Ok, got my TTL serial cable!
Nicely running 115200,8,n,1(,n).
And ... a second, working P-2812HNU-F1 (only also this one does not give ipadres or is accessible without DSL connected).
After installing the appropriate serial drivers, the following is seen on my (zerg said:) 'dead', P-2812HNU-F1:
ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK
ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...
ZyU-F02-300-20AA003-V3.06|03/31|2011(TUE)
CLOCK CPU 500M RAM 250M
DRAM: 128 MB
relocate_code start
relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment
In: serial
Out: serial
Err: serial
Net: fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x020c
setup MDIO for new GPHY
vr9 Switch
Hit any key to stop autoboot: 0
NAND read: device 0 offset 114688, size 65536 ... 65536 bytes read: OK
## Starting application at 0x86A80000 ...
Z-LOADER 3.0(Mar 31 2011)
NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=0 upgcnt2=1
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...
Z-Boot 3.0.0(Dec 29 2011)
we get zloader version: 3.0
Hit any key to stop autoboot:
So ... it's not dead at all!
Strange thing, I see twice the message: "Hit any key to stop autoboot:".
Only on the second message you can break the autoboot proces ('Z-BOOT').
This means, normally the 'Z-LOADER' is always loaded, i guess.
Why is the device using the 2nd zboot image, and not the 1st? I dont know.
Correct me if I am wrong:
- CPU 500MHz, 256 MB Ram and 128 MB DRAM?
If i dont stop the autoboot proces, the device tries to boot and following is shown:
no ROMD partition
MRD_CERT_1 check=0
MRD_CERT_2 check=0
Read Kernel to RAM from 2f80800
bootargs=root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
## Booting image at 80800000 ...
Image Name: MIPS Linux-2.6.20
Created: 2011-12-29 8:40:42 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1298116 Bytes = 1.2 MB
Load Address: 80002000
Entry Point: 803b3000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 803b3000) ...
## Giving linux memsize in MB, 128
Starting kernel ...
Infineon xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
Linux version 2.6.20.19
(jiuan@holyBuild) (gcc version 4.3.3 (GCC) ) #21 Thu Dec 29 16:40:32 CST 2011
phym = 08000000, mem = 07e00000, max_pfn = 00007e00
Reserving memory for CP1 @0xa7e00000, size 0x00200000
CPU revision is: 00019555
Determined physical RAM map:
User-defined physical RAM map:
memory: 07e00000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists. Total pages: 32004
Kernel command line: root=/dev/mtdblock1 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 512 (order: 9, 2048 bytes)
cycles_per_jiffy = 2500000
Using 250.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 123520k/129024k available (2986k kernel code, 5472k reserved, 788k data, 180k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.1.9, (c) 2001-2010 Lantiq Deutschland GmbH
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.10
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.11, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
yaffs Dec 29 2011 16:36:05 Installing.
Infineon Technologies DEU driver version 1.0.1
IFX DEU DES initialized (multiblock).
IFX DEU AES initialized (multiblock).
IFX DEU ARC4 initialized (multiblock).
IFX DEU SHA1 initialized.
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.1.4, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
MEI CPE Driver, Version 1.1.0
<6>(c) Copyright 2009, Infineon Technologies AG
<6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###
<6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 1.1.6
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Switch Auto Polling value = 0
GPHY FW load for A1x !!
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 400000
IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V0.7 - Firmware: 8304
Checking PHY LED States!!
ifx_nand_init
Probe for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 24 at 0x00300000
Creating 7 MTD partitions on "ifx_nand":
0x000e0000-0x01ee0000 : "rootfs,kernel1"
0x01ee0000-0x03ce0000 : "rootfs,kernel2"
0x03ce0000-0x047a0000 : "telenor"
0x047a0000-0x07460000 : "firmware"
0x07460000-0x07f00000 : "config"
0x07f00000-0x07f40000 : "mrd_cert1"
0x07f40000-0x07f80000 : "mrd_cert2"
Lantiq SSC driver, version 2.2.2, (c) 2001-2010 Lantiq Deutschland GmbH
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
Registered led device: ledc_0
Registered led device: ledc_1
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: ledc_12
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: ledc_15
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: ledc_18
Registered led device: ledc_19
Registered led device: ledc_20
Registered led device: ledc_21
Registered led device: ledc_22
Registered led device: ledc_23
Lantiq LED driver, version 1.0.15, (c) 2001-2010 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
Performance counters on
input device check on
Actions configured
nf_conntrack version 0.5.0 (1008 buckets, 8064 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_conntrack_rtsp v0.6.21 loading
ZLD: zy_sm_init() register hooks successful.
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
ebt_ulog: not logging via ulog since somebody else already registered for PF_BRIDGE
NET: Registered protocol family 8
atmpvc_init() failed with -17
lec.c: Dec 29 2011 16:37:55 initialized
mpc.c: Dec 29 2011 16:37:52 initialized
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
Time: MIPS clocksource has been installed.
yaffs: auto selecting yaffs2
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs filesystem) readonly.
Freeing unused kernel memor
init started: BusyBox v1.10.4 (2011-12-29 16:57:15 CST)
starting pid 162, tty '': '/etc/init.d/rcS'
Algorithmics/MIPS FPU Emulator v1.5
Run init.d/rcS!
Trying to mount NAND flash as YAFFS2 for configuration files
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
Checkpoint read object 1 type 0 chunk 2689 does not match existing object type 3
yaffs tragedy: Bad object type, 2097152 != 3, for object 1 at chunk 2886 during scan
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs tragedy: attempting to use non-directory as a directory in scan. Put in lost+found.
yaffs_read_super: isCheckpointed 0
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80101c08, ra == 8010117c
This device looks to have corrupted code to run. Device ends with no LED's on, and no prompt on serial port 
.
So beter try to fix this device first.
I can however also break the autoboot, by pressing any key.
"Next, I will follow the unbrick process descibed by asmartin, to get this device running original ZyXEL's firmware.
1st I'll leave boatloader the same, and try to flash device with next -original- firmware:
ZyXEL P-2812HNUL-F1 OBM
3.10(TUJ.0)C0
Release Note
Date: May 4, 2011
Supported Platforms:
ZyXEL P-2812HNUL-F1/P-2812HNU-F1
Versions:
Bootbase version: ZyU-F02-300-20AA003-V3.04|04/01|2011(TUJ)
Firmware version: 3.10(TUJ.0)C0
DSL code version: AnnexA_53.26.16.53.3B.11
WLAN code version: RT3062_LinuxAP_V2.3.0.0
Voice code version: 3.11.0 IFX TAPI
Before I (we) try to build openWRT version for these devices, for example, I don't need the 'Voice code' at all in my configuration 
.
Just more info:
When stopping the autoboot proces, we end up having the following command choices (just press ENTER):
(LED P2 stays on, POWER flashes)
ZHAL>
ATBT x block0 write enable (1=enable, 0=disable)
ATWM x set MAC address in working buffer
ATEN x,(y) set BootExtension Debug Flag (y=password)
ATSE x show the seed of password generator
ATWZ a(,b,c) write ZyXEL MAC addr, Country code, EngDbgFlag
ATCB copy from FLASH ROM to working buffer
ATCL clear working buffer
ATSB save working buffer to FLASH ROM
ATBU dump manufacturer related data in working buffer
ATSH dump manufacturer related data in ROM
ATCO x set country code in working buffer
ATFL x set EngDebugFlag in working buffer
ATVD x set vendor name in working buffer
ATPN x set product name in working buffer
ATFE x,y,... set feature bits in working buffer
ATSN x set serial number in FLASH ROM
ATTL MRD_CERT & ROM-D partition utility
ATGO boot up whole system
ATGU go back to U-Boot command line mode
ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
ATMI x Enable/Disable model ID checking (1=enable, 0=disable)
ATMT x reduce manufacture bootup time for wireless calibration (1=enable, 0=disable)
ATUR x upgrade RAS image (filename)
ATUB x upgrade ZyU-Boot image (filename)
The ATSH command returns:
ZHAL> ATSH
ZLD Version : V3.10(TUE.3)
Bootbase Version : V3.06|03/31|2011(TUE)
Vender Name : ZyXEL Communications Corp.
Product Model : P-2812HNU-F1
Serial Number : S110Y280xxxxx
First MAC Address : CC5xxxxx77F8
Last MAC Address : CC5xxxxx77FF
MAC Address Quantity : 08
Default Country Code : FD
Boot Module Debug Flag : 00
RootFS Checksum : 000014c9
Kernel Checksum : 000077cb
RomFile Checksum : 00002080
Main Feature Bits : 00
Other Feature Bits :
06 00 00 02 19 01 00 ff-f8 00 00 00 01 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
(MAC and serial are changed!)
I'll keep everybody posted here
DG.
PS. Also have a virtual machine testing openWRT with LUCI, attitude Adjustment, r36088, on only 32MB!
Maybe with the right kernel and driver sets we could make openWRT running on these devices?
(Last edited by DGDodo on 30 Dec 2013, 19:18)
