Zyxel NWA50AX Pro bricked

Installing and Using OpenWrt
1

Hello everyone,

I have the original NWA50AX and everything worked like a charm but not able to connect to the pro version after flashing. I've used this guide which insists that I update the stock firmware at least once before flashing openwrt which I did.
I've also tried to set up a static IP below and directly connect, but nothing is happening. I'm open to trying the console route if someone can point me to a good guide?

IP used:

  • IP address = 192.168.1.100
  • netmask = 255.255.255.0
  • gateway = 192.168.1.1
  • DNS = 192.168.1.1

Thanks in advance!

2

Hey @williamthrilliam

I just flashed over PoE, after flashing eth port PoE led were blinking with red and no ability to reach device, I were thinking that I brick the device, so I disconnect the device (after ~30min of waiting) and tried UART but were somehow unable to get console operable (no console output), after few tries with reset button and different baud etc, I disconnect UART, connect power cable, connect eth cable to PC and got IP assigned by DHCP from device in same CIDR that you specify, I were thinking that I reset the device, but after opening 192.168.1.1 in browser I'm surprisingly saw OpenWRT, so you may try the same.

So check your leds, on eth port for some clues

Hope this helps.

Regards

1 Like
3

Thanks, @v01t . I tried that, and the default 192.168.1.2 address that the device comes with, but I failed to connect.

I did manage to get the serial console up and running using a combo of this guide, this guide, and the nwa50ax pro guide on git.

Where it's failing is using TFTP to get the nwa50axpro-openwrt-initramfs.bin image to the device. I'm connecting over serial on ubuntu using this connector and I can get screen to connect to it. I'm also able to get the tftp sever up and running and I have tested it using another ubuntu server on my network.

Setting up the tftp server:

sudo ip addr add 192.168.1.66/24 dev eth0

sudo dnsmasq -d --port=0 --enable-tftp --tftp-root=/tftpboot

connecting to the NWA50AX Pro over serial:

screen /dev/ttyUSB0 115200

Trying to get the image:

MT7981> atnf nwa50axpro-openwrt-initramfs.bin
MT7981> atna 192.168.1.88
MT7981> atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff; bootm"
Using ethernet1@15100000 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.88
Filename 'nwa50axpro-openwrt-initramfs.bin'.
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again

Loading kernel from FIT Image at 46000000 ...

Bad FIT kernel image format! (err=-22)
ERROR: can't get kernel image!

I've made sure UFW is turned off on my server. @dannil would you have any input here? I feel like I'm so close!

Thank you!

4

Might as well post the entire boot output I get through the serial connection:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024B [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):645p0c0-49-g10d224bb-dirty
NOTICE:  BL2: Built : 17:12:31, Oct 20 2022
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
NOTICE:  TREFI = 3.9
BYTE_swap:0
BYTE_swap:0
Window Sum 580, worse bit 0, min window 72
Window Sum 580, worse bit 10, min window 68
[TxChooseVref] Worse bit 0, Min win 25, Win sum 411, Final Vref 40
Window Sum 92, worse bit 5, min window 6
Window Sum 170, worse bit 11, min window 12
Window Sum 162, worse bit 5, min window 10
Window Sum 238, worse bit 10, min window 24
Window Sum 224, worse bit 3, min window 20
Window Sum 274, worse bit 10, min window 30
Window Sum 258, worse bit 3, min window 26
Window Sum 294, worse bit 10, min window 32
Window Sum 292, worse bit 3, min window 30
Window Sum 318, worse bit 10, min window 34
Window Sum 320, worse bit 3, min window 34
Window Sum 340, worse bit 8, min window 40
Window Sum 340, worse bit 2, min window 40
Window Sum 360, worse bit 8, min window 42
Window Sum 358, worse bit 2, min window 42
Window Sum 372, worse bit 10, min window 42
Window Sum 376, worse bit 3, min window 44
Window Sum 386, worse bit 10, min window 44
Window Sum 382, worse bit 2, min window 46
Window Sum 400, worse bit 10, min window 46
Window Sum 398, worse bit 3, min window 46
Window Sum 420, worse bit 10, min window 50
Window Sum 410, worse bit 3, min window 48
Window Sum 428, worse bit 10, min window 50
Window Sum 426, worse bit 2, min window 52
Window Sum 442, worse bit 10, min window 52
Window Sum 430, worse bit 2, min window 52
Window Sum 450, worse bit 10, min window 52
Window Sum 444, worse bit 1, min window 54
Window Sum 462, worse bit 10, min window 54
Window Sum 448, worse bit 1, min window 54
Window Sum 464, worse bit 10, min window 56
Window Sum 458, worse bit 1, min window 56
NOTICE:  EMI: Detected DRAM size: 512MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 2047 [0x0ffe0000]
NOTICE:  First info table with writecount 0 found in block 1920
NOTICE:  Second info table with writecount 0 found in block 1923
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.7(release):650p0c0-fake-c0-4-g91e93c1f-dirty
NOTICE:  BL31: Built : 11:05:22, Jan  5 2023
NOTICE:  Hello BL31!!!


U-Boot 2022.07-rc3 (Jan 05 2023 - 11:04:38 +0800)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  512 MiB
Core:  38 devices, 16 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
Could not find a valid device for nmbm0
Signature found at block 2047 [0x0ffe0000]
First info table with writecount 0 found in block 1920
Second info table with writecount 0 found in block 1923
NMBM has been successfully attached

Loading Environment from MTD... *** Warning - bad CRC, using default environment

In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet1@15100000 (eth0) using random MAC address - f6:15:4f:63:db:3b
eth0: ethernet1@15100000
Warning: ethernet@15100000 (eth1) using random MAC address - 06:64:d0:89:80:7c
, eth1: ethernet@15100000
Zyxel version: V1.08
Reading from 0xef00000, size 0x20000
Succeeded
Reading from 0xef80000 to 0x5fb44f10, size 0x20000 ... OK
Autoboot in 2 seconds, press "<Esc><Esc>" to stop
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi_1", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2047604319
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 38
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.137
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3770078 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   9a2b13d4
     Hash algo:    sha1
     Hash value:   1d2dbbff63a73e6aba5f642570a0165e8e51757c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt zyxel_nwa50ax-pro device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46398910
     Data Size:    21959 Bytes = 21.4 KiB
     Architecture: AArch64
     Load Address: 0x44000000
     Hash algo:    crc32
     Hash value:   22557617
     Hash algo:    sha1
     Hash value:   7bb2aac02e07b18d3f931e6be7858c60f3c31cf0
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Loading fdt from 0x46398910 to 0x44000000
   Booting using the fdt blob at 0x44000000
   Uncompressing Kernel Image
   Loading Device Tree to 000000005f7f2000, end 000000005f7fa5c6 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.137 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23630-842932a63d) 12.3.0, GNU ld (GNU
 Binutils) 2.40.0) #0 SMP Tue Nov 14 13:38:11 2023
[    0.000000] Machine model: ZyXEL NWA50AX Pro
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
/lib/functions/leds.sh: line 8: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 19: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 8: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 19: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 8: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 19: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 8: warning: command substitution: ignored null byte in input
/lib/functions/leds.sh: line 19: warning: command substitution: ignored null byte in input
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
can not get genl family id!
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
touch: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
ls: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
/sbin/procd_start_instance.sh: line 38: [: : integer expression expected
/sbin/procd_start_instance.sh: line 16: /etc/zyxel/ftp/tmp/app_wd_recover.log: No such file or directory
can not get genl family id!
sh: line 1: /etc/zyxel/ftp/diaglog/war_status: No such file or directory
[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'filter' table.
The kernel doesn't support the ebtables 'filter' table.
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'nat' table.
The kernel doesn't support the ebtables 'filter' table.
The kernel doesn't support the ebtables 'filter' table.
Start EnterpriseWLAN system daemon....
.............can not get genl family id!
........[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
% The slot number is not supported.
% The slot number is not supported.
wlan-1-1  no private ioctls.

Applying system configuration file, please wait...
startup-config.conf not exist
no startup-config.conf file, Applying lastgood.conf
no lastgood.conf existed. Applying system-default.conf
Use system default configuration file (system-default.conf)
% Can not find regDomain
% Can not find regDomain
% Can not find regDomain
% Can not find regDomain
% Can not find regDomain
zysh daemon is terminated at Thu Oct  5 05:52:25 2023
  by signal: Segmentation fault
  command function history:
        0x47150c        argc:4  args:default2 rssi-dbm -82
        0x47150c        argc:4  args:default2 rssi-kickout -88
        0x47150c        argc:4  args:default2 rssi-interval 2
        0x47150c        argc:4  args:default2 rssi-optype 3
        0x47150c        argc:4  args:default2 rssi-retrycount 1
        0x47150c        argc:4  args:default2 rssi-verifytime 10
        0x47150c        argc:4  args:default2 rssi-privilegetime 1800
        0x47150c        argc:4  args:default2 rssi-idlechecklvl standard
        0x47150c        argc:4  args:default2 subframe-ampdu 64
        0x47150c        argc:3  args:default2 amsdu
        0x47150c        argc:4  args:default2 limit-amsdu 4096
        0x47150c        argc:3  args:default2 block-ack
        0x47150c        argc:4  args:default2 guard-interval short
        0x47150c        argc:4  args:default2 tx-mask 7
        0x47150c        argc:4  args:default2 rx-mask 7
        0x47150c        argc:4  args:default2 dcs activate
        0x47150c        argc:5  args:default2 dcs time-interval 720
        0x47150c        argc:5  args:default2 dcs sensitivity-level high
        0x47150c        argc:5  args:default2 dcs client-aware disable
        0x47150c        argc:5  args:default2 dcs dcs-2g-method auto
        0x47150c        argc:5  args:default2 dcs channel-deployment 3-channel
        0x47150c        argc:5  args:default2 dcs dcs-5g-method auto
        0x47150c        argc:5  args:default2 dcs dfs-aware disable
        0x47150c        argc:5  args:default2 dcs dfs-aware-neighbor-rssi -76
        0x47150c        argc:5  args:default2 dcs dfs-aware-neighbor-ch-util 80
        0x47150c        argc:5  args:default2 dcs mode schedule
        0x47150c        argc:12 args:default2 dcs schedule 03:00 mon tue wed thu fri sat sun
        0x47150c        argc:3  args:default2 multicast-to-unicast
        0x46f8f0        argc:3  args:default2 exit
        0x455bec        argc:5  args:ap bridge forward-delay 0
        0x455dcc        argc:5  args:ap bridge stp off
        0x459aa4        argc:6  args:ap vlan vlan-id 1 untag
can not get genl family id!
[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
can not get genl family id!
[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
can not get genl family id!
[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
[wifimgr_genl_connect:81]ERROR: not find family:zyUMAC id:-12
[WiFiNetlinkConnect:594]ERROR: fail: -12, zyUMAC
5

Sorry, no, I don't have any experience myself with the device, I only knew where to find the installation instructions in the Git history.

1 Like
6

Thanks for posting the full log. This should help anyone else to avoid the problem you have. The issue here is that you've flashed OpenWrt to the wrong partition. The bootloader attempts to boot the kernel image in "ubi_1". But the OpenWrt kernel assumes it is booted from "ubi" and mounts the ZyXEL rootfs there. That doesn't go well...

But it doesn't look like a complete disaster either. I guess the ZyXEL rootfs fails to configure networking with the OpenWrt kernel, since you don't get any action on the default ZyXEL address either. But there might be a shell there. Do you get a login prompt if you press enter? And if so, do you have (ZyXEL) credentials to log in? If so, then you might be able to resolve this by rearranging the ubi images between the two ubi partitions (move the ZyXEL kernel from ubi to ubi_1 and the OpenWrt rootfs from ubi_1 to ubi).

As for avoiding this problem: I believe the guide you followed is a bit terse. If you're flashing an OpenWrt sysupgrade image, then it's crucial that it ends up in "Slot A". You'll get only one attempt. The alternative is a brick like you have.

So I wonder if the guide maybe implied flashing the initramfs image for the initial installation? Assuming that will boot from flash, which I do NOT know! I don't own this device myself. If it doesn't work then it's an instant brick.

Maybe the OEM web interface can tell you which slot you are booting and/or installing to? That would be best. Then you could verify that OpenWrt is installed to Slot A before rebooting, and avoid the problem.

Wrt the tftp issue: Yes, looks close. Try snooping for the arps at the other end. Do you see any? Is there anything obviously wrong with them? Like wrong IP address or invalid source mac address.

Not sure if it is relevant since it's a completely different platform, but I have seen another ZyXEL device failing tftp boot because the mac address wasn't yet configured. This resulted in invalid ARP requests and ARP timeout. A workaround was to run

setenv eth0addr pr:op:er:ma:ca:dr

twice(! - don't know why) before starting the tftp boot. This was required even if the ethaddr variable was present with the correct address.

If you still can't make tftp boot work then I wonder what other commands you have access to in that boot loader shell. Is there an ATHE (help) command? What about ATGU (go back to U-Boot command line)? That would be useful....

Lacking those, maybe you can run other U-Boot command using that ATNS workaround. Like printenv to see what the default environment is. Maybe there's something explaining the tftp boot failure there?

1 Like
7

Wanted to comment this. Assuming the device is fresh from the factory, then you have to upgrade it an odd number of times before installing OpenWrt. Exactly once is fine. At least once is wrong.

But in general we can't assume clean devices straight from the factory. A device which has been connected to the Internet could have been upgraded an unknown number of times. Then you don't know if the number should be odd (1) or even (0). This kind of guide is therefore harmful.

There are only two possibilities for developing proper OpenWrt support for a "dual image" device:

  1. Either we document a method for verifying the correct destination regardless of device history, or
  2. we create an OpenWrt image which can be booted from any firmware slot
1 Like
8

@bmork incredibly helpful. I didn't know the help command for uboot, so had no idea there were other commands I could be using. Before I dive into that, letting AP boot and pressing enter didn't give me a login prompt, so dead end there. Also, the TFTP server I'm running is just an open ended command and I can see when my other server comes and gets the image file, but not when the AP tries to get the file. I also tried inserting setenv with the mac address as you suggested but it didn't work.

MT7981> atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff; setenv eth0addr d1:36:cd:58:7d:c8; bootm"
Using ethernet1@15100000 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.2
Filename 'nwa50axpro-openwrt-initramfs.bin'.
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again

Error: ethernet1@15100000 address d1:36:cd:58:7d:c8 illegal value
## Loading kernel from FIT Image at 46000000 ...
Bad FIT kernel image format! (err=-22)
ERROR: can't get kernel image!

So here are the rest of the commands. A few other zyxel guides reference deleting the kernel in the first slot so the tftp can fill that slot or I can set the second slot as active; so maybe I can use mtd to do that?

MT7981> athe
?         - alias for 'help'
at        - print OK
atds      - show dual image info
atgo      - boot
athe      - show available commands
atna      - set board IP for tftp
atnf      - set filename for tftp
atns      - set server IP for tftp
atnz      - do firmware update via tftp
atsh      - dump Manufacturer Related Data (MRD)
atsr      - reboot
bootflow  - Boot flows
mtd       - MTD utils
nand      - NAND utility
MT7981> at
MT7981> atds
Image0 status           :success
Image1 status           :success
Boot Image              :Image1
MT7981> atsh
Reading from 0xef80000 to 0x5fb45d60, size 0x20000 ... OK
Vendor name           : Zyxel Communications Corp.
Product model         : NWA50AX PRO
System type           : 10
MAC address           : f44d5c5d4929
Default country code  : ff
Boot module debug flag: 0
Hardware version      : Zyxel NWA50AX PRO MT7981
Serial number         : S230Y14017080
SNMP MIB level & OID  : 060102030405060708091011121314151617181920
Main feature bit      : 0
Other feature bits    : e1 80 00 00 00 00 00 00 00 00 88 00 00 00 00 00
                        03 00 00 00 00 00 00 00 00 00 00 00 00 00
MRD recovery flag     : 0
MT7981> mtd
mtd - MTD utils

Usage:
mtd - generic operations on memory technology devices

mtd list
mtd read[.raw][.oob]                  <name> <addr> [<off> [<size>]]
mtd dump[.raw][.oob]                  <name>        [<off> [<size>]]
mtd write[.raw][.oob][.dontskipff]    <name> <addr> [<off> [<size>]]
mtd erase[.dontskipbad]               <name>        [<off> [<size>]]

Specific functions:
mtd bad                               <name>
mtd markbad                           <name> <off>

With:   
        <name>: NAND partition/chip name (or corresponding DM device name or OF path)
        <addr>: user address from/to which data will be retrieved/stored
        <off>: offset in <name> in bytes (default: start of the part)
                * must be block-aligned for erase
                * must be page-aligned otherwise
        <size>: length of the operation in bytes (default: the entire device)
                * must be a multiple of a block for erase
                * must be a multiple of a page otherwise (special case: default is a page with dump)

The .dontskipff option forces writing empty pages, don't use it if unsure.

MT7981> nand
nand - NAND utility

Usage:
nand - NAND flash R/W and debugging utility
nand list
nand info - Show active NAND devices
nand select <name> - Select active NAND devices
nand dump[.raw] <off>
nand bad
nand markbad <off>
nand bitflip <off> <col> <bit>
nand erase[.spread|.force] [<off> <size>|<part> [<size>]]
nand read[.spread|.force][.raw] <addr> <off> <size>
                                <addr> <part> [<off> [<size>]]
nand write[.spread|.force][.raw][.ff] <addr> <off> <size>
                                      <addr> <part> [<off> [<size>]]
nand read.oob[.spread|.force][.raw|.auto] <addr> <off> <count>
                                          <addr> <part> [<off>] <count>
nand write.oob[.spread|.force][.raw|.auto][.ff] <addr> <off> <count>
                                                <addr> <part> [<off>] <count>


MT7981> mtd list
List of MTD devices:
* spi-nand0
  - device: spi_nand@0
  - parent: spi@1100a000
  - driver: spi_nand
  - path: /spi@1100a000/spi_nand@0
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 128 bytes
  - OOB available: 56 bytes
  - 0x000000000000-0x000010000000 : "spi-nand0"
* nmbm0
  - type: Unknown
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 128 bytes
  - OOB available: 56 bytes
  - 0x000000000000-0x00000f000000 : "nmbm0"
          - 0x000000000000-0x000000100000 : "bl2"
          - 0x000000100000-0x000000180000 : "u-boot-env"
          - 0x000000180000-0x000000380000 : "factory"
          - 0x000000380000-0x000000580000 : "fip"
          - 0x000000580000-0x000003780000 : "ubi"
          - 0x000003780000-0x000006980000 : "ubi_1"
          - 0x000006980000-0x00000a580000 : "rootfs_data"
          - 0x00000a580000-0x00000e000000 : "logs"
          - 0x00000e000000-0x00000ef00000 : "myzyxel"
          - 0x00000ef00000-0x00000ef80000 : "bootconfig"
          - 0x00000ef80000-0x00000f000000 : "mrd"
9

Don't think that is a good idea. And you can't do it using the mtd app anyway. You need the ubi app, which doesn't seem to be available here.

You might be able to switch to "Slot A" by modifying the "bootconfig" mtd partition. This should boot, assuming that you still have a valid OEM kernel and rootfs there.

But looking at the docs in

it seems that some bits are expected to be set, which is hard to do with the available commands. Maybe the bootloader will fix everything up and default to Slot A if you erase the first 4 bytes of "bootconfig", but I don't know. It's a bit risky.

10

@bmork I have a paperweight as it is right now anyways.

One thought, couldn't I use mtd to read from ubi_1 and write to ubi?

11

The idea seems very risky. UBI partitions are not supposed to be copied like that. It will probably just fry what's currently there.

I'd spend some time trying to figure out what's wrong with the tftp method. That's the safest solution and it is supposed to work according to the docs.

You're tftp server might be working fine. I don't question that. It doesn't matter really. The errors you get tell us that the device isn't even trying tftp because arp fails

The order is wrong. Won't help configuring the mac address after you've already started and failed the tftpboot.

But it looks like the address is also rejected for some reason. No idea why. Maybe start snooping the arp requests to see if this is actually the problem here. If the requests are fine then there is no point in changing the mac address and we have to look somewhere else.

And if you don't see any arp requests at all, then you should look closer at the network between device and server.

12

Ugh.. I thought the tftp was going to transfer over the serial cable!! I connected Ethernet to the ap and bam, worked.

Now I have a new problem.. when I login the first time with Luci at 192.168.1.1 and I switch the lan interface to DHCP and turn off the dhcp server, the AP appropriately grabs an IP address, I can ping the device, and ssh into it. But I can't get to luci. What happened? I'll write up full instructions once I get this thing working.

root@OpenWrt:/# netstat -na
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      
tcp        0      0 192.168.87.247:53       0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:1026            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      
tcp        0      0 192.168.87.247:38492    192.168.87.1:1026       ESTABLISHED 
tcp        0      0 192.168.87.247:43930    192.168.87.133:1026     ESTABLISHED 
tcp        0      0 192.168.87.247:59602    192.168.87.249:1026     ESTABLISHED 
tcp        0      0 fe80::f64d:5cff:fe5d:4929:53 :::*                    LISTEN      
tcp        0      0 :::80                   :::*                    LISTEN      
tcp        0      0 ::1:53                  :::*                    LISTEN      
tcp        0      0 :::22                   :::*                    LISTEN      
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           
udp        0      0 0.0.0.0:47853           0.0.0.0:*                           
udp        0      0 192.168.87.247:53       0.0.0.0:*                           
udp        0      0 127.0.0.1:53            0.0.0.0:*                           
udp        0      0 :::5353                 :::*                                
udp        0      0 :::547                  :::*                                
udp        0      0 fe80::f64d:5cff:fe5d:4929:53 :::*                                
udp        0      0 ::1:53                  :::*                                
udp        0      0 :::40594                :::*                                
raw        0      0 ::%166:58               :::*                    58          
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING       3729 /var/run/ubus/ubus.sock
unix  2      [ ]         DGRAM                       986 /var/run/hostapd/global
unix  2      [ ]         DGRAM                       991 /var/run/wpa_supplicant/global
unix  9      [ ]         DGRAM      CONNECTED        313 /dev/log
unix  3      [ ]         STREAM     CONNECTED       4418 
unix  3      [ ]         STREAM     CONNECTED       1014 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       4186 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       5429 
unix  3      [ ]         STREAM     CONNECTED        314 
unix  2      [ ]         DGRAM      CONNECTED       5605 
unix  3      [ ]         STREAM     CONNECTED       5283 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       1019 
unix  2      [ ]         DGRAM      CONNECTED       4104 
unix  3      [ ]         STREAM     CONNECTED       1013 
unix  3      [ ]         STREAM     CONNECTED       5430 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       4628 
unix  3      [ ]         STREAM     CONNECTED        838 /var/run/ubus/ubus.sock
unix  2      [ ]         DGRAM      CONNECTED        963 
unix  3      [ ]         STREAM     CONNECTED       5417 
unix  3      [ ]         STREAM     CONNECTED       4095 
unix  3      [ ]         STREAM     CONNECTED       3731 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       5508 
unix  2      [ ]         DGRAM      CONNECTED        149 
unix  3      [ ]         STREAM     CONNECTED       4223 
unix  3      [ ]         STREAM     CONNECTED       1017 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED        776 
unix  2      [ ]         DGRAM                      3730 
unix  3      [ ]         STREAM     CONNECTED       1016 
unix  3      [ ]         STREAM     CONNECTED       4101 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED        315 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       4185 
unix  3      [ ]         STREAM     CONNECTED       1020 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       5808 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       4096 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       4607 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED        906 /var/run/ubus/ubus.sock
unix  2      [ ]         DGRAM      CONNECTED        973 
unix  2      [ ]         DGRAM                      5144 
unix  2      [ ]         DGRAM      CONNECTED       4123 
unix  3      [ ]         STREAM     CONNECTED        138 
unix  3      [ ]         STREAM     CONNECTED       5418 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       5807 
unix  2      [ ]         DGRAM      CONNECTED       4221 
unix  3      [ ]         STREAM     CONNECTED       4629 /var/run/ubus/ubus.sock
unix  3      [ ]         STREAM     CONNECTED        837
13

Never mind.. chrome was trying to use https for some reason. I'm fully up and running. Guide incoming.

1 Like
14

Ok, here's the quick guide for un-bricking the NWA50AX Pro
You can avoid this by flashing the openwrt firmware the first time you boot up the device, though as another has pointed out, there's no way to guarantee that this is the right slot. You have above a 50% chance of bricking your device and having to connect to the AP via serial cable to recover. Once bricked, I used an ubuntu server to flash the new firmware:

Download a new basic kernel image (initramfs)

Move the file to /tftboot (you may need to modify permissions)

Rename the image to nwa50axpro-openwrt-initramfs.bin

Setting up the tftp server:

sudo ip addr add 192.168.1.66/24 dev eth0

sudo dnsmasq -d --port=0 --enable-tftp --tftp-root=/tftpboot

connecting to the NWA50AX Pro over serial:

Zyxel’s console header pin define: pin1 NA, pin2 White(RX)，pin3 Green(TX), pin4 Black(GND), PS: Don’t connect red color pin to zyxel’s console pin. Pin1 is indicated by the triangle.

Once connected to serial AND connected via Ethernet to a switch on the same lan as your server, open up a terminal and type:

screen /dev/ttyUSB0 115200

Power on the device and interrupt the boot
procedure by pressing Enter.

The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.

Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66.

$ atnf nwa50axpro-openwrt-initramfs.bin
 $ atna 192.168.1.88
 $ atns "192.168.1.66; tftpboot; setenv fdt_high 0xffffffffffffffff;
   bootm"

At this point you should be able to connect to luci by directly connecting to the lan port and accessing the webui at 192.168.1.1. I'd re-flash a new full image for good measure.

1 Like
15

Great work! I've edited my comment in How to install OpenWRT on the ZyXEL NWA50AX Pro - #2 by dannil where I linked the git commit to advise of the 50% chance of bricking the device.

1 Like
16

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.