DNS-320L A3 NAND dump

[Luca1234567]

Hi,

My DNS-320L A3 have the uboot corrupted, I see via serial uboot dont start.

I want to try to boot by sending the boot code via serial, procedure of Marvell processor

Anyone have a dump of NAND of DNS-320L A3, and send me ?
Precisely the address 0x000000000000-0x000000100000 "u-boot" and 0x000000100000-0x000000600000 "uImage"

Thank you

[João Cardoso]

You can do that for yourself using any fw file, either from D-Link or Alt-F, just follow this post.

You need a linux machine to run the attached dns323-fw program, or compile it for yourself.

Edit: my mistake, you need u-boot and it does not exists in the fw file. I can post the one from my DNS-320L-A1, which should be OK.

According to Lentin, it's not easy to make the processor accept and execute the code sent through the serial port.

Thank you

[Luca1234567]

I try the Alt-F, and next I want to reflash with the orginal firmware, but the system brick.
I enter via serial to try reflash the original firmware, for a error of keyboard type I had completely erased the NAND flash.

But now I success the reboot the system, but I have some question.

I use windows OS on my pC. Letin, use Linux. So I have used HyperTerminal.

1) I download the uboot dump image of 320L-A2 from that post https://groups.google.com/d/msg/alt-f/IcV6XOAmEPY/3IggMyY9RsYJ
2) To send it to processor via UARTboot, according to http://www.marvell.com/embedded-processors/kirkwood/assets/FS_88F6180_9x_6281_OpenSource.pdf page 293, you need modify byte in position 0x00 from 0x8B to 0x69 and recalculate the cheksum byte in position 0x1F
3) Then I put the uboot original image in a USB memory as mtd0.bin
4) Split the firmware dlink_dns320l(lw).1.06b03(3.07.0728.2015) by the first 8 long (4byte) and put it on USB
mtd1.bin Start=00000080 Lenght=0x002823D8
mtd2.bin Start=00282458 Lenght=0x001a9d00
mtd3.bin Start=0042c158 Lenght=0x0258b800
mtdx.bin Start=029B7958 Lenght=0x000024EC
5) To enter the UART BootMode of Marvell 88F6702 with HyperTerminali, I using the send text file to send a file composed by the byte 0xBB 0x11 0x22 0x33 0x44 0x55 0x66 0x77 repeated 300 time.
6) Next start sending power up the board.
7) The confirm of enter the UART BootMode, is receive the 0x15 byte
8) By using the send file, I send the file modifyed with Xmodem, now may start uBoot
9)
usb start ; usb tree
fatls usb 0 /
fatload usb 0:1 0xa00000 /mtd0.bin ; nand write 0xa00000 0x000000 0x0100000
mw.b 0xa00000 0xff 0x00300000 ; fatload usb 0:1 0xa00000 /mtd1.bin ; nand write 0xa00000 0x100000 0x00300000
mw.b 0xa00000 0xff 0x00200000 ; fatload usb 0:1 0xa00000 /mtd2.bin ; nand write 0xa00000 0x600000 0x00200000
mw.b 0xa00000 0xff 0x03000000 ; fatload usb 0:1 0xa00000 /mtd3.bin ; nand write 0xa00000 0xb00000 0x03000000

in according with the table present at boot in kernel
0x000000000000-0x000000100000 (0x00100000) : "u-boot" (mtd0)
0x000000100000-0x000000600000 (0x00500000) : "uImage" (mtd1)
0x000000600000-0x000000b00000 (0x00500000) : "ramdisk" (mtd2)
0x000000b00000-0x000006f00000 (0x06400000) : "image" (mtd3)
0x000006f00000-0x000007900000 (0x00a00000) : "rescue firmware" (mtd4)
0x000007900000-0x000007e00000 (0x00500000) : "config" (mtd5)
0x000007e00000-0x000008000000 (0x00200000) : "my-dlink" (mtd6)

10) next I reboot and all start.

11) But now, maybe because i erase all nand the Mac = 00:32:01:00:00:01, that NOT is my MAC address


The mtdx.bin Start=029B7958 Lenght=0x000024EC, I see that is a zip compressed file, the content is similar to a backup of config.
Maybe must be flash at 0x7900000 ?

Can any one post the dump of these three block

0x000006f00000-0x000007900000 (0x00a00000) : "rescue firmware" (mtd4)
0x000007900000-0x000007e00000 (0x00500000) : "config" (mtd5)
0x000007e00000-0x000008000000 (0x00200000) : "my-dlink" (mtd6)

Thank you
Hi

[Daniel Voina]

You can set the ethernet adress with in u-boot :

>> setenv ethaddr aa:bb:cc:dd:ee:ff

>> saveenv 

Just interrupt the boot sequence over serial.

[Luca1234567]

The mac address set in uboot is ethaddr=00:50:43:00:02:02, that is different of original mac addres of my DNS-320L, printed on bottom label
By some research and testing I see that the D-Link firmware retrive the MAC at address 0x6f00000 write in nand
If I write in 0x6f00000 my mac addres in text formar "aa:bb:cc:dd:ee:ff\0\0\0" (5 long, 20byte), D-link firmware boot with the correct Mac address

If I try bootm 0x0b00000 to force to boot the rescue firmware, ubbot laod at 0x06f00800 size 0x500000 the "rescue firmware"

So the memory 0x6f00000-6f007FF what is? what is the content ? Only Mac address ? or also serial number ?

Thank you

[João Cardoso]

On Tuesday, 16 February 2016 10:57:27 UTC, Luca1234567 wrote:

The mac address set in uboot is ethaddr=00:50:43:00:02:02, that is different of original mac addres of my DNS-320L, printed on bottom label
By some research and testing I see that the D-Link firmware retrive the MAC at address 0x6f00000 write in nand

For the DNS-320/320L/325/327L, Alt-F takes a pragmatic approach: it searches for a MAC-like-string in the first nand block of mtd4, that is where d-link stores it: /etc/init.d/rcS:

# MAC is stored in /dev/mtd4, configure eth0

if ! test -e /dev/mtd4; then mknod /dev/mtd4 c 90 8; fi

ifconfig eth0 hw ether $(nanddump -ql 2048 /dev/mtd4 | grep -E '..(:..){5}')

Not really fail-safe...