Unbricking guide
From NAS-4220
More detailed explanation is probably needed here to make this foolproof. JTAG flashing information should be added.
This should summarize known information about how to get the IB-4220-B device back from unreachable state. Thanks to HWguru and others in the forum and to Frank Meerkötter for hints.
Contents |
When applicable
Bootloader, kernel image, ramdisk image and application volume image are stored on device's flash memory. In case you happen to damage them (like unplugging power during upgrade or uploading wrong file for firmware update), you may loose network connectivity to the device. Depending whether bootloader still works or not, you can recover from this using a TTL-level serial cable.
Bootloader is probably OK when you get to kernel loading in the process. When you power on the device and look at the status LEDs in front, you should/may see: ~3 s no LED flashes - that's bootloader waiting for Ctrl+C break on serial line, green flashes once, orange flashes or starts to glow continuously if no disc, green flashes slowly --- that's kernel loading. If you get at least to the first 'green flash', it is likely that the bootloader is OK. If not, you'll probably have to get/build a JTAG cable to flash the device. (As 4220 bootloader is not telnet-enabled, you can't contact it through network.)
You may want to read the Make sure your NAS is really bricked section for MRT devices here.
Steps to recover using serial console
- Get serial cable (TTL-level), firmware image, tftp server and some half an hour of time.
- Get a computer with terminal program like minicom, set the port to 19200, 8N1 and check your cable - connect RX and TX and see if you can get what you send echoed back.
- Detach discs (unsure if needed).
- Power on the NAS device.
- Connect the serial cable.
- Press reset.
- You should see bootloader asking for Ctrl+C before boot, if you let is be, then kernel booting and a panic or whatever at some stage. Now you'll know where's the problem.
- Press reset again, now send Ctrl+C to the boot loader.
- You'll get a menu - press 8 to see device setup and ping that address. If OK, get the TFTP server with images ready.
- Use the upload options to flash the items - it always asks whether xmodem or through TFTP and for TFTP then for IP address and file name on server. Each file gets dowloaded, flash area is erased and reprogrammed - you'll see this happening on the console. There's probably no need to touch the bootloader as long as it works.
- Reboot (option 0), watch it start, you'll get a login prompt at the end if successful. At this point the web interface should be accessible as well.
If you get stuck in some points try following, more detailed description.
Prerequisites
Serial cable
As 4220 has not a telnet-enabled bootloader, access is only possible through the serial console connector. As the serial port works on 3.3V, you can't just connect PC-serial port to this, you have to get a serial cable or usb-serial dongle working at the TTL voltage level. See the Adding a serial port, The NAS unbricking guide for MRT devices, and pinout as described here.
It's also possible to modify a serial data cables for some mobile phones or their USB versions. You have to lookup if the phone really talks at 3.3V and what's the pinout and then modify it.
Example for ME45 USB data cable
Let's assume you have a old USB cable from Siemens x35/45 series. Pinout can be found on pinout.ru - note that that's phone seen from bottom when keyboard is up. So we'll need pins 1 (GND), 5 (TX) and 6 (RX). Pinout of the on-board serial connector is here --- we'll need to connect pin 1 from cable to pin 5 at the board, pin 5 (TX) to pin 3 on board and pin 6 (RX) to pin 2 on board.
As noted here, you have to first power on the device, then connect the cable (otherwise the device does not power on).
Getting computer-side ready (Linux)
This is an example for Ubuntu 9.04.
- Get tftpd, tftp and minicom packages.
- Setup address in 192.168.0.0/24 network (and do not use .200 as that's 4220's default address).
- Restart inetd daemon.
- Set minicom to 19200 8N1 on the right port, check if you get characters echoed back if you connect RX and TX on your cable.
- Setup the tftpd server - as for 9.04 it expects images in /srv/tftp (as noted in /etc/inetd.conf), so get firmware from Raidsonic website, extract it somewhere, then extract the archive inside once again - so you'll get rd.gz, zImage and hddapps.tgz. Place those three to /srv/tftp.
- Test if you can retrieve the file using the tftp client.
Getting serial console and uploading images
Get the bootloader prompt
- Power on the NAS device - if you don't do this before attaching the cable, the device won't boot.
- Connect the serial cable.
- Press reboot - and you should get bootloaders prompt as follows, press Ctrl+C in the three seconds.
Storlink SL351x Boot Loader [Linux], version 1.0.9
Built by linux, 17:27:04, Dec 19 2007
Processor: SL3516c3 CPU Rate: 300000000 AHB Bus Clock:150MHz Ratio:2/1 MAC 1 Address: 00:01:D2:07:06:E8 MAC 2 Address: 00:50:C2:2B:D0:02 inet addr: 192.168.0.200/255.255.255.0 ==> enter ^C to abort booting within 3 seconds ......
Upload images
- Use menu items to upload kernel/ramdisk/hdapp images - you'll always have to select tftp, give address of your computer (the one in the 192.168.0.0/24 network) and name of the file, relative to /srv/tftp (e.g. zImage). If you happen to not be able to get the images, check network settings (via key 8) and possibly use xmodem upload - you'll need lrzsz package for this. Reboot by 0 and watch the system boot. You'll get console login prompt at the end if all ok.
Information sources
- Unbrick procedure for NAS 4220 forum thread
- Hardware description at GPL-devices wiki
- NAS 4220 explorations by Frank Meerkötter and linked pages
- Raidsonic firmware download page
- ...more threads in the forum.
Example of the procedure - image upload/flashing
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: Y
1 : Download by X-modem
2 : Download by TFTP
ESC: Return
==> 2
TFTP Server IP Address: 192.168.0.117
Image Path and name(e.g. /images/zImage): zImage
TFTP Download zImage from 192.168.0.117 ..........................
Successful to download by TFTP! Size=3145728
Do not power-off this device while flash programming is proceeding!!
==> enter ^C to abort program flash 0x30020000 within 3 seconds ......
Erase flash (0x30020000): Size=3145728 ........................ OK!
Program flash (0x30020000): Size=3145728 ........................ OK!
Start Update FIS data......
Erase flash (0x30fe0000): Size=131072 . OK!
Program flash (0x30fe0000): Size=5120 . OK!
Successful to upgrade (0x30020000)!
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: R
1 : Download by X-modem
2 : Download by TFTP
ESC: Return
==> 2
TFTP Server IP Address: 192.168.0.117
Image Path and name(e.g. /images/zImage): rd.gz
TFTP Download rd.gz from 192.168.0.117 .....................................
Successful to download by TFTP! Size=4710138
Do not power-off this device while flash programming is proceeding!!
==> enter ^C to abort program flash 0x30320000 within 3 seconds ......
Erase flash (0x30320000): Size=6291456 ........................................!
Program flash (0x30320000): Size=4710138 .................................... O!
Start Update FIS data......
Erase flash (0x30fe0000): Size=131072 . OK!
Program flash (0x30fe0000): Size=5120 . OK!
Successful to upgrade (0x30320000)!
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: A
1 : Download by X-modem
2 : Download by TFTP
ESC: Return
==> 2
TFTP Server IP Address: 192.168.0.117
Image Path and name(e.g. /images/zImage): hddapp.tgz
TFTP Download hddapp.tgz from 192.168.0.117 ....................................
Successful to download by TFTP! Size=6291456
Do not power-off this device while flash programming is proceeding!!
==> enter ^C to abort program flash 0x30920000 within 3 seconds ......
Erase flash (0x30920000): Size=6291456 ........................................!
Program flash (0x30920000): Size=6291456 ......................................!
Start Update FIS data......
Erase flash (0x30fe0000): Size=131072 . OK!
Program flash (0x30fe0000): Size=5120 . OK!
Successful to upgrade (0x30920000)!
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: 2
Name FLASH addr Mem addr Datalen Entry point
BOOT 0x30000000-3001FFFF 0x00000000 0x00020000 0x00000000
FIS directory 0x30FE0000-30FFFFFF 0x30FE0000 0x00001400 0x00000000
Kern 0x30020000-3031FFFF 0x01600000 0x00300000 0x01600000
Ramdisk 0x30320000-3079DEF9 0x00800000 0x0047DEFA 0x00800000
Application 0x30920000-30F1FFFF 0x00000000 0x00600000 0x00000000
CurConf 0x30F40000-30FDFFFF 0x00000000 0x000A0000 0x00000000
VCTL 0x30F20000-30F3FFFF 0x00000000 0x00020000 0x00000000
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: 8
Processor: SL3516c3
CPU Rate: 300000000
AHB Bus Clock:150MHz Ratio:2/1
MAC 1 Address: 00:01:D2:07:06:E8
MAC 2 Address: 00:50:C2:2B:D0:02
inet addr: 192.168.0.200/255.255.255.0
Boot Menu
==============================================================================
0: Reboot 1: Start the Kernel Code
2: List Image 3: Delete Image
4: Create New Image 5: Enter Command Line Interface
6: Set IP Address 7: Set MAC Address
8: Show Configuration F: Create Default FIS
X: Upgrade Boot Y: Upgrade Kernel
Z: Upgrade Firmware A: Upgrade Application
R: Upgrade RAM Disk
=> Select: 0
Example kernel boot output if successfull (without disks attached)
Storlink SL351x Boot Loader [Linux], version 1.0.9
Built by linux, 17:27:04, Dec 19 2007
Processor: SL3516c3
CPU Rate: 300000000
AHB Bus Clock:150MHz Ratio:2/1
MAC 1 Address: 00:01:D2:07:06:E8
MAC 2 Address: 00:50:C2:2B:D0:02
inet addr: 192.168.0.200/255.255.255.0
==> enter ^C to abort booting within 3 seconds ......
Load Kern image from 0x30020000 to 0x1600000 size 3145728
Load Ramdisk image from 0x30320000 to 0x800000 size 4710138
Uncompressing Linux.............................................................
Linux version 2.6.15 (root@localhost.localdomain) (gcc version 3.4.4) #140 Fri 7
CPU: FA526id(wb) [66015261] revision 1 (ARMv4)
Machine: GeminiA
Ignoring unrecognised tag 0x00000000
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 2, 16 byte lines, 512 sets
CPU0: D cache: 8192 bytes, associativity 2, 16 byte lines, 256 sets
Built 1 zonelists
Kernel command line: root=/dev/ram0 rw console=ttySL0,19200 initrd=0x00800000,14
PID hash table entries: 1024 (order: 10, 16384 bytes)
Bus: 150MHz(2/1)
sl2312 console setup :
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 128MB = 128MB total
Memory: 108800KB available (3256K code, 1172K data, 104K init)
Mount-cache hash table entries: 512
*** Page_chain_cachep Init!***
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 16384K
NET: Registered protocol family 16
PCI: bus0: Fast back to back transfers disabled
sl2312_pci_map_irq : slot = 0 pin = 1
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Initial RAID Descripter...
XOR:tx_desc = ffc00000
XOR:rx_desc = ffc01000
XOR:tx_desc_dma = 01772000
XOR:rx_desc_dma = 01773000
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
NTFS driver 2.1.25 [Flags: R/O].
SGI XFS with ACLs, no debug enabled
SGI XFS Quota Management subsystem
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Real Time Clock Driver v0.10
Gemini Gpio init
Register Gemini Power control
Storlink CIR Initialization
Watchdog Timer Initialized
ttySL0 at MMIO 0x42000000 (irq = 18) is a SL2312
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
VSC-switch not found
SL351x Giga Ethernet driver 0.1.5 built at Sep 7 2007 10:23:54
Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
ide 0: physical = 63000000, virtual = c8800000, irq = 4
ide0: MMIO-DMA , BIOS settings: hda:pio, hdb:pio
ide 1: physical = 63400000, virtual = c8802000, irq = 5
ide1: MMIO-DMA , BIOS settings: hdc:pio, hdd:pio
hda: no response (status = 0x80), resetting drive
hda: no response (status = 0x80)
SL2312 MTD Driver Init.......
SL2312 CFI Flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 7 MTD partitions on "SL2312 CFI Flash":
0x00000000-0x00020000 : "RedBoot"
0x00020000-0x00320000 : "Kernel"
0x00320000-0x00920000 : "Ramdisk"
0x00920000-0x00f20000 : "Application"
0x00f20000-0x00f40000 : "VCTL"
0x00f40000-0x00fe0000 : "CurConf"
0x00fe0000-0x01000000 : "FIS directory"
SL2312 MTD Driver Init Success ......
FTC_FOTG2XX : Init FOTG2XX Driver
Init FOTG2xx driver
FTC_FOTG2XX : >>> Found FOTG2XX ...
pFTC_OTG c165a120
FTC_FOTG2XX_1 : Init FOTG2XX Driver
Init FOTG2xx driver
FTC_FOTG2XX_1 : >>> Found FOTG2XX ...
pFTC_OTG_1 c165a1e0
hcd->self.controller c1751000
hcd end
hcd_buffer_create
ehci-hcd-FOTG2XX ehci-hcd-FOTG2XX: new USB bus registered, assigned bus number 1
usb_register_bus
ghcd_FOTG2XX hcd c1751000
hcd_irq_For_OTG
ehci->caps->length 10, hcd->regs f6800000 , ehci->regs f6800010
udev->state 1
drivers/usb/host/ehci-hcd-FOTG2XX.c: USB support enabled, EHCI rev 101. 0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
FTC_FOTG2XX : >>> +FOTG2XX_get_otg_transceiver
FTC_FOTG2XX : registered host c1751000
OTG2XX act as HOST only (don't need to wait gadget driver)
+(OTGC_Init)
pFTC_OTG->otg.default_a=1
+(OTGC_Init)
pFTC_OTG->otg.default_a=1
OTG_enable_VBUS
FTC_FOTG2XX : >>> Drive VBUS ok...
+OTGP_Close()
OTG2XX act as HOST only (remove gadget function)
+OTGH_Open()(0x30=0x0)
OTG_enable_VBUS
mdwOTGC_Control_A_VBUS_VLD_Rd 80000
+OTGP_Close()
OTG2XX act as HOST only (remove gadget function)
+OTGH_Open()(0x30=0x0)
ehci otg_set_host status 0
connect_change 1
clear_bit
return set_bit
hcd->self.controller c05e9c00
hcd end
hcd_buffer_create
ehci-hcd-FOTG2XX-1 ehci-hcd-FOTG2XX-1: new USB bus registered, assigned bus num2
usb_register_bus
ghcd_FOTG2XX_1 hcd c05e9c00
hcd_irq_For_OTG_1
ehci->caps->length 10, hcd->regs f6900000 , ehci->regs f6900010
udev->state 1
drivers/usb/host/ehci-hcd-FOTG2XX-1.c: USB support enabled, EHCI rev 101. 0
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
FTC_FOTG2XX_1 : >>> +FOTG2XX_get_otg_transceiver_1
FTC_FOTG2XX_1 : registered host c05e9c00
OTG2XX act as HOST only (don't need to wait gadget driver)
+(OTGC_Init_1)
pFTC_OTG_1->otg.default_a=1
+(OTGC_Init_1)
pFTC_OTG_1->otg.default_a=1
OTG_enable_VBUS
FTC_FOTG2XX_1 : >>> Drive VBUS ok...
+OTGP_Close_1()
OTG2XX act as HOST only (remove gadget function)
+OTGH_Open_1()(0x30=0x0)
OTG_enable_VBUS
mdwOTGC_Control_A_VBUS_VLD_Rd 80000
+OTGP_Close_1()
OTG2XX act as HOST only (remove gadget function)
+OTGH_Open_1()(0x30=0x0)
ehci otg_set_host status 0
connect_change 1
clear_bit
return set_bit
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: raid10 personality registered as nr 9
md: raid5 personality registered as nr 4
raid5: measuring checksumming speed
gemini xor acceleration: 47.600 MB/sec
raid5: using function: gemini xor acceleration (47.600 MB/sec)
md: multipath personality registered as nr 7
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: bitmap version 4.39
ipsec_init : cryptographic accelerator
ipsec tx_desc = ffc14000
ipsec rx_desc = ffc15000
ipsec tx_desc_dma = 07237000
ipsec rx_desc_dma = 005f0000
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 104K
fuse init (API version 7.8)
fuse distribution version: 2.6.3
EXT3-fs: unable to read superblock
EXT2-fs: unable to read superblock
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will !
FAT: unable to read boot sector
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will !
FAT: unable to read boot sector
isofs_fill_super: bread failed, dev=md0, iso_blknum=16, block=32
NTFS-fs error (device md0): read_ntfs_boot_sector(): Unable to read primary boo.
NTFS-fs error (device md0): read_ntfs_boot_sector(): Mount option errors=recove.
NTFS-fs error (device md0): ntfs_fill_super(): Not an NTFS volume.
XFS: SB read failed
GMAC-0 Addr 1 Vendor ID: 0x01410e11
mii_write: phy_addr=0x1 reg_addr=0x4 value=0x5e1
mii_write: phy_addr=0x1 reg_addr=0x9 value=0x300
mii_write: phy_addr=0x1 reg_addr=0x18 value=0x41
mii_write: phy_addr=0x1 reg_addr=0x0 value=0x9200
mii_write: phy_addr=0x1 reg_addr=0x0 value=0x1200
Link Up (0x796d) MII REG 10 = 0x3c00
1000M/Full
Flow Control Enable.
Storlink eth0 address = 0001d20706e8
Enable MAC Flow Control...
GMAC-0 Change MTU = 1480
GMAC-0 Addr 1 Vendor ID: 0x01410e11
mii_write: phy_addr=0x1 reg_addr=0x4 value=0x5e1
mii_write: phy_addr=0x1 reg_addr=0x9 value=0x300
mii_write: phy_addr=0x1 reg_addr=0x18 value=0x41
mii_write: phy_addr=0x1 reg_addr=0x0 value=0x9200
mii_write: phy_addr=0x1 reg_addr=0x0 value=0x1200
Link Up (0x796d) MII REG 10 = 0x3c00
1000M/Full
Flow Control Enable.
Storlink eth0 address = 0001d20706e8
Enable MAC Flow Control...
IB-NAS4220-B.lan login: admin
Password:
warning: cannot change to home directory
BusyBox v1.00-rc3 (2008.10.30-06:50+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
IB-NAS4220-B> ifconfig
eth0 Link encap:Ethernet HWaddr 00:01:D2:07:06:E8
inet addr:192.168.1.122 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1480 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:57 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:256
RX bytes:1970 (1.9 KiB) TX bytes:13221 (12.9 KiB)
Interrupt:1 Base address:0xa000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
IB-NAS4220-B> ls
system volume2 tmp mnt home usr bin
tmpmnt volume1 root lib dev sbin lost+fod
sys var proc initrd etc linuxrc
IB-NAS4220-B> Power event by Button...
The system is going down NOW !!
Sending SIGTERM to all processes.
Sending SIGKILL to all processes.
The system is halted. Press Reset or turn off power
md: stopping all md devices.
md: md0 switched to read-only mode.
System halted.
arch_power_off
