Lacie wireless space u-boot and jtag backup-restore with openocd

Hi,
I am new to this forum but have some history with certain devices and other forums.
I started this topic because I received a Lacie wireless space device and woild like to set it up with new u-boot and openwrt.
I would need some help with it.
First, I compiled a version of u-boot from 2013.07. The config for this device was not kept in the mainline u-boot distribution.I wander if it is possible to reinclude it. I would do this with a little help.
Also, i can access the device with serial and can enter the u-boot console on stock version. Need some guide on backup using u-boot.
Maybe redboot would be also possible to be installed?
Also, I have jtag access with openocd. I have a tumpa device which is supported in openocd. There are configbfiles for feroceon but the samsung 128 mb flash i don't know if it is supported. I don't know if any board config can be used or i need to make another.
So could someone help me in some steps to hack this device? What inwould like:
-ability to backup / restore flash with jtag. This woild be a first step
- u-boot, recent version, flash repartition
- maybe dual boot in failsafe if long-pressing the power button
- ability to setup autostart if care of power failure
- openwrt in flash only and sata hdd to be used only as storage.
I will post here some device data.

Kind regards

fratzicu,

> Also, I have jtag access with openocd. I have a
> tumpa device which is supported in openocd. There
> are configbfiles for feroceon but the samsung 128
> mb flash i don't know if it is supported. I don't
> know if any board config can be used or i need to
> make another.

> - openwrt in flash only and sata hdd to be used
> only as storage.

For JTAG, see the Wiki thread

Quote

Unbricking with Serial Console & JTAG console

How to unbrick your box using serial console with kwboot
Repair Pogo E02 with Raspberry PI (JTAG) and OpenOCD

But first, you should try kwboot with your 2013 u-boot image. If kwboot works, then no need to use JTAG.

For OpenWrt, see Wiki thread

Quote

Rescue Systems

Rescue System V2 (Original)
MacPlug & SMBPLug
Rescue System Pogo V3
Rescue System V4, using a custom LEDE firmware (BETA)
Rescue System for Pogo E02 using LEDE/OpenWrt (Install with Serial Console)
Rescue System for Pogo V4/Mobile using OpenWrt (Install with NetConsole)

The OpenWrt installation is the same for all Kirkwood boxes, with appropriate (i.e. Lacie) tarball/images from OpenWrt website.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi, thank you. I don't know if kwvoot would work. Probably yes. But I woild like to be able to flash the existing flash d image in case of any failure. For now, I couldn't find a good, veryfied u-boot partition dump of wireless space device so if it would be bricked with openocd/jtag I could flash it. Kwboot can save the existing u-boot partition?

fratzicu Wrote:
-------------------------------------------------------
> Hi, thank you. I don't know if kwvoot would work.
> Probably yes. But I woild like to be able to flash
> the existing flash d image in case of any failure.
> For now, I couldn't find a good, veryfied u-boot
> partition dump of wireless space device so if it
> would be bricked with openocd/jtag I could flash
> it. Kwboot can save the existing u-boot partition?

If you can login stock OS now, you can dump stock uboot from there.

If it is already bricked then use your 2013 uboot image to run kwboot. And boot into Debian rootfs Debian-5.2.9-kirkwood-tld-1-rootfs-bodhi.tar.bz2 (https://forum.doozan.com/read.php?2,12096). And dump mtd0 (where stock uboot is).

It is possible to dump mtd0 from uboot console, but it is a bit cumbersome.

The bottom line is if you can boot with your 2013 uboot image using kwboot, then there is no need for JTAG (you will never need to use it while the serial port is working).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

According to LaCie-NAS Wiki the Wireless Space has mainline U-Boot support.

rayknight Wrote:
-------------------------------------------------------
> According to
> LaCie-NAS
> Wiki the Wireless Space has mainline U-Boot
> support.

Yes.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,
I know it has mainline u-boot suport. I even compiled a 2013 image. The latest version of u-boot does not have support for wireless space.bI read somewhere that kwboot and serial debricking might not work with wireless sapce.
I can load and flash it but i'm afraid it will be bricked if something goes wrong. I succeeded to connect with openocd through jtag using tumpa device and sheevaplug.cfg but don't know what openocd commands to give to backup and flash device with jtag. I will post later more information. Thank you fornyour answers. It looks promising.
Kind regards.

Lacie wireless space serial, jtag, openwrt
Hi,
I recently bought a lacie wireless space device just for fun.
https://www.lacie.com/de/de/support/netw…wireless-space/


The device is listed in Lacie wiki but does not have its own entry
http://lacie-nas.org/doku.php

The serial pinout is the same as other lacie devices (pin 1 being the squared one). There is a J2 connector and I think it is quite the same as the other lacie devices (attached) having both serial and jtag.

Pin 2 (gnd) second from squared one
pin 7 (Rx)
pin 8 (Tx)
Speed: 115200
The stock bootlog (attached).

Pressing ctrl+C interrupts boot ptocess and giver Marvell u-boot prompt

printenv output (attached)
You may want to increase boot delay

Marvell>> setenv bootdelay
3

Marvell>> saveenv
The device is listed as having support in mainline u-boot but I can't find a howto to build u-boot for this device
http://lacie-nas.org/doku.php?id=uboot

So I tried to compile it myself:
I installed prerequisites for Ubuntu 20.04:
sudo apt-get install gawk wget git diffstat unzip texinfo gcc-multilib build-essential chrpath socat libsdl1.2-dev xterm picocom ncurses-dev lzop gcc-arm-none-eabi
If i try to compile without external toolchain with the ubuntu package of version 20.04 it does not work out of the box as it complains of not finding refferal of gcc version 9 in the source files
/u-boot-lacie/include/linux/compiler-gcc.h:87:1: fatal error: linux/compiler-gcc9.h: No such file or directory

The Instructions from the lacie-wiki page on u-boot:
I created a compile folder /media/hala/compile/
then cd /media/hala/compile
git clone http://git.lacie-nas.org/u-boot-lacie.git u-boot-lacie (this downloads the sourcecode into a new folder called u-boot-lacie;browsing the sourcecode I found that the source only supports a maximum version of gcc 4 so I downloaded an external toolchain from launchpad

I created a folder toolchains in my /media/hala/compile/ folder
then I cd to that folder
cd /media/hala/compile/toolchains
wget https://launchpad.net/gcc-arm-embedded/4…3-linux.tar.bz2
tar -xjvf gcc-arm-none-eabi-4_9-2014q4-20141203-linux.tar.bz2

now I have the toolchain needed for crosscompile in /media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/

I returned to my compile folder
cd /media/hala/compile/u-boot-lacie
and followed the instructions from http://lacie-nas.org/doku.php?id=uboot
PATH=/media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/:$PATH CROSS_COMPILE=arm-none-eabi- make wireless_space_config
PATH=/media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/:$PATH CROSS_COMPILE=arm-none-eabi- make u-boot.kwb

surprisingly... in worked!

Source code

1



arm-none-eabi-objcopy --gap-fill=0xff -O binary u-boot u-boot.bintools/mkimage -n "/media/hala/compile/u-boot-lacie/"board/LaCie/wireless_space"/kwbimage.cfg" -T kwbimage \ -a 0x00600000 -e 0x00600000 -d u-boot.bin u-boot.kwbPreparing kirkwood boot image to boot from nandNand page size = 0x800Image Type: Kirkwood Boot from NAND Flash ImageData Size: 285452 Bytes = 278.76 kB = 0.27 MBLoad Address: 00600000Entry Point: 00600000


now i have new files

Source code

1



-rw-rw-r-- 1 fratzicu fratzicu 285452 mar 20 19:22 u-boot.bin-rw-rw-r-- 1 fratzicu fratzicu 285968 mar 20 19:22 u-boot.kwb-rw-rw-r-- 1 fratzicu fratzicu 1089 mar 20 19:22 u-boot.lds-rw-rw-r-- 1 fratzicu fratzicu 266427 mar 20 19:22 u-boot.map


in my folder

After connecting to serial console, I can login with user admin and password admin. I don't know how to connect as root.

During boot, There is a prompt to press a key to stop regular boot but there is no timeout, only 0.

$ cat /proc/cpuinfo
Processor : ARM926EJ-S rev 1 (v5l)
BogoMIPS : 799.53
Features : swp half thumb fastmult edsp
CPU implementer : 0x56
CPU architecture: 5TE
CPU variant : 0x2
CPU part : 0x131
CPU revision : 1
Cache type : write-back
Cache clean : cp15 c7 ops
Cache lockdown : format C
Cache format : Harvard
I size : 16384
I assoc : 4
I line length : 32
I sets : 128
D size : 16384
D assoc : 4
D line length : 32
D sets : 128

Hardware : wireless_space
Revision : 0002
Serial : 0000000000000000

$ cat /proc/cmdline

initrd=0x1200000 root=/dev/mtdblock3 ro console=ttyS0,115200 cap=gpt,lba64

Can you point me some commands to compile u-boot for this device?
Also, what jtag software could I use for this device?

Hi,
CPU is ARM926EJ-S rev 1 (v5l)

Flash is
NAND FLASH SAMSUNG K9F1G08U0B-PCB0 and it seems to have 128 Mb
I found it on http://www.linux-mtd.infradead.org/nand-data/nanddata.html.

Vendor 0xec, chip id 0xf1

Ram is
hynix h5ps1g83efr s6c 031ak and there are 2 chips of 128 Mb it seems.

I have a JTAG TUMPA device

https://www.diygadget.com/tiao-usb-multi-protocol-adapter-jtag-spi-i2c-serial

the lacie wireless space device is very similar with Sheeva Plug LE only the processor runs at 1200 mhz vs 800 mhz and thebflash is slightly different , still samsung but 0xec 0xdc.
I think openodc should work based on the info on this page
https://sites.google.com/site/odulo12321/sheevaplug

Hi,
Today I think I succeeded to connect to lacie wireless space using jtag port with the standard arm pinout (20 pin).
I used the following config files:
board: /usr/share/openocd/scripts/board/sheevaplug.cfg in which I modified interface :tumpa.cfg

interface: /usr/share/openocd/scripts/interface/tumpa.cfg (source [find interface/ftdi/tumpa.cfg]) in /usr/share/openocd/scripts/board/sheevaplug.cfg
target: /usr/share/openocd/scripts/target/feroceon.cfg (source [find target/feroceon.cfg]) in /usr/share/openocd/scripts/board/sheevaplug.cfg
actually, I copied sheevaplug.cfg to wspace.cfg and modified only the line source [find interface/ftdi/tumpa.cfg]

then gave the command

sudo openocd -f /usr/share/openocd/scripts/board/wspace.cfg

and got the output

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
none separate
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
adapter speed: 2000 kHz
dcc downloads are enabled
Warn : use 'feroceon.cpu' as target identifier, not '0'
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9 (Marvell Semiconductors), part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit

made a little progress...

telnet 127.0.0.1 4444

this is shown in the openocd terminal

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
none separate
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
adapter speed: 2000 kHz
dcc downloads are enabled
Warn : use 'feroceon.cpu' as target identifier, not '0'
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9 (Marvell Semiconductors), part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : accepting 'telnet' connection on tcp/4444
invalid command name "scan_chain\"
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: unknown NAND flash device found, manufacturer id: 0x02 device id: 0x02

invalid command name "monitor"
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
	blocksize: 131072, blocks: 1024

and this is shown in the telnet terminal

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> scan_chain\
invalid command name "scan_chain\"
> scan_chain 
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
> nand probe 0
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
unknown NAND flash device found, manufacturer id: 0x02 device id: 0x02

> monitor flash probe 0
invalid command name "monitor"
> sheevaplug_init
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> scan_chain
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
> nand probe 0
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
> nand list
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
	blocksize: 131072, blocks: 1024
>

So i'm feeling like making progress. Now I need some guidance on backing up and flashing.
Kind regards



Edited 1 time(s). Last edit at 04/01/2021 12:58PM by fratzicu.

fratzicu,

Please repost your JTAG installation and questions in this thread:

Wiki:

Quote
https://forum.doozan.com/read.php?2,23630

Unbricking with Serial Console & JTAG console

Repair Pogo E02 with Raspberry PI (JTAG) and OpenOCD

https://forum.doozan.com/read.php?3,21789

I am sure joerg can help you.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thank you. I'll do that.

Hi,

So it seems that I mastered the reading / erasing / writing to nand flash of wireless space with openocd.

Some bumps along the way:
> nand write 0 flash.bin 0
DCC write failed, expected end address 0x00100814 got 0x5a
For this to work I needed to change the openocd board script wspace.cfg to -work-area-phys 0x10000000 to 0x10000 (I saw it on a blog, don't know the signifficance but it works)
Examples:

telnet localhost 4444

>sheevaplug_init
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> nand probe 0   
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
> nand list 0    
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
	blocksize: 131072, blocks: 1024
>nand dump 0 "u-boot.printenv.bin" 0 786432   
dumped 786432 bytes in 386.816040s (1.985 KiB/s)
> nand erase 0 0 786432    
erased blocks 0 to 5 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'

After restart device is dead / bricked.

> nand write 0 u-boot.printenv.bin 0
wrote file u-boot.printenv.bin to NAND flash 0 up to offset 0x000c0000 in 23.302645s (32.958 KiB/s)

now again back to life but after decompressing.... booting the kernel it does not boot. So I restore now the whole flash

nand erase 0                      
erased blocks 0 to 1023 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'
> nand write 0 flash.bin 0
wrote file flash.bin to NAND flash 0 up to offset 0x08000000 in 3976.972900s (32.958 KiB/s)

before that i made a bakup of the whole flash

nand dump 0 "flash.bin" 0 134217728
dumped 134217728 bytes in 63788.855469s (2.055 KiB/s)

I tested it by erasing, seeing that it is bricked then erasing/writing and seeing it back to life.. Now it is time to continue my journey to understand the flash device partitioning and porting openwrt to it.
I'll keep you posted



Edited 1 time(s). Last edit at 04/05/2021 02:00PM by fratzicu.

Hi guys,

Now I am ready to explore the porting of u-boot last version to this device called lacie wireless space.

SO I compiled the u-boot 2013.04 using instructions from http://lacie-nas.org/doku.php?id=uboot. In this version there is a config for this device that is not maintained in the latest version. I don't know how to bring this config to the last version building of u-boot. Maybe you cpuld help me. So after flashing the new compiled u-boot this is the serial output:

U-Boot 2013.04-00574-gfbf87b182 (Mar 20 2021 - 19:21:55) Wireless Space

SoC:   Kirkwood 88F6281_A1
DRAM:  256 MiB
WARNING: Caches not enabled
NAND:  128 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E6161 Initialized on egiga0
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

Retry count exceeded; starting again
BOOTP broadcast 1
*** Unhandled DHCP Option in OFFER/ACK: 44
*** Unhandled DHCP Option in OFFER/ACK: 44
DHCP client bound to address 192.168.23.64
Hit any key to stop autoboot:  0 
(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **

Reset IDE: ide_preinit failed
** Bad device size - ide 0 **
ws>

If i try to set the stock env variables it complains of

u-boot unknown command jffs2, try 'help'

A little help... is there a discussion on this forum for compiling last version u-b00t using an old unmaintained version device config and adding support for jffs and setting needed env variables?

kind regards

fratzicu,

> A little help... is there a discussion on this
> forum for compiling last version u-b00t using an
> old unmaintained version device config and adding
> support for jffs and setting needed env
> variables?

No, we don't have that. But you can clone my u-boot GitHub and see the code for other Kirkwood u-boots. Currently, my u-boot source tracks mainline 2017.07.

https://forum.doozan.com/read.php?3,12381

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)