroll up.

Please post (attach if possible) the commands output and also the full log from the reboot.

If it seems to work, go to the d-link webUI, and use their firmware update page to reflash the box and reboot. Hopefully it will install the nuuo package in the flash partition; you should also "save settings" and I expect that it reformats the config flash partition. You can only see if this works by checking that your changes survive a reboot. I don't expect the my-dlink flash partition to be usable, perhaps installing it as one d-link package? To break-in in the serial prompt you can try to use your newly created password, I don't know, perhaps asking for it in d-link forums?

I think that's all, please report your progress,

Thanks

dns323-fw

João Cardoso

unread,

Oct 28, 2019, 3:32:01 PM10/28/19

to Alt-F

There was an error in the procedure, now fixed. Proceed stewise.

Viktor

unread,

Oct 29, 2019, 1:33:14 AM10/29/19

to al...@googlegroups.com

Now we're making some nice progress. Here's the telnet session for flashing:

[root@barney]# ./dns323-fw -s /mnt/DNR/DNR-322L_Ax_v2.60b15.bin

product_id=1;
custom_id=8;
model_id=2;
sub_id=1;
NewVersion=1;
signature="DNR-322";

sig_num=8 header=128 Next_offset=52908524

ko=128 kl=2551580 kr=0 kc=2977216790 next=2551708

io=2551708 il=1584728 ir=0 ic=2452063467 next=4136436

so=4136436      sl=48764928     sr=0    sc=48762880     next=52901364
do=52901364     dl=7160         dr=0    dc=2411735095   next=52908524
filesz=52908524 compsz=59468364
Next header at 52908524: dir=/mnt/HD_a4/install file=DNR-322L-nuuo_package
        off=52908620 len=6559744 checksum=3933658214 next_offset=0

WARNING, this firmware has unknown components.

signature is "DNR-322"
kernel saved, checksum is OK.
initramfs saved, checksum is OK.
sqimage saved, checksum is OK.
defaults saved, checksum is OK.
[root@barney]# flash_erase /dev/mtd1 0 0; echo $?
Erasing 128 Kibyte @ 4e0000 -- 100 % complete
0
[root@barney]# nandwrite -mp /dev/mtd1 kernel; echo $?
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
0
[root@barney]# flash_erase /dev/mtd2 0 0; echo $?
Erasing 128 Kibyte @ 4e0000 -- 100 % complete
0
[root@barney]# nandwrite -mp /dev/mtd2 initramfs; echo $?
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
0
[root@barney]# es=$(cat /sys/class/mtd/mtd3/erasesize)
[root@barney]# count=$(expr $(stat -t sqimage | cut -d" " -f2) / $es + 20)
[root@barney]# echo $count
392
[root@barney]# flash_erase /dev/mtd3 0 $count; echo $?
Erasing 128 Kibyte @ 4a0000 --  9 % complete flash_erase: Skipping bad block at 004c0000
Erasing 128 Kibyte @ 30e0000 -- 100 % complete
0
[root@barney]# nandwrite -mp /dev/mtd3 sqimage; echo $?
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
Writing data to block 20 at offset 0x280000
Writing data to block 21 at offset 0x2a0000
Writing data to block 22 at offset 0x2c0000
Writing data to block 23 at offset 0x2e0000
Writing data to block 24 at offset 0x300000
Writing data to block 25 at offset 0x320000
Writing data to block 26 at offset 0x340000
Writing data to block 27 at offset 0x360000
Writing data to block 28 at offset 0x380000
Writing data to block 29 at offset 0x3a0000
Writing data to block 30 at offset 0x3c0000
Writing data to block 31 at offset 0x3e0000
Writing data to block 32 at offset 0x400000
Writing data to block 33 at offset 0x420000
Writing data to block 34 at offset 0x440000
Writing data to block 35 at offset 0x460000
Writing data to block 36 at offset 0x480000
Writing data to block 37 at offset 0x4a0000
Writing data to block 38 at offset 0x4c0000
Bad block at 4c0000, 1 block(s) from 4c0000 will be skipped
Writing data to block 39 at offset 0x4e0000
Writing data to block 40 at offset 0x500000
Writing data to block 41 at offset 0x520000
Writing data to block 42 at offset 0x540000
Writing data to block 43 at offset 0x560000
Writing data to block 44 at offset 0x580000
Writing data to block 45 at offset 0x5a0000
Writing data to block 46 at offset 0x5c0000
Writing data to block 47 at offset 0x5e0000
Writing data to block 48 at offset 0x600000
Writing data to block 49 at offset 0x620000
Writing data to block 50 at offset 0x640000
Writing data to block 51 at offset 0x660000
Writing data to block 52 at offset 0x680000
Writing data to block 53 at offset 0x6a0000
Writing data to block 54 at offset 0x6c0000
Writing data to block 55 at offset 0x6e0000
Writing data to block 56 at offset 0x700000
Writing data to block 57 at offset 0x720000
Writing data to block 58 at offset 0x740000
Writing data to block 59 at offset 0x760000
Writing data to block 60 at offset 0x780000
Writing data to block 61 at offset 0x7a0000
Writing data to block 62 at offset 0x7c0000
Writing data to block 63 at offset 0x7e0000
Writing data to block 64 at offset 0x800000
Writing data to block 65 at offset 0x820000
Writing data to block 66 at offset 0x840000
Writing data to block 67 at offset 0x860000
Writing data to block 68 at offset 0x880000
Writing data to block 69 at offset 0x8a0000
Writing data to block 70 at offset 0x8c0000
Writing data to block 71 at offset 0x8e0000
Writing data to block 72 at offset 0x900000
Writing data to block 73 at offset 0x920000
Writing data to block 74 at offset 0x940000
Writing data to block 75 at offset 0x960000
Writing data to block 76 at offset 0x980000
Writing data to block 77 at offset 0x9a0000
Writing data to block 78 at offset 0x9c0000
Writing data to block 79 at offset 0x9e0000
Writing data to block 80 at offset 0xa00000
Writing data to block 81 at offset 0xa20000
Writing data to block 82 at offset 0xa40000
Writing data to block 83 at offset 0xa60000
Writing data to block 84 at offset 0xa80000
Writing data to block 85 at offset 0xaa0000
Writing data to block 86 at offset 0xac0000
Writing data to block 87 at offset 0xae0000
Writing data to block 88 at offset 0xb00000
Writing data to block 89 at offset 0xb20000
Writing data to block 90 at offset 0xb40000
Writing data to block 91 at offset 0xb60000
Writing data to block 92 at offset 0xb80000
Writing data to block 93 at offset 0xba0000
Writing data to block 94 at offset 0xbc0000
Writing data to block 95 at offset 0xbe0000
Writing data to block 96 at offset 0xc00000
Writing data to block 97 at offset 0xc20000
Writing data to block 98 at offset 0xc40000
Writing data to block 99 at offset 0xc60000
Writing data to block 100 at offset 0xc80000
Writing data to block 101 at offset 0xca0000
Writing data to block 102 at offset 0xcc0000
Writing data to block 103 at offset 0xce0000
Writing data to block 104 at offset 0xd00000
Writing data to block 105 at offset 0xd20000
Writing data to block 106 at offset 0xd40000
Writing data to block 107 at offset 0xd60000
Writing data to block 108 at offset 0xd80000
Writing data to block 109 at offset 0xda0000
Writing data to block 110 at offset 0xdc0000
Writing data to block 111 at offset 0xde0000
Writing data to block 112 at offset 0xe00000
Writing data to block 113 at offset 0xe20000
Writing data to block 114 at offset 0xe40000
Writing data to block 115 at offset 0xe60000
Writing data to block 116 at offset 0xe80000
Writing data to block 117 at offset 0xea0000
Writing data to block 118 at offset 0xec0000
Writing data to block 119 at offset 0xee0000
Writing data to block 120 at offset 0xf00000
Writing data to block 121 at offset 0xf20000
Writing data to block 122 at offset 0xf40000
Writing data to block 123 at offset 0xf60000
Writing data to block 124 at offset 0xf80000
Writing data to block 125 at offset 0xfa0000
Writing data to block 126 at offset 0xfc0000
Writing data to block 127 at offset 0xfe0000
Writing data to block 128 at offset 0x1000000
Writing data to block 129 at offset 0x1020000
Writing data to block 130 at offset 0x1040000
Writing data to block 131 at offset 0x1060000
Writing data to block 132 at offset 0x1080000
Writing data to block 133 at offset 0x10a0000
Writing data to block 134 at offset 0x10c0000
Writing data to block 135 at offset 0x10e0000
Writing data to block 136 at offset 0x1100000
Writing data to block 137 at offset 0x1120000
Writing data to block 138 at offset 0x1140000
Writing data to block 139 at offset 0x1160000
Writing data to block 140 at offset 0x1180000
Writing data to block 141 at offset 0x11a0000
Writing data to block 142 at offset 0x11c0000
Writing data to block 143 at offset 0x11e0000
Writing data to block 144 at offset 0x1200000
Writing data to block 145 at offset 0x1220000
Writing data to block 146 at offset 0x1240000
Writing data to block 147 at offset 0x1260000
Writing data to block 148 at offset 0x1280000
Writing data to block 149 at offset 0x12a0000
Writing data to block 150 at offset 0x12c0000
Writing data to block 151 at offset 0x12e0000
Writing data to block 152 at offset 0x1300000
Writing data to block 153 at offset 0x1320000
Writing data to block 154 at offset 0x1340000
Writing data to block 155 at offset 0x1360000
Writing data to block 156 at offset 0x1380000
Writing data to block 157 at offset 0x13a0000
Writing data to block 158 at offset 0x13c0000
Writing data to block 159 at offset 0x13e0000
Writing data to block 160 at offset 0x1400000
Writing data to block 161 at offset 0x1420000
Writing data to block 162 at offset 0x1440000
Writing data to block 163 at offset 0x1460000
Writing data to block 164 at offset 0x1480000
Writing data to block 165 at offset 0x14a0000
Writing data to block 166 at offset 0x14c0000
Writing data to block 167 at offset 0x14e0000
Writing data to block 168 at offset 0x1500000
Writing data to block 169 at offset 0x1520000
Writing data to block 170 at offset 0x1540000
Writing data to block 171 at offset 0x1560000
Writing data to block 172 at offset 0x1580000
Writing data to block 173 at offset 0x15a0000
Writing data to block 174 at offset 0x15c0000
Writing data to block 175 at offset 0x15e0000
Writing data to block 176 at offset 0x1600000
Writing data to block 177 at offset 0x1620000
Writing data to block 178 at offset 0x1640000
Writing data to block 179 at offset 0x1660000
Writing data to block 180 at offset 0x1680000
Writing data to block 181 at offset 0x16a0000
Writing data to block 182 at offset 0x16c0000
Writing data to block 183 at offset 0x16e0000
Writing data to block 184 at offset 0x1700000
Writing data to block 185 at offset 0x1720000
Writing data to block 186 at offset 0x1740000
Writing data to block 187 at offset 0x1760000
Writing data to block 188 at offset 0x1780000
Writing data to block 189 at offset 0x17a0000
Writing data to block 190 at offset 0x17c0000
Writing data to block 191 at offset 0x17e0000
Writing data to block 192 at offset 0x1800000
Writing data to block 193 at offset 0x1820000
Writing data to block 194 at offset 0x1840000
Writing data to block 195 at offset 0x1860000
Writing data to block 196 at offset 0x1880000
Writing data to block 197 at offset 0x18a0000
Writing data to block 198 at offset 0x18c0000
Writing data to block 199 at offset 0x18e0000
Writing data to block 200 at offset 0x1900000
Writing data to block 201 at offset 0x1920000
Writing data to block 202 at offset 0x1940000
Writing data to block 203 at offset 0x1960000
Writing data to block 204 at offset 0x1980000
Writing data to block 205 at offset 0x19a0000
Writing data to block 206 at offset 0x19c0000
Writing data to block 207 at offset 0x19e0000
Writing data to block 208 at offset 0x1a00000
Writing data to block 209 at offset 0x1a20000
Writing data to block 210 at offset 0x1a40000
Writing data to block 211 at offset 0x1a60000
Writing data to block 212 at offset 0x1a80000
Writing data to block 213 at offset 0x1aa0000
Writing data to block 214 at offset 0x1ac0000
Writing data to block 215 at offset 0x1ae0000
Writing data to block 216 at offset 0x1b00000
Writing data to block 217 at offset 0x1b20000
Writing data to block 218 at offset 0x1b40000
Writing data to block 219 at offset 0x1b60000
Writing data to block 220 at offset 0x1b80000
Writing data to block 221 at offset 0x1ba0000
Writing data to block 222 at offset 0x1bc0000
Writing data to block 223 at offset 0x1be0000
Writing data to block 224 at offset 0x1c00000
Writing data to block 225 at offset 0x1c20000
Writing data to block 226 at offset 0x1c40000
Writing data to block 227 at offset 0x1c60000
Writing data to block 228 at offset 0x1c80000
Writing data to block 229 at offset 0x1ca0000
Writing data to block 230 at offset 0x1cc0000
Writing data to block 231 at offset 0x1ce0000
Writing data to block 232 at offset 0x1d00000
Writing data to block 233 at offset 0x1d20000
Writing data to block 234 at offset 0x1d40000
Writing data to block 235 at offset 0x1d60000
Writing data to block 236 at offset 0x1d80000
Writing data to block 237 at offset 0x1da0000
Writing data to block 238 at offset 0x1dc0000
Writing data to block 239 at offset 0x1de0000
Writing data to block 240 at offset 0x1e00000
Writing data to block 241 at offset 0x1e20000
Writing data to block 242 at offset 0x1e40000
Writing data to block 243 at offset 0x1e60000
Writing data to block 244 at offset 0x1e80000
Writing data to block 245 at offset 0x1ea0000
Writing data to block 246 at offset 0x1ec0000
Writing data to block 247 at offset 0x1ee0000
Writing data to block 248 at offset 0x1f00000
Writing data to block 249 at offset 0x1f20000
Writing data to block 250 at offset 0x1f40000
Writing data to block 251 at offset 0x1f60000
Writing data to block 252 at offset 0x1f80000
Writing data to block 253 at offset 0x1fa0000
Writing data to block 254 at offset 0x1fc0000
Writing data to block 255 at offset 0x1fe0000
Writing data to block 256 at offset 0x2000000
Writing data to block 257 at offset 0x2020000
Writing data to block 258 at offset 0x2040000
Writing data to block 259 at offset 0x2060000
Writing data to block 260 at offset 0x2080000
Writing data to block 261 at offset 0x20a0000
Writing data to block 262 at offset 0x20c0000
Writing data to block 263 at offset 0x20e0000
Writing data to block 264 at offset 0x2100000
Writing data to block 265 at offset 0x2120000
Writing data to block 266 at offset 0x2140000
Writing data to block 267 at offset 0x2160000
Writing data to block 268 at offset 0x2180000
Writing data to block 269 at offset 0x21a0000
Writing data to block 270 at offset 0x21c0000
Writing data to block 271 at offset 0x21e0000
Writing data to block 272 at offset 0x2200000
Writing data to block 273 at offset 0x2220000
Writing data to block 274 at offset 0x2240000
Writing data to block 275 at offset 0x2260000
Writing data to block 276 at offset 0x2280000
Writing data to block 277 at offset 0x22a0000
Writing data to block 278 at offset 0x22c0000
Writing data to block 279 at offset 0x22e0000
Writing data to block 280 at offset 0x2300000
Writing data to block 281 at offset 0x2320000
Writing data to block 282 at offset 0x2340000
Writing data to block 283 at offset 0x2360000
Writing data to block 284 at offset 0x2380000
Writing data to block 285 at offset 0x23a0000
Writing data to block 286 at offset 0x23c0000
Writing data to block 287 at offset 0x23e0000
Writing data to block 288 at offset 0x2400000
Writing data to block 289 at offset 0x2420000
Writing data to block 290 at offset 0x2440000
Writing data to block 291 at offset 0x2460000
Writing data to block 292 at offset 0x2480000
Writing data to block 293 at offset 0x24a0000
Writing data to block 294 at offset 0x24c0000
Writing data to block 295 at offset 0x24e0000
Writing data to block 296 at offset 0x2500000
Writing data to block 297 at offset 0x2520000
Writing data to block 298 at offset 0x2540000
Writing data to block 299 at offset 0x2560000
Writing data to block 300 at offset 0x2580000
Writing data to block 301 at offset 0x25a0000
Writing data to block 302 at offset 0x25c0000
Writing data to block 303 at offset 0x25e0000
Writing data to block 304 at offset 0x2600000
Writing data to block 305 at offset 0x2620000
Writing data to block 306 at offset 0x2640000
Writing data to block 307 at offset 0x2660000
Writing data to block 308 at offset 0x2680000
Writing data to block 309 at offset 0x26a0000
Writing data to block 310 at offset 0x26c0000
Writing data to block 311 at offset 0x26e0000
Writing data to block 312 at offset 0x2700000
Writing data to block 313 at offset 0x2720000
Writing data to block 314 at offset 0x2740000
Writing data to block 315 at offset 0x2760000
Writing data to block 316 at offset 0x2780000
Writing data to block 317 at offset 0x27a0000
Writing data to block 318 at offset 0x27c0000
Writing data to block 319 at offset 0x27e0000
Writing data to block 320 at offset 0x2800000
Writing data to block 321 at offset 0x2820000
Writing data to block 322 at offset 0x2840000
Writing data to block 323 at offset 0x2860000
Writing data to block 324 at offset 0x2880000
Writing data to block 325 at offset 0x28a0000
Writing data to block 326 at offset 0x28c0000
Writing data to block 327 at offset 0x28e0000
Writing data to block 328 at offset 0x2900000
Writing data to block 329 at offset 0x2920000
Writing data to block 330 at offset 0x2940000
Writing data to block 331 at offset 0x2960000
Writing data to block 332 at offset 0x2980000
Writing data to block 333 at offset 0x29a0000
Writing data to block 334 at offset 0x29c0000
Writing data to block 335 at offset 0x29e0000
Writing data to block 336 at offset 0x2a00000
Writing data to block 337 at offset 0x2a20000
Writing data to block 338 at offset 0x2a40000
Writing data to block 339 at offset 0x2a60000
Writing data to block 340 at offset 0x2a80000
Writing data to block 341 at offset 0x2aa0000
Writing data to block 342 at offset 0x2ac0000
Writing data to block 343 at offset 0x2ae0000
Writing data to block 344 at offset 0x2b00000
Writing data to block 345 at offset 0x2b20000
Writing data to block 346 at offset 0x2b40000
Writing data to block 347 at offset 0x2b60000
Writing data to block 348 at offset 0x2b80000
Writing data to block 349 at offset 0x2ba0000
Writing data to block 350 at offset 0x2bc0000
Writing data to block 351 at offset 0x2be0000
Writing data to block 352 at offset 0x2c00000
Writing data to block 353 at offset 0x2c20000
Writing data to block 354 at offset 0x2c40000
Writing data to block 355 at offset 0x2c60000
Writing data to block 356 at offset 0x2c80000
Writing data to block 357 at offset 0x2ca0000
Writing data to block 358 at offset 0x2cc0000
Writing data to block 359 at offset 0x2ce0000
Writing data to block 360 at offset 0x2d00000
Writing data to block 361 at offset 0x2d20000
Writing data to block 362 at offset 0x2d40000
Writing data to block 363 at offset 0x2d60000
Writing data to block 364 at offset 0x2d80000
Writing data to block 365 at offset 0x2da0000
Writing data to block 366 at offset 0x2dc0000
Writing data to block 367 at offset 0x2de0000
Writing data to block 368 at offset 0x2e00000
Writing data to block 369 at offset 0x2e20000
Writing data to block 370 at offset 0x2e40000
Writing data to block 371 at offset 0x2e60000
Writing data to block 372 at offset 0x2e80000
Writing data to block 373 at offset 0x2ea0000
0

I'm kind of regretting using the latest beta firmware. More on that later. Here's the first boot after splitting/flashing DNR-322L_Ax_v2.60b15.bin:

 ** MARVELL BOARD: DB-88F6281A-BP LE

U-Boot 1.1.4 (May  7 2013 - 16:35:27) Marvell version: 3.4.14.DNR-322.02

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE80

Soc: MV88F6281 Rev 3 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=5
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x100000, size 0x300000
load addr ....  =a00000

 3145728 bytes read: OK

NAND read: device 0 offset 0x600000, size 0x300000

load addr ....  =f00000

 3145728 bytes read: OK
## Booting image at 00a00000 ...

   Image Name:   Linux-2.6.31.8
   Created:      2014-06-10   7:37:08 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2551516 Bytes =  2.4 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK

OK
## Loading Ramdisk Image at 00f00000 ...
   Image Name:   Ramdisk
   Created:      2014-06-10   8:29:25 UTC

Image Type: ARM Linux RAMDisk Image (gzip compressed)

Data Size: 1584662 Bytes = 1.5 MB

   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux.................................................................................................................................................................... done, booting the kernel.

Linux version 2.6.31.8 (jack@swtest6) (gcc version 4.3.2 (sdk3.3-ct-ng-1.4.1) ) #6 Tue Jun 10 15:37:06 CST 2014
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
CPU: VIVT data cache, VIVT instruction cache
Machine: Feroceon-KW
Using UBoot passing parameters structure

Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o 2 Giga ports supported
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload (TSO) supported
  o Large Receive offload (LRO) supported
  o Receive checksum offload supported
  o Transmit checksum offload supported
  o Network Fast Processing (Routing) supported - (Disabled)
  o Driver ERROR statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported - (Disabled)
  o SKB Recycle supported - (Disabled)
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
     o register under mv88fx_eth platform
     o egiga0, ifindex = 2, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c8686000): 2048 entries, 8192 bytes

Counter=0, opIdx=6, overhead=16
Counter=1, opIdx=2, overhead=0
Counter=2, opIdx=1, overhead=18
Counter=3, opIdx=2, overhead=0
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0

NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 126 at 0x000000fc0000
Bad eraseblock 906 at 0x000007140000
Using static partition definition
Creating 8 MTD partitions on "nand_mtd":

0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000600000 : "uImage"
0x000000600000-0x000000b00000 : "ramdisk"
0x000000b00000-0x000005100000 : "image"
0x000006f00000-0x000007900000 : "mini firmware"
0x000007900000-0x000007e00000 : "config"
0x000007e00000-0x000008000000 : "my-dlink"
0x000005100000-0x000006f00000 : "nuuo package"

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver

uhci_hcd: USB Universal Host Controller Interface driver
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised: dm-d...@redhat.com
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.

rtc mv_rtc: setting system clock to 2019-10-29 03:19:52 UTC (1572319192)

md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...
md: ... autorun DONE.

RAMDISK: gzip image found at block 0

VFS: Mounted root (ext2 filesystem) on device 1:0.
Freeing init memory: 136K
init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST)

starting pid 534, tty '': '/etc/rc.sh'

** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /usr/local/modules: not mounted

first good block is 0

image len = 48762880 , image checksum = 518ce839
**** Mount Image ****
umount: /usr/local/tmp: not mounted
allocate mem cmd:mount -t ramfs cramfs /usr/local/tmp -o size=49m
dump image checksum=518ce839
mount cmd:mount -t cramfs -o loop /usr/local/tmp/image.cfs /usr/local/modules
ln: /usr/sbin/system_init: File exists
mtd check v1.01.05292012
/usr/local/config free size is 4665344
new add : chap-secrets
check file : /usr/local/config/chap-secrets , size = 8
new add : config.xml
check file : /usr/local/config/config.xml , size = 6269
new add : firewall-masq
check file : /usr/local/config/firewall-masq , size = 2276
new add : group
check file : /usr/local/config/group , size = 32
new add : hosts
check file : /usr/local/config/hosts , size = 75
new add : iconv_table
check file : /usr/local/config/iconv_table , size = 321
new add : mail_event_conf.xml
check file : /usr/local/config/mail_event_conf.xml , size = 163
new add : mydlink.xml
check file : /usr/local/config/mydlink.xml , size = 278
new add : pap-secrets
check file : /usr/local/config/pap-secrets , size = 8
new add : passwd
check file : /usr/local/config/passwd , size = 314
new add : passwd.webdav
check file : /usr/local/config/passwd.webdav , size = 44
new add : pppoe.conf
check file : /usr/local/config/pppoe.conf , size = 4560
new add : rc.init.sh
check file : /usr/local/config/rc.init.sh , size = 594
new add : resolv.conf
check file : /usr/local/config/resolv.conf , size = 12
new add : shadow
check file : /usr/local/config/shadow , size = 195
new add : smbpasswd
check file : /usr/local/config/smbpasswd , size = 103
new add : sms_conf.xml
check file : /usr/local/config/sms_conf.xml , size = 285
new add : syslog.conf
check file : /usr/local/config/syslog.conf , size = 1637
new add : user.log
check file : /usr/local/config/user.log , size = 0

** copy config files
chmod: /etc/mt-daapd.conf: No such file or directory

cp: cannot stat '/usr/local/config/user.log.old': No such file or directory

** set loopback interface
Dumping nvr image....
Dump nvr image success
old ver:20190122
new ver:20190122

first good block is 0

mac = 28:10:7B:1D:74:6A

egiga0: mac address changed

egiga0: link down
egiga0: started
egiga0: link up, full duplex, speed 1 Gbps

hostname=[DNR-322L]
*** get Time from rtc and set it into system ****
rtc: RTC time = 2019/10/29 Tue 3:20:26
Tue Oct 29 03:20:26 UTC 2019
*** set Time Zone ****
Tue Oct 29 03:20:26 GMT 2019
** execute rc.init.sh
Step 1
Create config / ACTiPTZProtocol / web mail folders
** create /etc/nvr
** create /etc/ACTiPTZProtocol
Copy default config / EMap / ACTiPTZProtocol / web mail files to corresponding folders
192.168.0.32
requested_ip=192.168.0.32
udhcpc (v1.11.2) started
Sending discover...
Sending select for 192.168.1.223...
Lease of 192.168.1.223 obtained, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns 192.168.1.1
DHCP client: get IP
route: SIOCADDRT: File exists
Step 2
Copy current nvr config to /etc/nvr
cp: cannot stat '/usr/local/config/nvr': No such file or directory
cp: cannot stat '/usr/local/config/nvr/emap.jpg': No such file or directory
Step 3
Copy brandnamemap.ini to /var/nuuo/odmconfig/etc
Step 4
Replace /etc/nvr/camera.ini Manufacturer & Brand
Step 5
Modify the default value of Patrol.xml
sed: /etc/nvr/PatrolOpt000.xml: No such file or directory
sed: /etc/nvr/PatrolOpt001.xml: No such file or directory
sed: /etc/nvr/PatrolOpt002.xml: No such file or directory
sed: /etc/nvr/PatrolOpt003.xml: No such file or directory
sed: /etc/nvr/PatrolOpt004.xml: No such file or directory
sed: /etc/nvr/PatrolOpt005.xml: No such file or directory
sed: /etc/nvr/PatrolOpt006.xml: No such file or directory
sed: /etc/nvr/PatrolOpt007.xml: No such file or directory
sed: /etc/nvr/PatrolOpt008.xml: No such file or directory
Step 6
Create VIDEODATA, this is necessary for recording, then wake up nvr_main/autobackup/nagent_arm
Step 7
Create symbolic link for libs
ln: /lib/libnuminihelper.so: File exists
ln: /lib/libwto.so: File exists
ln: /lib/libxmldbc.so: File exists


Module IPC SERVER Version:(1.00.20090706)

hd verify v1.02.20110719
can not detect hd
** Get MAC Addr
operate_auth: restore_auth, 227: No such file or directory.
Make new ssl Certificate when change IP
Generating a 1024 bit RSA private key
...........................................................++++++
..................................................++++++
writing new private key to '/etc/server.pem'
-----
Certificate is done
Start Lighttpd Daemon
2019-10-29 03:20:42: (../../src/log.c.166) server started
2019-10-29 03:20:42: (../../src/network.c.345) can't bind to port:  80 Address already in use
../../src/lighttpd-angel.c.140: child (pid=2387) exited normally with exitcode: 255
ERROR: Module lltd does not exist in /proc/modules
cp: cannot stat '/usr/local/config/Mydlink_Status.xml': No such file or directory
sh: you need to specify whom to kill
mkdir: cannot create directory '/etc/ssl': File exists
mkdir: cannot create directory '/etc/ssl/certs': File exists
ln: /etc/ssl/certs/ca-certificates.crt: File exists
rm: cannot remove '/tmp/provision.conf': No such file or directory
system daemon v1.02.20120210
rm: cannot remove '/tmp/provision.conf': No such file or directory
chk_io V1.01.1013201
support usb storage unmount

mfg_svr version 1.01(2019-01-22)

mfg_svr

mfg_start version 1.00(2013-05-31)

Tue Oct 29 03:20:43 2019


Please press Enter to activate this console. Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
killall: mydlink-watch-dog.sh: no process killed
local ip c0a801df (192.168.1.223)
netmask  ffffff00 (255.255.255.0)
mfg_svr: init socket OK
killall: signalc: no process killed
killall: tsa: no process killed
killall: upnpc-ddns: no process killed
opt.local stop ok.
opt.local start ok.
NTFS driver 2.1.29 [Flags: R/O MODULE].
cat: can't open '/var/www/xml/dm_state.xml': No such file or directory
disk mode is
sh: standard: unknown operand
mount raid
ERROR: No HD, exit !!
grep: /etc/mdadm.conf: No such file or directory
DDNS disabled - do nothing
grep: /etc/mdadm.conf: No such file or directory
Judge_swap v1.01
grep: /tmp/onedisk: No such file or directory
Unable to find swap-space signature
swapon: /dev/md0: Invalid argument
LED_POWER_ON
load_module network
ERROR: Module lltd does not exist in /proc/modules
2019-10-29 03:21:04: (../../src/server.c.1389) [note] graceful shutdown started
rm: cannot remove '/tmp/provision.conf': No such file or directory
2019-10-29 03:21:04: (../../src/log.c.166) server started
killall: mydlink-watch-dog.sh: no process killed
killall: tsa: no process killed
killall: upnpc-ddns: no process killed
opt.local stop ok.
rm: cannot remove '/tmp/provision.conf': No such file or directory
rm: cannot remove '/tmp/provision.conf': No such file or directory
killall: mydlink-watch-dog.sh: no process killed
killall: tsa: no process killed
killall: upnpc-ddns: no process killed
opt.local stop ok.
opt.local start ok.

At this point, I can login to the full D-Link web UI :) Not only that, I can now login to the serial console with a blank password.

Unfortunately, trying to update the D-Link firmware through the web UI results in this error: Upload firmware failed. I've tried 3 different versions, and tried clearing all settings. This was attempted while on serial connection, but there was no log activity there while attempting to upload the firmware through web UI.

This is the current firmware on it: [edit]

Current NVR Firmware Version :	2.60
Firmware Date :	01/22/2019
Current NVR Device Pack Version :	2.0.13
Device Pack Date :	09/24/2015

Hope these logs help, and looking forward to the next.

Viktor

unread,

Oct 29, 2019, 1:26:29 PM10/29/19

to Alt-F

I managed to find an old version 1.40 firmware for the DNR-322L. This firmware flashed without any issue from the 2.60beta web UI.

Here is the u-boot log for D-Link v1.40, dated 12/19/2012:

   Image Name:   Linux-2.6.22.18
   Created:      2011-06-27  10:22:38 UTC

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 2173684 Bytes = 2.1 MB

   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00f00000 ...
   Image Name:   Ramdisk

Created: 2012-07-09 11:41:07 UTC

Image Type: ARM Linux RAMDisk Image (gzip compressed)

Data Size: 1757986 Bytes = 1.7 MB

   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux........................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (jack@swtest4) (gcc version 4.2.1) #3 Mon Jun 27 18:22:35 CST 2011

CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977

Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback

CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets

Built 1 zonelists. Total pages: 65024

Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 1024 (order: 10, 4096 bytes)

Console: colour dummy device 80x30

Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)

Memory: 256MB 0MB 0MB 0MB = 256MB total
Memory: 253568KB available (4080K code, 247K data, 124K init)

Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable

PEX0_MEM ....base e8000000, size 128MB

PEX0_IO ....base f2000000, size 1MB

INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB

Marvell Development Board (LSP Version KW_LSP_4.3.4_patch30)-- DB-88F6281A-BP Soc: 88F6281 A1 LE


 Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load

Marvell USB EHCI Host controller #0: c06b3600

PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled

SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2

Time: kw_clocksource clocksource has been installed.

IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered

checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 1716K

cpufreq: Init kirkwood cpufreq driver

XOR registered 1 NET_DMA over 4 channels

XOR 2nd invalidate WA enabled

cesadev_init(c00119d8)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.

MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.1

Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)

squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro

JFFS2 version 2.2. (NAND) Â© 2001-2006 Red Hat, Inc.
SGI XFS with large block numbers, no debug enabled

io scheduler noop registered
io scheduler anticipatory registered (default)

Serial: 8250/16550 driver $Revision: 1.7 $ 4 ports, IRQ sharing disabled

serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A

serial8250.0: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: module loaded

Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency

  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0

  o TCP segmentation offload enabled
  o LRO support supported
  o Receive checksum offload enabled
  o Transmit checksum offload enabled

o Network Fast Processing (Routing) supported

o Driver ERROR statistics enabled

o Driver INFO statistics enabled

  o Proc tool API enabled
  o SKB Reuse supported

o SKB Recycle supported

  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):

    o  register under egiga0 platform
    o egiga0, ifindex = 1, GbE port = 0


Warning: Giga 1 is Powered Off

mvFpRuleDb (cff02000): 2048 entries, 8192 bytes

PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24

Integrated Sata device found

scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter

NFTL driver: nftlcore.c $Revision: 1.1.1.1 $, nftlmount.c $Revision: 1.1.1.1 $

NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks

Bad eraseblock 126 at 0x00fc0000
Bad eraseblock 906 at 0x07140000

Using static partition definition

Creating 7 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00600000 : "uImage"
0x00600000-0x00b00000 : "ramdisk"
0x00b00000-0x06f00000 : "image"
0x06f00000-0x07900000 : "mini firmware"
0x07900000-0x07e00000 : "config"
0x07e00000-0x08000000 : "my-dlink"

ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100

ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004

usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected

USB Universal Host Controller Interface driver v3.0

mice: PS/2 mouse device common for all mice
i2c /dev entries driver
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1

device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-d...@redhat.com
dm_crypt using the OCF package.

usbcore: registered new interface driver usbhid

drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver

TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17

md: Autodetecting RAID arrays.

md: autorun ...
md: ... autorun DONE.

RAMDISK: Compressed image found at block 0
EXT2-fs warning: maximal mount count reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 124K

init started: BusyBox v1.11.2 (2012-07-09 19:28:56 CST)

starting pid 280, tty '': '/etc/rc.sh'

** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /usr/local/modules: not mounted

umount: /usr/local/tmp/image.cfs: not found
umount: /usr/local/tmp: not mounted

first good block is 0

ECC failed: 0
ECC corrected: 0
Number of bad blocks: 1
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64

Dumping data starting at 0x00000000 and ending at 0x00000800...
image len = 25042944 , image checksum = 5839bec

ECC failed: 0
ECC corrected: 0
Number of bad blocks: 1
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64

Dumping data starting at 0x00000800 and ending at 0x01900000...
dump image checksum=5839bec

ln: /usr/sbin/system_init: File exists
mtd check v1.01.05292012

/usr/local/config free size is 4370432

** copy config files
chmod: /etc/mt-daapd.conf: No such file or directory
cp: cannot stat '/usr/local/config/user.log.old': No such file or directory

insmod: can't read '/usr/local/modules/driver/usblp.ko': No such file or directory
** set loopback interface
old ver:20121219
new ver:20121219

first good block is 0

ECC failed: 0
ECC corrected: 0
Number of bad blocks: 1
Number of bbt blocks: 0
Block sizeegiga0: mac address changed
 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...

mac = 28:10:7B:1D:74:6A

egiga0: link down
egiga0: started
egiga0: link up, full duplex, speed 1 Gbps
hostname=[DNR-322L]

rtc: RTC time = 2019/10/29 Tue 13:15:16
rtc: RTC time = 2019/10/29 Tue 13:15:16

Step 1
Create config / ACTiPTZProtocol / web mail folders
** create /etc/nvr

** execute rc.init.sh

** create /etc/ACTiPTZProtocol
Copy default config / EMap / ACTiPTZProtocol / web mail files to corresponding folders

Step 2
Copy current nvr config to /etc/nvr

192.168.1.223
requested_ip=192.168.1.223

udhcpc (v1.11.2) started
Sending discover...

Step 3

Create VIDEODATA, this is necessary for recording, then wake up nvr_main/autobackup/nagent_arm

Sending select for 192.168.1.223...
Lease of 192.168.1.223 obtained, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns 192.168.1.1
DHCP client: get IP
route: SIOCADDRT: File exists

telnetd: starting
  port: 23; interface: any; login program: /bin/login


Module IPC SERVER Version:(1.00.20090706)

hd verify v1.02.20110719
can not detect hd

chk_io V1.01.1013201
support usb storage unmount

** Get MAC Addr
system daemon v1.02.20120210
op_server v2.01.06012006

cat: can't open '/var/www/xml/dm_state.xml': No such file or directory

/usr/sbin/system_init: line 266: mail_daemon: not found

disk mode is
sh: standard: unknown operand
mount raid

Start Lighttpd Daemon
2019-10-29 13:15:28: (../../src/log.c.166) server started

ERROR: No HD, exit !!
grep: /etc/mdadm.conf: No such file or directory

grep: /etc/mdadm.conf: No such file or directory
Judge_swap v1.01

ERROR: Module lltd does not exist in /proc/modules

sh: you need to specify whom to kill

mfg_svr version 1.01(2012-07-03)


Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.

opt.local start ok.
mfg_svr

mfg_start version 1.00(2011-08-04)

mfg_start
Tue Oct 29 13:15:29 2019

local ip c0a801df (192.168.1.223)
netmask  ffffff00 (255.255.255.0)
mfg_svr: init socket OK

Please press Enter to activate this console. grep: /tmp/onedisk: No such file or directory

Unable to find swap-space signature
swapon: /dev/md0: Invalid argument

sh: raid1: unknown operand
LED_POWER_ON

Note that the nuuo partition is gone after the downgrade. Accordingly, the firmware information page on the web UI indicates this:

Current NVR Firmware Version :	1.40
Firmware Date :	12/19/2012

Current NVR Device Pack Version :

Device Pack Date :

João, please let me know which firmware version you would like me to flash to, and what logs you would like attached.

João Cardoso

unread,

Oct 29, 2019, 4:35:45 PM10/29/19

to Alt-F

Great!

The rescue/recovery image in your particular case proved to not be useful, and that is my only concern regarding other users of Alt-F-1.0 on the DNR-322L without soldering skills. Such users, when using Alt-F-1.0 to flash a new firmware, be it Alt-F or D-Link, will destroy part of the rescue/recovery image.

It is of course possible to either:

-flash manually on a running box, as you did, and take precautions to not erase that part of the flash,

-or save on a file that part of the flash, flash the new firmware, and recover the erased part from the file,

-or make and publish a fix to the firmware webui.

The first is simpler than the second, but both require user intervention, and as we know the README release file is seldon readed :-)

The third option is the ideal one, using the System->Fixes webUI, but it also requires user intervention. Users are notified in the Status page of the fix availability, and it is installed on the Alt-F folder on disk; applying it creates a false sensation of security, as if at flash time the disk is not present, helas, the fix will not be available. I only have published fixes for the RC4.1, and I didn't like the experience.

I don't really know what the most sensible approach is... do you have an opinion? (Ronaldo and other DNR-322L users, your opinion is also welcome)

My other concern is the my-dlink flash partition, which is already erased and might have necessary binaries or some needed box ID. Have you tried to use or reinstall it? Initially it was just a way to access and share the NAS contents from anywhere in the net, but it seems to have evolved meanwhile.

Regarding the nuuo package flash partition, the flashing has restored it. On fw v2.20.B01 and v2.40.B03 (and on v2.60b15 which you used) it is present in the fw file, so I assume that they all will rebuild that flash partition.

So I will use for Alt-F the flash partition layout compatible with the nuuo package, which is a superset of the previous fw versions.

It also looks like the "config" flash-partition was recreated, as I already expected.

The only info I need from you is the output of the command 'cat /proc/mtd' on fw with and without the nuuo package present, just for checking the mtd name that is given to that partition. I expect it to be mtd7. I think that you can just bootm any of the v2.2/v2.4/v2.6, if you don't want to reflash again.

Thanks!

Viktor

unread,

Oct 30, 2019, 12:45:13 AM10/30/19

to Alt-F

You are correct, sir.

v.140 B01, without nuuo:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "u-boot"
mtd1: 00500000 00020000 "uImage"
mtd2: 00500000 00020000 "ramdisk"
mtd3: 06400000 00020000 "image"
mtd4: 00a00000 00020000 "mini firmware"
mtd5: 00500000 00020000 "config"
mtd6: 00200000 00020000 "my-dlink"

v2.40 B03, with nuuo:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "u-boot"
mtd1: 00500000 00020000 "uImage"
mtd2: 00500000 00020000 "ramdisk"
mtd3: 04600000 00020000 "image"
mtd4: 00a00000 00020000 "mini firmware"
mtd5: 00500000 00020000 "config"
mtd6: 00200000 00020000 "my-dlink"
mtd7: 01e00000 00020000 "nuuo package"

Regarding reflashing, the D-Link web UI has been rejecting all the stock firmware versions I tried, except for v1.40. After I tried to bootm v2.40, D-Link firmware again did Erase kernel,

Erasing 128 Kibyte @ 4e0000 -- 97 % complete. After this, the box rebooted again, but this time, I had access to the rescue/recovery web UI. Sadly, it too wouldn't flash any firmware properly, aside from v1.40.

In the end, I did your steps again of manually erasing/reflashing through bootm of Alt-F-1.0, and flashed D-Link v2.40. Still, flashing through web UI does not work, aside from the low firmware.

I think the third option would be best. If it's similar to the save settings notice in red and bold, users for sure would be able to see it, unlike the README file ;)

I haven't had a reason to use or reinstall mydlink. I don't know about a box ID, but the MAC address is still being detected correctly by the D-Link firmware. It's the same as printed under the box.

Joao Cardoso

unread,

Oct 30, 2019, 9:15:36 PM10/30/19

to Alt-F

On Wednesday, October 30, 2019 at 4:45:13 AM UTC, Viktor wrote:

You are correct, sir.

v.140 B01, without nuuo:
# cat /proc/mtd dev: size erasesize name mtd0: 00100000 00020000 "u-boot" mtd1: 00500000 00020000 "uImage" mtd2: 00500000 00020000 "ramdisk" mtd3: 06400000 00020000 "image" mtd4: 00a00000 00020000 "mini firmware" mtd5: 00500000 00020000 "config" mtd6: 00200000 00020000 "my-dlink"

v2.40 B03, with nuuo:
# cat /proc/mtd dev: size erasesize name mtd0: 00100000 00020000 "u-boot" mtd1: 00500000 00020000 "uImage" mtd2: 00500000 00020000 "ramdisk" mtd3: 04600000 00020000 "image" mtd4: 00a00000 00020000 "mini firmware" mtd5: 00500000 00020000 "config" mtd6: 00200000 00020000 "my-dlink" mtd7: 01e00000 00020000 "nuuo package"

Thanks. I will make a kernel for you to try using bootm, if you please.

In a couple of days I will have it ready.

Regarding reflashing, the D-Link web UI has been rejecting all the stock firmware versions I tried, except for v1.40.

You can try 'dns323-fw -f' applied to all fw you have and looking at the product_id, custom_id, model_id, sub_id and NewVersion fields. That's all info that characterizes a firmware. At some point they might have changed some id. Alt-F uses that fields to identify a given fw accepting or rejecting it accordingly; d-link has to do the same.

The DNR-322L Alt-F fw is just the Alt-F firmware for the DNS-320 "in disguise", by hacking those fw ids. That's why your box is identified as a DNS-320 and not as a DNR-322L (anyway the hardware is the same).

After I tried to bootm v2.40, D-Link firmware again did Erase kernel,
Erasing 128 Kibyte @ 4e0000 -- 97 % complete. After this, the box rebooted again, but this time, I had access to the rescue/recovery web UI.

I start to think (I'm almost sure) that the rescue/recovey system needs a "image"/mtd3 to display the webUI. Eventually in a first step the rescue starts to only reflash the kernel and initrd, and only if a compatible non-corrupted "image" is found the webUI will be displayed. I would do it that way.

By contrast, the Alt-F webUI is pretty simple and small, so it fits in the initrd image, and can be used even if a "image"/mtd3 is not found or is corrupted.

Sadly, it too wouldn't flash any firmware properly, aside from v1.40.

look at the fw signatures (see above).

In the end, I did your steps again of manually erasing/reflashing through bootm of Alt-F-1.0, and flashed D-Link v2.40. Still, flashing through web UI does not work, aside from the low firmware.

The bootm method only accepts a kernel and initrd/initramfs. once it is running it will do whatever it needs, like using the "image" partition that holds most programs (thus its bigger size)

I think the third option would be best. If it's similar to the save settings notice in red and bold, users for sure would be able to see it, unlike the README file ;)

OK.

But the action of installing the fix still depends on a user action on the webUI. I don't like "automagic" things happening in the users back!

I haven't had a reason to use or reinstall mydlink. I don't know about a box ID, but the MAC address is still being detected correctly by the D-Link firmware. It's the same as printed under the box.

That means that mtd4 has survived all flash/reflash, that is good news for Ronaldo and other users (no worrying anyway, as I said it can easily be rewritten using the printed box label). The box MAC is stored as a string in the first few bytes of mtd4, but Alt-F has mtd4 "misplaced"

Thanks.

Viktor

unread,

Oct 31, 2019, 10:58:02 AM10/31/19

to Alt-F

On Wednesday, 30 October 2019 21:15:36 UTC-4, Joao Cardoso wrote:

Thanks. I will make a kernel for you to try using bootm, if you please.
In a couple of days I will have it ready.

Thanks. I will eagerly await for the new kernel.

You can try 'dns323-fw -f' applied to all fw you have and looking at the product_id, custom_id, model_id, sub_id and NewVersion fields. That's all info that characterizes a firmware. At some point they might have changed some id. Alt-F uses that fields to identify a given fw accepting or rejecting it accordingly; d-link has to do the same.
The DNR-322L Alt-F fw is just the Alt-F firmware for the DNS-320 "in disguise", by hacking those fw ids. That's why your box is identified as a DNS-320 and not as a DNR-322L (anyway the hardware is the same).

I did dns323-fw -f on the various firmware versions, and they all returned almost the same fields except for the lowest firmware. v1.40, which was the only firmware that I was able to flash through web UI, returned NewVersion=0 whereas all the rest were NewVersion=1. One other thing I noticed was the big difference in file size for these firmware versions. v1.40 is almost half the size of v2.20+ firmwares. Could it be the web UI is having trouble flashing whatever is responsible for the size difference? The nuuo package?

I start to think (I'm almost sure) that the rescue/recovey system needs a "image"/mtd3 to display the webUI. Eventually in a first step the rescue starts to only reflash the kernel and initrd, and only if a compatible non-corrupted "image" is found the webUI will be displayed. I would do it that way.
By contrast, the Alt-F webUI is pretty simple and small, so it fits in the initrd image, and can be used even if a "image"/mtd3 is not found or is corrupted.

That makes sense about the image/mtd3. So far, I haven't been able to bootm any of the D-Link firmwares, only Alt-F has successfully booted through bootm.

That means that mtd4 has survived all flash/reflash, that is good news for Ronaldo and other users (no worrying anyway, as I said it can easily be rewritten using the printed box label). The box MAC is stored as a string in the first few bytes of mtd4, but Alt-F has mtd4 "misplaced"

Does that mean Alt-F-1.1 will have mtd4 correctly placed for the DNR-322L? :)

João Cardoso

unread,

Oct 31, 2019, 4:10:42 PM10/31/19

to Alt-F

On Thursday, 31 October 2019 14:58:02 UTC, Viktor wrote:

On Wednesday, 30 October 2019 21:15:36 UTC-4, Joao Cardoso wrote:

Thanks. I will make a kernel for you to try using bootm, if you please.
In a couple of days I will have it ready.

Thanks. I will eagerly await for the new kernel.

Attached. The uImage-DNR-322L-rev-Ax is the kernel and the urootfs-dns325 the initrd. Use bootm and please attach the full boot log.

I expect some errors, as I don't include the larger "image". Please verify that 'ifconfig eth0 | grep HWaddr' displays your MAC.

You can try 'dns323-fw -f' applied to all fw you have and looking at the product_id, custom_id, model_id, sub_id and NewVersion fields. That's all info that characterizes a firmware. At some point they might have changed some id. Alt-F uses that fields to identify a given fw accepting or rejecting it accordingly; d-link has to do the same.
The DNR-322L Alt-F fw is just the Alt-F firmware for the DNS-320 "in disguise", by hacking those fw ids. That's why your box is identified as a DNS-320 and not as a DNR-322L (anyway the hardware is the same).

I did dns323-fw -f on the various firmware versions, and they all returned almost the same fields except for the lowest firmware. v1.40, which was the only firmware that I was able to flash through web UI, returned NewVersion=0 whereas all the rest were NewVersion=1.

Yes, I noticed that also. At ftp://ftp2.dlink.com/PRODUCTS/DNR-322L/REVA/ you can find several other fw versions.

One other thing I noticed was the big difference in file size for these firmware versions. v1.40 is almost half the size of v2.20+ firmwares. Could it be the web UI is having trouble flashing whatever is responsible for the size difference? The nuuo package?

All v2 fw are bigger and contain the nuuo stuff. I think that they started using java, which is bigger.

The nuuo package only accounts for ~6MB.

Notice that dns323-fw noticies an unknown fw component, which it does not extracts, and displays "dir=/mnt/HD_a4/install file=DNR-322L-nuuo_package". This is typically a file to be put on disk (HD_a4, the D-link hidden and reserved disk partition) and executed. A similar process is used on other fw, and must be (is) a way to make modifications, at upgrade time, that can't be done in other way.

So: when you try to flash from a v1 to a v2 fw, do you have a disk installed and formatted using d-link webUI, so that that hidden partition (typically sda4) is available and used as part of the installation upgrade? Try it, it might explain why you can't flash from within the d-link webUI.

I start to think (I'm almost sure) that the rescue/recovey system needs a "image"/mtd3 to display the webUI. Eventually in a first step the rescue starts to only reflash the kernel and initrd, and only if a compatible non-corrupted "image" is found the webUI will be displayed. I would do it that way.
By contrast, the Alt-F webUI is pretty simple and small, so it fits in the initrd image, and can be used even if a "image"/mtd3 is not found or is corrupted.

That makes sense about the image/mtd3. So far, I haven't been able to bootm any of the D-Link firmwares, only Alt-F has successfully booted through bootm.

That means that mtd4 has survived all flash/reflash, that is good news for Ronaldo and other users (no worrying anyway, as I said it can easily be rewritten using the printed box label). The box MAC is stored as a string in the first few bytes of mtd4, but Alt-F has mtd4 "misplaced"

Does that mean Alt-F-1.1 will have mtd4 correctly placed for the DNR-322L? :)

Of course. I was just needing your soldering capabilities and help :-)

uImage-DNR-322L-rev-Ax

urootfs-dns325

Viktor

unread,

Nov 1, 2019, 2:02:01 AM11/1/19

to Alt-F

On Thursday, 31 October 2019 16:10:42 UTC-4, João Cardoso wrote:

On Thursday, 31 October 2019 14:58:02 UTC, Viktor wrote:

On Wednesday, 30 October 2019 21:15:36 UTC-4, Joao Cardoso wrote:

Thanks. I will make a kernel for you to try using bootm, if you please.
In a couple of days I will have it ready.

Thanks. I will eagerly await for the new kernel.

Attached. The uImage-DNR-322L-rev-Ax is the kernel and the urootfs-dns325 the initrd. Use bootm and please attach the full boot log.
I expect some errors, as I don't include the larger "image". Please verify that 'ifconfig eth0 | grep HWaddr' displays your MAC.

Here you go:

 ** MARVELL BOARD: DB-88F6281A-BP LE

U-Boot 1.1.4 (May  7 2013 - 16:35:27) Marvell version: 3.4.14.DNR-322.02

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CEE80

Soc: MV88F6281 Rev 3 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=5
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Flash:  0 kB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0

Marvell>> usb reset ; fatload usb 0:1 0xa00000 /uImage-DNR-322L-rev-Ax ; fatload usb 0:1 0xf00000 /urootfs-dns325
(Re)start USB...
USB:   scanning bus for devices... 2 USB Device(s) found
       scanning bus for storage devices... 1 Storage Device(s) found
reading /uImage-DNR-322L-rev-Ax
..........................................................................................................................................................................................

1909479 bytes read
reading /urootfs-dns325
................................................................................................................................................................................................................................................................................................

2953280 bytes read
Marvell>> bootm 0xa00000 0xf00000

## Booting image at 00a00000 ...

   Image Name:   Alt-F-1.1S, kernel 4.14.78
   Created:      2019-10-31  18:54:26 UTC

Image Type: ARM Linux Kernel Image (uncompressed)

Data Size: 1909415 Bytes = 1.8 MB

   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00f00000 ...

   Image Name:   Alt-F-1.1S, initrd
   Created:      2019-10-31  18:54:17 UTC
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    2953216 Bytes =  2.8 MB

   Load Address: 00800000
   Entry Point:  00800000

   Verifying Checksum ... OK

Starting kernel ...

Booting Linux on physical CPU 0x0

Linux version 4.14.78 (jcard@silver) (gcc version 4.3.3 (GCC)) #7 Thu Oct 10 16:55:53 WEST 2019
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=0005397f

CPU: VIVT data cache, VIVT instruction cache

OF: fdt: Machine model: D-Link DNR-322L-rev-Ax NAS
Memory policy: Data cache writeback
Built 1 zonelists, mobility grouping on.  Total pages: 65024
Kernel command line: console=ttyS0,115200n8 root=/dev/ram0 init=/init earlyprintk root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none console=ttyS0,115200 root=/dev/ram0 init=/init earlyprintk
PID hash table entries: 1024 (order: 0, 4096 bytes)

Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)

Memory: 251516K/262144K available (4276K kernel code, 146K rwdata, 656K rodata, 188K init, 84K bss, 10628K reserved, 0K cma-reserved)

Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xd0800000 - 0xff800000   ( 752 MB)
    lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)

      .text : 0xc0008000 - 0xc0435590   (4278 kB)
      .init : 0xc04db000 - 0xc050a000   ( 188 kB)
      .data : 0xc050a000 - 0xc052ea00   ( 147 kB)
       .bss : 0xc052ea00 - 0xc0543cbc   (  85 kB)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16

clocksource: orion_clocksource: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns

Switching to timer-based delay loop, resolution 5ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 400.00 BogoMIPS (lpj=2000000)

pid_max: default: 4096 minimum: 301

Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)

CPU: Testing write buffer coherency: ok

Setting up static identity map for 0x81e0 - 0x821c

mvebu-soc-id: MVEBU SoC ID=0x6281, Rev=0x3

devtmpfs: initialized
random: get_random_u32 called from 0xc01f361c with crng_init=0

clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 16 (order: -5, 192 bytes)

pinctrl core: initialized pinctrl subsystem

NET: Registered protocol family 16

DMA: preallocated 256 KiB pool for atomic coherent allocations

Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.

[Firmware Info]: /ocp@f1000000/ethernet-controller@72000/ethernet0-port@0: local-mac-address is not set

SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb

clocksource: Switched to clocksource orion_clocksource

VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)

NET: Registered protocol family 2

TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

NET: Registered protocol family 1

Trying to unpack rootfs image as initramfs...

rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 2884K
workingset: timestamp_bits=30 max_order=16 bucket_order=0

squashfs: version 4.0 (2009/01/31) Phillip Lougher

jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
aufs 4.14.73+-20181022
io scheduler noop registered

io scheduler cfq registered (default)
kirkwood-pinctrl f1010000.pin-controller: registered pinctrl driver

mv_xor f1060800.xor: Marvell shared XOR driver
mv_xor f1060800.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
mv_xor f1060900.xor: Marvell shared XOR driver
mv_xor f1060900.xor: Marvell XOR (Registers Mode): ( xor cpy intr )
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
console [ttyS0] disabled

f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 25, base_baud = 12500000) is a 16550A
console [ttyS0] enabled
f1012100.serial: ttyS1 at MMIO 0xf1012100 (irq = 26, base_baud = 12500000) is a 16550A

brd: module loaded
loop: module loaded

sata_mv f1080000.sata: slots 32 ports 2
scsi host0: sata_mv
scsi host1: sata_mv
ata1: SATA max UDMA/133 irq 33
ata2: SATA max UDMA/133 irq 33
nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1
nand: Samsung NAND 128MiB 3,3V 8-bit

nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64

Scanning device for bad blocks

Bad eraseblock 126 at 0x000000fc0000
Bad eraseblock 906 at 0x000007140000

8 ofpart partitions found on MTD device orion_nand
Creating 8 MTD partitions on "orion_nand":

0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000600000 : "uImage"
0x000000600000-0x000000b00000 : "ramdisk"
0x000000b00000-0x000005100000 : "image"
0x000006f00000-0x000007900000 : "mini firmware"
0x000007900000-0x000007e00000 : "config"
0x000007e00000-0x000008000000 : "my-dlink"
0x000005100000-0x000006f00000 : "nuuo package"

libphy: Fixed MDIO Bus: probed

libphy: orion_mdio_bus: probed
mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4

mv643xx_eth_port mv643xx_eth_port.0 eth0: port 0 with MAC address 00:50:43:0a:39:12

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver

ehci-pci: EHCI PCI platform driver
ehci-orion: EHCI orion driver
orion-ehci f1050000.ehci: EHCI Host Controller
orion-ehci f1050000.ehci: new USB bus registered, assigned bus number 1
orion-ehci f1050000.ehci: irq 30, io mem 0xf1050000

orion-ehci f1050000.ehci: USB 2.0 started, EHCI 1.00

hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected

usbcore: registered new interface driver usb-storage

rtc-mv f1010300.rtc: rtc core: registered f1010300.rtc as rtc0
i2c /dev entries driver

gpio-fan gpio_fan: GPIO fan initialized

usbcore: registered new interface driver usbhid
usbhid: USB HID core driver

NET: Registered protocol family 17

input: gpio_keys as /devices/platform/gpio_keys/input/input0
ata1: SATA link down (SStatus 0 SControl F300)

usb 1-1: new high-speed USB device number 2 using orion-ehci
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi host2: usb-storage 1-1:1.0
ata2: SATA link up 1.5 Gbps (SStatus 113 SControl F300)
ata2.00: ATA-6: ST340014AS, 8.12, max UDMA/133
ata2.00: 78125000 sectors, multi 0: LBA48 NCQ (depth 31/32)
ata2.00: configured for UDMA/133
scsi 1:0:0:0: Direct-Access     ATA      ST340014AS       8.12 PQ: 0 ANSI: 5
sd 1:0:0:0: [sda] 78125000 512-byte logical blocks: (40.0 GB/37.3 GiB)
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Write Protect is off
sd 1:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
 sda: sda1 sda2 sda4
sd 1:0:0:0: [sda] Attached SCSI disk

md: Skipping autodetection of RAID arrays. (raid=autodetect will force)

RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 2881KiB [1 disk] into ram disk... |
done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing unused kernel memory: 188K
This architecture does not have kernel memory protection.
pre-init started, pid=1
pre-init: squash-rd
init started: BusyBox v1.20.2 (2018-12-31 17:18:24 WET)
random: fast init done
ubi1: attaching mtd3
ubi1: scanning is finished
ubi1 error: 0xc02c49fc: the layout volume was not found
ubi1 error: 0xc02c818c: failed to attach mtd3, error -22
ubiattach: error!: cannot attach "/dev/mtd3"
           error 22 (Invalid argument)
rcS: UBI attach failed
random: sed: uninitialized urandom read (6 bytes read)
scsi 2:0:0:0: Direct-Access     SanDisk  Cruzer Micro     0.4  PQ: 0 ANSI: 2
sd 2:0:0:0: [sdb] 1000944 512-byte logical blocks: (512 MB/489 MiB)
sd 2:0:0:0: [sdb] Write Protect is off
sd 2:0:0:0: Attached scsi generic sg1 type 0
sd 2:0:0:0: [sdb] No Caching mode page found
sd 2:0:0:0: [sdb] Assuming drive cache: write through
 sdb: sdb1
sd 2:0:0:0: [sdb] Attached SCSI removable disk
rcS: Reading RCT in UTC and setting system time and date
rcS: Board: DNR-322L-Ax
rcS: Flashed Firmware: Linux-2.6.31.8
random: mktemp: uninitialized urandom read (6 bytes read)
random: mktemp: uninitialized urandom read (6 bytes read)
random: mktemp: uninitialized urandom read (6 bytes read)
rcS: loadsave_settings: loaded set_2019-10-24_02:40:26.tgz settings file.
random: mktemp: uninitialized urandom read (6 bytes read)
urandom_read: 2 callbacks suppressed
random: sed: uninitialized urandom read (6 bytes read)
random: sed: uninitialized urandom read (6 bytes read)
random: sed: uninitialized urandom read (6 bytes read)
md/raid1:md0: active with 1 out of 2 mirrors
md0: detected capacity change from 0 to 542769152
Adding 530044k swap on /dev/md0.  Priority:1 extents:1 across:530044k
rcS: IP from flash-defaults
mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled
mv643xx_eth_port mv643xx_eth_port.0 eth0: link down
rcS: Setting kernel parameters
rcS: Executing rc.sys
root: Starting syslogd: OK.
Starting klogd: OK.
root: Starting urandom: OK.
root: Starting sslcert: OK.
root: Starting sysctrl: OK.
root: Starting crond: OK.
Starting news: OK.
/etc/init.d/S41inetd: line 101: rcvsftpd: not found
/etc/init.d/S41inetd: line 101: rcstunnel: not found
grep: /etc/avahi/services/*.service*: No such file or directory
grep: /etc/avahi/services/*.service*: No such file or directory
grep: /etc/avahi/services/*.service*: No such file or directory
grep: /etc/avahi/services/*.service*: No such file or directory
grep: /etc/avahi/services/*.service*: No such file or directory
grep: /etc/avahi/services/*.service*: No such file or directory
root: Starting inetd: OK.
mount: mounting nfsd on /proc/fs/nfsd failed: No such device
exportfs: Failed to stat /mnt/teraone: No such file or directory
exportfs: Failed to stat /mnt/teraslim: No such file or directory
exportfs: can't open /var/lib/nfs/rmtab for reading
exportfs: can't open /var/lib/nfs/xtab for reading
mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled
grep: /etc/avahi/services/*.service*: No such file or directory
root: Starting rpc.statd: Starting portmap: .OK.
Starting sm-notify: OK.
Starting rpc.statd: OK.
OK.
Starting rpc.mountd: OK.
Starting rpc.nfsd: Fail.
root: Starting ffp: No ffp instalation found.
sgdisk: can't load library 'libiconv.so.2'
sgdisk: can't load library 'libiconv.so.2'
mv: can't rename '/mnt/DNR/alt-f.log': Read-only file system
cp: can't create '/mnt/DNR/alt-f.log': File exists
chmod: /mnt/DNR/alt-f.log: Read-only file system
root: Starting user: OK.

I can confirm that ifconfig eth0 | grep HWaddr displays my proper MAC address printed under the box. It also correctly gets the IP I assigned to it on my router a long time ago.

All v2 fw are bigger and contain the nuuo stuff. I think that they started using java, which is bigger.
The nuuo package only accounts for ~6MB.

Notice that dns323-fw noticies an unknown fw component, which it does not extracts, and displays "dir=/mnt/HD_a4/install file=DNR-322L-nuuo_package". This is typically a file to be put on disk (HD_a4, the D-link hidden and reserved disk partition) and executed. A similar process is used on other fw, and must be (is) a way to make modifications, at upgrade time, that can't be done in other way.
So: when you try to flash from a v1 to a v2 fw, do you have a disk installed and formatted using d-link webUI, so that that hidden partition (typically sda4) is available and used as part of the installation upgrade? Try it, it might explain why you can't flash from within the d-link webUI.

Bingo! I installed an old 40GB HDD in one of the drive bays and formatted it upon logging in to D-Link web UI, Tried to flash the latest/largest firmware v2.60, and it succeeded on the first attempt. Prior to that, I had been running the DNR-322L empty, partly because of the serial connection hanging out of the box. I actually noticed that dir=/mnt/HD_a4/install a couple of days ago, but thought to myself that I didn't have any HDD installed and just ignored it.

Of course. I was just needing your soldering capabilities and help :-)

My pleasure. These old boxes are still tremendously useful with Alt-F installed.Seeing Alt-F 1.1S brings a smile to my face. :)

João Cardoso

unread,

Nov 1, 2019, 3:52:20 PM11/1/19

to Alt-F

On Friday, 1 November 2019 06:02:01 UTC, Viktor wrote:

On Thursday, 31 October 2019 16:10:42 UTC-4, João Cardoso wrote:

On Thursday, 31 October 2019 14:58:02 UTC, Viktor wrote:

On Wednesday, 30 October 2019 21:15:36 UTC-4, Joao Cardoso wrote:

Thanks. I will make a kernel for you to try using bootm, if you please.
In a couple of days I will have it ready.

Thanks. I will eagerly await for the new kernel.

Attached. The uImage-DNR-322L-rev-Ax is the kernel and the urootfs-dns325 the initrd. Use bootm and please attach the full boot log.
I expect some errors, as I don't include the larger "image". Please verify that 'ifconfig eth0 | grep HWaddr' displays your MAC.

Here you go:
** MARVELL BOARD: DB-88F6281A-BP LE

...

nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1 nand: Samsung NAND 128MiB 3,3V 8-bit nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 Scanning device for bad blocks Bad eraseblock 126 at 0x000000fc0000 Bad eraseblock 906 at 0x000007140000 8 ofpart partitions found on MTD device orion_nand Creating 8 MTD partitions on "orion_nand": 0x000000000000-0x000000100000 : "u-boot" 0x000000100000-0x000000600000 : "uImage" 0x000000600000-0x000000b00000 : "ramdisk" 0x000000b00000-0x000005100000 : "image" 0x000006f00000-0x000007900000 : "mini firmware" 0x000007900000-0x000007e00000 : "config" 0x000007e00000-0x000008000000 : "my-dlink" 0x000005100000-0x000006f00000 : "nuuo package"

...

OK, identical to the D-Link v2 firmware.

This gives users the freedom to flash d-link fw back from within Alt-F. That's true freedom, as RMS would agreed :-)

I can confirm that ifconfig eth0 | grep HWaddr displays my proper MAC address printed under the box.

Great.

Now I only have to write and make available a fix to the Alt-F Firmware Updater webUI, and make available a snapshot of Alt-F-1.1S for DNR-322L users.

It also correctly gets the IP I assigned to it on my router a long time ago.

All v2 fw are bigger and contain the nuuo stuff. I think that they started using java, which is bigger.
The nuuo package only accounts for ~6MB.

Notice that dns323-fw noticies an unknown fw component, which it does not extracts, and displays "dir=/mnt/HD_a4/install file=DNR-322L-nuuo_package". This is typically a file to be put on disk (HD_a4, the D-link hidden and reserved disk partition) and executed. A similar process is used on other fw, and must be (is) a way to make modifications, at upgrade time, that can't be done in other way.
So: when you try to flash from a v1 to a v2 fw, do you have a disk installed and formatted using d-link webUI, so that that hidden partition (typically sda4) is available and used as part of the installation upgrade? Try it, it might explain why you can't flash from within the d-link webUI.

Bingo! I installed an old 40GB HDD in one of the drive bays and formatted it upon logging in to D-Link web UI, Tried to flash the latest/largest firmware v2.60, and it succeeded on the first attempt. Prior to that, I had been running the DNR-322L empty, partly because of the serial connection hanging out of the box. I actually noticed that dir=/mnt/HD_a4/install a couple of days ago, but thought to myself that I didn't have any HDD installed and just ignored it.

Don't know why that is not clearly stated or displayed.

Interesting enough, I always removed my disks when trying new fw, as some horror stories said that d-link fw formatted users disks at reboot after a fw update. Fake news? Perhaps, one user (regwergrgwerg) also says the same about Alt-F in its review, https://sourceforge.net/projects/alt-f/reviews, and it is simply not true.

Of course. I was just needing your soldering capabilities and help :-)

My pleasure. These old boxes are still tremendously useful with Alt-F installed.Seeing Alt-F 1.1S brings a smile to my face. :)

I might ask for your help again :-)

Viktor

unread,

Nov 4, 2019, 12:08:30 PM11/4/19

to Alt-F

On Friday, 1 November 2019 15:52:20 UTC-4, João Cardoso wrote:

OK, identical to the D-Link v2 firmware.

This gives users the freedom to flash d-link fw back from within Alt-F. That's true freedom, as RMS would agreed :-)

Now I only have to write and make available a fix to the Alt-F Firmware Updater webUI, and make available a snapshot of Alt-F-1.1S for DNR-322L users.

Can't wait for the freedom! Although, I'm pretty sure my DNR-322L is going to stay on Alt-F 1.1S firmware, once released ;)

Bingo! I installed an old 40GB HDD in one of the drive bays and formatted it upon logging in to D-Link web UI, Tried to flash the latest/largest firmware v2.60, and it succeeded on the first attempt. Prior to that, I had been running the DNR-322L empty, partly because of the serial connection hanging out of the box. I actually noticed that dir=/mnt/HD_a4/install a couple of days ago, but thought to myself that I didn't have any HDD installed and just ignored it.

Don't know why that is not clearly stated or displayed.

Interesting enough, I always removed my disks when trying new fw, as some horror stories said that d-link fw formatted users disks at reboot after a fw update. Fake news? Perhaps, one user (regwergrgwerg) also says the same about Alt-F in its review, https://sourceforge.net/projects/alt-f/reviews, and it is simply not true.

I had similar fears, that's why I had been running the box empty of HDD's. That, and the wires hanging out of the box.

In D-Link's defense, their firmware asked me first if I wanted to format the HDD that I inserted. Wish it also notified the user that it needed a hard drive for the v2 firmware upgrade. Instead, it just threw a generic "upload firmware failed."

I might ask for your help again :-)

Anytime. Just let me know and I'll be more than happy to assist.

Reply all

Reply to author

Forward

0 new messages