DS210j - flash chip failure and image rebuilding

DS210j, board ADM22L1 v1.3,

Went dead suddenly, currently only blue led blinks. No sings of life from debug console.
Found that flash chip is damaged - stayed quite hot when touched and i wasn't able to read/erase/write it in external programmer due to overcurrent error.

Appeared that i need new chip (25P32) programmed with rebuilt image. Altough i've managed to extract rd and zimage from syno PAT update, i couldn't find bootloader in none of update files. Is it possible to download or compile stock bootloader image intended for this particular board/CPU? (88F6-BIA2)


Another problem was about finding memory layout. Googled for ds210j bootlogs, found something:

0x003c0000-0x00400000 : "RedBoot"
0x00000000-0x00200000 : "zImage"
0x00200000-0x00380000 : "rd.gz"
0x00380000-0x00390000 : "vendor"
0x00390000-0x003b0000 : "RedBoot Config"
0x003b0000-0x003c0000 : "FIS directory"

which is weird because of redboot placed not at 0x00 flash addr.


When looked at bootlogs of other similiar devices, like ds110j:

0x00000000-0x00080000 : "RedBoot"
0x00080000-0x00280000 : "zImage"
0x00280000-0x003c0000 : "rd.gz"
0x003c0000-0x003d0000 : "vendor"
0x003d0000-0x003f0000 : "RedBoot Config"
0x003f0000-0x00400000 : "FIS directory"

This layout seemed more reasonable to me.


Does anyone can confirm first memory layout, or give a hint how to extract such information?



Edited 1 time(s). Last edit at 02/25/2021 03:34PM by twizzter.

twizzter,

> Altough i've managed to
> extract rd and zimage from syno PAT update,
> i couldn't find bootloader in none of update files.
> Is it possible to download or compile stock
> bootloader image intended for this particular
> board/CPU? (88F6-BIA2)

This DS210j board is Marvell Kirkwood 88F6281, so the bootloader for DS213 might work.

> When looked at bootlogs of other similiar
> devices, like ds110j:
>

> 0x00000000-0x00080000 : "RedBoot"
> 0x00080000-0x00280000 : "zImage"
> 0x00280000-0x003c0000 : "rd.gz"
> 0x003c0000-0x003d0000 : "vendor"
> 0x003d0000-0x003f0000 : "RedBoot Config"
> 0x003f0000-0x00400000 : "FIS directory"

>
> This layout seemed more reasonable to me.

Correct.

> Does anyone can confirm first memory layout, or
> give a hint how to extract such information?

This is DS213 mtd layout.

[    7.364601][    T1] 0x000000000000-0x000000080000 : "RedBoot"
[    7.371383][    T1] 0x000000080000-0x000000280000 : "zImage"
[    7.377942][    T1] 0x000000280000-0x0000003c0000 : "rd.gz"
[    7.384453][    T1] 0x0000003c0000-0x0000003d0000 : "vendor"
[    7.391052][    T1] 0x0000003d0000-0x0000003f0000 : "RedBoot config"
[    7.398293][    T1] 0x0000003f0000-0x000000400000 : "FIS directory"

See here how to extract to mtd0 from flash, and how to use serial consle to boot with mtd0.

https://forum.doozan.com/read.php?3,108294,111084#msg-111084

-bodhi
===========================
Forum Wiki
bodhi's corner

Thanks for quick answer Bodhi.

Used kwboot and only kwb which worked was uboot.2015.10-tld-1.nsa310.mtd0.kwb. Other files were not able to boot at all or hanged during ram detection.


So currently i'm at:

U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43 -0800)
ZyXEL NSA310 1-Bay Power Media Server 
 
 
SoC:   Kirkwood 88F6281_A1
DRAM:  256 MiB (ECC not enabled)
WARNING: Caches not enabled
NAND:  0 MiB
*** Warning - readenv() failed, using default environment
 
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
PHY reset timed out
MV88E1318 PHY initialized on egiga0
Hit any key to stop autoboot:  0 
NSA310>

Should i see SPI flash memory in log at this moment? Since old flash chip was fried i'm afraid of damaged CPUs SPI interface. "sflash info" gives unknown command.

Noob question - since i found working uboot image, can i just merge it with DS210's dedicated rd, zimage and flash it?



Edited 1 time(s). Last edit at 03/01/2021 02:01PM by twizzter.

twizzter,

>
> Used kwboot and only kwb which worked was
> uboot.2015.10-tld-1.nsa310.mtd0.kwb. Other files
> were not able to boot at all or hanged during ram
> detection.

That's good to hear. But have you tried uboot.2017.07-tld-1.t5325.mtd0.kwb or uboot.2017.07-tld-1.dreamplug.mtd0.kwb?


Note that it's not only the RAM size, but the DDR type also, that caused the hang. Usually we can boot a larger RAM Kirkwood u-boot on a box, if the DDR is the same type and speed (e.g. DDR2 vs DDR3)

> So currently i'm at:
> U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43
> -0800)
> ZyXEL NSA310 1-Bay Power Media Server
>
>
> SoC: Kirkwood 88F6281_A1
> DRAM: 256 MiB (ECC not enabled)
> WARNING: Caches not enabled
> NAND: 0 MiB
> *** Warning - readenv() failed, using default
> environment
>
> In: serial
> Out: serial
> Err: serial
> Net: egiga0
> PHY reset timed out
> MV88E1318 PHY initialized on egiga0
> Hit any key to stop autoboot: 0
> NSA310>

Great 1st step in unbricking this box!

> Should i see SPI flash memory in log at this
> moment? Since old flash chip was fried i'm afraid
> of damaged CPUs SPI interface. "sflash info" gives
> unknown command.

No, since the NSA310 use NAND flash, there is no SPI configured in this u-boot.

> Noob question - since i found working uboot image,
> can i just merge it with DS210's dedicated rd,
> zimage and flash it?

It will not work (the u-boot image was built for NAND flash).

At this point, the best next step is:

1. Find the mtd0 backup for this 210j box. kwboot it and flash it in u-boot console.

or

2. Boot into Debian on USB from the NSA310 u-boot. We need the DTB for this DS210j box from somewhere. Once you are in Debian, it is easier to make sure the SPI flash is working and can be flashed to. There might be a Synology procdure to restore to factory (either in u-boot or in Linux).

-bodhi
===========================
Forum Wiki
bodhi's corner

Thanks for explanation.

Quote
bodhi
have you tried
> uboot.2017.07-tld-1.t5325.mtd0.kwb or
> uboot.2017.07-tld-1.dreamplug.mtd0.kwb?

Tried as well. T5325 does not boot, dreamplug stops at ram detection. Pitty, because SPI was ready according to log ;)

Dumped flash from working 110j to try its uboot, no luck again.

At this moment i'm running out of ideas. Probably need to dump uboot from working unit or...Compile my own one?

Googled for syno uboots, found something at https://github.com/zkrx/u-boot-syno I've seen scripts named "ds210j.sh" Could it be useful to cook ubot image?

twizzter,

Try kwboot with this file:

https://github.com/zkrx/u-boot-syno/blob/master/image/mtd0.dmp.orig

-bodhi
===========================
Forum Wiki
bodhi's corner

Unfortunately, box does not boot from this image. Weird, as according to Syno's website 210j and 211j are equipped with same hw base components - 88F6281+DDR2 128 MB.

Edit:
Tried to kickstart using NSA310 uboot and TFTPd 210's zimage+rd:

U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43 -0800)
ZyXEL NSA310 1-Bay Power Media Server 
 
 
SoC:   Kirkwood 88F6281_A1
DRAM:  256 MiB (ECC not enabled)
WARNING: Caches not enabled
NAND:  0 MiB
*** Warning - readenv() failed, using default environment
 
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
PHY reset timed out
MV88E1318 PHY initialized on egiga0
Hit any key to stop autoboot:  0 
NSA310> setenv ipaddr 192.168.1.50
NSA310> setenv serverip 192.168.1.10
NSA310> tftpboot 0x2000000 zImage
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'zImage'.
Load address: 0x2000000
Loading: T 
 
TFTP error: First block is not block 1 (0)
Starting again
 
NSA310> tftpboot 0x2000000 zImage
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'zImage'.
Load address: 0x2000000
Loading: #################################################################
	 #########################################
	 7.5 MiB/s
done
Bytes transferred = 1551032 (17aab8 hex)
NSA310> tftpboot 0x8000000 rd.bin
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'rd.bin'.
Load address: 0x8000000
Loading: #################################################################
	 ###
	 7.5 MiB/s
done
Bytes transferred = 995110 (f2f26 hex)
NSA310> bootm 0x2000000 0x8000000
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-2.6.32.12
   Created:      2016-04-26   8:30:18 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1550968 Bytes = 1.5 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 08000000 ...
   Image Name:   synology_88f6281_210j 5967
   Created:      2016-04-26   9:42:51 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    995046 Bytes = 971.7 KiB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
Using machid 0x118f from environment
 
Starting kernel ...
 
Uncompressing Linux... done, booting the kernel.

And that's it. No change after 20min, i suppose won't boot :)



Edited 1 time(s). Last edit at 03/05/2021 01:59PM by twizzter.