venerdì, 31 ottobre 2025, 07:15 UTC+1

Non risulti loggato.

  • Login
  • Registrazione

Lacie wireless space serial, jtag, openwrt

fratzicu

Principiante

Posts: 23

Località: Romania

1

sabato, 20 marzo 2021, 15:52

Lacie wireless space serial, jtag, openwrt

Hi,
I recently bought a lacie wireless space device just for fun.
https://www.lacie.com/de/de/support/netw…wireless-space/


The device is listed in Lacie wiki but does not have its own entry
http://lacie-nas.org/doku.php

The serial pinout is the same as other lacie devices (pin 1 being the squared one). There is a J2 connector and I think it is quite the same as the other lacie devices (attached) having both serial and jtag.

Pin 2 (gnd) second from squared one
pin 7 (Rx)
pin 8 (Tx)
Speed: 115200
The stock bootlog (attached).

Pressing ctrl+C interrupts boot ptocess and giver Marvell u-boot prompt

printenv output (attached)
You may want to increase boot delay

Marvell>> setenv bootdelay
3

Marvell>> saveenv
The device is listed as having support in mainline u-boot but I can't find a howto to build u-boot for this device
http://lacie-nas.org/doku.php?id=uboot

So I tried to compile it myself:
I installed prerequisites for Ubuntu 20.04:
sudo apt-get install gawk wget git diffstat unzip texinfo gcc-multilib build-essential chrpath socat libsdl1.2-dev xterm picocom ncurses-dev lzop gcc-arm-none-eabi
If i try to compile without external toolchain with the ubuntu package of version 20.04 it does not work out of the box as it complains of not finding refferal of gcc version 9 in the source files
/u-boot-lacie/include/linux/compiler-gcc.h:87:1: fatal error: linux/compiler-gcc9.h: No such file or directory

The Instructions from the lacie-wiki page on u-boot:
I created a compile folder /media/hala/compile/
then cd /media/hala/compile
git clone http://git.lacie-nas.org/u-boot-lacie.git u-boot-lacie (this downloads the sourcecode into a new folder called u-boot-lacie;browsing the sourcecode I found that the source only supports a maximum version of gcc 4 so I downloaded an external toolchain from launchpad

I created a folder toolchains in my /media/hala/compile/ folder
then I cd to that folder
cd /media/hala/compile/toolchains
wget https://launchpad.net/gcc-arm-embedded/4…3-linux.tar.bz2
tar -xjvf gcc-arm-none-eabi-4_9-2014q4-20141203-linux.tar.bz2

now I have the toolchain needed for crosscompile in /media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/

I returned to my compile folder
cd /media/hala/compile/u-boot-lacie
and followed the instructions from http://lacie-nas.org/doku.php?id=uboot
PATH=/media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/:$PATH CROSS_COMPILE=arm-none-eabi- make wireless_space_config
PATH=/media/hala/compile/toolchains/gcc-arm-none-eabi-4_9-2014q4/bin/:$PATH CROSS_COMPILE=arm-none-eabi- make u-boot.kwb

surprisingly... in worked!

Codice sorgente

 
1

arm-none-eabi-objcopy --gap-fill=0xff -O binary u-boot u-boot.bintools/mkimage -n "/media/hala/compile/u-boot-lacie/"board/LaCie/wireless_space"/kwbimage.cfg" -T kwbimage \	-a 0x00600000 -e 0x00600000 -d u-boot.bin u-boot.kwbPreparing kirkwood boot image to boot from nandNand page size = 0x800Image Type:   Kirkwood Boot from NAND Flash ImageData Size:    285452 Bytes = 278.76 kB = 0.27 MBLoad Address: 00600000Entry Point:  00600000

now i have new files

Codice sorgente

 
1

-rw-rw-r--   1 fratzicu fratzicu  285452 mar 20 19:22 u-boot.bin-rw-rw-r--   1 fratzicu fratzicu  285968 mar 20 19:22 u-boot.kwb-rw-rw-r--   1 fratzicu fratzicu    1089 mar 20 19:22 u-boot.lds-rw-rw-r--   1 fratzicu fratzicu  266427 mar 20 19:22 u-boot.map

in my folder

After connecting to serial console, I can login with user admin and password admin. I don't know how to connect as root.

During boot, There is a prompt to press a key to stop regular boot but there is no timeout, only 0.

$ cat /proc/cpuinfo
Processor : ARM926EJ-S rev 1 (v5l)
BogoMIPS : 799.53
Features : swp half thumb fastmult edsp
CPU implementer : 0x56
CPU architecture: 5TE
CPU variant : 0x2
CPU part : 0x131
CPU revision : 1
Cache type : write-back
Cache clean : cp15 c7 ops
Cache lockdown : format C
Cache format : Harvard
I size : 16384
I assoc : 4
I line length : 32
I sets : 128
D size : 16384
D assoc : 4
D line length : 32
D sets : 128

Hardware : wireless_space
Revision : 0002
Serial : 0000000000000000

$ cat /proc/cmdline

initrd=0x1200000 root=/dev/mtdblock3 ro console=ttyS0,115200 cap=gpt,lba64

Can you point me some commands to compile u-boot for this device?
Also, what jtag software could I use for this device?
fratzicu ha allegato i seguenti files:
  • Stock-boot.txt (22,89 kB - Il file è stato scaricato 15 volte - Ultimo download: 10/04/2021, 23:26)
  • SerialPort-NS2.jpg (33,16 kB - Il file è stato scaricato 2 volte - Ultimo download: 01/04/2021, 19:37)
  • lacie-2bignas-8-jtag-pinout.jpg (32,01 kB - Il file è stato scaricato 3 volte - Ultimo download: 01/04/2021, 19:37)
  • u-boot-printenv.txt (2,33 kB - Il file è stato scaricato 7 volte - Ultimo download: 10/04/2021, 23:05)
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

Questo post è stato modificato 7 volta(e), ultima modifica di "fratzicu" (20/03/2021, 23:10)

HWguru

NAS2000-Team

Posts: 1.039

Località: Wien

2

sabato, 20 marzo 2021, 16:41

Hi,
sorry, I am no SW guru. Maybe someone else could give you some advice?

If CPU and FLASH is compatible with our NAS_Flashtool you can run it.
Otherwise you have to find something else.

HWguru
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

fratzicu

Principiante

Posts: 23

Località: Romania

3

sabato, 20 marzo 2021, 17:28

Hi,
CPU is ARM926EJ-S rev 1 (v5l)

Flash is
NAND FLASH SAMSUNG K9F1G08U0B-PCB0 and it seems to have 128 Mb
I found it on http://www.linux-mtd.infradead.org/nand-data/nanddata.html.

Vendor 0xec, chip id 0xf1

Ram is
hynix h5ps1g83efr s6c 031ak and there are 2 chips of 128 Mb it seems.
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

Questo post è stato modificato 2 volta(e), ultima modifica di "fratzicu" (21/03/2021, 15:08)

fratzicu

Principiante

Posts: 23

Località: Romania

4

sabato, 20 marzo 2021, 17:42

Does your flash tool work with TIAO device? This is what i have.

https://www.diygadget.com/tiao-usb-multi…-spi-i2c-serial
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

hendi060

Principiante

Posts: 30

5

sabato, 20 marzo 2021, 21:37

Hi Fratzicu,

as far as I understood you can try it with OpenOCD?!

HWguru

NAS2000-Team

Posts: 1.039

Località: Wien

6

sabato, 20 marzo 2021, 21:38

NAS_Flashtool was developed to work with the Storlink/Cortina SOCs 3316, 3512, 3516 and a FTDI FT232R chip based adapter.

I am afraid that CPU, FLASH and your adapter does not match...
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

fratzicu

Principiante

Posts: 23

Località: Romania

7

sabato, 20 marzo 2021, 21:51

Thank you guys,
I will try with openocd but first I have to learn how to use it. I already found some information
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

fratzicu

Principiante

Posts: 23

Località: Romania

8

domenica, 21 marzo 2021, 15:11

Thebdevixe seems very similar with Sheeva Plug LE only the processor runs at 1200 mhz vs 800 mhz and thebflash is slightly different , still samsung but 0xec 0xdc.
I think openodc should work based on the info on this page
https://sites.google.com/site/odulo12321/sheevaplug
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

fratzicu

Principiante

Posts: 23

Località: Romania

9

domenica, 28 marzo 2021, 16:33

succeeded connecting through jtag with openocd. wht now?

Hi,
Today I think I succeeded to connect to lacie wireless space using jtag port with the standard arm pinout (20 pin).
I used the following config files:
board: /usr/share/openocd/scripts/board/sheevaplug.cfg in which I modified interface :tumpa.cfg

interface: /usr/share/openocd/scripts/interface/tumpa.cfg (source [find interface/ftdi/tumpa.cfg]) in /usr/share/openocd/scripts/board/sheevaplug.cfg
target: /usr/share/openocd/scripts/target/feroceon.cfg (source [find target/feroceon.cfg]) in /usr/share/openocd/scripts/board/sheevaplug.cfg
actually, I copied sheevaplug.cfg to wspace.cfg and modified only the line source [find interface/ftdi/tumpa.cfg]

then gave the command

Codice sorgente

 
1

openocd -f /usr/share/openocd/scripts/board/wspace.cfg
and got the output

Codice sorgente

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
none separate
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
adapter speed: 2000 kHz
dcc downloads are enabled
Warn : use 'feroceon.cpu' as target identifier, not '0'
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9 (Marvell Semiconductors), part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit

What to do now?
Is there something to change in those config files... what commands to use to backup flash?
The boards are very similar with the difference that sheevaplug has 1.200 MHz CPU and Wireless Space has 800 MHz Also flash is a litthe different
fratzicu ha allegato i seguenti files:
  • wspace.cfg.txt (4,76 kB - Il file è stato scaricato 6 volte - Ultimo download: 12/05/2023, 20:01)
  • tumpa.cfg.txt (383 Byte - Il file è stato scaricato 2 volte - Ultimo download: 12/05/2023, 20:02)
  • feroceon.cfg.txt (676 Byte - Il file è stato scaricato 4 volte - Ultimo download: 12/05/2023, 20:02)
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

fratzicu

Principiante

Posts: 23

Località: Romania

10

giovedì, 01 aprile 2021, 19:35

Hi, I made a little progress...
after giving command

Codice sorgente

 
1

sudo openocd -f /usr/share/openocd/scripts/board/wspace.cfg

and in another terminal

Codice sorgente

 
1

telnet 127.0.0.1 4444

i connected to the device.
this is shown in the openocd terminal

Codice sorgente

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
none separate
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
adapter speed: 2000 kHz
dcc downloads are enabled
Warn : use 'feroceon.cpu' as target identifier, not '0'
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9 (Marvell Semiconductors), part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : accepting 'telnet' connection on tcp/4444
invalid command name "scan_chain"
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: NAND flash access requires halted target
Error: unknown NAND flash device found, manufacturer id: 0x02 device id: 0x02

invalid command name "monitor"
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
    blocksize: 131072, blocks: 1024

and this is shown in the telnet terminal

Codice sorgente

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> scan_chain\
invalid command name "scan_chain"
> scan_chain 
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
> nand probe 0
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
NAND flash access requires halted target
unknown NAND flash device found, manufacturer id: 0x02 device id: 0x02

> monitor flash probe 0
invalid command name "monitor"
> sheevaplug_init
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> scan_chain
   TapName         	Enabled  IdCode 	Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 feroceon.cpu       	Y 	0x20a023d3 0x20a023d3 	4 0x01  0x0f
> nand probe 0
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
> nand list
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
    blocksize: 131072, blocks: 1024
> nand dump 0 "first4.bin" 0 65536
dumped 65536 bytes in 32.075588s (1.995 KiB/s)
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

Questo post è stato modificato 2 volta(e), ultima modifica di "fratzicu" (03/04/2021, 23:07)

fratzicu

Principiante

Posts: 23

Località: Romania

11

lunedì, 05 aprile 2021, 18:00

Hi,

So it seems that I mastered the reading / erasing / writing to nand flash of wireless space with openocd.

Some bumps along the way:
> nand write 0 flash.bin 0
DCC write failed, expected end address 0x00100814 got 0x5a
For this to work I needed to change the openocd board script wspace.cfg to -work-area-phys 0x10000000 to 0x10000 (I saw it on a blog, don't know the signifficance but it works)
Examples:

Codice sorgente

 
1

telnet localhost 4444


Codice sorgente

 
1
2
3
4
5
6
7
8
9
10
11
12
13

>sheevaplug_init
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> nand probe 0   
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
> nand list 0    
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
    blocksize: 131072, blocks: 1024
>nand dump 0 "u-boot.printenv.bin" 0 786432   
dumped 786432 bytes in 386.816040s (1.985 KiB/s)
> nand erase 0 0 786432    
erased blocks 0 to 5 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'


After restart device is dead / bricked.

Codice sorgente

 
1
2

> nand write 0 u-boot.printenv.bin 0
wrote file u-boot.printenv.bin to NAND flash 0 up to offset 0x000c0000 in 23.302645s (32.958 KiB/s)


now again back to life but after decompressing.... booting the kernel it does not boot. So I restore now the whole flash

Codice sorgente

 
1
2
3
4

nand erase 0                 	 
erased blocks 0 to 1023 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'
> nand write 0 flash.bin 0
wrote file flash.bin to NAND flash 0 up to offset 0x08000000 in 3976.972900s (32.958 KiB/s)


before that i made a bakup of the whole flash

Codice sorgente

 
1
2

nand dump 0 "flash.bin" 0 134217728
dumped 134217728 bytes in 63788.855469s (2.055 KiB/s)


I tested it by erasing, seeing that it is bricked then erasing/writing and seeing it back to life.. Now it is time to continue my journey to understand the flash device partitioning and porting openwrt to it.
I'll keep you posted
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

Questo post è stato modificato 2 volta(e), ultima modifica di "fratzicu" (05/04/2021, 21:00)

hendi060

Principiante

Posts: 30

12

sabato, 10 aprile 2021, 22:13

Hi Fratzicu,

congratulations! I also played a little with OpenOCD these days, but were not ableto backup/write something, but I tried to flash it with one command line like

Codice sorgente

 
1

openocd -f /usr/share/openocd/scripts/interface/ftdi/FT232H.cfg -f /usr/share/openocd/scripts/target/cs351x_meins.cfg -c "program /home/henne/Downloads/Linux/OpenWRT/redboot_cs351x_planex_109a.bin verify exit 0x30000000"

with errors. I will try your commands.
I was to lazy to write/modify a boardfile to be honest. Did you also try to just connect via giving adapter and chip config?
BTW, I just installed version 0.11 from OpenOCD which was released this year.
Did someone already did anything in openwrt for your CPU? Is it one of those: Marvel SOCs? From menuconfig menu of Openwrt:

Codice sorgente

 
1
2
3

                                                        Target System (Marvell Kirkwood)  --->                                                                                  │ │  
  │ │                                                Target Profile (RaidSonic ICY BOX IB-NAS62x0)  --->                                                           │ │  
  │ │                                                Target Images  --->

Maybe you can adapt some of this.

Threads simili