NAS326 how to boot with UART?

Hello, I'm new to the forum.

I have a Zyxel NAS326 with a physically damaged NAND memory - it does not save the configuration. I want to buy a new memory, unfortunately I do not have a programmer to program it. That's why I am trying to boot the device via UART.
I'm trying a modified version of kwboot, which should work with the Armada 38x processor: https://forum.armbian.com/topic/4444-solved-kwboot-on-armada-38x/
and the uboot file from this forum: https://forum.doozan.com/read.php?2,27108,31893#msg-31893
I tried UART converters on FTDI, PL2303 and CP2102 chips. Each time loading is interrupted after a few percent, and the device resets.

I attach a screen from the terminal.

Please help. Thank you.

gutek18,

Unfortunately, I had not been successful in getting kwboot to work on NAS326. And I still look at this issue once a while, but I did not spend much effort on it.

The kwboot you've posted was from hmartin. He and I worked on this issue a while back here. But he use the WD EX2 Ultra EX2100. Eventhough it has the same SoC a38x family, that box behavior is different from the NAS326.

In any case, the u-boot you used from rm's was my rebuild of stock u-boot. That did not work either.

At the moment, I don't have a solution for you. But I do plan to come back to this UART booting issue and try to make it work for NAS326 (I own one). However, I don't know when I can do that.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

gutek18,

Quote

I have a Zyxel NAS326 with a physically damaged NAND memory - it does not save the configuration. I want to buy a new memory, unfortunately I do not have a programmer to program it. That's why I am trying to boot the device via UART.

When you said " it does not save the configuration", did you mean the envs cannot be saved?

Can you still boot with u-boot in NAND? for is the whole NAND bad and you can't boot?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

(I write using a translator, I hope that everything will be understandable.)
In my opinion, all memory is damaged. Each time you turn it on, there is information in the log that the "config" partition can not be read. It is formatted and created a new one. Also, once in a while the time after turning on the information about the wrong CRC of the "env" partition appears and is restored to the default.

If I download all mtd partitions using the nanddump command and combine them into one file, will the new memory programmed by the programmer be correct?
On the Internet I can buy a new memory with a programming service, I just need to have the right content.

gutek18,

> (I write using a translator, I hope that
> everything will be understandable.)
> In my opinion, all memory is damaged. Each time
> you turn it on, there is information in the log
> that the "config" partition can not be read. It is
> formatted and created a new one. Also, once in a
> while the time after turning on the information
> about the wrong CRC of the "env" partition appears
> and is restored to the default.

Sounds like you can still boot into u-boot. That means u-boot mtd is not damaged.

> If I download all mtd partitions using the
> nanddump command and combine them into one file,
> will the new memory programmed by the programmer
> be correct?

Yes. But your NAND is damaged, your mtds are not good. So the nanddump will not give good images.

> On the Internet I can buy a new memory with a
> programming service, I just need to have the right
> content.

I'll look in my archive for NAS326 stock mtd nanddump backup. So when you ready I'll send you the link to download.

====

Connect serial console, power up and let it boot automatically. And post the entire serial console log here.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Yes, the device starts. However, each time it starts with factory settings. All settings that are saved in NAND are deleted, e.g. passwords, ip etc.

I have a log saved from the console. After returning from work, I will share it.

I am attaching the log from the device start.


Because of accuracy:
- the device started up on the factory NAND Macronix MX30LF2G18AC memory, but errors were created. Thanks to which settings were not saved.
- I bought on the internet a cheap similar Samsung K9F2G08U0C memory along with the programming service. Unfortunately, after replacing the memory, the device DOES NOT BOOT. I get the message "Invalid Header Checksum" on the console. PDF
- that's why I would like to start the device via UART to check if the problem is incorrectly programmed new memory or if it is not supported.



Edited 1 time(s). Last edit at 06/03/2019 10:57AM by gutek18.

gutek18,

I don't think your flash is damaged. Looks like the rootfs image in NAND was corrupted so it was reflashed by their recovery procedure each time. And that's why the settings were gone when you reboot.

You could try to restore the stock FW to factory condition, and that will get you back to normal booting.

Or you could install Debian:

https://forum.doozan.com/read.php?2,32146

Quote

Zyxel NAS326 Installation: 3rd Update 25 Mar 2017 (added Section C), 2nd Update 18 Feb 2017 (added section B), 1st Update 05 Feb 2017.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I tried to restore the factory settings and change the software version. I also installed older versions of the firmware using a script from nas-central.
I also formatted the config partition from the uboot.
Unfortunately, it did not help.


I even did an experiment. I inserted the 0xBB content in place of the config partition, and after rebooting the device I downloaded the content. There was a lot of mistakes and only in some places it was correct. That's why I am convinced of the memory damage.



Edited 1 time(s). Last edit at 06/03/2019 11:04AM by gutek18.

> - that's why I would like to start the device via
> UART to check if the problem is incorrectly
> programmed new memory or if it is not supported.

Can you still boot with stock u-boot using the original NAND? does it get you to the u-boot prompt?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

No, I damaged the original NAND during desoldering.
Currently, I have such a message in the console. (soldered Samsung memory)



Edited 1 time(s). Last edit at 06/03/2019 11:30AM by gutek18.

If I turn on the device without a soldered memory, the message in the console is.

That's why I think that the new Samsung memory is seen by the device, but it either can not read it, or it is incorrectly programmed.

gutek18 Wrote:
-------------------------------------------------------
> If I turn on the device without a soldered memory,
> the message in the console is.
>
> That's why I think that the new Samsung memory is
> seen by the device, but it either can not read it,
> or it is incorrectly programmed.

Yes indeed. The BootROM detected NAND, but it could not use it. So it fell back to UART.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

So, if there is no way to start by UART at the moment, I will buy a new Macronix memory and try, maybe it will work with it.

Thanks for the answers.

Hello after a long time ...
At that time, I was unable to do anything with the device. I put them back on the shelf.
@bodhi, has something changed at the moment when it comes to starting uboot with UART for NAS326? Is there a new version of kwboot?

Thanks for the answer

gutek18,

Unfortunately, no. I have not attempted UART booting again for this box. Don't know when and if I will try again.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello there,

I'm hoping my question is close enough to the topic that it will be okay here.

Would someone be able to tell me the wiring schema for the UART on the NAS326 board please? I want to ensure I hook my TTL to USB adapter up correctly. Also is the board 3.3v or 5v?

I would like to be able to flash the board using a stock BIN formware from the ZyXEL website, so I may factory reset the board. It appears that the built in factory reset function does not wipe modifications done using the terminal clean. Is this possible through the UART? Could the UART be used with a stock firmware file to recover the device from a corrupt or messed with firmware?

Many thanks,

Alex

Alex,


> Would someone be able to tell me the wiring schema
> for the UART on the NAS326 board please? I want to
> ensure I hook my TTL to USB adapter up correctly.

See the serial pinouts for Zyxel NSA325 here, it is the same for NAS326.

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

> Also is the board 3.3v or 5v?

Do not connect 3.3V or 5V (you will fry the serial header if power pin is connected). UART should be connected with only 3 wires (GND, TXD, and RXD).

> Could the UART be
> used with a stock firmware file to recover the
> device from a corrupt or messed with firmware?

Yes.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 01/28/2021 04:26PM by bodhi.

Hey Bodhi,

Thank you for the information! If you don't mind, I would like to copy your information (and credit you by linking back to this forum) on my NAS326 repo https://github.com/alexhorner/ZyXEL-NAS326 Is that okay?

When I said 3.3v or 5v, I meant the RX/TX line level as my adapter has a switcher on it. Not sure if it really makes any difference though. Don't worry, I know not to connect the adapter's power source to my box :P

I also see you have images for the 325 but not the 326. Is the 325 image correct for the 326 board too? I have 0 experience with UBoot or flashing firmware in general so my intention is to find a reproducable procedure and document it on my repo step by step.

If you have any other recommendations or resources, please do let me know, they would be much appreciated!

Thanks,

Alex

Alex,

> Thank you for the information! If you don't mind,
> I would like to copy your information (and credit
> you by linking back to this forum) on my NAS326
> repo
> https://github.com/alexhorner/ZyXEL-NAS326
> Is that okay?

You could copy the text and state the credit where it comes from.

I would prefer you only link to the post here where the kernel and rootfs tarball can be downloaded.

However, for whatever reason, if you want to copy the kernel and rootfs tarballs to you GitHub, then you could do so but point back to the thread here for md5 and sha256 hashes. This is to ensure the integrity of those tarballs when people download it. The hash info must be from this website, don't repost it anywhere else if possible.

>
> When I said 3.3v or 5v, I meant the RX/TX line
> level as my adapter has a switcher on it. Not sure
> if it really makes any difference though. Don't
> worry, I know not to connect the adapter's power
> source to my box :P

Cool!

> I also see you have images for the 325 but not the
> 326. Is the 325 image correct for the 326 board
> too?

Yes. It is identical.

> I have 0 experience with UBoot or flashing
> firmware in general so my intention is to find a
> reproducable procedure and document it on my repo
> step by step.

Yes, all info I post are GPL 2. So feel free to copy and give credit. The only thing I care is people not posting the hashes somewhere else. Please make sure that users come here to download the tarballs or get the hash for each tarball they use (if you mirror the tarballs). That's the least we can do to be secured in using the tarballs.

I have a blog (bodhi's corner in my signature: https://mibodhi.blogspot.com/). That's the backup place where people can find me if needed to.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 01/30/2021 09:30PM by bodhi.

Hello,

I found a way to uart boot nas326. The trick is to replace the ddr3-training binary in uboot provided by zyxel using u-boot-tools. Replace it with ddr3-training binary from Linksys WRT3200ACM uboot (this router has a similar soc) and it will work.
uboot for wrt3200acm can be downloaded from openwrt project site. It is also contained in source code from linksys.
The uboot from zyxel can be obtained from zyxel support or simply downloaded from here:
https://zyxel.diskstation.eu/Users/Mijzelf/RescueSticks/NAS326.zip

Follow these steps to create a bootable image (recent u-boot-tools are needed):

1.) download NAS326.zip and extract uboot.bin, download WRT3200ACM_uboot_1.0.0.bin

2.) dump ddr3-training-binary from linksys uboot:

dumpimage -T kwbimage -p 1 -o binary1.bin WRT3200ACM_uboot_1.0.0.bin

3.) dump config file from zyxel uboot:

dumpimage -T kwbimage -p -1 -o uboot.cfg uboot.bin

4.) dump binary data from zyxel uboot:

dumpimage -T kwbimage -p 0 -o uboot.data uboot.bin

5.) build new uboot image with mkimage:

mkimage -T kwbimage -n uboot.cfg -d uboot.data uboot_nas326_uart.kwb

6.) finally boot nas326 with uart:

kwboot -b uboot_nas326_uart.kwb -B 115200 -t /dev/ttyUSB0

I hope this helps anyone with a bricked NAS326,

martini

Can you share the final boot file? uboot_nas326_uart.kwb

@martini: That is a neat trick. Do you have any idea why it works? I'd say that for ddr training it doesn't matter if the binary is read from uart or from nand. So which subtle effect is causing this?

here's the requested file
@mijzelf: I found this solution by doing a lot of try and error. Since my knowledge in programming is very limited I cannot tell why it works and while uart booting uboot.bin from zyxel rescue files does not. So I cannot offer neccessary changes to uboot source code for nas326

@martini,

Nice! It will come in handy when I start working on u-boot for this box.

@mijzelf,

Quote

That is a neat trick. Do you have any idea why it works? I'd say that for ddr training it doesn't matter if the binary is read from uart or from nand. So which subtle effect is causing this?

The ddr training is the same, but IIRC these old bin_hdr binaries have something in it that Marvell built 2 versions, one for UART booting and one for NAND/SPI flash. Happily, this is no longer true. With latest u-boot, the same image can be kwboot or flashed). BootROM version is also a factor (some has bugs).

The current kwboot is substantiallly improved. That also an important factor. I think kwboot can boot just about any Armada 37x/38x/XP board with the right image. I have not gone back to check this NAS326 yet, though.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Bodhi, can you share latest u-boot for NAS326?

RRRrrr,

I have not started working on the new u-boot for this box. Also, currently my box is at a remote location.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)