I am trying to restore telco provided firmware on a ZyXEL P-2812. I have two: one this runs the correct telco firmware, and another that I used to play with OpenWRT. For various reasons I'd like to restore the telco firmware on that one.
The telco firmware is not available on the Internet so a regular "return to stock" procedure is not applicable. Therefore I am trying to get a full NAND backup from the source, and write to the target, to work, so far unsuccessfully.
Here is some general info. I am using an ASCII UART build of u-boot mentioned on the wiki page https://openwrt.org/toh/zyxel/p2812hnu-f1. I boot the board in UART mode.
P-2812HNU-Fx # nand info
Device 0: nand0, sector size 128 KiB
Page size 2048 b
OOB size 64 b
Erase size 131072 b
P-2812HNU-Fx # version
U-Boot 2013.10-openwrt4 (Apr 10 2020 - 15:45:45) P-2812HNU-Fx
mips-openwrt-linux-musl-gcc (OpenWrt GCC 7.5.0 r10947-65030d81f3) 7.5.0
GNU ld (GNU Binutils) 2.31.1
P-2812HNU-Fx #
First step is where I am not sure if I am actually getting the full NAND of the source device. What about OOB data?
I follow the recommended backup procedure, however the final read gives an error:
nand read 81000000 0 2000000 && tftpput 81000000 2000000 p2812backup-2000000.bin (works...)
nand read 81000000 2000000 2000000 && tftpput 81000000 2000000 p2812backup-2000000-4000000.bin (works...)
nand read 81000000 4000000 2000000 && tftpput 81000000 2000000 p2812backup-4000000-6000000.bin (works...)
nand read 81000000 6000000 2000000 && tftpput 81000000 2000000 p2812backup-6000000-8000000.bin
NAND read: device 0 offset 0x6000000, size 0x2000000
Attempt to read outside the flash area
0 bytes read: ERROR
Through trial and error I have gotten the following maximum size to read:
nand read 81000000 6000000 1fdffff && tftpput 81000000 1fdffff p2812backup-6000000-8000000.bin
Obviously this does not give me 100% confidence.
Next step is to restore the parts on the target device, this is what I did:
nand erase.chip (works...)
tftpboot p2812backup-2000000.bin (etc... works)
nand write $fileaddr 0 $filesize (works...)
However the result is a boot loop on the target device, with a weird reference to OpenWRT right before the kernel panic?!
KOAM is loaded successfully.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs2 filesystem) readonly on device 31:0.
Freeing unused kernel memory: 204k freed
Please be patient, while OpenWrt loads ...
Kernel panic - not syncing: No init found. Try passing init= option to kernel.
Rebooting in 1 seconds..
Here is the relevant boot log from the (working) source device:
KOAM is loaded successfully.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
block 11 is bad
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs2 filesystem) readonly on device 31:0.
Freeing unused kernel memory
init started: BusyBox v1.10.4 (2015-10-05 14:53:24 CST)
So, please have a think with me, and I am looking forward to your suggestions! Thanks.