dump of the steps taken so far

Makefile

@@ -0,0 +1,9 @@
+uboot.kwb: uboot-NV+-1.0.05
+	mkimage -n kwbimage.cfg -A arm -O linux -T kwbimage -d uboot-NV+-1.0.05 uboot.kwb 
+
+# boot the damn thing over UARTBoot
+boot: uboot.kwb
+	kwboot -b uboot.kwb -t /dev/ttyUSB0
+
+terminal:
+	kwboot -t /dev/ttyUSB0

README.md

@@ -1,3 +1,17 @@
 # readynas-resurecction
 
-This repository describes the attempt at resuscitation of a ReadyNAS NV+v2.
+This document describes the attempt at resuscitation of a ReadyNAS NV+v2.
+
+This device is not booting but power is present wherever we tested. The most likely explanation
+for it not booting is that the SPI flash containing the BIOS is faulty.
+
+As the SOC is produced by Marvell and they advertise a UARTBoot mode which is simply triggered
+by an handshake there is still hope to confirm it's just a bad BIOS.
+
+Starting from a firmware update image we have reversed what was possible using binwalk. Then after
+binwalk had done its job we were left with binaries for u-boot, initrd and kernel.
+
+The image for the UARTBoot is created using mkimage and a board configuration which was sourced
+by the chromium project and most likely is not for the board we have.
+
+Once the image has been created we can UARTBoot using the kwboot tool.

kwbimage.cfg

@@ -0,0 +1,144 @@
+#
+# (C) Copyright 2009
+# Marvell Semiconductor <www.marvell.com>
+# Written-by: Prafulla Wadaskar <prafulla@marvell.com>
+#
+# See file CREDITS for list of people who contributed to this
+# project.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 2 of
+# the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301 USA
+#
+# Refer docs/README.kwimage for more details about how-to configure
+# and create kirkwood boot image
+#
+# Boot Media configurations
+BOOT_FROM	spi	# Boot from SPI flash
+# SOC registers configuration using bootrom header extension
+# Maximum KWBIMAGE_MAX_CONFIG configurations allowed
+# Configure RGMII-0 interface pad voltage to 1.8V
+DATA 0xFFD100e0 0x1b1b1b9b
+#Dram initalization for SINGLE x16 CL=5 @ 400MHz
+DATA 0xFFD01400 0x43000a00	# DDR Configuration register
+# bit13-0:  0xa00 (2560 DDR2 clks refresh rate)
+# bit23-14: zero
+# bit24: 1= enable exit self refresh mode on DDR access
+# bit25: 1 required
+# bit29-26: zero
+# bit31-30: 01
+DATA 0xFFD01404 0x38543000	# DDR Controller Control Low
+# bit 4:    0=addr/cmd in smame cycle
+# bit 5:    0=clk is driven during self refresh, we don't care for APX
+# bit 6:    0=use recommended falling edge of clk for addr/cmd
+# bit14:    0=input buffer always powered up
+# bit18:    1=cpu lock transaction enabled
+# bit23-20: 5=recommended value for CL=5 and STARTBURST_DEL disabled bit31=0
+# bit27-24: 8= CL+3, STARTBURST sample stages, for freqs 400MHz, unbuffered DIMM
+# bit30-28: 3 required
+# bit31:    0=no additional STARTBURST delay
+DATA 0xFFD01408 0x2202433D	# DDR Timing (Low) (active cycles value +1)
+# bit3-0:   TRAS lsbs
+# bit7-4:   TRCD
+# bit11- 8: TRP
+# bit15-12: TWR
+# bit19-16: TWTR
+# bit20:    TRAS msb
+# bit23-21: 0x0
+# bit27-24: TRRD
+# bit31-28: TRTP
+DATA 0xFFD0140C 0x0000002A	#  DDR Timing (High)
+# bit6-0:   TRFC
+# bit8-7:   TR2R
+# bit10-9:  TR2W
+# bit12-11: TW2W
+# bit31-13: zero required
+DATA 0xFFD01410 0x0000000D	#  DDR Address Control
+# bit1-0:   01, Cs0width=x16
+# bit3-2:   11, Cs0size=1Gb
+# bit5-4:   00, Cs2width=nonexistent
+# bit7-6:   00, Cs1size =nonexistent
+# bit9-8:   00, Cs2width=nonexistent
+# bit11-10: 00, Cs2size =nonexistent
+# bit13-12: 00, Cs3width=nonexistent
+# bit15-14: 00, Cs3size =nonexistent
+# bit16:    0,  Cs0AddrSel
+# bit17:    0,  Cs1AddrSel
+# bit18:    0,  Cs2AddrSel
+# bit19:    0,  Cs3AddrSel
+# bit31-20: 0 required
+DATA 0xFFD01414 0x00000000	#  DDR Open Pages Control
+# bit0:    0,  OpenPage enabled
+# bit31-1: 0 required
+DATA 0xFFD01418 0x00000000	#  DDR Operation
+# bit3-0:   0x0, DDR cmd
+# bit31-4:  0 required
+DATA 0xFFD0141C 0x00000C52	#  DDR Mode
+# bit2-0:   2, BurstLen=2 required
+# bit3:     0, BurstType=0 required
+# bit6-4:   4, CL=5
+# bit7:     0, TestMode=0 normal
+# bit8:     0, DLL reset=0 normal
+# bit11-9:  6, auto-precharge write recovery ????????????
+# bit12:    0, PD must be zero
+# bit31-13: 0 required
+DATA 0xFFD01420 0x00000046	#  DDR Extended Mode
+# bit0:    0,  DDR DLL enabled
+# bit1:    1,  DDR drive strenght reduced
+# bit2:    1,  DDR ODT control lsd enabled
+# bit5-3:  000, required
+# bit6:    1,  DDR ODT control msb, enabled
+# bit9-7:  000, required
+# bit10:   0,  differential DQS enabled
+# bit11:   0, required
+# bit12:   0, DDR output buffer enabled
+# bit31-13: 0 required
+DATA 0xFFD01424 0x0000F1FF	#  DDR Controller Control High
+# bit2-0:  111, required
+# bit3  :  1  , MBUS Burst Chop disabled
+# bit6-4:  111, required
+# bit7  :  1  , D2P Latency enabled
+# bit8  :  1  , add writepath sample stage, must be 1 for DDR freq >= 300MHz
+# bit9  :  0  , no half clock cycle addition to dataout
+# bit10 :  0  , 1/4 clock cycle skew enabled for addr/ctl signals
+# bit11 :  0  , 1/4 clock cycle skew disabled for write mesh
+# bit15-12: 1111 required
+# bit31-16: 0    required
+DATA 0xFFD01428 0x00085520	# DDR2 ODT Read Timing (default values)
+DATA 0xFFD0147C 0x00008552	# DDR2 ODT Write Timing (default values)
+DATA 0xFFD01500 0x00000000	# CS[0]n Base address to 0x0
+DATA 0xFFD01504 0x07FFFFF1	# CS[0]n Size
+# bit0:    1,  Window enabled
+# bit1:    0,  Write Protect disabled
+# bit3-2:  00, CS0 hit selected
+# bit23-4: ones, required
+# bit31-24: 0x07, Size (i.e. 128MB)
+DATA 0xFFD0150C 0x00000000	# CS[1]n Size, window disabled
+DATA 0xFFD01514 0x00000000	# CS[2]n Size, window disabled
+DATA 0xFFD0151C 0x00000000	# CS[3]n Size, window disabled
+DATA 0xFFD01494 0x00010001	#  DDR ODT Control (Low)
+# bit3-0:  1, ODT0Rd, MODT[0] asserted during read from DRAM CS0
+# bit19-16:1, ODT0Wr, MODT[0] asserted during write to DRAM CS0
+DATA 0xFFD01498 0x00000000	#  DDR ODT Control (High)
+# bit1-0:  00, ODT0 controlled by ODT Control (low) register above
+# bit3-2:  01, ODT1 active NEVER!
+# bit31-4: zero, required
+DATA 0xFFD0149C 0x0000E811	# CPU ODT Control
+# bit3-0:  1, ODT0Rd, Internal ODT asserted during read from DRAM bank0
+# bit7-4:  1, ODT0Wr, Internal ODT asserted during write to DRAM bank0
+# bit11-10:1, DQ_ODTSel. ODT select turned on
+DATA 0xFFD01480 0x00000001	# DDR Initialization Control
+#bit0=1, enable DDR init upon this register write
+# End of Header extension
+DATA 0x0 0x0