AKITIO MyCloud Mini Brick UART/SPI/JTAG help please

For Developers
1

Hello, I have also bricked my Akitio mycloud mini. I am an amateur at figuring out how to use JTAG/UART/SPI to flash my rom back to the tsop48 chip on the board. I have been using a raspberry pi pico with code installed on it from various Git's to try and figure out how to flash the NAND. so far I have gotten the low hanging fruit and figured out how to hook up the pico to view the serial output in putty... this is what i used for code:Uart Bridge

Attempting to set PLLA to 750MHz ...
  plla_ctrl0 : 0x0000000A
  plla_ctrl1 : 0x000F0000
  plla_ctrl2 : 0x001D01A0
  plla_ctrl3 : 0x00000017
PLLA Set

Setup memory, 
testingMemory test failed, 
reverting to default PLL config
Attempting to set PLLA to 500MHz ...
  plla_ctrl0 : 0x0000012A
  plla_ctrl1 : 0x003C0000
  plla_ctrl2 : 0x007700D0
  plla_ctrl3 : 0x000000BD
PLLA Set

Image 0
Failed to correct error
  Hdr len: 0x00CFACE5
  Hdr CRC: 0xB9CBAD92
 read failed, 

Image 1
Failed to correct error
  Hdr len: 0x00CFACE5
  Hdr CRC: 0xB9CBAD92
read failed,

This code just continues to loop as unable to read... As I suspected, there is no image on the NAND.

I was toying with using Pico Flasher and adapting it for my uses and flashing the NAND through SPI but I don't know what contact points to use (which i can probably figure out through the data sheet for the NAND Hynix Datasheet) but where that plan falls apart is my lack of understanding of NAND chip timings and how the software needs to be augmented to be usable.

Finally, I looked into JTAG. I soldered headers on where "J10" is marked on the board and I am fairly certain it follows this convention Akitio MyCloud Mini JTAG header and that led me to this git: JTAGenum which uses a rapberry pi (experimentally, which i have plenty of) to enumerate the JTAG port and all its functions.

I have a serious lack of programming knowledge. I can solder and fix hardware, but anything software and how it all integrates and talks to each other I have a serious lack of understanding. (not for lack of trying though....)

If anyone would care to help/guide me on this last piece of what software/setup/ commands through, UART/SPI/JTAG, I can use to reflash my NAND. I have original FW provided to me from AKITIO (apparently each FW is custom with each mac address added to the file). So if I can figure out how to flash the file I have, I think I will have a working mycloud again, not to mention the (intended) ability to run OpenWRT on the cloud device, as well as document the procedure and missing info on all Akitio Wiki's which is OpenWrt Akitio Mycloud Mini Wiki and Akitio MyCloud Mini Wiki Dev just for reference....

thanks for any help....

2

Hi,

I had one of those and tried to run openwrt on it but the current release does not work. There are issues with the dts file that need to be fixed / updated to get the current release to work. I did some testing but ended up bricking my device.

There is an oxnas boot from sata drive recovery method to unbrick the device but I've not been successful in recovering mine. The guys at the doozan forum may have more info on this.

1 Like
3

Thanks for info and reply. I can't get a console or anything to boot. I am trying to figure out what the process is to JTAG or UART into the machine to write an image directly to the nand... do you have any ideas?

4

The oxnas processor has a 'rescue' system build into it. When the bootloader is not working it will fall back to booting from sata drive. On the doozan forum there are a few posts on how you can prepare a bootable sata drive. So in theory you don't need jtag but can prepare a sata drive, boot debian linux off it and then write your firmware back to nand.

I never managed to unbrick mine since I didn't create a backup of the firmware before I started messing with it and ended up accidentally wiping the whole nand flash.

5

akitio can provide firmware if you give them the mac address of your machine... if you need the initial bootloader I can see if I can make a copy and send it to you... I'm not sure exactly what I will be doing, but let me know what I need to do and I'm happy to send you anything I can get off the nand...

6

I've not touched it in a while but it is still in a box somewhere. I don't care about the stock firmware but a copy of the original bootloader would be useful.

7

well before i make a mistake or do anything else with the mini, let me know how i might be able to get the image for you. so far i have prepared a sata HD using this:

bodhi Wrote:

maldridge,

What I post below is untested (I don't have access
to my Pogo Pro to test this). But since you have
SATA boot recovery, we could risk messing up NAND
without worrying. You don't have USB at this
serial console shell, so we will use the same SATA
disk to store new u-boot binaries.

This will be an instructional post that I will
later add to the Wiki. So it will be modified
along the way as you will be the tester for it :slight_smile:

How to flash new uboot.2015.10-tld-2 for Pogo
V3 OXNAS in serial console

A. Using an HDD attached to the SATA port

  1. Download the new u-boot tarball
    uboot.2015.10-tld-2.ox820.bodhi.tar from the
    u-boot installation thread:
    https://forum.doozan.com/read.php?3,16017

  2. Put this on a SATA HDD. Assuming your SATA disk
    is mounted as /media/sdb1 on a Linux box. And we
    will put it on the root folder / of this drive.

cd /media/sdb1
> cp -a uboot.2015.10-tld-2.ox820.bodhi.tar .
> tar xf uboot.2015.10-tld-2.ox820.bodhi.tar
  1. Verify these files are all there in the root
    folder:
uboot.2015.10-tld-2.ox820.mtd0.img
> uboot.spl.2013.10.ox820.850mhz.mtd0.img
> uboot.2015.10-tld-2.ox820.environment
> uboot.2015.10-tld-2.ox820.environment.img

And then sync and umount:

sync
> umount /media/sdb1

  1. Bring this HDD to the Pogo V3, attach it to the
    SATA port.

  2. Power up and let it boot to serial console,
    interrupt it at countdown.

  3. Start up the HDD and verify the files can be
    accessed:

ide reset
> ext2ls ide 0:1 /

7. Installation steps

As you execute each step, if there are error in
the output, please stop and post the serial
console log.

a. Erase 6 blocks on mtd0

nand erase 0x0 0xC0000

b. Flash encoded spl stage1 to 0x0 (the SPL is 1
block = 128K = 0x20000)

ext2load ide 0:1 0x800000 
> /uboot.spl.2013.10.ox820.850mhz.mtd0.img
> nand write 0x800000 0x0 0x20000

c. Flash u-boot to 0x40000 (the u-boot image is
512K = 0x80000)

ext2load ide 0:1 0x800000 
> /uboot.2015.10-tld-2.ox820.mtd0.img
> nand write 0x800000 0x40000 0x80000

d. Erase 1 block starting 0x00100000:

nand erase 0x100000 0x20000

e. Flash uboot environment to 0x100000 (the env is
1 block)

ext2load ide 0:1 0x800000 
> /uboot.2015.10-tld-2.ox820.environment.img
> nand write 0x800000 0x100000 0x20000

f. Now you are ready to boot with u-boot in NAND.

  • Wait for a 10 to 30 seconds for the SATA disk to
    settle down (as a precaution).
  • Unplug power to to HDD.
  • Unplug the SATA cable

g. Reset the box at serial console prompt

reset

h. After u-boot starts loading and running,
interrupt serial console at countdown.

Please post the entire serial log from step A.5
until the end of step A.7.h.

B. Using tftp server

If you have a tftp server in your network, you can
also load the u-boot images from there and flash
them.

  1. Download the new u-boot tarball
    uboot.2015.10-tld-2.ox820.bodhi.tar from the
    u-boot installation thread:
    https://forum.doozan.com/read.php?3,16017

  2. Put this on the tftp server root folder.
    Assuming on your tftp server box, the tftp root
    folder is /tftproot.

cd /tftproot
> cp -a uboot.2015.10-tld-2.ox820.bodhi.tar .
> tar xf uboot.2015.10-tld-2.ox820.bodhi.tar
  1. Verify these files are all there in the tftp
    root folder:
uboot.2015.10-tld-2.ox820.mtd0.img
> uboot.spl.2013.10.ox820.850mhz.mtd0.img
> uboot.2015.10-tld-2.ox820.environment
> uboot.2015.10-tld-2.ox820.environment.img
  1. Sync the tftp folder to make sure
sync

  1. Power up the Pogo V3 and let it boot to serial
    console, interrupt it at countdown.

  2. Preparation for tftp and NAND operations

a. Setup the tftp server. Assuming your tftp
server IP is 192.168.0.100. And your Pogo V3 box
is 192.168.0.101 (adjust these to the real IP
numbers in your local network).

setenv serverip 192.168.0.100
> setenv ipaddr    192.168.0.101

b. Define the mtd partitions if they are not
defined yet:

setenv mtdids 'nand0=41000000.nand'
> setenv mtdparts
> 'mtdparts=41000000.nand:14m(boot),-(data)'

7. Installation steps

As you execute each step, if there are error in
the output, please stop and post the serial
console log.

a. Load the SPL image over tftp

tftp 0x800000 
> uboot.spl.2013.10.ox820.850mhz.mtd0.img

Note: The load command above will be successful is
your tftp server is setup correctly.

b. Erase 6 blocks on mtd0

nand erase 0x0 0xC0000

c. Flash encoded spl stage1 to 0x0 (the SPL is 1
block = 128K = 0x20000)

nand write 0x800000 0x0 0x20000

d. Load the u-boot image over tftp

tftp 0x800000  uboot.2015.10-tld-2.ox820.mtd0.img

e. Flash u-boot to 0x40000 (the u-boot image is
512K = 0x80000)

nand write 0x800000 0x40000 0x80000

f. Load the u-boot env image over tftp

tftp 0x800000 
> uboot.2015.10-tld-2.ox820.environment.img

g. Erase 1 block starting 0x00100000:

nand erase 0x100000 0x20000

h. Flash uboot environment to 0x100000 (the env is
1 block)

nand write 0x800000 0x100000 0x20000

i. Now you are ready to boot with u-boot in NAND.
Reset the box at serial console prompt

reset

j. After u-boot starts loading and running,
interrupt serial console at countdown.

Please post the entire serial log from step B.5
until the end of step B7.j.

and have gotten this output:

Stage-1 Bootloader 五 10月 28 10:36:29 CST 2011
Attempting to set PLLA to 750MHz ...
  plla_ctrl0 : 0x0000000A
  plla_ctrl1 : 0x000F0000
  plla_ctrl2 : 0x001D01A0
  plla_ctrl3 : 0x00000017
PLLA Set

Setup memory, testingMemory test failed, reverting to default PLL configAttempting to set PLLA to 500MHz ...
  plla_ctrl0 : 0x0000012A
  plla_ctrl1 : 0x003C0000
  plla_ctrl2 : 0x007700D0
  plla_ctrl3 : 0x000000BD
PLLA Set

, Image 0
  Hdr len: 0x0001AC3C
  Hdr CRC: 0xB931AD17
 OK


U-Boot 1.1.2 (Oct 28 2011 - 10:44:29)

U-Boot code: 60D00000 -> 60D1AC3C  BSS: -> 60D1F2F4
RAM Configuration:
        Bank #0: 60000000 256 MB
SRAM Configuration:
        64KB at 0x50000000
NAND:256 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting Linux mem= boot arg value
Reading upgrade flag from NAND address 0x01ec0000 : 0
Hit any key to stop autoboot:    0
Extinguish LED

Loading from device 0: 256MiB 3,3V 8-bit (offset 0x440000)
   Image Name:   Linux-2.6.31.14-fast-20110801-fa
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3116240 Bytes =  3 MB
   Load Address: 60008000
   Entry Point:  60008000
\45Too many bad pages
** Read error on 0

Loading from device 0: 256MiB 3,3V 8-bit (offset 0xa40000)
   Image Name:   Linux-2.6.31.14-fast-20110801-fa
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3116240 Bytes =  3 MB
   Load Address: 60008000
   Entry Point:  60008000
Too many bad pages
** Read error on 0
Light LED
$

i pressed "0" to stop boot during this startup and got the "$" symbol but i couldn't input anything after that. let me know how i can get you what you need... and if you want to i have an extra laptop or two you can remote into to do the commands yourself if you tell me how to get it setup for you...

let me know whats easiest..

8

It looks like you have managed to load uboot from the sata hdd and are now at the uboot prompt / command line. That is the first step in recovering the device.

If possible I would like a copy of the original uboot from your device to try to restore my box at some point in the future. It is probably easiest if you try to recover your nas. Extracting uboot from the nand flash while still inside the rescue uboot is not easy. This is a lot easier when running the stock system or Debian or OpenWrt.

I would also be interested in a copy of the stock firmware that akitio supplied to you. I think there is a slim chance that they may have included uboot in there. Running the firmware through binwalk may show some light on this.

9

Original Firmware

10

Thanks for the files. I've downloaded and extracted them. There are 2 .rpm files in the archive that I've run through binwalk. The .rpm files contain updates for the software on a running akitio nas but I'm not sure if they are any use in recovering a bricked unit. I can't see uboot, kernel or initramfs files in there which are needed to recover a unit that doesn't boot.

11

i was afraid of that, i am still trying to boot off of sata to get to shell on the mycloud mini, i can get shell, but not every boot. I have had to reformat my SSD a few different ways and reload uboot through "create_disk" script in some of the uboot archives. i can get a boot maybe once every ten tries. Ive only managed to get to shell 2-3 times but each time id try a command and then get a freeze or a "resetting cpu" output with nothing after.. i'm still unsure if there is a hardware issue or if its purely how im setting up the hardware... but still havent been able to boot debian or any other OS. I wish i knew how to image my drive so i have the Uboot bootsect and then the debian partition to get this thing to just boot... its so tedious trying to figure this out...

12

That sounds similar to the experience I had after messing up mine. It seems that the generic oxnas uboot that is used for sata boot works fine to recover the pogoplug but is not great for the akitio device. Another problem is that this box is not very common so it is tricky to get a copy of the original nand from someone.

I think the issues with the openwrt dts file definitions can be sorted out but that does require a working device first.

I've considered buying another one on ebay to help in recovering the bricked one. Unfortunately the only one available in the UK seems too expensive for what is quite an old and under powered nas.

13

I have two of these devices somewhere in my hardware stack. I'll look for them and see if I can dump the flash contents.

1 Like
14

awesome thank you... obviously I'm happy to help either of you in any way I can...

15

do you know if the first stage bootloader is stored on the NAND or if its on a 8-pin bios chip? if it is i can rip it off the chip with a ch139a spi rom reader... it looks like my nand is toast, and i was wondering how it is the 1st stage loader is still working... it looks like there might be a chip on the bottom which can be read... any thoughts?

16

I've no idea to be honest. It's been a year since I last tried to unbrick it and has been in a box ever since. I think you may get more answers by asking questions at the doozan forum since they have quite an active group of people with oxnas and kirkwood devices.

1 Like
17

Been a while since I created the entry on WikiDevi, but it appears that there is no NOR (or BIOS) chip on board. It only has the 256MB NAND.

1 Like
18

have you had any luck with dumping the nand? this is such an obscure little box... i wonder what its really capable of..

19

i have a tsop48 programmer now. i was thinking about delsoldering the flash and programming it externally... if i can get a image i can just write the image to the TSOP

20

how is the dump going? have you had any time to mess with it?