Nas542 dead + spi_flash_dead + barebox_dead + Uloader_dead

stein_990 · August 22

Hello.

Problem with NAS. Autostart, tries to boot and reboots. Tried to restore from flash drive "NAS540_521AATB3C0_Upgradekey", but in logs comes out this:

"+ CURR_BOOTFROM=

[ -eq 1 ]
sh: 1: unknown operand
[ -eq 2 ]
sh: 2: unknown operand
"

Red LED blinks, and reboots. Help, please. Thank you!

stein_990 · August 25

I fixed it!
I collected information from the entire forum.
So.

A new problem arose in that the bootloader and borebox broke. The power button lit up and went out.
Took 3 files: nas520_mtd0 + nas520_mtd1 + nas540.mtd2 kindly provided by Mr. Mijzelf.
Combined them in a Hex editor. Got firmware for the Spi _Flash_542.bin chip
Unsoldered the chip "mx25l8006e" (It is located on the back side of the board and is 1 MB) and installed it on the Chinese ch341 programmer.
In spi there was data only from nas540.mtd2. Cleared and filled Spi _Flash_542.bin. Soldered it back onto the board.
Connected the board via UART. Paused in borebox.
Immediately enable TFTP on the PC (the PC has a static IP).
Open the file "edit /env/config".
Change line 11: eth0.serverip="192.168.2.50" - this is the address on the PC.
Change line 31: mfg_kernel_img=uImage.520ABAG1C0.bin - I have this file in the main folder of the TFTP server. I renamed it to "uImage_MFG".
Change MODEL_ID=B403
Change the serial number and MAC address.
Exit by pressing Ctrl+D to save the configuration file.
Enter "saveenv" to save the changes on the next boot. You can immediately press printenv to check all the data.
Type "boot" and the system will download the uImage from your TFTP server directly to the NAND twice, once for each core.
The LED will blink.
Prepare a flash drive in fat16 with the Rescue Stick, RAS.bin firmware. Fat16 in Windows will only be formatted with a volume of less than 4 GB. I created a separate partition.
Turn off the power on the device, insert the flash drive and flash the firmware. The entire process can be seen via UART. I installed the ABAG_7 firmware, but after turning off and starting I updated it from the Abag_15 web interface.
Something like that)
I've only been on this forum for 4 days, but I've learned a lot, and it seems like I've been here my whole life)
Thank you all very much, I had to put it together piece by piece!

IMG_20250825_215408.jpg

IMG_20250825_215238_1.jpg

IMG_20250825_202234.jpg

IMG_20250825_203125.jpg

Spi _Flash_542.rar

Print.txt

Mijzelf · August 22

2 Possibilities:

The usb_key_func.sh script is not compatible with a 542, or
More likely, your environment in flash is corrupted.

The direct cause of the log is this part of the script:

FW_PATH="/firmware"

# which kernel and system image partitions
CURR_BOOTFROM=`${FW_PATH}/sbin/info_printenv curr_bootfrom | awk -F"=" '{print $2}'`
if [ ${CURR_BOOTFROM} -eq 1 ]; then
	NEXT_BOOTFROM=2
elif [ ${CURR_BOOTFROM} -eq 2 ]; then
	NEXT_BOOTFROM=1
else
	echo "ERROR!!! Invalid INFO value 'curr_bootfrom'!"
	# All leds show red
	setLED SYS RED BLINK
	setLED HD RED BLINK
	setLED COPY RED BLINK
	exit 1
fi

It tries to read the variable 'curr_bootfrom' from the environment in flash, using the executable '/firmware/sbin/info_printenv', and a filter 'awk'. It tries to find out if it's value is 1 or 2. According to your log ${CURR_BOOTFROM} is empty, which means that either the environment variable does not exist, or it's empty.

The NAS has 2 separate firmwares, the current and the previous. If the current fails to boot, it falls back to the previous. If you flash new firmware, 'previous' is overwritten, and then ´curr_bootfrom' is set to point to 'previous', to make it the new 'current'.

This way the box still boots if writing to 'previous' fails due to a power fail, or something like that, as 'curr_bootfrom' isn't changed.

Now your box seems not to have a 'curr_bootfrom'. I suppose the bootloader then defaults to '1', as it clearly boots something.

You can try if you can get telnet access using 'https://zyxel.ddnss.eu/Users/Mijzelf/universal_usb_key_func-2015-10-12.zip', where you should activate the network_telnet_stop variant. When I remember well there is a problem on the NAS series, telnetd doesn't support the '-l' option, so you'll have to remove that. If you can get so far that you get a login prompt without knowing the password, we will have to find a work-around for that.

With telnet access it might be possible to set 'curr_bootfrom', provided the corruption is limited.

stein_990 · August 22

https://community.zyxel.com/en/discussion/comment/79602#Comment_79602

And what command via telnet can change the bootloader after connecting via putty? I found similar topics about these problems, and there "curr" and "next" change places, and then the person flashed from a flash drive with your script. Unfortunately, I am not strong in programming on Linux and switches. (( The device itself gives life, because there are reactions to the buttons, the disks spin up gradually, the reboot occurs after the start of blinking activity after 30 seconds.

Mijzelf · August 22

The device itself gives life, because there are reactions to the buttons

And better, it generates a logfile on your flash drive, which means the script on it is executed.

And what command via telnet can change the bootloader

You can't change the bootloader, but you can change environment variables. From the top of my head that should be

/firmware/sbin/info_setenv curr_bootfrom 1

But before you can do that you should first concentrate on getting a shell, and then run /firmware/sbin/info_printenv without parameters, to get a complete dump, to see if it's sane. Writing to a corrupt database can corrupt it further.

On the other hand, you could say that it can't get worse than now, with a not booting device.

stein_990 · August 22

https://community.zyxel.com/en/discussion/comment/79604#Comment_79604

Thank you very much! I will try and let you know the result.

stein_990 · August 22

https://community.zyxel.com/en/discussion/comment/79604#Comment_79604

This comes out:

/ $ /firmware/sbin/info_printenv
envfs: wrong magic on /dev/mtd2

If you go to /etc/init.d/rcS it is displayed as in the screenshot.

Mijzelf · August 22

envfs: wrong magic on /dev/mtd2

So indeed the environment is damaged. I can provide you a backup of mtd2 of my NAS540. You can put that on the USB stick, decompress it:

gunzip /mnt/partnerkey/nas540.mtd2.gz

and write it to mtd2:

dd if=/mnt/partnerkey/nas540.mtd2 of=/dev/mtd2 bs=64k

After that reboot the box, and try again.

stein_990 · August 22

https://community.zyxel.com/en/discussion/comment/79615#Comment_79615

Now it says:

~ # /firmware/sbin/info_printenv

wrong crc on env

I also gave the command: "/sbin/flash_erase /dev/mtd2 0 0" and only then your file, because without cleaning nothing changed. I tried to upload the firmware from "NAS540_521AATB3C0_Upgradekey" - no result(

stein_990 · August 22

https://community.zyxel.com/en/discussion/comment/79615#Comment_79615

ip=dhcp

eth0.serverip=192.168.1.70

kernel_loc=nand

rootfs_loc=nand

uloaderimage=microloader-c2kevm.bin

bareboximage=barebox-c2kevm.bin

mfg_kernel_img=uImage_MFG

mfg_rootfs_img=rootfs_ubi.img_MFG

rootfs_type=ubifs

rootfsimage=root.$rootfs_type-128k

kernelimage_type=uimage

kernelimage=uImage

spi_parts=256k(uloader)ro,512k(barebox)ro,256k(env)

spi_device=spi0.0

nand_device=comcertonand

nand_parts=10M(config),10M(kernel1),110M(rootfs1),10M(kernel2),110M(rootfs2),-(reserved)

rootfs_mtdblock_nand=2

autoboot_timeout=3

usb3_internal_clk=yes

bootargs=console=ttyS0,115200n8, init=/etc/preinit pcie_gen1_only=yes

bootargs=$bootargs mac_addr=$eth0.ethaddr,$eth1.ethaddr,$eth2.ethaddr

next_bootfrom=2

curr_bootfrom=2

kernel_mtd_1=4

sysimg_mtd_1=5

kernel_mtd_2=6

sysimg_mtd_2=7

MODEL_ID=B103

fwversion_1=V5.04(AATB.0)

fwversion_2=V5.11(AATB.2)

revision_1=46843

revision_2=49397

modelid_1=B103

modelid_2=B103

core_checksum_1=32768bcdcd9677274d4af1c02f41dda6

core_checksum_2=0eaa12517d117ff7dd2f68502b7f961d

zld_checksum_1=dbdacfd6dd97dad4787d514f7cdaa496

zld_checksum_2=44485b00ede541d4f27db02f0da490f9

romfile_checksum_1=8D7D

romfile_checksum_2=28C8

img_checksum_1=2dbaf250ef4e9574d28a0340379f831a

img_checksum_2=83d14a443096a8284b07e3f3a91b1673

serial_number=S140Z45007917

ethaddr=5C:F4:AB:5C:58:FC

eth2addr=5C:F4:AB:5C:58:FD

change_boot_part=0

stein_990 · August 23

flash.log

https://community.zyxel.com/en/discussion/10235/nas542-stuck-in-a-boot-loop/p3

Hello! Yesterday I did everything as you said, and also found information on editing the configuration, I edited it as the person indicated, only I specified my serial numbers and MAC. Then I flashed it from a flash drive. Here is the flash drive log after the flashing. After the flashing, the NAS turned off by itself. I removed the flash drive and turned it on with the button. Now after startup it lights up with the top indicator and that's it. There is no more booting from the flash drive. The fan rotates. It receives the address, but there is no ping. I am very upset ((( We almost restored it with you (( I have usb-ttl. Will it help?

stein_990 · August 23

uloader 2011.06.0 (May 20 2014 - 16:36:41)


Board: Mindspeed C2000

c2k_spi_probe


Copying Barebox from SPI Flash(bootopt=0)

BB Copying Done

## Starting Barebox at 0x01000000 ...



barebox 2011.06.0-svn44305-dirty6 (Aug 28 2014 - 22:25:22)


Board: Mindspeed C2000

c2k_spi_probe

c2k_otp_probe.

cbus_baseaddr: 9c000000, ddr_baseaddr: 03800000, ddr_phys_baseaddr: 03800000

class init complete

tmu init complete

bmu1 init: done

bmu2 init: done

util init complete

GPI1 init complete

GPI2 init complete

HGPI init complete

HIF rx desc: base_va: 03e80000, base_pa: 03e80000

HIF tx desc: base_va: 03e80400, base_pa: 03e80400

HIF init complete

bmu1 enabled

bmu2 enabled

pfe_hw_init: done

pfe_firmware_init

pfe_load_elf

pfe_load_elf no of sections: 10

pfe_firmware_init: class firmware loaded

pfe_load_elf

pfe_load_elf no of sections: 10

pfe_firmware_init: tmu firmware loaded

pfe_load_elf

pfe_load_elf no of sections: 14

pfe_firmware_init: util firmware loaded

eth_port: 0

NAS540_phy_reg_setting[eth_port].phyaddr: 0x4

miidev_restart_aneg for PHY4

eth_port: 1

NAS540_phy_reg_setting[eth_port].phyaddr: 0x6

miidev_restart_aneg for PHY6

cfi_probe: cfi_flash base: 0xc0000000 size: 0x04000000

## Unknown FLASH on Bank at 0xc0000000 - Size = 0x00000000 = 0 MB

bootopt = 0x0

Using ENV from SPI Flash.

nand_probe: comcerto_nand base: 0xc8300000 size: 0x256 MB

NAND device: Manufacturer ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bi                                                 t), page size: 2048, OOB size: 64

Using default values

Bad block table not found for chip 0

Bad block table not found for chip 0

Scanning device for bad blocks

Bad eraseblock 1536 at 0x0c000000

Bad eraseblock 1537 at 0x0c020000

Bad block table written to 0x0ffe0000, version 0x01

Bad block table written to 0x0ffc0000, version 0x01

Malloc space: 0x00600000 -> 0x01000000 (size 10 MB)

Stack space : 0x005f8000 -> 0x00600000 (size 32 kB)

running /env/bin/init...

Unknown command 'export' - try 'help'

Disabling eee function of phy 4 ...

Disabling eee function of phy 6 ...


Hit any key to stop autoboot:  1

usage: update -t <kernel|rootfs|barebox|bareboxenv> -d <nor|nand> [-m tftp|xmode                                                 m|ddr] [-f imagename|-a address] -c

update tools.


options

 -c     to check the crc32 for the image and flashed one


default mode is tftp

type update -t uloader -d <nor|nand> [-m tftp|xmodem|ddr] [-f imagename|-a addre                                                 ss] to update uloader into flash

type update -t barebox -d <nor|nand> [-m tftp|xmodem|ddr] [-f imagename|-a addre                                                 ss] to update barebox into flash

type update -t kernel -d <nor|nand> [-m tftp|xmodem|ddr] [-f imagename|-a addres                                                 s] to update kernel into flash

type update -t rootfs -d <nor|nand> [-m tftp|xmodem|ddr] [-f imagename|-a addres                                                 s] to update rootfs into flash

type update -t bareboxenv -d <nor|nand> [-m tftp|xmodem|ddr] [-f imagename|-a ad                                                 dress] to update bareboxenv into flash

Barebox-C2K >/

Connected via TTL-USB

Nas542 dead + spi_flash_dead + barebox_dead + Uloader_dead

Accepted Solution

All Replies

Categories

Consumer Product Help Center