NSA325v2 How to write U-Boot by JTAG to NAND

Hi,

After flashing by RS232 my Zyxel is dead. Not booting and RS232 not working, only reseting after 30 sec.
Unbrick method by USB not working.
How to connect JTAG to pcb (pinout) and write u-boot ?

Thanks for Your help

mantico,

> Not
> booting and RS232 not working, only reseting after
> 30 sec.

Which serial module converter do you use?

Most of the time this NSA325V2 can be rescued with UART booting using kwboot:

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

If I understood you correctly, you can see the box reset after 30s by looking at serial console? If that's true then you don't need JTAG.

And how did you run kwboot to try to load u-boot image to the NSA325? do you have a serial console log that you can post here?

Post as much as you can about your attempt with kwboot.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi bohdi,

I use Prolific PL2303 RS-USB converter and to this point he has worked correctly. I was flashing him my nasa correctly previously 3 times.

At this moment nothing to see on the console RS232.(all time is black) It happened after the failed erase and write to nand.

root@NAS325:/usb/tools# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00100000 00020000 "u-boot"
mtd1: 00400000 00020000 "uImage"
mtd2: 02000000 00020000 "rootfs"
mtd3: 05b00000 00020000 "data"

root@NAS325:/usb/tools# nanddump --noecc --omitoob -l 0x80000 -f mtd0 /dev/mtd0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00080000...

root@NAS325:/usb/tools# flash_erase /dev/mtd0 0 4

Erasing 128 Kibyte @ 4760e800000000 --  0 % complete 
Erasing 128 Kibyte @ 4760e800000019 --  1 % complete 
Erasing 128 Kibyte @ 4760e800000032 --  2 % complete 
Erasing 128 Kibyte @ 4760e80000004b --  3 % complete 
Erasing 128 Kibyte @ 460f5c00000064 --  4 % complete 

root@NAS325:/usb/tools# nandwrite /dev/mtd0 /usb/u-boot.kwb 
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
           error 0 (Success)
		   
root@NAS325:/usb/tools# nandwrite /dev/mtd0 /usb/u-boot.kwb 
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
           error 0 (Success)

I tryed this method „kwboot to load u-boot image to the NSA325” but not working.

Hi mantico,

> root@NAS325:/usb/tools# cat /proc/mtd
> dev: size erasesize name
> mtd0: 00100000 00020000 "u-boot"
> mtd1: 00400000 00020000 "uImage"
> mtd2: 02000000 00020000 "rootfs"
> mtd3: 05b00000 00020000 "data"

These are not NSA325 mtd layout. But it is OK because the u-boot mtd0 definition is correct.

>
> root@NAS325:/usb/tools# nanddump --noecc --omitoob
> -l 0x80000 -f mtd0 /dev/mtd0
> Block size 131072, page size 2048, OOB size 64
> Dumping data starting at 0x00000000 and ending at
> 0x00080000...
>
> root@NAS325:/usb/tools# flash_erase /dev/mtd0 0 4
>
> Erasing 128 Kibyte @ 4760e800000000 -- 0 %
> complete
> Erasing 128 Kibyte @ 4760e800000019 -- 1 %
> complete
> Erasing 128 Kibyte @ 4760e800000032 -- 2 %
> complete
> Erasing 128 Kibyte @ 4760e80000004b -- 3 %
> complete
> Erasing 128 Kibyte @ 460f5c00000064 -- 4 %
> complete

Look good so far.

> root@NAS325:/usb/tools# nandwrite /dev/mtd0
> /usb/u-boot.kwb
> Input file is not page-aligned. Use the padding
> option.
> nandwrite: error!: Data was only partially written
> due to error
> error 0 (Success)
>

Once you see that nandwrite error above, what you should have done is stopping right there, keep the box running, avoid rebooting the box or power down. And then post here for help. If you reboot, then it is bricked for sure.


How did you create this u-boot.kwb file? download somewhere? or did you compile it yourself and from what source?

The NSA325 u-boot that I've released is uboot.2017.07-tld-1.nsa325.mtd0.kwb from this thread:
https://forum.doozan.com/read.php?3,12381

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi bohdi,

„These are not NSA325 mtd layout.”
– yes not really because the root was loaded with a usb stick.

„Once you see that nandwrite error above, what you should have done is stopping right there, keep the box running…..”
At this point, I tried to delete and save the different u-boot and yours a few times and unfortunately I had to turn it off.

„If you reboot, then it is bricked for sure.”
Yes I am sure that we are bricked and for this I need to write the u-boot via JTAG.

I wrote earlier that there is no communication via RS232.

P.S -- how to activate my account on forum ? (manticore)

mantico,

> Yes I am sure that we are bricked and for this I
> need to write the u-boot via JTAG.
>
> I wrote earlier that there is no communication
> via RS232.

How did you run kwboot? But it you are absolutely sure about kwboot is not working then by all means, installing JTAG.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,

I tried the procedure from this thread but on virtual linux: https://forum.doozan.com/read.php?3,51739,51919#msg-51919

The system has seen the programmer on USB but after entering:

kwboot -t -B 115200 / dev / ttyUSB0 -b uboot.2017.07-tld-1.nsa325.mtd0.kwb -p

nothing happened on the console. I found a laptop with a physical RS232 and will try it again today.

HI,

I tried with linux and physical COM but it did not do anything.
In addition, I had a problem with the compiled kwboot and had to use another one.
Logs below.

root@debian:/nsa# md5sum kwboot-2016.05.tar 
76977c5a61544a5707dfa17ae832a3ad  kwboot-2016.05.tar

root@debian:/nsa# ./kwboot -t -B 115200 /dev/ttyS0 -b ./uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
bash: ./kwboot: cannot execute binary file: Exec format error

root@debian:/nsa# uname -a
Linux debian 4.18.0-3-686-pae #1 SMP Debian 4.18.20-2 (2018-11-23) i686 GNU/Linux

Different kwboot from u-boot tools package:

root@debian:/# kwboot -t -B 115200 /dev/ttyS0 -b /nsa/uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
Sending boot message. Please reboot the target...|

I turned off and turned on the power and nothing happened. Several times I tried waiting for 5-10 minutes.

manticore Wrote:
-------------------------------------------------------
> HI,
>
> I tried with linux and physical COM but it did not
> do anything.
> In addition, I had a problem with the compiled
> kwboot and had to use another one.
> Logs below.
>
>

> root@debian:/nsa# md5sum kwboot-2016.05.tar 
> 76977c5a61544a5707dfa17ae832a3ad 
> kwboot-2016.05.tar
> 
> root@debian:/nsa# ./kwboot -t -B 115200 /dev/ttyS0
> -b ./uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
> bash: ./kwboot: cannot execute binary file: Exec
> format error
> 
> root@debian:/nsa# uname -a
> Linux debian 4.18.0-3-686-pae #1 SMP Debian
> 4.18.20-2 (2018-11-23) i686 GNU/Linux
> 
> Different kwboot from u-boot tools
> package:
> 
> root@debian:/# kwboot -t -B 115200 /dev/ttyS0 -b
> /nsa/uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
> Sending boot message. Please reboot the
> target...|
>

>
> I turned off and turned on the power and nothing
> happened. Several times I tried waiting for 5-10
> minutes.


Try this kwboot:

https://forum.doozan.com/read.php?3,58144,74249#msg-74249

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Tahnks bodhi,

This kwboot not worked to.

root@debian:~# /nsa/kwboot
bash: /nsa/kwboot: cannot execute binary file: Exec format error
root@debian:~# file /nsa/kwboot
/nsa/kwboot: ELF 32-bit LSB pie executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, BuildID[sha1]=0e826ccb432db617e7d06297445101badcbdf7ff, not stripped
root@debian:~# uname -m
i686

=====================
I installed tools from debian packages

root@debian:~# apt-get install u-boot-tools

But this not work too.

root@debian:~# kwboot -t -B 115200 /dev/ttyS0 -b /nsa/uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
Sending boot message. Please reboot the target...-

I finally connected the RS-TTL converter to usb laptop with linux and it worked.

root@debian:~# lsusb
Bus 001 Device 003: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port

root@debian:~# kwboot -t -B 115200 /dev/ttyUSB0 -b /nsa/uboot.2017.07-tld-1.nsa325.mtd0.kwb -p
Sending boot message. Please reboot the target...\
Sending boot image...
  0 % [......................................................................]
  1 % [......................................................................]
................................................>
 97 % [......................................................................]
 99 % [....................................]
[Type Ctrl-\ + c to quit]

Now I have to read what's next because I still do not boot, and I want the whole root to be on the usb drive.

U-Boot 2017.07-tld-1 (Sep 05 2017 - 00:42:03 -0700)
ZyXEL NSA325 2-Bay Power Media Server

SoC:   Kirkwood 88F6282_A1
DRAM:  512 MiB
WARNING: Caches not enabled
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
MV88E1318 PHY initialized on egiga0
Hit any key to stop autoboot:  0 
NSA325> printenv
MODEL_ID=AE03
PRODUCT_NAME=NSA-325v2
VENDOR_NAME=MitraStar Technology Corp.
arcNumber=4495
baudrate=115200
bootcmd=run bootcmd_uenv; run scan_disk; run set_bootargs; run bootcmd_exec; reset
bootcmd_exec=run load_uimage; if run load_initrd; then if run load_dtb; then bootm $load_uimage_addr $load_initrd_addr $load_dtb_addr; else bootm $load_uimage_addr $load_initrd_addr; fi; else if run load_dtb; then bootm $load_uimage_addr - $load_dtb_addr; else bootm$load_uimage_addr; fi; fi
bootcmd_uenv=run uenv_load; if test $uenv_loaded -eq 1; then run uenv_import; fi
bootdelay=10
bootdev=usb
console=console=ttyS0,115200
device=0:1
devices=usb ide
disks=0 1 2 3
dtb_file=/boot/dts/kirkwood-nsa325.dtb
ethact=egiga0
ethaddr=5C:F4:AB:48:F2:B9
if_netconsole=ping $serverip
ipaddr=192.168.0.231
led_error=orange blinking
led_exit=green off
led_init=green blinking
load_dtb=echo loading DTB $dtb_file ...; load $bootdev $device $load_dtb_addr $dtb_file
load_dtb_addr=0x1c00000
load_initrd=echo loading uInitrd ...; load $bootdev $device $load_initrd_addr /boot/uInitrd
load_initrd_addr=0x1100000
load_uimage=echo loading uImage ...; load $bootdev $device $load_uimage_addr /boot/uImage
load_uimage_addr=0x800000
mainlineLinux=yes
mtdids=nand0=orion_nand
mtdparts=mtdparts=orion_nand:0x100000(uboot),0x80000(stock_uboot_env),0x80000(key_store),0x80000(info),0xA00000(etc),0xA00000(kernel_1),0x2FC0000(rootfs1),0xA00000(kernel_2),0x2FC0000(rootfs2)
partition=nand0,2
preboot_nc=run if_netconsole start_netconsole
scan_disk=echo running scan_disk ...; scan_done=0; setenv scan_usb "usb start";  setenv scan_ide "ide reset";  setenv scan_mmc "mmc rescan"; for dev in $devices; do if test $scan_done -eq 0; then echo Scan device $dev; run scan_$dev; for disknum in $disks; do if test $scan_done -eq 0; then echo device $dev $disknum:1; if load $dev $disknum:1 $load_uimage_addr /boot/uImage 1; then scan_done=1; echo Found bootable drive on $dev $disknum; setenv device $disknum:1; setenv bootdev $dev; fi; fi; done; fi; done
serverip=192.168.0.220
set_bootargs=setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10 $mtdparts $custom_params
start_netconsole=setenv ncip $serverip; setenv bootdelay 10; setenv stdin nc; setenv stdout nc; setenv stderr nc; version;
stderr=serial
stdin=serial
stdout=serial
uenv_addr=0x810000
uenv_import=echo importing envs ...; env import -t $uenv_addr $filesize
uenv_init_devices=setenv init_usb "usb start";  setenv init_ide "ide reset";  setenv init_mmc "mmc rescan"; for devtype in $devices; do run init_$devtype; done;
uenv_load=run uenv_init_devices; setenv uenv_loaded 0; for devtype in $devices;  do for disknum in 0; do run uenv_read_disk; done; done;
uenv_read=echo loading envs from $devtype $disknum ...; if load $devtype $disknum:1 $uenv_addr /boot/uEnv.txt; then setenv uenv_loaded 1; fi
uenv_read_disk=if test $devtype -eq mmc; then if $devtype part; then run uenv_read;  fi; else if $devtype part $disknum; then run uenv_read; fi;  fi
usb_ready_retry=15

Environment size: 3098/131068 bytes

manticore,

Cool! That's why I insist to see you kwboot attempt :) This box is very rarely bricked to the point that you cannot rescue with UART booting.

Now you can create a USB rootfs using Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2:

https://forum.doozan.com/read.php?2,12096

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,
Tahnks bodhi for your help - NAS working.

When I upgraded system from linux-4.18.4-kirkwood-tld-1-bodhi to linux-4.19.0-kirkwood-tld-1-bodhi then not see network card (lshw) but dmesg show

root@NAS325:~# dmesg | grep eth
[    0.165810] [Firmware Info]: /ocp@f1000000/ethernet-controller@72000/ethernet0-port@0: local-mac-                                                    address is not set
[    5.306422] mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4
[    5.313607] mv643xx_eth_port mv643xx_eth_port.0: DMA mask not set

boot show:
[    5.289777] libphy: Fixed MDIO Bus: probed
[    5.294519] libphy: orion_mdio_bus: probed
[    5.298826] mdio_bus f1072004.mdio-bus-mii: MDIO device at address 0 is missing.
[    5.306422] mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4
[    5.313607] mv643xx_eth_port mv643xx_eth_port.0: DMA mask not set

eth0 not exist

What happend ?

manticore,

Check ethaddr to see if it is valid.

fw_printenv ethaddr

Better yet, please post the entire serial console log. There are many phases in u-boot and kernel booting that network could fail to come up.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,
Finally I format my USB (EXT4) and install rootfs again from Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2 and uprading to linux-4.19.0-kirkwood-tld-1-bodhi.tar.bz2.
Network working.
I try move system to SATA disk.

Maybe i connect JTAG programmer and I try read NAND.

Thanks again bodhi

Hi Bodhi,

I am in trouble now with this NSA320s and I ended up into no good mtd0 to boot from.

After I read the above I think this is the right place so I am asking if I can write somehow the mtd0 from my linux laptop using serial console and not jtag. I have tried kwboot but no success. It shows the followings:

sudo kwboot  -t -B 115200 /dev/ttyUSB0 -b /home/sp/Downloads/uboot.2017.07-tld-1.nsa310s.mtd0.kwb  -p
Sending boot message. Please reboot the target.../^C

I had to ^C to stop it after a while. How long I should wait for this until I know is done or failed?

Much obliged,
E