MEDION LifeCloud P89654 (MD90224)

Hardware Questions and Recommendations
1

In my search for an alternative firmware for my crashed MD90224 NAS from Medion. I stumbled on a page about flashing OpenWRT on a Medion Live NASserver P89625 (MD86407).

After inspecting the compatible models, I noticed my model wasn't in the list. But I thought, WTH do I have to loose, I just try it. But unfortunately after succesfully loading the firmware in the memory of my NAS and trying to boot the image from the memory with the bootm command, I get the "bad magic number" error.

I guess this is due to the fact my model isn't mentioned as being compatible?

The big question is, is there a way to make it compatible? Or is that said easier than done?

2

You will need a bespoke image for this model, not something else.

As you are the only one with this hardware on the desk, only you can can answer this question. We have no idea what hardware (SOC, flash, RAM, switch, SATA controller, etc. pp.), nor if -based on that- it could even be supported at all. If it is supportable, someone (realistically, you) would have to do the necessary development for it.

3

AFAIK there are two lines of Medion NASses, one has a PLX 7820 SoC, the other has a Marvell Kirkwood SoC. A quick google shows your MD90224 has 2 drive bays, and I think that means that it's a Kirkwood. In that case this box is more related than the MD86407, and a better startpoint for adaption.

If you are not especially interested in OpenWrt, but more in a more modern OS than you now have, you might want to look at doozan.com.

4

Thanks for your reply. But I have no experience in development of a firmware on my own. I am only trying to modernize my old NAS. So I can ditch the need for FlashBrowser.

When I connect to the mainboard of the NAS with a serial to TTY, I get the Marvell U-Boot. Which says it has:

Marvell Board: DB6702A-GMtech LE with U-Boot 1.1.4.
SOC 88F6702 A1
DRAM (DDR2) size 256MB
NAND: 256MB
Flash: 0kB

5

Thanks for your reply. Your right, the MD90224 has 2 drive bays. And my interest isn't especially for OpenWrt as you mentioned, I just want it be updated which ditches the need for FlashBrowser.

I looked at the doozan,com link, but because I'm new at this it is all not that clear to me how it works. I can come as far as following a step by step manual on how to do something.

My knowledge of Linux is also very low. So a step by step guide would be very helpful.

6

Forgot to mention:

CPU: Marvell Feroceon (Rev 1)

7

That's hard. As the doozan way also doesn't exist yet for your box.

Basically the doozan way is to boot (almost) stock Debian from a USB stick (or -disk). To get it booted, you'll need to let u-boot load a kernel and a dtb file in memory, and boot it. The kernel is configured to use the Debian rootfs, when properly created (basically, it needs to have a certain label, rootfs, or something like that)
The thread I pointed to is a quest to get the dtb file for the MD86946. A dtb file is basically a database which describes the hardware so the kernel knows how to access/use it. Don't know what the difference is between an MD86946 and a MD90244, but odds are that it's only a difference in disk size, and in that case the dtb is the same.
When the dtb is settled, a way has to be found to get u-boot load that kernel/dtb. Maybe from USB stick, maybe from flash. Whatever comes in handy, and is supported by that u-boot.

The OpenWrt way would be to put the whole system in flash (your 256MB is plenty). Odds are that if you would put the right dtb file in the NSA325 image, it would work. But unfortunately that transplantation isn't easy for a beginner.

8

Unfortunately I think I brinked my NAS... After following the guide from here: https://openwrt.org/toh/medion/md86587
I did all the steps, including:
setenv bootcmd 'nboot 60500000 0 440000; bootm'
saveenv

And ended up with the "bad magic number" error. But if I now try to boot the NAS normal while connect by TTY, it stops the boot right after the countdown to push a button to stop booting. And gives me the "bad magic number" error now. :frowning:

Enthusiastic as I was, I didn't make a safety backup of the original firmware.

9

guess you didn't save the default values, before you changed them ?

10

Nope! Like I said...I was a bit to enthusiastic. Stupid of me! :frowning:

11

The bootloader is still alive, else you didn't see that "bad magic number". Can you post the output of

printenv
help
12

I let it boot like normal, this is the complete dump from boot till after the printenv command:


         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|
 ** MARVELL BOARD: DB6702A-GMtech LE

U-Boot 1.1.4 (Jun  5 2013 - 10:49:39) Marvell version: 3.6.0

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0

Loading from NAND 256MB 3,3V 8-bit, offset 0x440000

** Bad Magic Number 0x0 **
## Booting image at 02000000 ...
Bad Magic Number
Marvell>> printenv
baudrate=115200
loads_echo=0
run_diag=yes
MALLOC_len=1
ethprime=egiga0
bootargs_end=:::DB88FXX81:eth0:none
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
ethmtu=1500
mvPhoneConfig=mv_phone_config=dev[0]:fxs,dev[1]:fxo
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
image_multi=yes
ethact=egiga0
console=console=ttyS0,115200
bootargs_root=ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
bootargs=console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
rootpath=/tftpboot_tokyo/marvell_nfs
bootfile=/pxelinux.0
gatewayip=10.0.0.1
netmask=255.255.0.0
ipaddr=10.0.2.14
serverip=10.0.0.5
image_name=uImage.medion
ethaddr=00:11:41:3C:5A:D5
PK=MEZE-BQGJ-TGKJ-ZYUM
bootcmd=nboot 60500000 0 440000; bootm
stdin=serial
stdout=serial
stderr=serial
mainlineLinux=no
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
bootdelay=3
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no

Environment size: 1289/131068 bytes
Marvell>>

When I type help, I saw a command resetenv what will do? Is this something I can try, without consequences or will it reset everything and am I then much further from where I want to be?

13

The environment is not more than you see here. So if resetenv makes it worse, you can simply set the vars again.

14

I did the resetenv command and afterwards I needed to reset the device. And this is what I get now:


         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|
 ** MARVELL BOARD: DB6702A-GMtech LE

U-Boot 1.1.4 (Jun  5 2013 - 10:49:39) Marvell version: 3.6.0

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6702 A1 CPU running @ 1000Mhz L2 running @ 500Mhz
SysClock = 400Mhz , TClock = 166Mhz

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
*** Warning - bad CRC or NAND, using default environment

Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled


USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 10.4.52.7; our IP address is 10.4.52.165
Filename 'uImage'.
Load address: 0x2000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
## Booting image at 02000000 ...
Bad Magic Number
Unknown command '<NULL>' - try 'help'
Marvell>>

Would be nice if I had a original dump... if only I hadn't been so stupid. :frowning:

15

I think I found an original printenv of the stock rom. But if I compare it with my current printenv, I notice a few variables which are not in the original one.

I tried help, to see if there is a command to remove a variable. So I can copy every line back, hoping it will be in original booting state.

16

That is setenv varname

How does that look?

17

I found this dump, which should be the original dump. But for some enviroments I can't get it set to the value in the dump. Or the complete enviroment disappears or isn't changed at all?

Marvell>> printenv
baudrate=115200
loads_echo=0
run_diag=yes
MALLOC_len=1
ethprime=egiga0
bootargs_end=:::DB88FXX81:eth0:none
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
ethmtu=1500
mvPhoneConfig=mv_phone_config=dev[0]:fxs,dev[1]:fxo
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
yuk_ethaddr=00:00:00:EE:51:81
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
image_multi=yes
ethact=egiga0
console=console=ttyS0,115200
bootargs_root=ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
bootargs=console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
bootcmd=nand read.e 0x800000 0x100000 0x400000; setenv bootargs $(console) $(bootargs_root); bootm 0x800000
rootpath=/tftpboot_tokyo/marvell_nfs
bootfile=/pxelinux.0
gatewayip=10.0.0.1
netmask=255.255.0.0
ipaddr=10.0.2.14
serverip=10.0.0.5
image_name=uImage.medion
ethaddr=00:11:41:3C:30:07
PK=MEPN-MDBQ-PTZT-AWZE
stdin=serial
stdout=serial
stderr=serial
mainlineLinux=no
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
bootdelay=3
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no

For example I can't seem to set the enviroment for the rootpath, image_name or console...

18

When the value is complex, you should set it between ''. For instance, the console should be set as setenv console 'console=ttyS0,115200'
And it doesn't hurt to use the quotes also for simple values.

Most of the variables aren't important for normal booting. In this case the bootcommand is:

bootcmd=nand read.e 0x800000 0x100000 0x400000; setenv bootargs $(console) $(bootargs_root); bootm 0x800000

This means: read from nand address 0x100000 a block of 0x400000 bytes, and put it in memory address 0x800000. Then set bootargs to '$(console) $(bootargs_root)' where the actual value is used instead of the variable names, Then boot the image at address 0x800000.
So to boot this box only bootcmd, console and bootargs_root need to be set.

19

It worked!! It boots again in the original form. I'm happy it kind of resurrected again, but now to find a way to transform it to more near present and ditch the need for flashbrowser to configure the NAS.

I am so glad right now that I'm back on my starting point.