Bricked Synology DS213 (Kirkwood) so close

Synology DS213 - How to restore stock FW in flash.

Warning: This instruction is still under tested.


Prerequisite

1. Have a set of backup mtds (0-5) available (see this thread).
2. Connect serial console.
3. Set up tftp server at the Linux host where you run serial console. The tftp root must be at top folder in this server: /tftproot. Copy the mtd files to this folder.

Quote

/tftproot/ds213.mtd0
/tftproot/ds213.mtd1
/tftproot/ds213.mtd2
/tftproot/ds213.mtd3
/tftproot/ds213.mtd4
/tftproot/ds213.mtd5

Steps


1. Boot with UART (skip this step if mtd0 is not corrupted, i.e stock u-boot still running OK during power up).

kwboot -t -B 115200 /dev/ttyUSB0 -b ds213.mtd0 -p

2. Power up the brick boxed, interrupt serial console at countdown.

3. Turn the SPI flash protection off

sflash protect off
sflash info

Expected Output

Flash Base Address  : 0xf8000000
Flash Model         : ST N25Q064
Manufacturer ID     : 0x20
Device Id           : 0xba17
Sector Size         : 64K
Number of sectors   : 128
Page Size           : 256
Write Protection    : Off

4. Load the images with tftp and flash each to SPI flash.

Note: if your u-boot is still running OK, then you don't have to flash mtd0 and mtd4.

tftpboot 0x800000 ds213.mtd0
sflash write 0x800000 0x000000000000 0x00090000

tftpboot 0x800000 ds213.mtd1
sflash write 0x800000 0x000000090000 0x00300000

tftpboot 0x800000 ds213.mtd2
sflash write 0x800000 0x000000390000 0x00440000

tftpboot 0x800000 ds213.mtd3
sflash write 0x800000 0x0000007d0000 0x00010000

tftpboot 0x800000 ds213.mtd4
sflash write 0x800000 0x0000007e0000 0x00010000

tftpboot 0x800000 ds213.mtd5
sflash write 0x800000 0x0000007f0000 0x00010000

DONE.

==========

So now you can either reset it at u-boot prompt, or recycle the power the DS213 to see if stock system is booting OK.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 3 time(s). Last edit at 12/17/2020 06:01AM by bodhi.

Sorry to take so long, it has been a tough couple of weeks but had some personal time this weekend. It also took some time to figure out and cobfigure the tftp server as information varies. I eventually got it pointed to the tftproot directory

It seems to read fine, but writing ia not working with little or no info as to why.

Marvell>> tftpboot 0x800000 ds213.mtd2
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.9
Filename 'ds213.mtd2'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##########################
done
Bytes transferred = 4456448 (440000 hex)
Marvell>> sflash write 0x000000390000 0x00440000
Usage:
sflash	- read, write or erase the external SPI Flash.

Marvell>> tftpboot 0x800000 ds213.mtd1          
Unknown command 'tftpboot' - try 'help'
Marvell>> tftpboot 0x800000 ds213.mtd1
Unknown command 'tftpboot' - try 'help'
Marvell>> tftpboot 0x800000 ds213.mtd1
Unknown command 'tftpboot' - try 'help'
Marvell>> tftpboot 0x800000 ds213.mtd1
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.9
Filename 'ds213.mtd1'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##############################
done
Bytes transferred = 3145728 (300000 hex)
Marvell>> sflash write 0x000000090000 0x00300000
Usage:
sflash	- read, write or erase the external SPI Flash.

I had a syntax error on the commands. Will revise it.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Revised. Please try again.

https://forum.doozan.com/read.php?3,108294,111084#msg-111084

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Congratulations! You have succeeded! ;-)

tftpboot/sflash went smoothly and after a reset the box was discovered by the Synology software and allowed a fresh upgrade of the OS. After that, the web interface presented the normal login and indicated the box was healthy.

When/if you have the time (no hurry) could you summarize what you found in all this? Will the user need to do the dump using one method and the flash using another? I'm looking to compact all this into a single guide.

Can't thank you enough bodhi. Many of these DS212/213 boxes no doubt went into the trash and many sitting on shelves.

itangoii,

> Congratulations! You have succeeded! ;-)
>
> tftpboot/sflash went smoothly and after a reset
> the box was discovered by the Synology software
> and allowed a fresh upgrade of the OS. After
> that, the web interface presented the normal login
> and indicated the box was healthy.

Awesome!

> When/if you have the time (no hurry) could you
> summarize what you found in all this? Will the
> user need to do the dump using one method and the
> flash using another? I'm looking to compact all
> this into a single guide.

Yes. I'll write the summary.

> Can't thank you enough bodhi. Many of these
> DS212/213 boxes no doubt went into the trash and
> many sitting on shelves.

Glad to hear! hate to see a good piece of hardware going to the trash :)

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Well. I spoke too soon.

After the box was up and running I installed the second drive and it would not complete the boot. I removed the drive and again it would not complete the boot, but the web interface indicated it had crashed and to remove the volume and re-install. I tried to do so, but it went into the same problem that started all of this in that the OS will download but give an error very shortly after saying it was installing of

Failed to install the file. The file is probably corrupted. (13)

Replacing the drive with another drive even one that has been wiped results in the same behavior. I find it odd that it would be fine after the sflash and then have a problem with the addition of the second drive and then generate a problem onto the first drive.

Any thoughts appreciated. The sflash went fine, and the first boot and health check went fine. It was only after a restart. Actually a second restart as the first would have been doing the "reset" from the marvel prompt. Terminal output showed a full boot before
I used the web interface and logged in.

itangoii,

Quote

tftpboot/sflash went smoothly and after a reset the box was discovered by the Synology software and allowed a fresh upgrade of the OS. After that, the web interface presented the normal login and indicated the box was healthy.

At this point, it is OK running stock FW without the 2nd drive.

Quote

After the box was up and running I installed the second drive and it would not complete the boot. I removed the drive and again it would not complete the boot, but the web interface indicated it had crashed and to remove the volume and re-install.

Now you will need to make sure you run the correct Synology setup procedure that allow you to complete the installation. Perhaps it is obsolete?

So the best approach now is to start fresh, i.e. reflash with the tftpboot procedure, and try again.

Other than that, I don't know anything about Synology FW and its installation procedure details, so cannot recommend a better way forward.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I found this on the Synology form a while back and looked it up again after seeing in the Synology software that the bricked box had the same serial and MAC as the one we copied from. I think I need to address that first. The serial and MAC are in MTD3. The serial was in ASCI and I could change it easily with a hex editor, but I'm not sure from this post how to come to the MAC address and insert it.

The URL for the article is...

https://community.synology.com/enu/forum/17/post/69287

Unfortunately the formatting on the post is a mess.

For the next step you will need the serial number and original MAC from the sticker and a hex editor (I use hexeditor). First we create an empty 64 kB vender partition: $ dd if=/dev/zero of=vender.img bs=1024 count=64 The MAC address is stored in the first 6 bytes and the 7th byte contains a checksum. The checksum is calculated by taking the sum of the bytes in the MAC address. The following C program can be used to calculate the checksum. The checksum is stored in an unsigned char, which is not large enough to store the total. It will flow over give the rest, which is larger than multiples of 256 bytes:
#include <stdio.h> int main() { unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF}; for (i = 0; i < 6; i++) { chksum += rgAddr; } printf("Checksum: 0x%X\n", chksum); return 0; } The first three bytes are the Synology part, the last three bytes needs to be changed to your MAC address. Compile with $ gcc -o checksum mac_checksum.c This MAC example 00:11:32:FF:FF:FF will give a checksum of 0x40.

Insert these bytes into the image: $ hexeditor -b vender.img 00000000 00 11 32 FF FF FF 40 The serial number is written like this. For example:
SN=1350LAN009999,CHK=999
00000020 53 4e 3d 31 33 35 30 4c 41 4e 30 30 31 39 39 39 00000030 2c 43 48 4b 3d 39 39 39 Use an ascii to hex converter to generate the hex values. The checksum is calculated on next reboot automatically and can be inserted later. We use a dummy of 999 for now. Once u-boot is working again, you can flash the updated vender image from u-boot (see below how to do this). Now insert the vender data into the flash image: $ dd if=vender.img of=flash.rom bs=1 seek=$((0x7d0000)) The flash.rom image is now ready to be flashed onto the chip. The RedBoot_Config and FIS_directory partitions are not needed.

itangoii,

OK so the Synology FW actually check the serial number and MAC address to complete the intstalltion.

Normally, you don't have to do the complicate stuff with hex editing. You can change these envs upon the 1st boot after unbricking.

Go through the flashing for all mtds like you did. And then at serial console, reset the box. And then interrupt serial console, at the prompt do:

printenv

and see if the serial number and MAC address appear on the list. If they ar, then you can change these 2 envs to the real ones for this box.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Well I had some time today to pursue this after alot of research on the MAC address and serial number. Serial number is in mtd3 and is about all that's there. I'm assuming the MAC is as well (easy to flash at the factory since those are the only two things that would need to be static and are on a barcode label on back) However, unlike the serial number it is not in plain text. a few posts above show I found a post on how to change it but the post is badly formated.

For some reason after trying a re-flash the box will no longer boot. picocom says ready, but when I boot it the terminal locks up. Doing a kwboot with mtd0 and interrupting works fine, but flashing that same file results in the same lockup which seems a bit strange.

Printenv does show a ethaddr (which is a MAC address, but does not match the label) setenv ethaddr MAC-on-Label and then printenv again shows that env gone from the list.

Last attempt from a kwboot startup

92 % [......................................................................]
 94 % [......................................................................]
 95 % [......................................................................]
 97 % [......................................................................]
 98 % [..........................................................]
[Type Ctrl-\ + c to quit]

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: Synology Disk Station LE 

U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 0068B3D4

Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz
SysClock = 500Mhz , TClock = 200Mhz 

DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7
DRAM CS[0] base 0x00000000   size 512MB 
DRAM Total size 512MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
Using default environment

[8192kB@f8000000] Flash:  8 MB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
PEX 1: PCI Express Root Complex Interface
PEX interface detected Link X1

Synology Model: DS213
Fan Status: Good

Net:   egiga0 [PRIME], egiga1
Hit any key to stop autoboot:  0 
Marvell>> sflash protect off
Marvell>> 
Marvell>> setenv ipaddr 192.168.0.100
Marvell>> setenv serverip 192.168.0.11
Marvell>> sflash info

Flash Base Address  : 0xf8000000
Flash Model         : ST N25Q064
Manufacturer ID     : 0x20
Device Id           : 0xba17
Sector Size         : 64K
Number of sectors   : 128
Page Size           : 256
Write Protection    : Off

Marvell>> tftpboot 0x800000 ds213.mtd0
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd0'.
Load address: 0x800000
Loading: #################################################################
	 ###################################################
done
Bytes transferred = 589824 (90000 hex)
Marvell>> sflash write 0x800000 0x000000000000 0x00090000
Marvell>> tftpboot 0x800000 ds213.mtd1
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd1'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##############################
done
Bytes transferred = 3145728 (300000 hex)
Marvell>> sflash write 0x800000 0x000000090000 0x00300000
Marvell>> tftpboot 0x800000 ds213.mtd2
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd2'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##########################
done
Bytes transferred = 4456448 (440000 hex)
Marvell>> sflash write 0x800000 0x000000390000 0x00440000
Marvell>> tftpboot 0x800000 ds213.mtd3
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd3'.
Load address: 0x800000
Loading: #############
done
Bytes transferred = 65536 (10000 hex)
Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000
Marvell>> 
Marvell>> tftpboot 0x800000 ds213.mtd4
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd4'.
Load address: 0x800000
Loading: #############
done
Bytes transferred = 65536 (10000 hex)
Marvell>> sflash write 0x800000 0x0000007e0000 0x00010000
Marvell>> tftpboot 0x800000 ds213.mtd5
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.100
Filename 'ds213.mtd5'.
Load address: 0x800000
Loading: #############
done
Bytes transferred = 65536 (10000 hex)
Marvell>> sflash write 0x800000 0x0000007f0000 0x00010000
Marvell>>      

Quote

Printenv does show a ethaddr (which is a MAC address, but does not match the label) setenv ethaddr MAC-on-Label and then printenv again shows that env gone from the list.

Any log that you can post?

Also, if the 2nd DS213 is running, it probably phones home to tell Synology that there is a box with that serial number is in operation. So you would want to shut down that 2nd box before you restore the flash mtds on the bricked box and reboot it.

After you can upgrade the FW, then change the MAC address to the one on the box label, and the serial number to the correct one (whether it is possible depending on if they are available as u-boot envs)

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi Wrote:
-------------------------------------------------------
>

Quote

Printenv does show a ethaddr (which is a
> MAC address, but does not match the label) setenv
> ethaddr MAC-on-Label and then printenv again shows
> that env gone from the list.

>
> Any log that you can post?

What i posted above was the whole process except for the reboot after starting picocom which froze when power was turned on.

>
> Also, if the 2nd DS213 is running, it probably
> phones home to tell Synology that there is a box
> with that serial number is in operation. So you
> would want to shut down that 2nd box before you
> restore the flash mtds on the bricked box and
> reboot it.

The good box has never been in operation while working on the bricked one. They are both sitting together and the good one has not been started since we pulled the MTDs

>
> After you can upgrade the FW, then change the MAC
> address to the one on the box label, and the
> serial number to the correct one (whether it is
> possible depending on if they are available as
> u-boot envs)

As mentioned above, the MAC seems to be an env called ethaddr and at the marvel prompt setenv ettaddr 00:11:32:20:3D:nn is accepted without error but then doing a printenv lists the envs but ettsddr is no longer in the list.

I'll keep working on how and where to put the MAC address, but right now I don't understand why kwboot with ds213.mtd0 works but after tftp the file and sflash does not. In other words I'm following the first post above.

Regarding where you were in this post when the flash and boot procedure was successful:

https://forum.doozan.com/read.php?3,108294,111674#msg-111674

Could it be that you did not do the exact same steps this time?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I followed the revised post here.

https://forum.doozan.com/read.php?3,108294,111084#msg-111084

That's why it seems odd that the kwboot works to proceed with the flashing, but the same ds213.mtd0 used in the flashing will just lock up the terminal with no output.

Something came to mind, and I will have to read back on this tread. If I'm not mistaken we did get the box to boot on its own uboot (instead of the kwboot) and then flashed it. Could that be a problem?



Edited 4 time(s). Last edit at 12/09/2020 09:41AM by itangoii.

Good news.

I've nailed down the serial number and MAC address. MAC address is the first 6 bytes of mtd3. The first 3 are vendor specific and would likely not change for Synology. The last three are going to be on the label on the box. More on that later.

Serial number is in plain text starting at 33 and is 10 bytes.

Back to the MAC, the seventh byte is a calculated checksum based on the MAC. I previously had found and posted a snippet of code in C to do that, but I'm not a C guy and the code is a mess due to the poster using an editor that did not support the transition of carriage returns in non Linux environment. here is the code if anyone can sort it or since it is not that big possibly change it over to another language.

#include <stdio.h> int main() { unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF}; for (i = 0; i < 6; i++) { chksum += rgAddr; } printf("Checksum: 0x%X\n", chksum); return 0; }

Well, I'm smarter than people think I am ;-)

#include <stdio.h>
int main() {
    unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF};
    for (i = 0; i < 6; i++) { 	chksum += rgAddr;}
    printf("Checksum: 0x%X\n", chksum);
    return 0;
}

In the above code change the FFs to the last three of your MAC address before running. The first three are Synology's vendor part.

For my particular MAC that gives a checksum of F2 which is entered into the mtd3 file at byte 7 so with the changes to the last 3 of the MAC per the label on the case, the checksum at 7 and the serial number at 33 I may have the mtd3 (AKA the VENDOR file) back where it should be.

Now to figure out what happened to UBoot.



Edited 1 time(s). Last edit at 12/09/2020 05:03PM by itangoii.

itangoii,

> I followed the revised post here.
>
> https://forum.doozan.com/read.php?3,108294,111084#msg-111084

No you should not. Keep the log of what you did successfully, and that will be used to update the instruction.

> If I'm not mistaken we did
> get the box to boot on its own uboot (instead of
> the kwboot) and then flashed it. Could that be a
> problem?

Yes.

So try kwboot into Debian rootfs on USB. Flash mtd0 and mtd1. Shut down. And then reboot without the USB, and without kwboot. Interrupt serial console, and start at Step 2.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi Wrote:
-------------------------------------------------------
> itangoii,
>
> > I followed the revised post here.
> >
> >
> https://forum.doozan.com/read.php?3,108294,111084#msg-111084
>
> No you should not. Keep the log of what you did
> successfully, and that will be used to update the
> instruction.
>
> > If I'm not mistaken we did
> > get the box to boot on its own uboot (instead
> of
> > the kwboot) and then flashed it. Could that be
> a
> > problem?
>
> Yes.
>
> So try kwboot into Debian rootfs on USB. Flash
> mtd0 and mtd1. Shut down. And then reboot without
> the USB, and without kwboot. Interrupt serial
> console, and start at Step 2.

Well. that worked to a point. After the box restarted It was visible to the synology assistant, and to the web admin. It of course complained that there was no hard drive it it and I shut down (can be done correctly with the button on the front if you get a good boot) I booted and it asked to migrate the hard drive which is the expected procedure An info button on that page showed me that the MAC address and checksum bit had been successful and was showing the correct MAC from the label but no serial number. I researched that and came up with how to set that and did so. I flashed just mtd3 and it went into a boot loop again failing at the ramdisk (mtd2) with bad CRC.

I've done the same thing from scratch with just mtd2 and with all of them both via tftp and with flashcp with same result.

I kept track of the procedure I used the first time, but can not duplicate the good boot.

Quote

Well. that worked to a point. After the box restarted It was visible to the synology assistant, and to the web admin

So at this point it is working.

The hard drive is not required to run Synology FW. So can you upgrade to what ever the latest FW is? And then after all have been upgraded, start booting with 1 HDD.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

That's the problem, It did start up but then after restarting with a clean hard drive in it, it went into a boot loop. The box has started twice now on successful flashings but after a restart goes into a boot loop. Startup monitoring the console shows it gets through the first two mtds but fails with a bad crc on the third (mtd2).

After that I flashed both ways with tftp and flashcp methods but still a bad crc on mtd2.

Thank you for your patience, after getting it running twice now it falls back to a boot loop after a reboot or two.

this is the procedure I used and the boot after. It seems to go fine, but still fails with the loop of the ramdisk having a bad crc when booting which results in a loop. Can you see anything wrong?

Thanks

root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0
picocom v3.1

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
stopbits are   : 1
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
hangup is      : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv -E
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,
logfile is     : none
initstring     : none
exit_after is  : not set
exit is        : no

Type [C-a] [C-h] to see available commands
Terminal ready
�
         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: Synology Disk Station LE 

U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 0068B3D4

Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz
SysClock = 500Mhz , TClock = 200Mhz 

DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7
DRAM CS[0] base 0x00000000   size 512MB 
DRAM Total size 512MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
Using default environment

[8192kB@f8000000] Flash:  8 MB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
PEX 1: PCI Express Root Complex Interface
PEX interface detected Link X1

Synology Model: DS213
Fan Status: Good

Net:   egiga0 [PRIME], egiga1
Hit any key to stop autoboot:  0 
Marvell>> setenv serverip 192.168.0.11
Marvell>> setenv ipaddr 192.163.0.240
Marvell>> sflash protect off
Marvell>> sflash info

Flash Base Address  : 0xf8000000
Flash Model         : ST N25Q064
Manufacturer ID     : 0x20
Device Id           : 0xba17
Sector Size         : 64K
Number of sectors   : 128
Page Size           : 256
Write Protection    : Off

Marvell>> tftpboot 0x800000 ds213.mtd0
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.240
Filename 'ds213.mtd0'.
Load address: 0x800000
Loading: #################################################################
	 ###################################################
done
Bytes transferred = 589824 (90000 hex)
Marvell>> sflash write 0x800000 0x000000000000 0x00090000
Marvell>> tftpboot 0x800000 ds213.mtd1
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.240
Filename 'ds213.mtd1'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##############################
done
Bytes transferred = 3145728 (300000 hex)
Marvell>> sflash write 0x800000 0x000000090000 0x00300000
Marvell>> tftpboot 0x800000 ds213.mtd2
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.240
Filename 'ds213.mtd2'.
Load address: 0x800000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##########################
done
Bytes transferred = 4456448 (440000 hex)
Marvell>> sflash write 0x800000 0x000000390000 0x00440000
Marvell>> tftpboot 0x800000 ds213.mtd3
Using egiga0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.240
Filename 'ds213.mtd3'.
Load address: 0x800000
Loading: #############
done
Bytes transferred = 65535 (ffff hex)
Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000
Marvell>> 

------------------
boot after flash
-----------------

root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0
picocom v3.1

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
stopbits are   : 1
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
hangup is      : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv -E
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,
logfile is     : none
initstring     : none
exit_after is  : not set
exit is        : no

Type [C-a] [C-h] to see available commands
Terminal ready
�
         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: Synology Disk Station LE 

U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 0068B3D4

Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz
SysClock = 500Mhz , TClock = 200Mhz 

DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7
DRAM CS[0] base 0x00000000   size 512MB 
DRAM Total size 512MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
Using default environment

[8192kB@f8000000] Flash:  8 MB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
PEX 1: PCI Express Root Complex Interface
PEX interface detected Link X1

Synology Model: DS213
Fan Status: Good

Net:   egiga0 [PRIME], egiga1
Hit any key to stop autoboot:  0 
## Booting image at f8090000 ...
   Image Name:   Linux-2.6.32.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1553512 Bytes =  1.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at f8390000 ...
   Image Name:   synology_88f6282_213 25426
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    3297004 Bytes =  3.1 MB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... Bad Data CRC

root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0
....
U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9
....
Hit any key to stop autoboot:  0

At this point, you have booted with u-boot in flash. So don't flash mtd0.

Marvell>> tftpboot 0x800000 ds213.mtd1
Marvell>> tftpboot 0x800000 ds213.mtd2

Flashing was OK for mtd1 and mtd2.

Marvell>> tftpboot 0x800000 ds213.mtd3
Bytes transferred = 65535 (ffff hex)
Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000

But mtd3 does not look right. There is 1 byte missing.

Quote

hex 0x00010000 = decimal 65536

mtd4 has the same problem.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 12/11/2020 05:36PM by bodhi.

Interesting. I never would have seen that. Part of my confusion was that mtd2 is what is getting the crc error, but has never been touched before or after the good boot. Do you suppose mtd3 is causing a shift into the mtd2 area?

I checked the properties on my windows work station and it to sees a discrepancy (see attached pic). I'll assume that's one of those Windows/Linux things and keep the files on the Ubuntu box and do the hex editing there.

Thank you, will update later.

> I checked the properties on my windows work
> station and it to sees a discrepancy (see attached
> pic). I'll assume that's one of those
> Windows/Linux things and keep the files on the
> Ubuntu box and do the hex editing there.

Yes, always do everything in Linux to avoid the problem. Linux is very precise with raw binary data. When you dd something, it is exactly what it is.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I decided to start over and clean up my notes as well. I booted the good box ad dd the mtds'. Then after doing a hex edit on mtd3 fo correct MAC address and serial number I booted the bad box with kwboot and the usb. Logged into Debian with root and root then changed to the /boot directory.

When trying to flash I got......

root@debian:/boot# flash_unlock /dev/mtd0
root@debian:/boot# flashcp -v ds213.mtd0 /dev/mtd0
ds213.mtd0 won't fit into /dev/mtd0!
root@debian:/boot# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00001000 "RedBoot"
mtd1: 00200000 00001000 "zImage"
mtd2: 00140000 00001000 "rd.gz"
mtd3: 00010000 00001000 "vendor"
mtd4: 00020000 00001000 "RedBoot config"
mtd5: 00010000 00001000 "FIS directory"

So somethings not right.

itangoii,

Have you thought about running this box with Debian permanently? we are pretty close to get it running with full functionality. Once we can get network is working, it is basically done.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi guys!
Need help!
My DS213 is bricked!
Please send me dump flash chip or
ds213.mtd0
ds213.mtd1
ds213.mtd2
ds213.mtd3
ds213.mtd4
ds213.mtd5
ds213.mtd6

Best regard



Edited 2 time(s). Last edit at 01/22/2021 10:20AM by AMD.

AMD,

I don't have this box. So hopefully itangoii will read your post and upload the mtd dumps.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi Bodhi!
I will be waiting itangoii :- (