Thursday, November 23rd 2017, 4:52am UTC+1

You are not logged in.

  • Login
  • Register

Dear visitor, welcome to NAS Forum. If this is your first visit here, please read the Help. It explains how this page works. You must be registered before you can use all the page's features. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.

1

Wednesday, December 14th 2011, 10:22am

Another Brick Topic - unbricking SL3516 based Planet-7201

Well hello everyone. I bricked my NAS. My NAS is Planet-7201 2bay sata, based upon Cortina CS/SL3516 (c3),16mb Flash and 128mb Ram, 1Gb marvell based ethernet phy). http://www.youtube.com/watch?v=3AqanxvE-Ng (this is how the device looks).

Original firmware sucked very badly so I started my research for alternative firmware for 3516, BTW(if anyone would want to test my org firmware I have a backup of it even with RedBoot bootloader 16M+128MB on http://www.bitmex.pl/nas7201). First i Upgraded my device to (Mr. EmAns (that was his name, I guess) firmware (it was modified Raidsonic 4220 firmware with rsync, ssh support and much more). Lately I wanted to switch to try some firmware still in development based on OpenWRT. http://opengemini.free.fr/wiki/doku.php?id=start. From device Ui site I tried to uplaod the firmware for Planex device by loading sysupgrade image. Device flashed but wasn't working so I entered a bootloader console that still was available/working. I tried loading a firmware by pressing (bad decission) the magic X - upgrade firmware button. Than I loaded an image (binary for redboot update). Now I can't access the RedBoot anymore. I guess it's dead cannot access from TTL serial console anymore. Propably will need to do JTAG and load RedBoot :(


asking kindly for support :worthy:

I have an images of the PCB of the device these pictures are kind a in high resolution more than 200kb attachments upload limit so they are available at the external link http://www.bitmex.pl/nas7201

HWguru

NAS2000-Team

Posts: 1,001

Location: Wien

2

Wednesday, December 14th 2011, 11:10am

Hi and welcome!

Yes, it seems that you have overwritten the bootloader with some wrong data.

The only way to recover is either soldering a programmed FLASH to the board or having JTAG access.

From the pictures I don't see any connector that could be the JTAG interface.
Sometimes manufacturer put some copper pads on the board for accessing the signals through testing probes.

There should be some 4k7 pull up resistors connected to some of the JTAG signals.
TDI, TCK, TMS, DBGACK normally have a 4k7 pullup to VCC (3.3V)
DBGRQ normally has a 4k7 pulldown to GND
I assume them to be near the corner (top and/or bottom) of the CPU where you see R133

HWguru

P.S. edited the title - helps a lot when searching the forum
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

3

Wednesday, December 14th 2011, 12:05pm

Thank you for the answer. Have to checki it than with a voltometer. Maybe I will be able to come up with something. I have an unbuffered jtag adapter will this be suitable to program that flash? How to enter a debug mode to enable flash write capabilities? Also what kind a software do I need to program the flash and also what area of the flash need to be programmed ?

I'am kind a new into hardcore hacking into hardware :) maybe I will try to make more detailed photos for better identification of possible areas (near cpu) where I could try soldering ?

kind regards,

This post has been edited 1 times, last edit by "Baron3K" (Dec 14th 2011, 12:11pm)


HWguru

NAS2000-Team

Posts: 1,001

Location: Wien

4

Wednesday, December 14th 2011, 12:20pm

Hi,
good point for start is the MRT unbricking guide and our guide at the NAS2000 wiki (HowTos)

We only program the bootloader as programming the whole FLASH with our tool would take about a day :rolleyes:
Then you can flash the other parts using the bootloader which controlled by commands sent through the serial console.

HWguru
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

AQUAR

Trainee

Posts: 100

Location: Australia

5

Wednesday, December 14th 2011, 12:58pm

Might be a good idea to ask the person behind the OpenGemini project if his OpenWRT firmware port is a suitable match for this hardware.
The Planex only has an 8 MB flash and has a realtek chip set for ethernet.
Also the sysupgrade image is for upgrading his OpenWRT firmware via its GUI ("LUCI"). Incorectly applying this is an upgrade to a brick :pinch: .
I guess if you set up the planex flash structure and use his redboot loader, kernel and "ramdisk" images then most of it might/should work.

Aquar

This post has been edited 1 times, last edit by "AQUAR" (Dec 14th 2011, 1:03pm)


6

Wednesday, December 14th 2011, 2:09pm

Well I fully understand, though that X- upgrade firmware will not overwrite the RedBoot also. :(

Redboot has only 128k (it should take rather fast to program that) , I don't understand why I have to program the whole flash ? 128k with unbuffered jtag should take way faster than a day ?

Well I will play a little bit today to see where is a possibility to connect jtag. Propably will have to install windows also doh, OR is there any jtag utility that will work for linux ?

HWguru

NAS2000-Team

Posts: 1,001

Location: Wien

7

Wednesday, December 14th 2011, 3:00pm

If you look at the nas4220 unbricking guide you will see that X would update the bootloader.

... we only program the bootloader (128k) which will take some minutes.
Programming the whole FLASH would be slow.

I am sure you will find a linux tool for detecting a JTAG device but for nas_flashtool you will need Win anyway.

HWguru
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!