[U-Boot] Beginners Questions on modding a NAS

[JPT]

Hi,

I've got a NAS which uses uboot:
U-Boot 1.1.4 (Feb  6 2012 - 14:40:46) Marvell version: 3.4.27

It's a Netgear ReadyNAS Duo V2, and the original sofware sucks. ;)

I would like to start with the original kernel (because it contains some 
patches) and a custom debian made with multistrap.

Where do I start?

I'll add some information about the config.

I believe these are the most important boot options.

standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) 
root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) 
$(mvPhoneConfig); bootm 0x2000000;

bootcmd=nand read.e 0x1200000 0x200000 0x600000;nand read.e 0x2000000 
0x800000 0x1000000;bootm 0x1200000 0x2000000

bootargs=console=ttyS0,115200 reason=normal 
mtdparts=nand_mtd:0x180000 at 0(u-boot),0x20000 at 0x180000(u-boot-env),0x600000 at 0x200000(uImage),0x1000000 at 0x800000(minirootfs),0x6800000 at 0x1800000(jffs2);


there are 5 mtds:
1,5M mtd0 - ?
128K mtd1 - ?
6,0M mtd2 - kernel
2,2M mtd3 - initrd (gzipped)
  89M mtd4 - jffs2 image, I think it contains a rescue image of the 
filesystem which is applied to the harddisks.

I dumped the kernel from mtd2, it is:
u-boot legacy uImage, Linux-2.6.31.8.duov2, Linux/ARM, OS Kernel Image 
(Not compressed), 3442208 bytes, Tue Aug 28 05:21:43 2012, Load Address: 
0x00008000, Entry Point: 0x00008000, Header CRC: 0xDA1ECA31, Data CRC: 
0x269C27DE


I tried to load the kernel through tftp, but it crashed:

Marvell>> dhcp

BOOTP broadcast 1
*** Unhandled DHCP Option in OFFER/ACK: 28
*** Unhandled DHCP Option in OFFER/ACK: 28
DHCP client bound to address 192.168.20.35
Marvell>> set serverip 192.168.20.24

Marvell>> tftpboot 0x02000000 /boot/kernel.img

Using egiga0 device
TFTP from server 192.168.20.24; our IP address is 192.168.20.35
Filename '/boot/kernel.img'.
Load address: 0x2000000
Loading: #################################################################
...
done
Bytes transferred = 3442272 (348660 hex)
Marvell>> go  0x02000000

## Starting application at 0x02000000 ...
software interrupt
pc : [<0200001c>]	   lr : [<00633cac>]
sp : 005fef68  ip : ffffffff	 fp : 005ff7de
r10: 005ff3de  r9 : ffffe804	 r8 : 005fffcc
r7 : 005ff388  r6 : 00000001	 r5 : 005ff38c  r4 : 02000000
r3 : 30383101  r2 : f1012000	 r1 : 005ff38c  r0 : c0c0e0c4
Flags: nZCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...


thanks for any help,

JPT