Broken OpenWrt install on Shuttle OMNINAS KD20

I own a Shuttle Omninas KD20 on which I tried to install OpenWrt (this was already 2 years ago and I gave up at that time. Now i want to know if I can revive the KD20. This is what I did:

  • I successfully created the file lede-oxnas-kd20-factory.tar.gz and did a firmware update

  • The KD20 started with no problem and I could ssh into it (new MAC, new ID).

  • Then I made a mistake because i thought I'm clever and looked for the latest OpenWrt firmware release available for the KD20, which I thought was 23.05.4 and replaced the files to upload in the next steps with the newer ones. I think used tftp to upload files.

  • No problem at all with the steps ’re-format UBI' and 'write kernel' only I did it with the newer version 23.9.4 which was probably a BIG MISTAKE.

  • After this, the KD20 boots but the ON/OFF Led turns red and that's it.

  • I can ping the KD20 but all ports are closed, no web, no ssh, and the serial console doesn't work either after I tried to use it - in a wrong way which probably damaged the 3.3V power regulator feeding the UART.

After this I gave up. Now I asked ChatGPT for a solution to prepare a SATA disk and make the KD20 boot from there. The outcome was the following:

  • I have a disk image which I insert into Bay 1 and power up
  • The blue power LED flashes, the turns solid blue and then solid red. The disk 1 LED lights blue.
  • The KD20 is not visible on the network.

I created the disk image using the following procedure - based on openwrt-23.05.4-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar as quoted below. No write to NVRAM is included, I just want to boot into a system where I can get access with ssh to fix the NVRAM from there.

I assume a kernel panic while loading. I also tried to to include a network console to no avail so far. I’m still confident to get the job done finally, but at the moment I would welcome any hint on what I’m doing wrong.

#!/usr/bin/env bash
set -euo pipefail
PS4='Line $LINENO:'
# -------------------------------------------------
# build-kd20-rescue.sh
# Creates a bootable KD20 rescue SATA disk (2GB, ext3)
# Usage: sudo ./build-kd20-rescue.sh openwrt-23.05.4-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar
# -------------------------------------------------
TARFILE="${1:-openwrt-23.05.4-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar}"
IMGNAME="kd20-rescue.img"
IMGSIZE_MB=2048
MNTDIR="./mnt_kd20"
TMPDIR="./kd20_tmp"
ROOTFS_DIR="./rootfs_unsquash"
# ------------------ cleanup ------------------
sudo umount "$MNTDIR" 2>/dev/null || true
sudo losetup -D
rm -rf "$MNTDIR" "$TMPDIR" "$ROOTFS_DIR" "$IMGNAME"
mkdir -p "$MNTDIR" "$TMPDIR"
# ------------------ create image and partition ------------------
dd if=/dev/zero of="$IMGNAME" bs=1M count="$IMGSIZE_MB" status=progress
parted --script "$IMGNAME" mklabel msdos
parted --script "$IMGNAME" mkpart primary ext3 1MiB 100%
LOOPDEV=$(sudo losetup -Pf --show "$IMGNAME")
PART="${LOOPDEV}p1"
sleep 0.5
sudo mkfs.ext3 -L KD20ROOT "$PART"
sudo mount "$PART" "$MNTDIR"
# ------------------ extract sysupgrade tar ------------------
tar -xf "$TARFILE" -C "$TMPDIR"
SRCDIR=$(find "$TMPDIR" -maxdepth 2 -type d -name "sysupgrade-*" | head -n1)
KERNEL="$SRCDIR/kernel"
ROOTFS_SQUASH="$SRCDIR/root"
# ------------------ extract rootfs ------------------
rm -rf ./rootfs_unsquash
unsquashfs -d ./rootfs_unsquash "$ROOTFS_SQUASH"
# ------------------ install kernel ------------------
mkdir -p "$MNTDIR/boot"
sudo cp "$KERNEL" "$MNTDIR/boot/uImage"
sudo sync
# ------------------ copy rootfs ------------------
sudo rsync -aHAX --numeric-ids "$ROOTFS_DIR/" "$MNTDIR/"
# ------------------ boot script ------------------
cat > /tmp/boot.txt <<'EOF'
# KD20 SATA rescue boot script
setenv bootargs 'console=ttyS0,115200 root=/dev/sda1 rootfstype=ext3 rw init=/sbin/init'
echo "Loading kernel from SATA..."
ext2load ide 0:1 0x6400000 /boot/uImage
echo "Booting kernel..."
bootm 0x6400000
EOF
sudo mv /tmp/boot.txt "$MNTDIR/boot/boot.txt"
sudo mkimage -A arm -O linux -T script -C none -n "KD20 Rescue Boot" -d "$MNTDIR/boot/boot.txt" "$MNTDIR/boot/boot.scr"
# ------------------ network configuration ------------------
sudo tee "$MNTDIR/etc/config/network" > /dev/null <<'EOF'
config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'
config interface 'lan'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr '192.168.20.60'
        option netmask '255.255.255.0'
        option gateway '192.168.20.1'
        option dns '8.8.8.8'
EOF
# ------------------ dropbear SSH ------------------
sudo tee "$MNTDIR/etc/config/dropbear" > /dev/null <<'EOF'
config dropbear
        option PasswordAuth 'on'
        option RootPasswordAuth 'on'
        option Port '22'
EOF
# ------------------ rc.local for logging ------------------
sudo tee "$MNTDIR/etc/rc.local" > /dev/null <<'EOF'
#!/bin/sh
LOG=/root/start.log
echo "$(date): rc.local starting" >> $LOG 2>&1
mount >> $LOG 2>&1
dmesg | tail -n 200 >> $LOG 2>&1
/sbin/ifconfig eth0 192.168.20.60 netmask 255.255.255.0 up >> $LOG 2>&1 || true
/sbin/route add default gw 192.168.20.1 >> $LOG 2>&1 || true
/etc/init.d/dropbear start >> $LOG 2>&1 || true
echo "$(date): rc.local finished" >> $LOG 2>&1
exit 0
EOF
sudo chmod +x "$MNTDIR/etc/rc.local"
# ------------------ root password ------------------
HASH=$(python3 -c 'import crypt; print(crypt.crypt("root", crypt.mksalt(crypt.METHOD_SHA512)))')
sudo awk -v H="$HASH" '$1=="root" {$2=H} {print}' "$MNTDIR/etc/shadow" | sudo tee "$MNTDIR/etc/shadow" >/dev/null
sudo chmod 600 "$MNTDIR/etc/shadow"
# ------------------ final cleanup ------------------
sync
sudo umount "$MNTDIR"
sudo losetup -d "$LOOPDEV"
rm -rf "$TMPDIR" "$ROOTFS_DIR"
echo "Done! Image: $IMGNAME"
echo "Write with: sudo dd if=$IMGNAME of=/dev/sdX bs=4M conv=fsync status=progress"

The reason the KD20 can boot from a rescue disk, is that the SoC first tries to boot from sata, and then from flash. But to do so the disk must contain a bootloader, and I don’t see where your script gets that from. It’s certainly not included in a sysupgrade package, as that is supposed to be loaded by an existing u-boot in nand.

Here you can find instructions how to create a disk which will flash stock firmware on a Medion Live NASserver. The create script writes a pre-loader to disk, u-boot, generates a u-boot environment, and puts nand partition dumps on the disk. The on-disk u-boot environment (created in build.sh from line 139) contains a script to read the partition dumps from script, and write them to nand. But of course it shouldn’t be hard to change the script to store an initramfs on disk, and boot that.

Thank you for that quick reply. I’m not so deep into the details of the KD20 and firmware flashing as I should. I apologize for the following questions:

  • I assume the MedionNASServer is built on the same HW as the KD20. Correct?
  • I thought my u-boot living in the NAND is still working, because the KD20 obviously accesses disk1 and tries to load something but is probably running into a kernel panic, maybe because it’s loading the kernel in NAND which I think has the wrong version. Could integrating u-boot into the rescue disk change this behaviour and load the correct kernel from disk?
  • How can I integrate u-boot in my procedure?

I’d like to avoid creating a new procedure which might change my NVRAM and finally render my KD20 unrecoverable. My goal is to gain ssh access to the KD20 in the first place. From there I think I could try to fix my former mistake when tried to install OpenWrt. I’d appreciate any help with this.

Thank you

I assume the MedionNASServer is built on the same HW as the KD20. Correct?

It has the same SoC. But I suppose GPIO layout is different. (leds, buttons, …)

I thought my u-boot living in the NAND is still working, because the KD20 obviously accesses disk1

As I wrote, the SoC tries to boot from SATA before it tries NAND. So the accessing of the disk says nothing about u-boot in NAND.

Could integrating u-boot into the rescue disk change this behaviour and load the correct kernel from disk?

u-boot has to be integrated on disk, as this is how SATA boot works. The SoC loads a few sectors from disk, and tries to execute that. If that sectors happen to contain a pre-loader, this will load+execute u-boot from some other prefixed bunch of sectors. Normally this would be enough to use serial and tftp to load+execute an initramfs image, but as you think your serial port is damaged, you’ll have to put a bootcmd in u-boot environment, which loads an initramfs image from disk, and executes it. This will give you ssh access, and then you can inspect your NAND.

I’d like to avoid creating a new procedure which might change my NVRAM and finally render my KD20 unrecoverable.

As long as you remove the scary ‘nand erase’ and ‘nand write’ commands from the u-boot environment generated in build.sh, the disk won’t touch the NAND. It’s up to you to repair it from the ssh shell.

Sorrry for being a pain in the neck. I tried to consult ChatGPT again about your suggestion to adapt my script to “put a bootcmd in u-boot environment, which loads an initramfs image from disk, and executes it”. ChatGPT was obviously confused and I don’t trust the answers.

Then ChatGPT says:

Your build.sh script from flash-recovery-hdd was originally designed for flashing — to rewrite NAND contents from a disk image.
It’s not a bootable rescue disk image in itself — it’s a tool disk that U-Boot loads only to copy data into NAND (using those nand write commands that you commented out).

So with the nand write lines commented, it does nothing beyond booting, trying to load the flash instructions, then failing silently.

This is more or less what you are telling telling me

I guess the NAND setup for the KD20 could differ from that of the Medion device? I remember I had correct values when I first tried to install OpenWrt using telnet but I can’t find the old instructions anymore.

So I’m lost again and my questions are:

  1. What if I write the wrong layout to NAND? Would this finally brick the KD20 because its not able to boot from SATA anymore?
  2. How can I “put a bootcmd in u-boot environment, which loads an initramfs image from disk, and executes it”.?
  3. How do i create the initramfs? - ChatGPT gave me something but it didn’t work, maybe because the KD20 disk numbering is different or out of whatever reason.

Still, my final target is to have KD20 with a working Openwrt install.

You can’t. The SoC first tries to boot from SATA, and then from NAND. So there is no NAND content which can keep the NAS from booting from SoC. It isn’t read yet.

Which doesn’t make it a good idea to destroy the contents of NAND, of course.

Starting with that build.sh. It writes the mtd backups to harddisk on ascending addresses. So if you exchange the last mtd dump (mtd7.dump) by and initramf image, it will be written to the disk, and not overwritten by a following dump. Then you can edit the generation of the u-boot environment:

echo "Generate SATA U-Boot Environment"
echo -en "bootcmd=run select0 load_mtd7 boot_mtd7\0" >env.data
echo -en "bootdelay=2\0" >>env.data
echo -en "baudrate=115200\0" >>env.data
echo -en "ipaddr=192.168.50.100\0" >>env.data
echo -en "serverip=192.168.50.59\0" >>env.data
echo -en "autoload=n\0" >>env.data
echo -en "netmask=255.255.0.0\0" >>env.data
echo -en "bootfile=\"uImage\"\0" >>env.data
echo -en "select0=ide dev 0\0" >>env.data
echo -en "boot_mtd7=bootm 61000000 \0" >>env.data
echo -en "ethaddr=${macaddr}\0" >>mtd3.data
echo -en "load_mtd7=ide read 61000000 c600 2ee00\0" >>env.data
echo -en "\0" >>env.data

This will read the data from sector c600h (2ee00h sectors) to address 61000000h, and boot the module on that address. I think all lines not mentioned in ‘bootcmd’ are not needed, but they won’t hurt either.

Not. You download it: https://archive.openwrt.org/releases/23.05.5/targets/oxnas/ox820/openwrt-23.05.5-oxnas-ox820-shuttle_kd20-initramfs-uImage

One thing I remember from running OpenWrt on a KD20 is that the kernel of newer releases got too big and needed a change in the uboot environment to be able to work properly.

I’m not sure how you would fix that unless you have a working serial connection?

If @arcasys can boot to an initramfs disk with a prepared disk, he could use fw_setenv for this.

I’m still struggling with creating a SATA disk image that would - best case - install a working version of OpenWrt on my KD20 including fixing the NAND or - at least - provide ssh access and/or a netconsole. Maybe there’s something like this available somewhere…

@Mijzelf: Your suggestions are very helpful - but I still have to go through some trial and error. I will report when there’s some progress or ask more questions when I feel I’m on the right track.

I created a disk image using the following procedure:

#!/bin/bash

device="$1"
macaddr="$2"

if [ "x$macaddr" = "x" ] ; then
    echo "Usage: $0 device mac-addr"
    echo "mac-addr must have following style xx:xx:xx:xx:xx:xx"
    exit 1
fi

echo "Deleting partitions on device"
# Delete partitions first
dd if=/dev/zero of=$device bs=512 seek=0 count=34 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MBR to device"
# Make MBR
dd if=../mbr.bin of=$device bs=512 seek=0 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
# Add stage1 and u-boot
echo "Adding stage1"
dd if=stage1.wrapped750 of=$device bs=512 seek=34 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding U-Boot"
dd if=../u-boot.wrapped of=$device bs=512 seek=154 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}

echo "Generating NAND U-Boot Environment"
# Sector Starts (all values in HDD sectors)
# MTD1 => 1024
# MTD2 => 1024 + MTD1Size 
# => 1536
# MTD3 => 1024 + MTD1Size + MTD2Size 
# => 8704
# MTD4 => 1024 + MTD1Size + MTD2Size + MTD3Size 
# => 9728
# MTD6 => 1024 + MTD1Size + MTD2Size + MTD3Size + MTD4Size
# => 30208
# MTD7 => 1024 + MTD1Size + MTD2Size + MTD3Size + MTD4Size + MTD6Size
# => 50688

# MTD1Size = 512
# MTD2Size = 7168
# MTD3Size = 1024
# MTD4Size = 20480
# MTD6Size = 20480
# MTD7Size = 192000

# Generate MTD3
echo -en "bootargs= console=ttyS0,115200 elevator=cfq mac_addr=0x00,0x30,0xe0,0x00,0x00,0x01\0" >mtd3.data
echo -en "bootcmd=run boot_nand\0" >>mtd3.data
echo -en "bootdelay=2\0" >>mtd3.data
echo -en "baudrate=115200\0" >>mtd3.data
echo -en "ipaddr=192.168.20.60\0" >>mtd3.data
echo -en "serverip=192.168.20.20\0" >>mtd3.data
echo -en "autoload=n\0" >>mtd3.data
echo -en "netmask=255.255.0.0\0" >>mtd3.data
echo -en "bootfile=\"uImage\"\0" >>mtd3.data
echo -en "load_nand=nboot 61000000 0 440000\0" >>mtd3.data
echo -en "boot=bootm 61000000\0" >>mtd3.data
echo -en "boot_nand=run load_nand boot\0" >>mtd3.data
echo -en "MODEL_ID=AB03\0" >>mtd3.data
echo -en "PRODUCT_NAME=STG-212\0" >>mtd3.data
echo -en "VENDOR_NAME=MitraStar Technology Corp.\0" >>mtd3.data
echo -en "ethaddr=${macaddr}\0" >>mtd3.data
echo -en "\0" >>mtd3.data
# Enlarge the image
dd if=/dev/zero of=mtd3.data conv=notrunc seek=131067 bs=1 count=1 status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
cksum <mtd3.data >cksum.data
read CRC32 REMAINDER <cksum.data 
# Byte 0
CRC32_OCTAL0L=$((CRC32 & 7))
CRC32_OCTAL0M=$(((CRC32 >> 3) & 7))
CRC32_OCTAL0H=$(((CRC32 >> 6) & 3))
# Byte 1
CRC32_OCTAL1L=$(((CRC32 >> 8) & 7))
CRC32_OCTAL1M=$(((CRC32 >> 11) & 7))
CRC32_OCTAL1H=$(((CRC32 >> 14) & 3))
# Byte 2
CRC32_OCTAL2L=$(((CRC32 >> 16) & 7))
CRC32_OCTAL2M=$(((CRC32 >> 19) & 7))
CRC32_OCTAL2H=$(((CRC32 >> 22) & 3))
# Byte 3
CRC32_OCTAL3L=$(((CRC32 >> 24) & 7))
CRC32_OCTAL3M=$(((CRC32 >> 27) & 7))
CRC32_OCTAL3H=$(((CRC32 >> 30) & 3))

CRC32_STRING="\0$CRC32_OCTAL0H$CRC32_OCTAL0M$CRC32_OCTAL0L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL1H$CRC32_OCTAL1M$CRC32_OCTAL1L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL2H$CRC32_OCTAL2M$CRC32_OCTAL2L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL3H$CRC32_OCTAL3M$CRC32_OCTAL3L"
echo -en "$CRC32_STRING" >mtd3.crc
cat mtd3.crc mtd3.data >mtd3.bin

echo "Adding MTD1 data (stage1)"
dd if=mtd1.backup of=$device bs=512 seek=1024 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MTD2 data (NAND U-Boot)"
dd if=mtd2.backup of=$device bs=512 seek=1536 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MTD3 data (U-Boot Environment)"
dd if=mtd3.bin of=$device bs=512 seek=8704 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MTD4 data (Kernel)"
dd if=mtd4.backup of=$device bs=512 seek=9728 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MTD6 data (info)"
dd if=mtd6.backup of=$device bs=512 seek=30208 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
echo "Adding MTD7 data (sysdisk)"
dd if=mtd7.backup of=$device bs=512 seek=50688 bs=512 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}

rm mtd3.data mtd3.crc mtd3.bin cksum.data

echo "Generate SATA U-Boot Environment"
echo -en "bootcmd=run select0 load_mtd7 boot_mtd7\0" >env.data
echo -en "bootdelay=2\0" >>env.data
echo -en "baudrate=115200\0" >>env.data
echo -en "ipaddr=192.168.20.60\0" >>env.data
echo -en "serverip=192.168.20.20\0" >>env.data
echo -en "autoload=n\0" >>env.data
echo -en "netmask=255.255.0.0\0" >>env.data
echo -en "bootfile=\"uImage\"\0" >>env.data
echo -en "select0=ide dev 0\0" >>env.data
echo -en "boot_mtd7=bootm 61000000 \0" >>env.data
echo -en "mtd7=run load_mtd7 flash_mtd7\0" >>env.data
echo -en "ethaddr=${macaddr}\0" >>mtd3.data

echo -en "load_mtd7=ide read 61000000 c600 2ee00\0" >>env.data
echo -en "clear_mbr=ide write 0x60000000 0 1\0" >>env.data
echo -en "MODEL_ID=AB03\0" >>env.data
echo -en "PRODUCT_NAME=STG-212\0" >>env.data
echo -en "VENDOR_NAME=MitraStar Technology Corp.\0" >>env.data
echo -en "\0" >>env.data

# Enlarge the image
dd if=/dev/zero of=mtd3.data conv=notrunc seek=8187 bs=1 count=1 status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
cksum <env.data >cksum.data
read CRC32 REMAINDER <cksum.data 
# Byte 0
CRC32_OCTAL0L=$((CRC32 & 7))
CRC32_OCTAL0M=$(((CRC32 >> 3) & 7))
CRC32_OCTAL0H=$(((CRC32 >> 6) & 3))
# Byte 1
CRC32_OCTAL1L=$(((CRC32 >> 8) & 7))
CRC32_OCTAL1M=$(((CRC32 >> 11) & 7))
CRC32_OCTAL1H=$(((CRC32 >> 14) & 3))
# Byte 2
CRC32_OCTAL2L=$(((CRC32 >> 16) & 7))
CRC32_OCTAL2M=$(((CRC32 >> 19) & 7))
CRC32_OCTAL2H=$(((CRC32 >> 22) & 3))
# Byte 3
CRC32_OCTAL3L=$(((CRC32 >> 24) & 7))
CRC32_OCTAL3M=$(((CRC32 >> 27) & 7))
CRC32_OCTAL3H=$(((CRC32 >> 30) & 3))

CRC32_STRING="\0$CRC32_OCTAL0H$CRC32_OCTAL0M$CRC32_OCTAL0L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL1H$CRC32_OCTAL1M$CRC32_OCTAL1L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL2H$CRC32_OCTAL2M$CRC32_OCTAL2L"
CRC32_STRING="$CRC32_STRING\0$CRC32_OCTAL3H$CRC32_OCTAL3M$CRC32_OCTAL3L"
echo -en "$CRC32_STRING" >env.crc
cat env.crc env.data >env.bin

echo "Integrating SATA U-Boot Environment"
dd if=env.bin of=$device bs=512 seek=558 conv=notrunc status=noxfer &>/dev/null || {
    echo "Failed to write disk"
    exit 1
}
rm env.data env.crc env.bin cksum.data

The result is: Power LED is solid blue, no disk LED, nothing on the network.

I digged a bit deeper and had a look into u-boot.wrapped where I found config entries not matching the values I’ve configured in the procedure. Here’s a snippet:

0001e350  ff ff ff ff a4 a1 d0 60  62 6f 6f 74 61 72 67 73  |.......`bootargs|0001e360  3d 72 6f 6f 74 3d 2f 64  65 76 2f 73 64 61 31 20  |=root=/dev/sda1 |0001e370  63 6f 6e 73 6f 6c 65 3d  74 74 79 53 30 2c 31 31  |console=ttyS0,11|0001e380  35 32 30 30 20 65 6c 65  76 61 74 6f 72 3d 63 66  |5200 elevator=cf|0001e390  71 20 6d 61 63 5f 61 64  72 3d 30 78 30 30 2c 30  |q mac_adr=0x00,0|0001e3a0  78 33 30 2c 30 78 65 30  2c 30 78 30 30 2c 30 78  |x30,0xe0,0x00,0x|0001e3b0  30 30 2c 30 78 30 31 00  62 6f 6f 74 63 6d 64 3d  |00,0x01.bootcmd=|0001e3c0  72 75 6e 20 73 65 6c 65  63 74 30 20 6c 6f 61 64  |run select0 load|0001e3d0  20 62 6f 6f 74 20 7c 7c  20 72 75 6e 20 73 65 6c  | boot || run sel|0001e3e0  65 63 74 30 20 6c 6f 61  64 32 20 62 6f 6f 74 20  |ect0 load2 boot |0001e3f0  7c 7c 20 72 75 6e 20 6c  69 67 68 74 6c 65 64 20  ||| run lightled |0001e400  73 65 6c 65 63 74 31 20  6c 6f 61 64 20 65 78 74  |select1 load ext|0001e410  69 6e 67 75 69 73 68 6c  65 64 20 62 6f 6f 74 20  |inguishled boot |0001e420  7c 7c 20 72 75 6e 20 6c  69 67 68 74 6c 65 64 20  ||| run lightled |0001e430  73 65 6c 65 63 74 31 20  6c 6f 61 64 32 20 65 78  |select1 load2 ex|0001e440  74 69 6e 67 75 69 73 68  6c 65 64 20 62 6f 6f 74  |tinguishled boot|0001e450  20 7c 7c 20 6c 69 67 68  74 6c 65 64 00 62 6f 6f  | || lightled.boo|0001e460  74 64 65 6c 61 79 3d 32  00 62 61 75 64 72 61 74  |tdelay=2.baudrat|0001e470  65 3d 31 31 35 32 30 30  00 65 74 68 61 64 64 72  |e=115200.ethaddr|0001e480  3d 30 30 3a 33 30 3a 65  30 3a 30 30 3a 30 30 3a  |=00:30:e0:00:00:|0001e490  30 31 00 69 70 61 64 64  72 3d 31 39 32 2e 31 36  |01.ipaddr=192.16|0001e4a0  38 2e 35 30 2e 31 30 30  00 73 65 72 76 65 72 69  |8.50.100.serveri|0001e4b0  70 3d 31 39 32 2e 31 36  38 2e 35 30 2e 35 39 00  |p=192.168.50.59.|
0001e4c0  61 75 74 6f 6c 6f 61 64  3d 6e 00 6e 65 74 6d 61  |autoload=n.netma|
0001e4d0  73 6b 3d 32 35 35 2e 32  35 35 2e 30 2e 30 00 62  |sk=255.255.0.0.b|
0001e4e0  6f 6f 74 66 69 6c 65 3d  22 75 49 6d 61 67 65 22  |ootfile="uImage"|
0001e4f0  00 73 65 6c 65 63 74 30  3d 69 64 65 20 64 65 76  |.select0=ide dev|
0001e500  20 30 00 73 65 6c 65 63  74 31 3d 69 64 65 20 64  | 0.select1=ide d|
0001e510  65 76 20 31 00 6c 6f 61  64 3d 69 64 65 20 72 65  |ev 1.load=ide re|
0001e520  61 64 20 30 78 36 30 35  30 30 30 30 30 20 35 30  |ad 0x60500000 50|
0001e530  61 20 32 37 61 38 00 6c  6f 61 64 32 3d 69 64 65  |a 27a8.load2=ide|
0001e540  20 72 65 61 64 20 30 78  36 30 35 30 30 30 30 30  | read 0x60500000|
0001e550  20 65 33 65 38 20 32 37  61 38 00 6c 69 67 68 74  | e3e8 27a8.light|
0001e560  6c 65 64 3d 6c 65 64 66  61 69 6c 20 31 00 65 78  |led=ledfail 1.ex|
0001e570  74 69 6e 67 75 69 73 68  6c 65 64 3d 6c 65 64 66  |tinguishled=ledf|
0001e580  61 69 6c 20 30 00 62 6f  6f 74 3d 62 6f 6f 74 6d  |ail 0.boot=bootm|
0001e590  20 36 30 35 30 30 30 30  30 00 00 00 59 dd d1 60  | 60500000...Y..`|

Can this be the reason for the kernel not loading? If so, can I adapt u-boot.wrapped somehow? Another file pulled into the image is mbr.bin:

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001a0  00 00 00 00 00 5f 01 00  00 df 00 00 00 80 00 00  |....._..........|
000001b0  22 80 00 00 22 00 00 00  00 80 00 00 00 00 00 00  |"..."...........|
000001c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

Thank you for helping.

In a previous post you managed to go back to stock using an USB stick recovery method. Can’t you just use the same method again? I still have the recovery files for the KD20 on my laptop if you need them.

I’ve already tried this method but it doesn’t work - probably because U-Boot has been changed when I tried to install OpenWrt.

Normally u-boot has a default config which is used in case the checksum of the environment doesn’t fit. I suppose this is the default config of this u-boot. Assuming jedie knew what he did, this u-boot looks at sector 558 for it’s environment, where you wrote it. (line 192 of your script).

Did your script output anything when creating the disk? And you did exchange mtd7.dump by an initramfs image?

I’ve added line numbers to be created with bash -x and created the file test.img which I then transfered to disk using dd

hans@hans-lappy:~/KD20/JEDIE/NAS7820-Tools-master/flash-recovery-hdd/MedionNAS$ bash -x build.sh test.img 80:ee:73:4b:ca:6a
+ PS4='Line $LINENO: '
Line 3: device=test.img
Line 4: macaddr=80:ee:73:4b:ca:6a
Line 6: '[' x80:ee:73:4b:ca:6a = x ']'
Line 12: echo 'Deleting partitions on device'
Deleting partitions on device
Line 14: dd if=/dev/zero of=test.img bs=512 seek=0 count=34 conv=notrunc status=noxfer
Line 18: echo 'Adding MBR to device'
Adding MBR to device
Line 20: dd if=../mbr.bin of=test.img bs=512 seek=0 conv=notrunc status=noxfer
Line 25: echo 'Adding stage1'
Adding stage1
Line 26: dd if=stage1.wrapped750 of=test.img bs=512 seek=34 conv=notrunc status=noxfer
Line 30: echo 'Adding U-Boot'
Adding U-Boot
Line 31: dd if=../u-boot.wrapped of=test.img bs=512 seek=154 bs=512 conv=notrunc status=noxfer
Line 36: echo 'Generating NAND U-Boot Environment'
Generating NAND U-Boot Environment
Line 58: echo -en 'bootargs= console=ttyS0,115200 elevator=cfq mac_addr=0x00,0x30,0xe0,0x00,0x00,0x01\0'
Line 59: echo -en 'bootcmd=run boot_nand\0'
Line 60: echo -en 'bootdelay=2\0'
Line 61: echo -en 'baudrate=115200\0'
Line 62: echo -en 'ipaddr=192.168.20.60\0'
Line 63: echo -en 'serverip=192.168.20.20\0'
Line 64: echo -en 'autoload=n\0'
Line 65: echo -en 'netmask=255.255.0.0\0'
Line 66: echo -en 'bootfile="uImage"\0'
Line 67: echo -en 'load_nand=nboot 61000000 0 440000\0'
Line 68: echo -en 'boot=bootm 61000000\0'
Line 69: echo -en 'boot_nand=run load_nand boot\0'
Line 70: echo -en 'MODEL_ID=AB03\0'
Line 71: echo -en 'PRODUCT_NAME=STG-212\0'
Line 72: echo -en 'VENDOR_NAME=MitraStar Technology Corp.\0'
Line 73: echo -en 'ethaddr=80:ee:73:4b:ca:6a\0'
Line 74: echo -en '\0'
Line 76: dd if=/dev/zero of=mtd3.data conv=notrunc seek=131067 bs=1 count=1 status=noxfer
Line 80: cksum
Line 81: read CRC32 REMAINDER
Line 83: CRC32_OCTAL0L=6
Line 84: CRC32_OCTAL0M=0
Line 85: CRC32_OCTAL0H=2
Line 87: CRC32_OCTAL1L=5
Line 88: CRC32_OCTAL1M=3
Line 89: CRC32_OCTAL1H=1
Line 91: CRC32_OCTAL2L=5
Line 92: CRC32_OCTAL2M=4
Line 93: CRC32_OCTAL2H=2
Line 95: CRC32_OCTAL3L=0
Line 96: CRC32_OCTAL3M=2
Line 97: CRC32_OCTAL3H=2
Line 99: CRC32_STRING='\0206'
Line 100: CRC32_STRING='\0206\0135'
Line 101: CRC32_STRING='\0206\0135\0245'
Line 102: CRC32_STRING='\0206\0135\0245\0220'
Line 103: echo -en '\0206\0135\0245\0220'
Line 104: cat mtd3.crc mtd3.data
Line 106: echo 'Adding MTD1 data (stage1)'
Adding MTD1 data (stage1)
Line 107: dd if=mtd1.backup of=test.img bs=512 seek=1024 bs=512 conv=notrunc status=noxfer
Line 111: echo 'Adding MTD2 data (NAND U-Boot)'
Adding MTD2 data (NAND U-Boot)
Line 112: dd if=mtd2.backup of=test.img bs=512 seek=1536 bs=512 conv=notrunc status=noxfer
Line 116: echo 'Adding MTD3 data (U-Boot Environment)'
Adding MTD3 data (U-Boot Environment)
Line 117: dd if=mtd3.bin of=test.img bs=512 seek=8704 bs=512 conv=notrunc status=noxfer
Line 121: echo 'Adding MTD4 data (Kernel)'
Adding MTD4 data (Kernel)
Line 122: dd if=mtd4.backup of=test.img bs=512 seek=9728 bs=512 conv=notrunc status=noxfer
Line 126: echo 'Adding MTD6 data (info)'
Adding MTD6 data (info)
Line 127: dd if=mtd6.backup of=test.img bs=512 seek=30208 bs=512 conv=notrunc status=noxfer
Line 131: echo 'Adding MTD7 data (sysdisk)'
Adding MTD7 data (sysdisk)
Line 132: dd if=mtd7.backup of=test.img bs=512 seek=50688 bs=512 conv=notrunc status=noxfer
Line 137: rm mtd3.data mtd3.crc mtd3.bin cksum.data
Line 139: echo 'Generate SATA U-Boot Environment'
Generate SATA U-Boot Environment
Line 140: echo -en 'bootcmd=run select0 load_mtd7 boot_mtd7\0'
Line 141: echo -en 'bootdelay=2\0'
Line 142: echo -en 'baudrate=115200\0'
Line 143: echo -en 'ipaddr=192.168.20.60\0'
Line 144: echo -en 'serverip=192.168.20.20\0'
Line 145: echo -en 'autoload=n\0'
Line 146: echo -en 'netmask=255.255.0.0\0'
Line 147: echo -en 'bootfile="uImage"\0'
Line 148: echo -en 'select0=ide dev 0\0'
Line 149: echo -en 'boot_mtd7=bootm 61000000 \0'
Line 150: echo -en 'mtd7=run load_mtd7 flash_mtd7\0'
Line 151: echo -en 'ethaddr=80:ee:73:4b:ca:6a\0'
Line 153: echo -en 'load_mtd7=ide read 61000000 c600 2ee00\0'
Line 154: echo -en 'clear_mbr=ide write 0x60000000 0 1\0'
Line 155: echo -en 'MODEL_ID=AB03\0'
Line 156: echo -en 'PRODUCT_NAME=STG-212\0'
Line 157: echo -en 'VENDOR_NAME=MitraStar Technology Corp.\0'
Line 158: echo -en '\0'
Line 161: dd if=/dev/zero of=mtd3.data conv=notrunc seek=8187 bs=1 count=1 status=noxfer
Line 165: cksum
Line 166: read CRC32 REMAINDER
Line 168: CRC32_OCTAL0L=0
Line 169: CRC32_OCTAL0M=2
Line 170: CRC32_OCTAL0H=2
Line 172: CRC32_OCTAL1L=3
Line 173: CRC32_OCTAL1M=4
Line 174: CRC32_OCTAL1H=3
Line 176: CRC32_OCTAL2L=7
Line 177: CRC32_OCTAL2M=5
Line 178: CRC32_OCTAL2H=3
Line 180: CRC32_OCTAL3L=4
Line 181: CRC32_OCTAL3M=3
Line 182: CRC32_OCTAL3H=3
Line 184: CRC32_STRING='\0220'
Line 185: CRC32_STRING='\0220\0343'
Line 186: CRC32_STRING='\0220\0343\0357'
Line 187: CRC32_STRING='\0220\0343\0357\0334'
Line 188: echo -en '\0220\0343\0357\0334'
Line 189: cat env.crc env.data
Line 191: echo 'Integrating SATA U-Boot Environment'
Integrating SATA U-Boot Environment
Line 192: dd if=env.bin of=test.img bs=512 seek=558 conv=notrunc status=noxfer
Line 196: rm env.data env.crc env.bin cksum.data

There is no mtd7.dump just mtd7.backup and this is linked to initramfs

32270670 -rw-rw-r-- 4 hans hans    7584688 Okt 30 00:04 initramfs
32768960 -rw-r--r-- 1 hans hans     262144 Jan 16  2012 mtd1.backup
32768961 -rw-r--r-- 1 hans hans    3670016 Jan 16  2012 mtd2.backup
32777045 -rw-rw-r-- 1 hans hans       8188 Nov  2 19:50 mtd3.data
32768963 -rw-r--r-- 1 hans hans   10485760 Jan 16  2012 mtd4.backup
32768964 -rw-r--r-- 1 hans hans   10485760 Jan 16  2012 mtd6.backup
32270670 -rw-rw-r-- 4 hans hans    7584688 Okt 30 00:04 mtd7.backup
32768965 -rw-r--r-- 1 hans hans   98304000 Jan 16  2012 mtd7.backup.ori
32768959 -rw-r--r-- 1 hans hans        230 Jan 16  2012 mtd-checksums.md5
32768966 -rwxr-xr-x 1 hans hans       7576 Jan 16  2012 stage1.wrapped750
32770101 -rw-rw-r-- 1 hans hans   33536944 Nov  2 19:50 test.img
32770082 -rw-r--r-- 1 hans hans          0 Nov  1 17:07 uwrap
hans@hans-lappy:~/KD20/JEDIE/NAS7820-Tools-master/flash-recovery-hdd/MedionNAS$ file mtd7.backup
mtd7.backup: u-boot legacy uImage, ARM OpenWrt Linux-5.15.167, Linux/ARM, OS Kernel Image (Not compressed), 7584624 bytes, Mon Sep 23 12:34:46 2024, Load Address: 0X60008000, Entry Point: 0X60008000, Header CRC: 0X72A13338, Data CRC: 0X67A4A78A

hans@hans-lappy:~/KD20/JEDIE/NAS7820-Tools-master/flash-recovery-hdd/MedionNAS$ file mtd4.backup 
mtd4.backup: u-boot legacy uImage, Linux-2.6.31.14_SMP_820, Linux/ARM, OS Kernel Image (Not compressed), 5241420 bytes, Wed Oct  5 13:54:17 2011, Load Address: 0X60008000, Entry Point: 0X60008000, Header CRC: 0X1373966A, Data CRC: 0XAB72B74

Maybe there are some version mismatches? I found the following Dropbox link with obviously newer files: KD20 Dropbox. Could that be of some help?

Possibly. That KD20_sata_boot.tar.gz looks promising. It contains a script which creates a bootable disk, with a preloader and u-boot and optionally an uImage.

The u-boot has this default environment:

bootargs=root=/dev/sda2 initrd=0x61000000 console=ttyS0,115200 elevator=cfq mac_adr=0x00,0x25,0xb1,0xff,0xff,0x00
bootcmd=run beep select0 load loadr sysled boot || run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot|| run sysretry load loadr sysled boot || run sysretry load loadr sysled boot || run errled select2 load3 loadr3 ramboot boot 
bootdelay=2
baudrate=115200
ethaddr=00:25:b1:ff:ff:00
ipaddr=192.168.0.128
serverip=192.168.0.1
autoload=n
netmask=255.255.0.0
bootfile="uImage"
select0=ide dev 0
select1=ide dev 1
select2=dhcp 
loadr=ide read 0x62000000 2122 1644
load=ide read 0x60500000 50a 1800
loadr3=tftp 0x62000000 rdimg.gz
load2=ide read 0x60500000 e3e8 1800
load3=tftp 0x60500000 uImage
sysretry=led a;ide res
sysled=led 1
errled=led r
beep=beep
ramboot=setenv bootargs root=/dev/ram0 console=ttyS0,115200 initrd=0x61000000 mem=256M
boot=bootm 60500000 62000000

It will try to load an uImage from sector 50a, and an initrd from sector 2122. Unfortunately the uImage can only be 1800h sectors in size, which is a bit more than 3MB, which is not enough for the initramfs image.

But, it will retry this a few times (beats me why, why would it succeed a 2nd time?), and finally try a tftp boot, which means it will try to download a uImage and initrd over tftp, and boot that. If you prepare your disk using this script and files, and use Wireshark to watch the network activity, you should see a dhcp request, and a try to download a file uImage from a tftpserver on address 192.168.0.1. When that succeeds it will try to download a file rdimg.gz, after which it boots.

So if you setup a tftp server on that address (your OpenWrt router could do it, it has a build-in tftp server) and provide those 2 files (and rdimg.gz can be just anything, the initramfs image will ignore it), it should boot.

I think I’m close but it’s not working yet because I’m nor clear about some details:

I prepared a disk (sdd) using disk_create. The disk had a partition table - which the script deletes - and the script creates a file /dev/sdd1 which is not a block device. The script lists kernelFile=$workarea/uImage which I linked to uImage3.18.1_7

I got a tftp server running (tftpd-hpa) with root dir /srv/tftp. In /srv/tftp I have

root@hans-lappy:/srv# tree
.
├── kd20.pcap
└── tftp
    ├── rdimg.gz
    ├── uImage

uImage is the same as uImage3.18.1_7.

I insert the disk into the KD20, start tcpdump and the power up the KD20.

root@hans-lappy:/srv# tcpdump -n -ienp0s31f6 -w kd20.pcap -vv
tcpdump: listening on enp0s31f6, link-type EN10MB (Ethernet), snapshot length 262144 bytes 

In the tcpdump output I see

17:12:07.322313 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:25:b1:ff:ff:00 (oui Unknown), length 301
17:12:07.322575 ARP, Request who-has 192.168.0.50 tell hans-lappy, length 28
17:12:08.322959 IP hans-lappy.bootps > 192.168.0.50.bootpc: BOOTP/DHCP, Reply, length 300
17:12:08.325033 IP 192.168.0.50.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:25:b1:ff:ff:00 (oui Unknown), length 301
17:12:08.326297 IP hans-lappy.bootps > 192.168.0.50.bootpc: BOOTP/DHCP, Reply, length 300
17:12:08.328217 ARP, Request who-has 192.168.0.50 tell hans-lappy, length 28
17:12:17.617243 ARP, Request who-has hans-lappy tell 192.168.0.50, length 46
17:12:17.617286 ARP, Reply hans-lappy is-at 3c:52:82:b8:89:5f (oui Unknown), length 28
17:12:17.618307 ARP, Request who-has hans-lappy tell 192.168.0.50, length 46
17:12:17.618317 ARP, Reply hans-lappy is-at 3c:52:82:b8:89:5f (oui Unknown), length 28
17:12:17.619321 IP 192.168.0.50.3015 > hans-lappy.tftp: TFTP, length 25, RRQ "uImage" octet timeout 5
17:12:17.620810 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 12
17:12:17.622062 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.622175 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.623140 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.623234 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.624124 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.624211 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.625114 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.625151 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.626331 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.626426 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.627302 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.627390 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.628360 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.628429 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.629517 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.629608 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.630490 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.630561 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.631467 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.631492 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.632622 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.632711 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.633678 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.633748 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
17:12:17.634737 IP 192.168.0.50.3015 > hans-lappy.59648: UDP, length 4
17:12:17.634807 IP hans-lappy.59648 > 192.168.0.50.3015: UDP, length 516
....
....

The output goes on and on, the KD20 power LED is red, disk 1 LED steady blue.
ping 192.168.0.50 does not respond but nmap shows

root@hans-lappy:/srv# nmap  192.168.0.50
Starting Nmap 7.80 ( https://nmap.org ) at 2025-11-03 17:18 CET
Nmap scan report for 192.168.0.50
Host is up (0.00029s latency).
All 1000 scanned ports on 192.168.0.50 are filtered
MAC Address: 00:25:B1:FF:FF:00 (Maya-Creation)
root@hans-lappy:/srv# nmap -sU -p 69 192.168.0.50
Starting Nmap 7.80 ( https://nmap.org ) at 2025-11-03 17:21 CET
Nmap scan report for 192.168.0.50
Host is up (0.00048s latency).

PORT   STATE         SERVICE
69/udp open|filtered tftp
MAC Address: 00:25:B1:FF:FF:00 (Maya-Creation)

Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds

What’s also remarkable: The fan is running all the time…

I think if I’m getting uImage right for the procedure and for /svr/tftp. It might work. What about rdimg.gz? You said it’s ignored. The file I have is:

root@hans-lappy:/srv/tftp# file rdimg.gz
rdimg.gz: u-boot legacy uImage, , Linux/ARM, RAMDisk Image (gzip), 2287245 bytes, Wed Jun 18 05:51:04 2014, Load Address: 0X61000000, Entry Point: 0X61000000, Header CRC: 0X924D7088, Data CRC: 0XD2298BD5

The idea was not to use uImage3.18.1_7, but the initramfs image. Seeing it’s size uImage3.18.1_7 is just a kernel, and without rootfs it won’t do anything, while the initramfs is a kernel + a complete OpenWrt rootfs, running an ssh server.

Actually I’m a bit surprised you got a tftp request. You wrote uImage3.18.1_7 to disk, which fits in the 1800h sectors, so it should have booted that. The kernel will panic out, but u-boot doesn’t know that, as it’s no longer there. U-boot only knows booting failed when it didn’t have a kernel to boot. But maybe rdimg.gz is not supposed to be random data, but have an u-boot header, in which case u-boot knows it fails.

The output goes on and on,

Yeah, it’s transferring 2.92MB in chunks of 516 bytes. That takes some time.

ping 192.168.0.50 does not respond

Until it has booted Linux, there is only u-boot on the other side. That doesn’t have a very sophisticated network stack. And it is already busy handling tftp messages. So no ping response doesn’t say much.

What about rdimg.gz? You said it’s ignored.

u-boot loads the kernel and initrd in memory, and boots the kernel. Using some memory structure it provides the kernel some information, like the bootargs (cmdline), and the address and size of the initrd. But the initramfs image contains it’s own rootfs (that’s why it’s that big), and ignores the initrd. (and also the bootargs, but for another reason). So the only reason to provide the rdimg.gz is because u-boot wants to download it, before it boots the uImage. Your file should be fine.

A few seconds after the rdimg.gz is send, the box should have booted OpenWrt, and have an ssh daemon listening. (And Luci, BTW). There is one small problem, OpenWrt by default listens on 192.168.1.1. So you’ll have to reconfigure your network port to connect.

Hurray! Here’s the breakthrough - but I still need some help:

First thing, I found my notes about what I did when I bricked the KD20 with a failed OpenWrt install:

Starting from the KD20 running on stock firmware I followed the instructions in https://openwrt.org/toh/shuttle/kd20#installation_process. Then I did

    • make -j$(nproc)

    • lede-oxnas-kd20-factory.tar.gz successfully created in bin/targets/oxnas/generic

    • perform firmware update with lede-oxnas-kd20-factory.tar.gz

    • Success! After rebooting the KD20 starts with no problem

  1. ssh into KD20

    • There is no device with the previous address 192.168.20.101. nmap shows a device with MAC Address: 00:25:B1:FF:FF:00 (Maya-Creation), ok

    • MAC new: 00:25:B1:FF:FF:00

    • IP new: 192.168.20.105

    • ssh 192.168.20.105 diectly show the LEDE greeter

  2. Install final firmware

  • wget https://downloads.openwrt.org/releases/23.05.4/targets/oxnas/ox820/openwrt-23.05.4-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar
  • wget https://downloads.openwrt.org/releases/23.05.4/targets/oxnas/ox820/openwrt-23.05.4-oxnas-ox820-shuttle_kd20-squashfs-ubinized.bin
  • scp openwrt-23.05.4-oxnas-ox820-shuttle_kd20* 192.168.20.105:/tmp

Step 3 failed because the install intructions i followed referred to 19.07.5 and now I had downloaded newer files. The result was

  • No boot from NVRAM

  • No boot from USB

As much for the history.
What if the NVRAM and U-Boot from the failed OpenWrt install was still intact and ready to load a kernel, didn’t find something proper and then? What if I made sure the the KD20 would actually use the U-Boot from NVRAM? How do I force this?

Ok, I removed disk 1, so no disk was left. Then I started tcpdump, powered the Shuttle and looked at the output. I had to fix the server address, i.e. my laptops address and started again. This time the Shuttle got the IPs right, issued a RRQ for uImage and the started the download. uImage in /srv/tftp still was openwrt-23.05.5-oxnas-ox820-shuttle_kd20-initramfs-uImage as you sugested. I had tcpdump write to a file, let it run for 10 minutes and checked if the download would start over like I had seen in my trials to boot from SATA. To my surprise the uImage download had finished properly then rdimg.gz was downloaded.

nmap 192.168.0.50 looks promising:

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 00:25:B1:FF:FF:00 (Maya-Creation)
When i log in with root I get:

BusyBox v1.36.1 (2024-09-23 12:34:46 UTC) built-in shell (ash)


BusyBox v1.36.1 (2024-09-23 12:34:46 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.5, r24106-10cc5fcd00
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~#

Now we try the web interface. This also works and says:

“System running in recovery (initramfs) mode.No changes to settings will be stored and are lost after rebooting. This mode should only be used to install a firmware upgrade”

…..

Powered by LuCI openwrt-23.05 branch (git-24.264.56413-c7a3562) / OpenWrt 23.05.5 (r24106-10cc5fcd00)

Which file do I have to upload? The Flash Operations Page says:

Flash new firmware image

Upload a sysupgrade-compatible image here to replace the running firmware.

Image Flash Image…

In my understanding it’s not an upgrade but a first installation.

My question is: How do I proceed from here. I do not want to risk to destroy what I’ve achieved …

Thank you for your patience

On the device I’ve already copied openwrt-23.05.6-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar to /tmp. ChatGPT suggests that I run sysupgrade -n /tmp/openwrt-23.05.6-oxnas-ox820-shuttle_kd20-squashfs-sysupgrade.tar and this would only touch mtd4 and mtd5 in NVRAM and reboot into a ‘fresh installed OpenWrt’. If so, I would be safe (?) and could start to configure OpenWrt to my liking (not as router with static IP but as a client getting its IP by DHCP.

It shall finally serve as a NAS, being far more configurable as with the stock firmware, e.g.

  • NFS configuration
  • maybe WiFi could be enabled using a USB dongle
  • etc …

I’m not really good friend with ChatGPT. You need to check carefully where the information came from and in doubt have a look at the original source. AI like ChatGPT is not intelligent at all but a great tool to find and gather references relating to your topic on the network. As they say: ChatGPT can make errors - and often enough it does. I guess you know all that but I thought this has to be said,

Do you remember what was the last OpenWrt version that worked with your device? If so I would recommend to do a sysupgrade using that specific OpenWrt version. That should install the firmware on the nand flash and hopefully result in a working system again.

Upgrading OpenWrt to the latest versions requires a change in the uboot environment and I think it is best to do that separately from a working system instead of trying to do it all in one go.