Synology Diskstation DS414 Unbricking

> i have marvell promt but no command fatload, how
> to download files by USB?

Check for ext2load

help

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,
I try to unbrick a DS416.
It posts this upon power up via uart:

Annapurna Labs stage 2: stage2_eth3_ram_loader v1.49.3
Executing next!
Annapurna Labs stage 2: stage2.5_loader v1.49.3
SPD I2C Address:00000057
Executing next!


Stage 3 2013.10-alpine_spl-1.49.4-00666-gccfe35f (Sep 08 2014 - 09:15:21)

DRAM:  1 GiB
EEPROM Revision ID = 34
Device ID = a212
Device Info: AL21200-1400
Loading DT to 00100000 (17059 bytes)...
Board config ID: Synology DS416
SRAM agent up: agent_wakeup v1.49.3
Loading U-Boot to 00100000 (373616 bytes)...
Executing U-Boot...


U-Boot 2013.10-alpine_db-1.49.4-SYNO-768e80b-2016-01-04 (Jan 04 2016 - 18:44:17)

Annapurna Labs
Board: Alpine Development Board
I2C:   ready
DDR size is 1024 MB according to shared params
DRAM:  1 GiB

   _
  /_\  _ __  _ __   __ _ _ __  _   _ _ __ _ __   __ _
 //_\\| '_ \| '_ \ / _` | '_ \| | | | '__| '_ \ / _` |
/  _  \ | | | | | | (_| | |_) | |_| | |  | | | | (_| |
\_/ \_/_| |_|_| |_|\__,_| .__/ \__,_|_|  |_| |_|\__,_|
   __       _           |_|
  / /  __ _| |__  ___
 / /  / _` | '_ \/ __|
/ /__| (_| | |_) \__ \
\____/\__,_|_.__/|___/
               ___             _
 /\ /\        / __\ ___   ___ | |_
/ / \ \_____ /__\/// _ \ / _ \| __|
\ \_/ /_____/ \/  \ (_) | (_) | |_
 \___/      \_____/\___/ \___/ \__|

CPU DevID = 0, rev_id = 1
eeprom_per_device_init: no valid information found!
power_init_board: EEPROM per device information is not valid - using defaults!
Early init addr = 00000400
Early init DT offset = 00080000
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
U-Boot script not found in TOC!
U-Boot redundant environment not found in TOC!
DT info:
--------------------
Board config ID: Synology DS416
Muxed interfaces:
        if_uart_1(0)
GPIO configuration:
        GPIO 0 is input
        GPIO 1 is input
        GPIO 2 is input
        GPIO 3 is input
        GPIO 35 is input
        GPIO 36 is input
        GPIO 5 is output, value = 1
        GPIO 10 is output, value = 0
        GPIO 11 is output, value = 0
        GPIO 19 is output, value = 0
        GPIO 22 is output, value = 0
        GPIO 23 is output, value = 0
        GPIO 24 is output, value = 0
        GPIO 25 is output, value = 0
        GPIO 26 is output, value = 0
        GPIO 27 is output, value = 0
        GPIO 29 is output, value = 0
        GPIO 31 is output, value = 0
        GPIO 32 is output, value = 0
        GPIO 33 is output, value = 0
        GPIO 38 is output, value = 0
        GPIO 39 is output, value = 0
        GPIO 40 is output, value = 0
        GPIO 41 is output, value = 0
        GPIO 43 is output, value = 0
dt_based_init_gpio: GPIO  0: 1
dt_based_init_gpio: GPIO  1: 1
dt_based_init_gpio: GPIO  2: 1
dt_based_init_gpio: GPIO  3: 1
dt_based_init_gpio: GPIO  4: 1
dt_based_init_gpio: GPIO  5: 1
dt_based_init_gpio: GPIO  6: 0
dt_based_init_gpio: GPIO  7: 1
dt_based_init_gpio: GPIO  8: 0
dt_based_init_gpio: GPIO  9: 0
dt_based_init_gpio: GPIO 10: 0
dt_based_init_gpio: GPIO 11: 0
dt_based_init_gpio: GPIO 12: 1
dt_based_init_gpio: GPIO 13: 1
dt_based_init_gpio: GPIO 14: 1
dt_based_init_gpio: GPIO 15: 1
dt_based_init_gpio: GPIO 16: 1
dt_based_init_gpio: GPIO 17: 0
dt_based_init_gpio: GPIO 18: 1
dt_based_init_gpio: GPIO 19: 0
dt_based_init_gpio: GPIO 20: 0
dt_based_init_gpio: GPIO 21: 0
dt_based_init_gpio: GPIO 22: 0
dt_based_init_gpio: GPIO 23: 0
dt_based_init_gpio: GPIO 24: 0
dt_based_init_gpio: GPIO 25: 0
dt_based_init_gpio: GPIO 26: 0
dt_based_init_gpio: GPIO 27: 0
dt_based_init_gpio: GPIO 28: 1
dt_based_init_gpio: GPIO 29: 0
dt_based_init_gpio: GPIO 30: 1
dt_based_init_gpio: GPIO 31: 0
dt_based_init_gpio: GPIO 32: 0
dt_based_init_gpio: GPIO 33: 0
dt_based_init_gpio: GPIO 34: 1
dt_based_init_gpio: GPIO 35: 1
dt_based_init_gpio: GPIO 36: 1
dt_based_init_gpio: GPIO 37: 1
dt_based_init_gpio: GPIO 38: 0
dt_based_init_gpio: GPIO 39: 0
dt_based_init_gpio: GPIO 40: 0
dt_based_init_gpio: GPIO 41: 0
dt_based_init_gpio: GPIO 42: 1
dt_based_init_gpio: GPIO 43: 0
dt_based_init_gpio: GPIO 44: 1
dt_based_init_gpio: GPIO 45: 1
dt_based_init_gpio: GPIO 46: 1
dt_based_init_gpio: GPIO 47: 1
Ethernet port 0:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 1
        i2c-id: N/A
Ethernet port 1:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 2
        i2c-id: N/A
Ethernet port 2:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 3
        i2c-id: N/A
Ethernet port 3:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 0
        i2c-id: N/A
PCIe endpoint ports:
PCIe port 0:
        PCIe port status: enabled
        Gen: 2
        Width: 2
PCIe port 1:
        PCIe port status: enabled
        Gen: 2
        Width: 2
PCIe port 2:
        PCIe port status: disabled
        Gen: 2
        Width: 4
NAND:  0 MiB
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
  00:00.0     - 1c36:0002 - Network controller
  00:01.0     - 1c36:0001 - Network controller
  00:04.0     - 1c36:0011 - Cryptographic device
  00:05.0     - 1c36:0021 - Base system peripheral
  00:09.0     - 1c36:0031 - Mass storage controller
PCIE_0: Link up. Speed 5GT/s Width x1
  01:00.0     - 1b6f:7023 - Serial bus controller
PCIE_1: Link up. Speed 5GT/s Width x1
  02:00.0     - 1b6f:7023 - Serial bus controller
In:    serial
Out:   serial
Err:   serial

Synology Model: DS416
Fan Status: Good

Net:
Turn off EEE of rl8211D
Disable eth0 green mode
Turn off EEE of rl8211D
Disable eth1 green mode
al_eth0 [PRIME], al_eth1
Press Ctrl+C to abort autoboot in 3 second
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
SF: 3014656 bytes @ 0x90000 Read: OK
SF: 4587520 bytes @ 0x370000 Read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
ALPINE_DB>

The link led is on if I plug in the ethernet cable and the activity led indicates some traffic.
First there wasn't a environment variable for ipaddr and netmask.
The box cannot ping or be pinged even after setting the variables above.
I tried tftpboot based on Tim Butler's guide but it does not connect to the PC (the tftp server is functional).

ALPINE_DB> tftpboot
al_eth0 Waiting for PHY auto negotiation to complete.... done
*** Warning: no boot file name; using 'C0A8002D.img'
Using al_eth0 device
TFTP from server 192.168.0.20; our IP address is 192.168.0.45
Filename 'C0A8002D.img'.
Load address: 0x8000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again

It cannot get an IP address with dhcp either:

ALPINE_DB> dhcp
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

Retry count exceeded; starting again
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

What should I do next?

I downloaded the zimage and the rd.bin with serial to the addresses 0x8000000 and 0x7500000 and tried to boot them from there but it hangs at "booting the kernel".

ALPINE_DB> loadb  7500000 115200
## Ready for binary (kermit) download to 0x07500000 at 115200 bps...
## Total Size      = 0x0037bef8 = 3653368 Bytes
## Start Addr      = 0x07500000
ALPINE_DB> loadb  8000000 115200
## Ready for binary (kermit) download to 0x08000000 at 115200 bps...
## Total Size      = 0x00213018 = 2175000 Bytes
## Start Addr      = 0x08000000
ALPINE_DB> bootm 0x8000000 0x7500000
## Booting kernel from Legacy Image at 08000000 ...
   Image Name:   Linux-3.10.108
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2174936 Bytes = 2.1 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 07500000 ...
   Image Name:   synology_alpine4k_ds416 42218
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    3653304 Bytes = 3.5 MiB
   Load Address: 08000000
   Entry Point:  08000000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Well, it seems that after uploading the kernel via serial, starting it with the FDT took care of it.

bootm 0x8000000 0x7500000 0x3b84008

With this the kernel was able to boot, the webserver is started also.
Then I did quickly put an HDD in it and installed the DSM and that updated the eprom so the NAS now starts without issues.

Thank you for all the valuable information posted here!



Edited 1 time(s). Last edit at 04/19/2024 02:59AM by EzLett.