1 Intro

The D-Link DNS-320L is a simple 2-bay SATA NAS device which can run multiple versions of Linux. This post provides information on how to run the newest (at the point of writing) mainline kernel on it without patching as well as how to build a simple initramfs using buildroot.

2 Hardware

The NAS is based on a Marvell Kirkwood 1GHz SOC, other chips include an Ethernet controller, flash, RAM as well as an MCU which is a systems management controller similar to what you would have in a laptop or PC. The NAS has it's page on both deviwiki and new wikidevi where detailed information about the chips on the board can be found. The main board looks like this:

thumb-board1.jpg

Number Label Chip type Description
1 M1   The fan connector
2 JP1   The serial console
3 U2 Hynix H27U1G8F2BTR NAND flash
4 U3 Marvell 88E1318R Ethernet chip
5     Testpads (likely JTAG)
6 U7 Marvell 88F6702 The CPU
7 U10,U11 Nanya NT5TU128M8GE-AC RAM chips
8 U14 Weltrend WT69P3 The system management MCU
9 JP2   WT69P3 programming bus?

In order to access the unpopulated connectors on the board I soldered two pin connectors, because the JP2 pitch was smaller than the standard 2.54mm pinheads I had I used some wire to route it to where it can be accessed:

thumb-connectors.jpg

The board contains four LEDs with the following purpose:

Label Color Description
D6 Blue Power-on and booting indicator LED
D7 Red "USB" LED
D8 Red SATA1 port activity LED
D9 Red SATA2 port activity LED

2.0.1 Weltrend WT69P3

The WT69P3 is a systems management MCU which controls the power to the boardm provides an RTC for time keeping and controls the fan. The MCU is connected via a RS232 link with the main CPU and in the original firmare a daemon in the system communicates with it. The communications protocol has been reverse-engineered and there exist at least two independent open-source implementations of the manamgement daemon - https://www.aboehler.at/hg/dns320l-daemon and https://github.com/martignlo/DNS-320L.

2.0.2 JP2 connector

This connector seems to terminate an I2C bus. I deduced this from the fact that both lines have pullups to +3.3 V and the Weltrend chip's ISP protocol is I2C according to information from the manufacturer. Unfortunately the programmer software published uses a WLINK-I2C adapter with a WT6563 microcontroller. Unfortunately I was not able to find any place selling this programmer online.

The current assumption was that this is the ISP interface for the Weltrend WT69P3 MCU.

When I connected a Saleae logic analyzer to the bus I noticed something interesting however. When the system boots it tries to initiate a write to address 0x40.

[WT69P3-boot.png]

In order to investigate this I have used an Arduino board and the builtin Wire library to make an I2C slave respond to the address where the MCU is writing. The code for the sketch used is below:

#include 

void setup()
{
  Wire.begin(0x20);
  Wire.onReceive(receiveCmd);
  Wire.onRequest(sendResponse);
  Serial.begin(9600);
}

void loop()
{
  delay(100);
}

void receiveCmd(int howMany)
{
  while(Wire.available()>0) // loop through all but the last
  {
    char c = Wire.read(); // receive byte as a character
    Serial.print("CMD: ");
    Serial.println(c, HEX);         // print the character
  }
}

void sendResponse() {
  Wire.write(0xAA);
}

The wiring is documented in the Wire library reference page. Now things have started to look more interesting:

[WT69P3-i2c-write.png]

When we decode the traffic we see that the MCU is first writing byte 0x00 to address 0x40 and then reading a byte from address 0x41:

Time [s], Analyzer Name, Decoded Protocol Result
4.226217250000000,I2C,Setup Write to [0x40] + ACK
4.228212250000000,I2C,0x00 + ACK
4.233196500000000,I2C,Setup Read to [0x41] + ACK
4.235190500000000,I2C,0xAA + NAK

As I was expecting the second read to be some kind of status register I tried to send all 256 different responses to see what would happen. Some bytes sent back have triggered interesting behaviour:

Response byte Boot message LEDs
0x01 Module 0 is TDM  
0x02 Module 0 is AUDIO D7 and D9 LEDs light up
0x03 Module 0 is RGMII  
0x04 Module 0 is GMII  
0x05 Module 0 is TS  
0x06 Module 0 is MII  
0x07 Module 0 is TDM  
0x09 Error!, MV88F6282 doesn't support LCD module when booting from NAND!  

Later I noticed an "iprobe" command in the U-Boot help. It detected 3 addresses on the bus:

Marvell>> iprobe
Valid chip addresses: 13 20 64

This bus layout seems to be confirmed when we scan the bus with buspirate:

I2C>(1)
Searching I2C address space. Found devices at:
0x02(0x01 W) 0x26(0x13 W) 0x27(0x13 R) 0x40(0x20 W) 0x41(0x20 R) 0xC9(0x64 R) 

What is interesting apart from the 0x13, 0x20 (our fake Arduino slave) and 0x64 we also get write address 0x02. Interestingly, when the device is not booting (when LED6 is not blinking) the 0x64 is not present:

I2C>(1)
Searching I2C address space. Found devices at:
0x02(0x01 W) 0x26(0x13 W) 0x27(0x13 R) 0x40(0x20 W) 0x41(0x20 R) 

The "Boot message" documents additional messages that are printed by U-Boot when we respond to a read from 0x20 with a particular byte, for example for response 0x04:

 ** MARVELL BOARD: DB-88F6702A-BP LE 

U-Boot 1.1.4 (Aug 22 2012 - 17:06:54) Marvell version: 3.6.0.DNS-320L.01

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz 

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled

Module 0 is GMII

USB 0: host mode

It looks like the 0x20 address is some kind of peripheral type detection mechanism and the u-boot code is shared between different devices. I have found references to the "Boot message" strings from the table in various places on the internet, for example here, here and here always in connection to some hardware using the Kirkwood chipset.

3 Bootloader

The board uses the U-Boot bootloader like other Kirkwood-based devices. The boot process can be escaped in the usual way for U-Boot - by pressing SPACE and then 1. When we do this we are greeted with the U-Boot prompt and can poke around various commands. Below you can see exploration results of the information seen by the bootloader:

Marvell>> printenv
bootargs=root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
baudrate=115200
loads_echo=0
ipaddr=2.66.66.201
serverip=2.66.66.32
rootpath=/srv/ubuntu
netmask=255.255.255.0
run_diag=yes
console=console=ttyS0,115200 mtdparts=nand_mtd:0xc0000@0(uboot)ro,0x7f00000@0x100000(root)
MALLOC_len=1
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
ethaddr=00:50:43:00:02:02
ethmtu=1500
mvPhoneConfig=mv_phone_config=dev[0]:fxs,dev[1]:fxo
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
image_multi=yes
ethact=egiga0
bootcmd=nand read.e 0xa00000 0x100000 0x300000;nand read.e 0xf00000 0x600000 0x300000;bootm 0xa00000 0xf00000
stdin=serial
stdout=serial
stderr=serial
mainlineLinux=no
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
bootdelay=1
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no
Marvell>> version

U-Boot 1.1.4 (Aug 22 2012 - 17:06:54) Marvell version: 3.6.0.DNS-320L.01
Marvell>> usb start
(Re)start USB...
USB:   scanning bus for devices... 2 USB Device(s) found
Waiting for storage device(s) to settle before scanning...
1 Storage Device(s) found
Marvell>> usb tree

Device Tree:
  1  Hub (480MBit/s, 0mA)
  |  Marvell EHCI 
  |
  +-2  Mass Storage (480MBit/s, 200mA)
       Kingston DT 100 G2 XXXXXXXXXXXXXXXXXXXX
     
Marvell>> usb storage
  Device 0: Vendor: Kingston Prod.: DT 100 G2        Rev: PMAP
            Type: Removable Hard Disk
            Capacity: 3736.9 MB = 3.6 GB (7653312 x 512)
Marvell>> Temp
Unknown command 'Temp' - try 'help'
Marvell>> temp
Tj temp is 0
Marvell>> sp

Bus: 0 Device: 0 Func: 0 Vendor ID: 11ab Device ID: 6702
-------------------------------------------------------------------
Class: Memory controller
PCI_BAR0 (Mem-64bit) base: 0f1000000	size: 1048576 bytes
PCI_BAR1 (Mem-64bit) base: 000000000		size: 268435456 bytes
Marvell>> sg
PHY 0 :
---------
Auto negotiation: Enabled
Speed: 100 Mbps
Duplex: Half
Link: up

PHY 1 :
---------
Auto negotiation: Enabled
Speed: Uknown
Duplex: Full
Link: up
Marvell>> nand info

Device 0: NAND 128MB 3,3V 8-bit, sector size 128 KB
Marvell>> map

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB 
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base 90000000, size 128MB 
PEX0_IO ....base f0000000, size  16MB 
PEX1_MEM ....no such
PEX1_IO ....no such
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base f9000000, size   8MB 
SPI_CS ....base f8000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base fb000000, size  64KB 

AHB To MBUS Bridge:
-------------------
win0 - PEX0_MEM base 90000000, ....size 128MB 
win1 - disable
win2 - PEX0_IO base f0000000, ....size  16MB 
win3 - disable
win4 - NFLASH_CS base f9000000, ....size   8MB 
win5 - SPI_CS base f8000000, ....size  16MB 
win6 - disable
win7 - CRYPT_ENG base fb000000, ....size  64KB 
win8 - INTER_REGS base f1000000, ....size   1MB 

PEX0:
-----

Pex Bars 

Internal Regs Bar0.... base f1000000, size   1MB 
DRAM Bar1............. base 00000000, size 256MB 
Devices Bar2.......... disable

Pex Decode Windows

win0 - SDRAM_CS0 base 00000000, ....size 256MB 
win1 - disable
win2 - disable
win3 - disable
win4 - disable
win5 - disable
default win - target unknown 
Expansion ROM - NFLASH_CS 

USB:
----
Device 0:
win0 - SDRAM_CS0 base 00000000, size 256MB 
win1 - PEX0_MEM base 90000000, size 128MB 
win2 - disable
win3 - disable

ETH 0:
----
win0 - SDRAM_CS0 base 00000000, ....size 256MB 
win1 - NFLASH_CS base f9000000, ....size   8MB 
win2 - SPI_CS base f8000000, ....size  16MB 
win3 - PEX0_IO base f0000000, ....size  16MB 
win4 - disable
win5 - disable

XOR 0:
----
win0 - NFLASH_CS base f9000000, size   8MB 
win1 - PEX0_MEM base 90000000, size 128MB 
win2 - SDRAM_CS0 base 0, size 256MB 
win3 - SPI_CS base f8000000, size  16MB 
win4 - CRYPT_ENG base fb000000, size  64KB 
win5 - disable
win6 - disable
win7 - disable

XOR 1:
----
win0 - NFLASH_CS base f9000000, size   8MB 
win1 - PEX0_MEM base 90000000, size 128MB 
win2 - SDRAM_CS0 base 0, size 256MB 
win3 - SPI_CS base f8000000, size  16MB 
win4 - CRYPT_ENG base fb000000, size  64KB 
win5 - disable
win6 - disable
win7 - disable

SATA 0:
----
win0 - SDRAM_CS0 base 00000000, ....size 256MB 
win1 - SDRAM_CS1 base 10000000, ....size 256MB 
win2 - SDRAM_CS2 base 20000000, ....size 256MB 
win3 - SDRAM_CS3 base 30000000, ....size 256MB 

SATA 1:
----
win0 - SDRAM_CS0 base 00000000, ....size 256MB 
win1 - SDRAM_CS1 base 10000000, ....size 256MB 
win2 - SDRAM_CS2 base 20000000, ....size 256MB 
win3 - SDRAM_CS3 base 30000000, ....size 256MB 

AUDIO:
----
win0 - SDRAM_CS0 base 00000000, ....size 256MB 
win1 - SDRAM_CS1 base 10000000, ....size 256MB 
Marvell>> dclk
TCLK 166Mhz, SYSCLK 400Mhz (UART baudrate 115200)
Marvell>> ide reset

Reset IDE: 
Marvell Serial ATA Adapter
Integrated Sata device found
[0 0 0]: Enable DMA mode (6)
  Device 0 @ 0 0:
Model: HITACHI HUA722010ALA330                  Firm: JP4ONA01 Ser#: XXXXXX
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 953869.7 MB = 931.5 GB (1953525168 x 512)
[0 1 0]: Enable DMA mode (6)
  Device 1 @ 0 1:
Model: ST31000524AS                             Firm: JC4A     Ser#:             XXXXXXXXXX
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 953869.7 MB = 931.5 GB (1953525168 x 512)

Some of these variables are documented, some seem to be Marvell or Kirkwood specific cruft.

4 Original firmware

The original firmware resides on the NAND flash and an example of the entire boot console log is provided below:

 ** MARVELL BOARD: DB-88F6702A-BP LE 

U-Boot 1.1.4 (Aug 22 2012 - 17:06:54) Marvell version: 3.6.0.DNS-320L.01

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz 

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB 
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:128 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 0x100000, size 0x300000
load addr ....  =a00000

 3145728 bytes read: OK

NAND read: device 0 offset 0x600000, size 0x300000
load addr ....  =f00000

 3145728 bytes read: OK
## Booting image at 00a00000 ...
   Image Name:   Linux-2.6.31.8
   Created:      2012-08-22   8:55:08 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2630552 Bytes =  2.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00f00000 ...
   Image Name:   Ramdisk
   Created:      2014-12-26   3:00:57 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    1743894 Bytes =  1.7 MB
   Load Address: 00e00000
   Entry Point:  00e00000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux......................................................................................................................................................................... done, booting the kernel.
Linux version 2.6.31.8 (jack@swtest6) (gcc version 4.3.2 (sdk3.3-ct-ng-1.4.1) ) #1 Wed Aug 22 16:55:05 CST 2012
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
CPU: VIVT data cache, VIVT instruction cache
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 65024
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none
PID hash table entries: 1024 (order: 10, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256MB = 256MB total
Memory: 246272KB available (4960K code, 334K data, 136K init, 0K highmem)
Hierarchical RCU implementation.
NR_IRQS:128
Console: colour dummy device 80x30
Calibrating delay loop... 999.42 BogoMIPS (lpj=4997120)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB 
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
PEX1_MEM ....no such
PEX1_IO ....no such
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB 

  Marvell Development Board (LSP Version KW_LSP_5.1.3_patch29)-- DB-88F6702A-BP  Soc: 88F6702 A1 LE

 Detected Tclk 166666667 and SysClk 400000000 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c8040740
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
mvPexLocalBusNumSet: ERR. Invalid PEX interface 1
bio: create slab  at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (no cpio magic); looks like an initrd
Freeing initrd memory: 1700K
RTC has been updated!!!
rtc mv_rtc: rtc core: registered kw-rtc as rtc0
RTC registered
cpufreq: Init kirkwood cpufreq driver
XOR registered 4 channels
XOR 2nd invalidate WA enabled
cesadev_init(c000ed5c)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
NTFS driver 2.1.29 [Flags: R/O].
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.12)
msgmni has been set to 484
alg: No test for cipher_null (cipher_null-generic)
alg: No test for ecb(cipher_null) (ecb-cipher_null)
alg: No test for digest_null (digest_null-generic)
alg: No test for compress_null (compress_null-generic)
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
alg: No test for hmac(digest_null) (hmac(digest_null-generic))
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler anticipatory registered (default)
Initializing ths8200_init
Initializing dove_adi9889_init
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
console [ttyS0] enabled
serial8250.1: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A
brd: module loaded
loop: module loaded
Integrated Sata device found
IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o 2 Giga ports supported
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload (TSO) supported
  o Large Receive offload (LRO) supported
  o Receive checksum offload supported
  o Transmit checksum offload supported
  o Network Fast Processing (Routing) supported - (Disabled)
  o Driver ERROR statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported - (Disabled)
  o SKB Recycle supported - (Disabled)
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
     o register under mv88fx_eth platform
     o egiga0, ifindex = 2, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c0edc000): 2048 entries, 8192 bytes
Counter=0, opIdx=6, overhead=16
Counter=1, opIdx=2, overhead=0
Counter=2, opIdx=1, overhead=18
Counter=3, opIdx=2, overhead=0
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 7 MTD partitions on "nand_mtd":
0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000600000 : "uImage"
0x000000600000-0x000000b00000 : "ramdisk"
0x000000b00000-0x000006f00000 : "image"
0x000006f00000-0x000007900000 : "rescue firmware"
0x000007900000-0x000007e00000 : "config"
0x000007e00000-0x000008000000 : "my-dlink"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
uhci_hcd: USB Universal Host Controller Interface driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised: dm-devel@redhat.com
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
rtc mv_rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...
md: ... autorun DONE.
RAMDISK: gzip image found at block 0
VFS: Mounted root (ext2 filesystem) on device 1:0.
Freeing init memory: 136K
init started: BusyBox v1.20.2 (2013-11-27 15:54:37 CST)
starting pid 536, tty '': '/etc/rc.sh'
 Mounting /etc/fstab
umount: can't umount /proc: Invalid argument
umount: can't umount /usr/local/modules: Invalid argument
sh: can't open '/usr/sbin/pre_usb.sh'
first good block is 0
image len = 39137280 , image checksum = beaa9c0
umount: can't umount /usr/local/tmp: Invalid argument
dump image checksum=beaa9c0
mount cmd:busybox mount -t squashfs -o loop /usr/local/tmp/image.cfs /usr/local/modules
ln: /lib/./libnss_dns-2.8.so: File exists
ln: /lib/./libnss_dns.so.2: File exists
ln: /usr/sbin/./system_init: File exists
hardware init
GbE port 0: TxEnable WA - Enabled, deep=1, tx_en_bk=1

mtd check v1.02.08062012
config mtd type is JFFS2
/usr/local/config free size is 4767744
 copy config files
cp: can't stat '/usr/local/config/user.log.old': No such file or directory
usbcore: registered new interface driver usblp
 set loopback interface
old firmware ver:20141226
new firmware ver:20141226
first good block is 0
mac1 = 70:62:B8:2A:52:73
lan0:ifconfig egiga0 hw ether 70:62:B8:2A:52:73
egiga0: mac address changed
egiga0: started
Support Mydlink
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
ADDRCONF(NETDEV_UP): egiga0: link is not ready
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
ip6tnl0: Disabled Privacy Extensions
IPv4 over IPv4 tunneling driver
tunl0: Disabled Privacy Extensions
net.ipv6.conf.default.accept_dad = 2
net.ipv6.conf.egiga0.accept_dad = 2
net.ipv6.conf.default.dad_transmits = 1
net.ipv6.conf.egiga0.dad_transmits = 1
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.accept_redirects = 1
 execute rc.init.sh
awk: /var/run/udhcpc0.pid: No such file or directory
udhcpc (v1.20.2) started
Sending discover...
Sending discover...
Sending discover...
init egiga0
No lease, forking to background
killall: crond: no process killed
 set Time Zone ****
Fri Dec 31 22:00:51 GMT 1999
 get Time from rtc and set it into system ****
rtc: RTC time = 2020/3/2 Mon 10:16:15
Mon Mar  2 10:16:15 GMT 2020
 Do not adjust RTC time ***

Module IPC SERVER Version:(1.00.20090706)

ads=0
created mail daemon thread 0
ifconfig: egiga1: error fetching interface information: Device not found
Starting system message bus
Command: wget -T5 -t3 -q http://cfaj.freeshell.org/ipaddr.cgi -O /tmp/exip.0
Command: wget -T5 -t3 -q http://icanhazip.com/ -O /tmp/exip.1
Command: wget -T5 -t3 -q http://ifconfig.me/ip -O /tmp/exip.2
Command: wget -T5 -t3 -q http://whatismyip.org/ -O /tmp/exip.3
Command: wget -T5 -t3 -q http://ifconfig.me/ip -O /tmp/exip.4
Command: wget -T5 -t3 -q http://checkip.dyndns.com:8245/ -O /tmp/exip.5
config egiga0 169.254.173.176
RTNETLINK answers: File exists
call load_module network

Up_Send_Ctl : Can not find specified command "SysIP1"
Command line is not complete. Try option "help"
zcip: script /usr/share/udhcpc/zcip.script config failed, exitcode=1
Stop NFS Deamon....
Stop NFS mountd....
Unload Driver....
Stop Portmap.
No NFS information .
Stop NFS Server OVER.
Start config the NFS needed file....
Config Over.
No NFS information .
Start portmap....
Load Driver .
Start NFS Deamon .
svc: failed to register lockdv1 RPC service (errno 97).
NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovury0di�e{u�_k�owSf:�unicne*�o*gind recovery directory /var/lib/nfs/v4recovery
NFSD: starting 90-second grace period
Start NFS Server OVER .
cp: can't stat '/usr/local/config/Mydlink_Status.xml': No such file or directory
mcu version 1.02
system daemon v1.03.20130707
chk_io v1.03.20130502

mfg_start version 1.00(2014-12-26)

Mon Mar  2 10:16:42 2020

usb_dir []
cp: can't stat '/usr/local/config/mydlink_time.xml': No such file or directory
2020-03-02 10:16:39: (../../src/log.c.166) server started 
killall: chk_hotplug: no process killed
sh: you need to specify whom to kill
killall: dcp: no process killed
2020-03-02 10:16:42: (../../src/log.c.166) server started 
kinmyno��signalc: no process killed
usb_dir [/]
filename_mfg mfg_DNS_320L
check //mfg_DNS_320L file
opeo*��/mfw_Vn[�3::m�vime>gainme�jkillall: upnpc-ddns: no process killed
killall: tsa: no process killed
opt.local stop�ok.
o|w/oo{un���izu6ok��Jkillall: smbd: no process killed

Please press Enter to activate this console. LED_POWER_ON

Commands used to boot the device from a usb stick plugged in the back:

setenv boot_usb usb start\;fatload usb 0 0xa00000 /slots/A/kernel\;fatload usb 0 0xf00000 /slots/A/initramfs\;bootm 0xa00000 0xf00000