NWA50AX Stuck in a boot loop (diagnostic code inside)

Stardude900

Hi all,

I was trying to perform a software update and had a power glitch and now I am stuck in a boot loop. Connecting to a PC / router and I only see activity on the ethernet port for about 5 seconds. I was able to connect to the Console port to watch activity go by and I get stuck in the following boot loop. I'm able to cancel the auto boot by typing something random, but now it won't accept any commands.

Any help on what to do here?

U-Boot SPL 2018.09 (May 17 2022 - 01:17:57 +0000)
Trying to boot from NAND

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

U-Boot 2018.09 (May 17 2022 - 01:17:57 +0000)

CPU: MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM: 256 MiB
NAND: 128 MiB

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from NMBM... *** Warning - bad CRC, using default environment

In: uartlite0@1e000c00
Out: uartlite0@1e000c00
Err: uartlite0@1e000c00
Net:
Warning: eth@1e100000 (eth0) using random MAC address - 36:28:78:08:40:24
eth0: eth@1e100000
Reading from 0x7700000, size 0x20000
Succeeded
Zyxel version:V1.05
gpio: pin 24 (gpio 24) value is 0
gpio: pin 24 (gpio 24) value is 1
Hit any key to stop autoboot: 0
Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x2ad7a4 ...
Automatic boot of image at addr 0x83000000 ...

Loading kernel from FIT Image at 83000000 ...

Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.15.134
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x830000e4
Data Size: 2794332 Bytes = 2.7 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x80001000
Entry Point: 0x80001000
Hash algo: crc32
Hash value: acc5387c
Hash algo: sha1
Hash value: 32aff5785944e5a2c718ee48ba1eb5cf63ead146
Verifying Hash Integrity ... crc32+ sha1+ OK

Loading fdt from FIT Image at 83000000 ...

Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: MIPS OpenWrt zyxel_nwa50ax device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x832aa57c
Data Size: 11489 Bytes = 11.2 KiB
Architecture: MIPS
Hash algo: crc32
Hash value: a4107862
Hash algo: sha1
Hash value: 38e546a790a2be220e709e2d2260801ee547119d
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x832aa57c
Uncompressing Kernel Image ... OK
Loading Device Tree to 8fe67000, end 8fe6cce0 ... OK
[ 0.000000] Linux version 5.15.134 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23497-6637a f95aa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Oct 9 21:45:35 2023
[ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] MIPS: machine is ZyXEL NWA50AX
[ 3.161322] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 3.169571] Rebooting in 1 seconds..

Zyxel_Melen

Hi @Stardude900,

You were using "atnf openwrt-initramfs.bin, " a wrong command and firmware file. Please download the correct firmware file via this link. And use the command "atnz 629ABYW4C0.bin" to upload the firmware file. The only different place for NWA50AX is the file name in step 3. The commands are the same.

Stardude900

Alright so I wanted to document this here in case anyone else runs into this issue like me.

I flashed OpenWRT onto this access point because the stock GUI was not intuitive and the instructions were written rather poorly. After flashing OpenWRT (btw this took forever), I noticed wifi speeds were reduced by about 50% so I said "welp. Let me flash the OS stock back onto it and just figure their manual out". I started to flash stock OS, had a blip, and that's where my problems started. It would go into a boot loop (not able to load any firmware) and the ethernet port would only be active for 5 seconds. I had no way of loading new software onto it, but could at least interrupt the boot process and send a few commands. I also was somehow setting up a tfptd server on some virtual ethernet thing (really not sure how that happened). It must be on your ethernet adapter that you will plug into.

So I want to walk through what to do and save you all the headache I was getting. I'm going to write this with some assumptions that you have a basic understanding of setting up putty, assigning an IP address,

1. You are going to need a usb to serial adapter in order to hookup to the console port of the AP. You need something like this. When looking at the ports of the AP with the QR code facing up, it goes Ground - Receive - Transmit - V (from left to right).
   1. Hook up Ground to Ground, Transmit of the USB adapter to Receive of the AP, Receive of USB to the Transmit of Console. DO NOT DO ANYTHING WITH THE V PIN. The USB Device needs to be set to 3.3v (this is usually done with a jumper.
2. Plug the USB into your laptop. Open up a putty serial session in order to see information coming from the router. This will allow you to break the boot sequence and send commands.
   1. Needs to be 115200 baud rate, other settings I didn't change.
   2. Boot up the router. You should now see information flying through the terminal on it trying to boot. Hit the spacebar until it stops the boot process.
3. Set the IP of your ethernet port on your laptop to something like 192.168.1.10 It just can't be 192.168.1.2 (this is the IP address of the AP)
4. Setup a tftpd server using tftpd64. I'd recommend watching this video (it's two minutes, just set it up how he does and make sure you select the 192.168.1.10 address for the server to be on).
   1. Download the .bin file that zixel_melen posted above (I think you can use any firmware version of the AP, but this should work). Put it in the working directory that you setup with the tfptd server.
5. Connect an ethernet cable from your laptop to your AP directly (does not need to be a crossover cable).
6. On the putty session enter the following commands.
   1. atna 192.168.1.2
      1. This is telling the AP that it's IP address is 192.168.1.2 (which it should be)
   2. atns 192.168.1.10
      1. This is telling the AP that the IP of the tfptd server is 192.168.1.10 (or whatever number you set above)
   3. atnz 629ABYW4C0.bin
      1. This tells the AP to go fetch this file name and start loading the .bin file.
7. As long as you've done everything correctly, you should start seeing it loading the file over and flashing the .bin file
   1. This took about 3 minutes to complete. The LED on top of the AP will start to blink it's LED patterns while it is booting up. Eventually it will take you to a login dialogue in the terminal.
8. Congrats, you're now back on stock firmware. I'd recommend pressing the "reset" button on the AP to get it to go back to factory defaults and you can login with admin 1234.

I hope this helps people and is written in a way that most people can understand. The wording on the Openwrt is incorrect on what steps to do, so I'll try to make an account and update it there.

Thanks again everyone

Zyxel_Melen

Hi @Stardude900,

May I know do you have a 4-pin console? If yes, please reference the document I sent in the private message.
You may reference this FAQ to check the detailed of 4-pin console:

https://community.zyxel.com/en/discussion/17842/how-to-use-the-console-port-to-access-points

If not, please submit an RMA request via the link below:
https://mysupport.zyxel.com/hc/en-us/requests/new

Stardude900

Hey Melen,

I responded to your PM. I do have the NWA50AX which has a 4 pin console port. That's how I was able to communicate and get the dialogue listed above.

Stardude900

This is now where I'm at when trying to flash a new firmware.

=> atnf openwrt-initramfs.bin
=> atna 192.168.1.10
=> atns "192.168.1.20; tftpboot; bootm"
Using eth@1e100000 device
TFTP from server 192.168.1.20; our IP address is 192.168.1.10
Filename 'openwrt-initramfs.bin'.
Load address: 0x83000000
Loading: *
ARP Retry count exceeded; starting again

Loading kernel from FIT Image at 83000000 ...

Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.15.134
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x830000e4
Data Size: 2794332 Bytes = 2.7 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x80001000
Entry Point: 0x80001000
Hash algo: crc32
Hash value: acc5387c
Hash algo: sha1
Hash value: 32aff5785944e5a2c718ee48ba1eb5cf63ead146
Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash-1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
=> <INTERRUPT>
=>

Zyxel_Melen

Hi @Stardude900,

You were using "atnf openwrt-initramfs.bin, " a wrong command and firmware file. Please download the correct firmware file via this link. And use the command "atnz 629ABYW4C0.bin" to upload the firmware file. The only different place for NWA50AX is the file name in step 3. The commands are the same.

Stardude900

No dice. Here is the bug i run into.

=> atna 192.168.1.10
=> atns 192.168.1.20
=> atnz 629ABYW4C0.bin
Using eth@1e100000 device
TFTP from server 192.168.1.20; our IP address is 192.168.1.10
Filename '629ABYW4C0.bin'.
Load address: 0x83000000
Loading: *
ARP Retry count exceeded; starting again

Stardude900

Alright so I wanted to document this here in case anyone else runs into this issue like me.

I flashed OpenWRT onto this access point because the stock GUI was not intuitive and the instructions were written rather poorly. After flashing OpenWRT (btw this took forever), I noticed wifi speeds were reduced by about 50% so I said "welp. Let me flash the OS stock back onto it and just figure their manual out". I started to flash stock OS, had a blip, and that's where my problems started. It would go into a boot loop (not able to load any firmware) and the ethernet port would only be active for 5 seconds. I had no way of loading new software onto it, but could at least interrupt the boot process and send a few commands. I also was somehow setting up a tfptd server on some virtual ethernet thing (really not sure how that happened). It must be on your ethernet adapter that you will plug into.

So I want to walk through what to do and save you all the headache I was getting. I'm going to write this with some assumptions that you have a basic understanding of setting up putty, assigning an IP address,

1. You are going to need a usb to serial adapter in order to hookup to the console port of the AP. You need something like this. When looking at the ports of the AP with the QR code facing up, it goes Ground - Receive - Transmit - V (from left to right).
   1. Hook up Ground to Ground, Transmit of the USB adapter to Receive of the AP, Receive of USB to the Transmit of Console. DO NOT DO ANYTHING WITH THE V PIN. The USB Device needs to be set to 3.3v (this is usually done with a jumper.
2. Plug the USB into your laptop. Open up a putty serial session in order to see information coming from the router. This will allow you to break the boot sequence and send commands.
   1. Needs to be 115200 baud rate, other settings I didn't change.
   2. Boot up the router. You should now see information flying through the terminal on it trying to boot. Hit the spacebar until it stops the boot process.
3. Set the IP of your ethernet port on your laptop to something like 192.168.1.10 It just can't be 192.168.1.2 (this is the IP address of the AP)
4. Setup a tftpd server using tftpd64. I'd recommend watching this video (it's two minutes, just set it up how he does and make sure you select the 192.168.1.10 address for the server to be on).
   1. Download the .bin file that zixel_melen posted above (I think you can use any firmware version of the AP, but this should work). Put it in the working directory that you setup with the tfptd server.
5. Connect an ethernet cable from your laptop to your AP directly (does not need to be a crossover cable).
6. On the putty session enter the following commands.
   1. atna 192.168.1.2
      1. This is telling the AP that it's IP address is 192.168.1.2 (which it should be)
   2. atns 192.168.1.10
      1. This is telling the AP that the IP of the tfptd server is 192.168.1.10 (or whatever number you set above)
   3. atnz 629ABYW4C0.bin
      1. This tells the AP to go fetch this file name and start loading the .bin file.
7. As long as you've done everything correctly, you should start seeing it loading the file over and flashing the .bin file
   1. This took about 3 minutes to complete. The LED on top of the AP will start to blink it's LED patterns while it is booting up. Eventually it will take you to a login dialogue in the terminal.
8. Congrats, you're now back on stock firmware. I'd recommend pressing the "reset" button on the AP to get it to go back to factory defaults and you can login with admin 1234.

I hope this helps people and is written in a way that most people can understand. The wording on the Openwrt is incorrect on what steps to do, so I'll try to make an account and update it there.

Thanks again everyone