Synology Diskstation DS414 Unbricking

> i have marvell promt but no command fatload, how
> to download files by USB?

Check for ext2load

help

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi,
I try to unbrick a DS416.
It posts this upon power up via uart:

Annapurna Labs stage 2: stage2_eth3_ram_loader v1.49.3
Executing next!
Annapurna Labs stage 2: stage2.5_loader v1.49.3
SPD I2C Address:00000057
Executing next!


Stage 3 2013.10-alpine_spl-1.49.4-00666-gccfe35f (Sep 08 2014 - 09:15:21)

DRAM:  1 GiB
EEPROM Revision ID = 34
Device ID = a212
Device Info: AL21200-1400
Loading DT to 00100000 (17059 bytes)...
Board config ID: Synology DS416
SRAM agent up: agent_wakeup v1.49.3
Loading U-Boot to 00100000 (373616 bytes)...
Executing U-Boot...


U-Boot 2013.10-alpine_db-1.49.4-SYNO-768e80b-2016-01-04 (Jan 04 2016 - 18:44:17)

Annapurna Labs
Board: Alpine Development Board
I2C:   ready
DDR size is 1024 MB according to shared params
DRAM:  1 GiB

   _
  /_\  _ __  _ __   __ _ _ __  _   _ _ __ _ __   __ _
 //_\\| '_ \| '_ \ / _` | '_ \| | | | '__| '_ \ / _` |
/  _  \ | | | | | | (_| | |_) | |_| | |  | | | | (_| |
\_/ \_/_| |_|_| |_|\__,_| .__/ \__,_|_|  |_| |_|\__,_|
   __       _           |_|
  / /  __ _| |__  ___
 / /  / _` | '_ \/ __|
/ /__| (_| | |_) \__ \
\____/\__,_|_.__/|___/
               ___             _
 /\ /\        / __\ ___   ___ | |_
/ / \ \_____ /__\/// _ \ / _ \| __|
\ \_/ /_____/ \/  \ (_) | (_) | |_
 \___/      \_____/\___/ \___/ \__|

CPU DevID = 0, rev_id = 1
eeprom_per_device_init: no valid information found!
power_init_board: EEPROM per device information is not valid - using defaults!
Early init addr = 00000400
Early init DT offset = 00080000
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
U-Boot script not found in TOC!
U-Boot redundant environment not found in TOC!
DT info:
--------------------
Board config ID: Synology DS416
Muxed interfaces:
        if_uart_1(0)
GPIO configuration:
        GPIO 0 is input
        GPIO 1 is input
        GPIO 2 is input
        GPIO 3 is input
        GPIO 35 is input
        GPIO 36 is input
        GPIO 5 is output, value = 1
        GPIO 10 is output, value = 0
        GPIO 11 is output, value = 0
        GPIO 19 is output, value = 0
        GPIO 22 is output, value = 0
        GPIO 23 is output, value = 0
        GPIO 24 is output, value = 0
        GPIO 25 is output, value = 0
        GPIO 26 is output, value = 0
        GPIO 27 is output, value = 0
        GPIO 29 is output, value = 0
        GPIO 31 is output, value = 0
        GPIO 32 is output, value = 0
        GPIO 33 is output, value = 0
        GPIO 38 is output, value = 0
        GPIO 39 is output, value = 0
        GPIO 40 is output, value = 0
        GPIO 41 is output, value = 0
        GPIO 43 is output, value = 0
dt_based_init_gpio: GPIO  0: 1
dt_based_init_gpio: GPIO  1: 1
dt_based_init_gpio: GPIO  2: 1
dt_based_init_gpio: GPIO  3: 1
dt_based_init_gpio: GPIO  4: 1
dt_based_init_gpio: GPIO  5: 1
dt_based_init_gpio: GPIO  6: 0
dt_based_init_gpio: GPIO  7: 1
dt_based_init_gpio: GPIO  8: 0
dt_based_init_gpio: GPIO  9: 0
dt_based_init_gpio: GPIO 10: 0
dt_based_init_gpio: GPIO 11: 0
dt_based_init_gpio: GPIO 12: 1
dt_based_init_gpio: GPIO 13: 1
dt_based_init_gpio: GPIO 14: 1
dt_based_init_gpio: GPIO 15: 1
dt_based_init_gpio: GPIO 16: 1
dt_based_init_gpio: GPIO 17: 0
dt_based_init_gpio: GPIO 18: 1
dt_based_init_gpio: GPIO 19: 0
dt_based_init_gpio: GPIO 20: 0
dt_based_init_gpio: GPIO 21: 0
dt_based_init_gpio: GPIO 22: 0
dt_based_init_gpio: GPIO 23: 0
dt_based_init_gpio: GPIO 24: 0
dt_based_init_gpio: GPIO 25: 0
dt_based_init_gpio: GPIO 26: 0
dt_based_init_gpio: GPIO 27: 0
dt_based_init_gpio: GPIO 28: 1
dt_based_init_gpio: GPIO 29: 0
dt_based_init_gpio: GPIO 30: 1
dt_based_init_gpio: GPIO 31: 0
dt_based_init_gpio: GPIO 32: 0
dt_based_init_gpio: GPIO 33: 0
dt_based_init_gpio: GPIO 34: 1
dt_based_init_gpio: GPIO 35: 1
dt_based_init_gpio: GPIO 36: 1
dt_based_init_gpio: GPIO 37: 1
dt_based_init_gpio: GPIO 38: 0
dt_based_init_gpio: GPIO 39: 0
dt_based_init_gpio: GPIO 40: 0
dt_based_init_gpio: GPIO 41: 0
dt_based_init_gpio: GPIO 42: 1
dt_based_init_gpio: GPIO 43: 0
dt_based_init_gpio: GPIO 44: 1
dt_based_init_gpio: GPIO 45: 1
dt_based_init_gpio: GPIO 46: 1
dt_based_init_gpio: GPIO 47: 1
Ethernet port 0:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 1
        i2c-id: N/A
Ethernet port 1:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 2
        i2c-id: N/A
Ethernet port 2:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 3
        i2c-id: N/A
Ethernet port 3:
        mode: sgmii
        SFP module: N/A
        10gbe params: N/A
        PHY address: 0
        i2c-id: N/A
PCIe endpoint ports:
PCIe port 0:
        PCIe port status: enabled
        Gen: 2
        Width: 2
PCIe port 1:
        PCIe port status: enabled
        Gen: 2
        Width: 2
PCIe port 2:
        PCIe port status: disabled
        Gen: 2
        Width: 4
NAND:  0 MiB
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
  00:00.0     - 1c36:0002 - Network controller
  00:01.0     - 1c36:0001 - Network controller
  00:04.0     - 1c36:0011 - Cryptographic device
  00:05.0     - 1c36:0021 - Base system peripheral
  00:09.0     - 1c36:0031 - Mass storage controller
PCIE_0: Link up. Speed 5GT/s Width x1
  01:00.0     - 1b6f:7023 - Serial bus controller
PCIE_1: Link up. Speed 5GT/s Width x1
  02:00.0     - 1b6f:7023 - Serial bus controller
In:    serial
Out:   serial
Err:   serial

Synology Model: DS416
Fan Status: Good

Net:
Turn off EEE of rl8211D
Disable eth0 green mode
Turn off EEE of rl8211D
Disable eth1 green mode
al_eth0 [PRIME], al_eth1
Press Ctrl+C to abort autoboot in 3 second
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
SF: 3014656 bytes @ 0x90000 Read: OK
SF: 4587520 bytes @ 0x370000 Read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
ALPINE_DB>

The link led is on if I plug in the ethernet cable and the activity led indicates some traffic.
First there wasn't a environment variable for ipaddr and netmask.
The box cannot ping or be pinged even after setting the variables above.
I tried tftpboot based on Tim Butler's guide but it does not connect to the PC (the tftp server is functional).

ALPINE_DB> tftpboot
al_eth0 Waiting for PHY auto negotiation to complete.... done
*** Warning: no boot file name; using 'C0A8002D.img'
Using al_eth0 device
TFTP from server 192.168.0.20; our IP address is 192.168.0.45
Filename 'C0A8002D.img'.
Load address: 0x8000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again

It cannot get an IP address with dhcp either:

ALPINE_DB> dhcp
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

Retry count exceeded; starting again
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

What should I do next?

I downloaded the zimage and the rd.bin with serial to the addresses 0x8000000 and 0x7500000 and tried to boot them from there but it hangs at "booting the kernel".

ALPINE_DB> loadb  7500000 115200
## Ready for binary (kermit) download to 0x07500000 at 115200 bps...
## Total Size      = 0x0037bef8 = 3653368 Bytes
## Start Addr      = 0x07500000
ALPINE_DB> loadb  8000000 115200
## Ready for binary (kermit) download to 0x08000000 at 115200 bps...
## Total Size      = 0x00213018 = 2175000 Bytes
## Start Addr      = 0x08000000
ALPINE_DB> bootm 0x8000000 0x7500000
## Booting kernel from Legacy Image at 08000000 ...
   Image Name:   Linux-3.10.108
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2174936 Bytes = 2.1 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 07500000 ...
   Image Name:   synology_alpine4k_ds416 42218
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    3653304 Bytes = 3.5 MiB
   Load Address: 08000000
   Entry Point:  08000000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Well, it seems that after uploading the kernel via serial, starting it with the FDT took care of it.

bootm 0x8000000 0x7500000 0x3b84008

With this the kernel was able to boot, the webserver is started also.
Then I did quickly put an HDD in it and installed the DSM and that updated the eprom so the NAS now starts without issues.

Thank you for all the valuable information posted here!



Edited 1 time(s). Last edit at 04/19/2024 02:59AM by EzLett.

Hi bodhi,
nice tutorial! Many thanks for you. I have ds414 without history and even power adaptor (i took from my ds414j).
NAS seems to starting but orange light flashing and i cannot reset (beep after reset button doing nothing).
LAN cards shine a continuous green light, when i plugin cable - nothing. Then i found your tutorial, boought cable plugin and... synology flashing now blue light and nothing happened on putty. This is output:

ţ ţ ŕ Á  ĚG ` l[  ˙@
E˙
< ˙ đ `Ă0 Ŕ  


Could you help me or any idea how to recovery system?

@adrkan,

Check your putty settings and make sure they are correct. Here is how I run picocom in Linux.

baudrate= 115200, no flow control, no parity bit, 8 data bit, 1 stop bit.

picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0

# picocom --help

picocom v3.1

Compiled-in options:
  TTY_Q_SZ is 0
  HIGH_BAUD is enabled
  USE_FLOCK is enabled
  LINENOISE is enabled
  HISTFILE is: .picocom_history
  USE_CUSTOM_BAUD is enabled
  --parit<y> o (=odd) | e (=even) | n (=none)
  --<d>atabits 5 | 6 | 7 | 8
  --sto<p>bits 1 | 2
  --<e>scape <char>
  --<n>o-escape
  --e<c>ho
  --no<i>nit
  --no<r>eset
  --hang<u>p
  --no<l>ock
  --<s>end-cmd <command>
  --recei<v>e-cmd <command>
  --imap <map> (input mappings)
  --omap <map> (output mappings)
  --emap <map> (local-echo mappings)
  --lo<g>file <filename>
  --inits<t>ring <string>
  --e<x>it-after <msec>
  --e<X>it
  --lower-rts
  --raise-rts
  --lower-dtr
  --raise-dtr
  --<q>uiet
  --<h>elp
<map> is a comma-separated list of one or more of:
  crlf : map CR --> LF
  crcrlf : map CR --> CR + LF
  igncr : ignore CR
  lfcr : map LF --> CR
  lfcrlf : map LF --> CR + LF
  ignlf : ignore LF
  bsdel : map BS --> DEL
  delbs : map DEL --> BS
  spchex : map special chars (excl. CR, LF & TAB) --> hex
  tabhex : map TAB --> hex
  crhex : map CR --> hex
  lfhex : map LF --> hex
  8bithex : map 8-bit chars --> hex
  nrmhex : map normal ascii chars --> hex
<?> indicates the equivalent short option.
Short options are prefixed by "-" instead of by "--".

If after you've verified your putty settings are correct, and still see garbage, then you will need a Linux host to run kwboot. I'll build and post the latest DS414 u-boot after you let me know.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thank you for reply. In attach i sending what i get from output picocom :(
Im sending photo of cables



Edited 2 time(s). Last edit at 05/08/2024 03:23AM by adrkan.

@adrkan,

- Check the 3 wires, make sure they are away from the power cord.
- Try swapping TX and RX wires.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Everything is ok for me, i swipe cables and still same :/

Try runing kwboot with this newly build DS414 u-boot: uboot.2024.07-rc2-tld-1.ds414.kwb .

Download in this post

https://forum.doozan.com/read.php?3,137334,137508#msg-137508

See here for an example how to run kwboot from your Linux host:

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thank you @bodhi so much for trying to help. I dont know where is issue. Maybe i will order another uart usb cable. As you can see nothing progressing when im trying to do anything with uart.

I connect the uart cables then only the blue LED flashes. When I unplug the usb uart cable then there is a beep and the orange LED starts flashing. I have tried various ways to bootloader but it doesn't do anything. I can prob with another power supply which I would also have to purchase but the one from 414j is probably the same. There is simply no communication with this brick. If you have any idea what else I could try then please let me know

Thank you and br

adrkan,

Reread the 1st post. bignellrp started with the same blue blinking ligth.

Quote

So, where do you start with blue blinking light of death. Many unhelpful suggestions on the Synology forums, even from the synology support chat saying the box was “unrecoverable” but a couple of useful posts did start me on the right track.

Perhaps watch all the videos to see if you missed any thing when you connect serial console?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

No, everything its ok with cables and pins. I checked lot of times, I even bought second different cable and even once I managed to make it load however, it crashed on the same thing someone had before. After restarting nothing happened unfortunately, there is the same problem. I don't know if the rom is broken or there is a hardware problem somewhere.

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

and nothing else going on :/ stuck here



Edited 2 time(s). Last edit at 05/16/2024 08:51AM by adrkan.

adrkan,

> No, everything its ok with cables and pins. I
> checked lot of times, I even bought second
> different cable and even once I managed to make it
> load however, it crashed on the same thing someone
> had before. After restarting nothing happened

Meaning the same behavior as above?

https://forum.doozan.com/read.php?3,100059,137493#msg-137493

> unfortunately, there is the same problem. I don't
> know if the rom is broken or there is a hardware
> problem somewhere.
>
>

> Starting kernel ...
> 
> Uncompressing Linux... done, booting the kernel.
>

Now I'm confused. The above indicates that u-boot has load and tried to boot the kernel.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)