Nas542 dead + spi_flash_dead + barebox_dead + Uloader_dead

Mijzelf

/ $ /sbin/flash_erase /dev/mtd2 0 0
flash_erase: error!: /dev/mtd2
error 13 (Permission denied)

You are not root. If you are root, you have a # prompt instead of a $

echo ERROR!!! Invalid INFO value 'curr_bootfrom'!
ERROR!!! Invalid INFO value 'curr_bootfrom'!

Somehow your environment got corrupted again. From your flash.log:

/firmware/sbin/info_setenv revision_2 51201
Erasing 64 Kibyte @ 0 -- 0 % complete
Erasing 64 Kibyte @ 10000 -- 25 % complete
Erasing 64 Kibyte @ 20000 -- 50 % complete
Erasing 64 Kibyte @ 30000 -- 75 % complete
Erasing 64 Kibyte @ 30000 -- 100 % complete

As you can see each setenv overwrites the whole 256kB mtd2. Maybe it's a good idea to first set some environment variables in the bootloader prompt, in case there is something wrong with the content, after reflashing mtd2. A small corruption could get bigger if info_setenv has a bug. I think the command in the bootloader prompt is simply setenv.

stein_990

https://community.zyxel.com/en/discussion/comment/79638#Comment_79638

dd if=/mnt/partnerkey/nas540.mtd2 of=/dev/mtd2 bs=64k

dd: can't open '/dev/mtd2': No such device

—

/firmware/sbin/info_printenv

Open /dev/mtd2 void

Is there no way out at all now?

stein_990

Is it possible to somehow upload the firmware via telnet to create partitions?

Mijzelf

Hm. I wonder if something else is going on. The flash is just a block of, well, flash. The separation in partitions is artificial, and on this box the kernel 'knows' the partitions by it's commandline, which is provided by the bootloader.

In the bootloader environment you can find

spi_parts=256k(uloader)ro,512k(barebox)ro,256k(env)
nand_parts=10M(config),10M(kernel1),110M(rootfs1),10M(kernel2),110M(rootfs2),-(reserved)

The bootloader uses this to create a commandline which it passes to the Linux kernel, which you can find back in the kernel bootlog:

Kernel command line: console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes mac_addr=,, ip=dhcp root=ubi0:rootfs ubi.mtd=2,2048 rootfstype=ubifs rw noinitrd mtdparts=spi0.0:256k(uloader)ro,512k(barebox)ro,256k(env);comcertonand:10M(config),10M(kernel1),110M(rootfs1),10M(kernel2),110M(rootfs2),-(reserved) usb3_internal_clk=yes

mtdparts defines the mtd partitions. mtd0 is uloader, mdt1 barebox, mtd2 env, and so on.

By executing 'cat /proc/cmdline' in the telnet shell you can see the kernel commandline. It should be (nearly) identical to the command line above.

If the mtdparts lacks or is empty, do a printenv in the bootloader prompt, to see if spi_parts and nand_parts are still there. If they are, bootm is apparently not the right way to boot the kernel properly. Try a 'help' in the bootloader prompt.

Somehow the bootloader should boot the module in /dev/mem the same way as it should boot /dev/nand0.kernel1.bb. The latter is a handle to the 'kernel1' partition on NAND.

stein_990

https://community.zyxel.com/en/discussion/comment/79645#Comment_79645

I can only get into telnet after flashing the kernel, after rebooting and loading from a flash drive. Is it possible to somehow flash your nas540.mtd2 dump in TTL mode? I've been struggling with its recovery for the second day already, yesterday there was hope, but after a successful firmware download everything collapsed(

stein_990

https://community.zyxel.com/en/discussion/comment/79645#Comment_79645

Spoiler Warning

Barebox-C2K >/ printenv
locals:
PATH=/env/bin
ip=dhcp
kernel_loc=nand
rootfs_loc=nand
uloaderimage=microloader-c2kevm.bin
bareboximage=barebox-c2kevm.bin
mfg_kernel_img=uImage_MFG
mfg_rootfs_img=rootfs_ubi.img_MFG
rootfs_type=ubifs
rootfsimage=root.ubifs-128k
kernelimage_type=uimage
kernelimage=uImage
spi_parts=256k(uloader)ro,512k(barebox)ro,256k(env)
spi_device=spi0.0
nand_device=comcertonand
nand_parts=10M(config),10M(kernel1),110M(rootfs1),10M(kernel2),110M(rootfs2),-(reserved)
rootfs_mtdblock_nand=2
autoboot_timeout=3
usb3_internal_clk=yes
bootargs=console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes mac_addr=,,
next_bootfrom=2
curr_bootfrom=1
kernel_mtd_1=4
sysimg_mtd_1=5
kernel_mtd_2=6
sysimg_mtd_2=7
MODEL_ID=B103
globals:

Spoiler Warning

~ # cat /proc/cmdline
console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes mac_addr=,,

Spoiler Warning

Barebox-C2K >/ help
. - alias for source
? - alias for help
[ - alias for test
addpart - adds a partition table to a device
bootm - boot an application image
bootu - bootu - start a raw linux image
bootz - bootz - start a zImage
cat - concatenate file(s)
cd - change working directory
clear - clear screen
copy - copy command
cp - copy files
cpuinfo - Show info about CPU
crc32 - crc32 checksum calculation
delpart - delete partition(s)
devinfo - Show information about devices and drivers.
dhcp - invoke dhcp client to obtain ip/boot params
echo - echo args to console
edit - Usage: (s)edit <file>
erase - erase FLASH memory
erase_nand - Erase the NAND
erase_old_nand_fmt - Erase old NAND format
ethact - set current ethernet device
exit - exit script
false - do nothing, unsuccessfully
gemac_stats - retrieve GEMAC statistics
getopt - getopt <optstring> <var>
help - print online help
i2c_probe - probe for an i2c device
i2c_read - read from an i2c device
i2c_write - write to an i2c device
loadb - Load binary file over serial line (kermit mode)
loadenv - Load environment from ENVFS into DIRECTORY (default: /dev/env0 -> /env).
ls - list a file or directory
md - memory display
memcmp - memory compare
memcpy - memory copy
memset - memory fill
mkdir - make directories
mount - Mount a filesystem of a given type to a mountpoint or list mounted filesystems.
mtest - simple RAM test
mw - memory write (fill)
nand - NAND specific handling
pfe - pfe <options>
pfe_stats - retrieve PFE statistics
phy - PHY status, read and write operation
ping - ping <destination>
printenv - Print value of one or all environment variables.
protect - enable flash write protection
pwd - print working directory
read_nand - Read the NAND
readline - prompt for user input
reset - Perform RESET of the CPU
rm - remove files
rmdir - remove directorie(s)
sata - SATA sub system
saveenv - save environment to persistent storage
sedit - alias for edit
sh - run shell script
sleep - delay execution for n seconds
socinfo - print SoC info
source - execute shell script in current shell environment
switch - Atheros AR8328 switch read and write operation
test - minimal test like /bin/sh
tftp - Load file using tftp protocol
timeout - wait for a specified timeout
true - do nothing, successfully
umount - umount a filesystem
unprotect - disable flash write protection
update_i2c - update_i2c <src> <off> <size>
update_nand - Flash the NAND
update_nor - Flash the NOR
update_spi - update_spi <src> <sec> <off> <size>
version - print monitor version

Mijzelf

~ # cat /proc/cmdline
console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes mac_addr=,,

Barebox-C2K >/ printenv
bootargs=console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes mac_addr=,,

OK. The command line are the raw bootargs from the environment. So obviously the bootm command is not capable of creating the wanted commandline. Further the environment looks complete. Maybe this are defaults, as the checksums are lacking.

Anyway, I did some reading in older threads, and found the script /env/bin/boot, which is also stored on mtd2

When I read it well, it is supposed to boot a raw kernel or module, and create a command line, and do some fan work.

When called with argument 'tftp', is tries to download a file called uImage, and boots that. So rename the module on your tftpserver to uImage, set the ip and serverip, and try to call the boot script.

boot tftp

or, if that fails with something like 'unknown command boot' try

/env/bin/boot tftp

Is it possible to somehow flash your nas540.mtd2 dump in TTL mode?

Should be possible, the bootloader contains all tools needed to load modules in memory, and to write them in flash. Probably using the command 'update_spi'. But I would be very reluctant to try that. The spi flash contains 256k uloader, 512k barebox and 256k 'mtd2'. If you by accident overwrite the uloader or barebox, you can throw away the box, as there is no bootloader anymore.

stein_990

https://community.zyxel.com/en/discussion/comment/79654#Comment_79654

Hello. I've been wondering for the last few days what could have gone wrong. I used the command you gave me for recording: "dd if=/mnt/partnerkey/nas540.mtd2 of=/dev/mtd2 bs=64k" and the command that helped another person on the forum recover "cat nas540.mtd2.gz | gzip -d | nandwrite /dev/mtd2" is different. Could this have caused the problem? I followed the instructions. I don't know what firmware was installed before all the manipulations, so I installed "abag6". It was successfully flashed, but stopped booting. Now the NAS immediately turns off after pressing the power button, I cleared mtd0 and 1... out of anger... Naturally, now UART doesn't work either... Where are all the bootloaders stored? On the 1Gb Toshiba chip? Is this the end? I just don't understand why after recording mtd2, editing and flashing it, it stopped working then...

stein_990

I saw 2 more 8-pin chips (like for BIOS) on the board, with a white dot. What are they for? I have a CH341A programmer.

stein_990

Screenshot_2025-08-25-09-14-08-592_com.android.chrome_1.jpg