I am trying to restore telco provided firmware on a ZyXEL P-2812. I have two: one this runs the correct telco firmware, and another that I used to play with OpenWRT. For various reasons I'd like to restore the telco firmware on that one.
The telco firmware is not available on the Internet so a regular "return to stock" procedure is not applicable. Therefore I am trying to get a full NAND backup from the source, and write to the target, to work, so far unsuccessfully.
Here is some general info. I am using an ASCII UART build of u-boot mentioned on the wiki page https://openwrt.org/toh/zyxel/p2812hnu-f1. I boot the board in UART mode.
P-2812HNU-Fx # nand info Device 0: nand0, sector size 128 KiB Page size 2048 b OOB size 64 b Erase size 131072 b P-2812HNU-Fx # version U-Boot 2013.10-openwrt4 (Apr 10 2020 - 15:45:45) P-2812HNU-Fx mips-openwrt-linux-musl-gcc (OpenWrt GCC 7.5.0 r10947-65030d81f3) 7.5.0 GNU ld (GNU Binutils) 2.31.1 P-2812HNU-Fx #
First step is where I am not sure if I am actually getting the full NAND of the source device. What about OOB data?
I follow the recommended backup procedure, however the final read gives an error:
nand read 81000000 0 2000000 && tftpput 81000000 2000000 p2812backup-2000000.bin (works...) nand read 81000000 2000000 2000000 && tftpput 81000000 2000000 p2812backup-2000000-4000000.bin (works...) nand read 81000000 4000000 2000000 && tftpput 81000000 2000000 p2812backup-4000000-6000000.bin (works...) nand read 81000000 6000000 2000000 && tftpput 81000000 2000000 p2812backup-6000000-8000000.bin NAND read: device 0 offset 0x6000000, size 0x2000000 Attempt to read outside the flash area 0 bytes read: ERROR
Through trial and error I have gotten the following maximum size to read:
nand read 81000000 6000000 1fdffff && tftpput 81000000 1fdffff p2812backup-6000000-8000000.bin
Obviously this does not give me 100% confidence.
Next step is to restore the parts on the target device, this is what I did:
nand erase.chip (works...) tftpboot p2812backup-2000000.bin (etc... works) nand write $fileaddr 0 $filesize (works...)
However the result is a boot loop on the target device, with a weird reference to OpenWRT right before the kernel panic?!
KOAM is loaded successfully. 802.1Q VLAN Support v1.8 Ben Greear <firstname.lastname@example.org> All bugs added by David S. Miller <email@example.com> yaffs: dev is 32505856 name is "mtdblock0" yaffs: passed flags "" yaffs: Attempting MTD mount on 31.0, "mtdblock0" yaffs_read_super: isCheckpointed 0 VFS: Mounted root (yaffs2 filesystem) readonly on device 31:0. Freeing unused kernel memory: 204k freed Please be patient, while OpenWrt loads ... Kernel panic - not syncing: No init found. Try passing init= option to kernel. Rebooting in 1 seconds..
Here is the relevant boot log from the (working) source device:
KOAM is loaded successfully. 802.1Q VLAN Support v1.8 Ben Greear <firstname.lastname@example.org> All bugs added by David S. Miller <email@example.com> yaffs: dev is 32505856 name is "mtdblock0" yaffs: passed flags "" yaffs: Attempting MTD mount on 31.0, "mtdblock0" block 11 is bad yaffs_read_super: isCheckpointed 0 VFS: Mounted root (yaffs2 filesystem) readonly on device 31:0. Freeing unused kernel memory init started: BusyBox v1.10.4 (2015-10-05 14:53:24 CST)
So, please have a think with me, and I am looking forward to your suggestions! Thanks.