DS210j - flash chip failure and image rebuilding

DS210j, board ADM22L1 v1.3,

Went dead suddenly, currently only blue led blinks. No sings of life from debug console.
Found that flash chip is damaged - stayed quite hot when touched and i wasn't able to read/erase/write it in external programmer due to overcurrent error.

Appeared that i need new chip (25P32) programmed with rebuilt image. Altough i've managed to extract rd and zimage from syno PAT update, i couldn't find bootloader in none of update files. Is it possible to download or compile stock bootloader image intended for this particular board/CPU? (88F6-BIA2)


Another problem was about finding memory layout. Googled for ds210j bootlogs, found something:

0x003c0000-0x00400000 : "RedBoot"
0x00000000-0x00200000 : "zImage"
0x00200000-0x00380000 : "rd.gz"
0x00380000-0x00390000 : "vendor"
0x00390000-0x003b0000 : "RedBoot Config"
0x003b0000-0x003c0000 : "FIS directory"

which is weird because of redboot placed not at 0x00 flash addr.


When looked at bootlogs of other similiar devices, like ds110j:

0x00000000-0x00080000 : "RedBoot"
0x00080000-0x00280000 : "zImage"
0x00280000-0x003c0000 : "rd.gz"
0x003c0000-0x003d0000 : "vendor"
0x003d0000-0x003f0000 : "RedBoot Config"
0x003f0000-0x00400000 : "FIS directory"

This layout seemed more reasonable to me.


Does anyone can confirm first memory layout, or give a hint how to extract such information?



Edited 1 time(s). Last edit at 02/25/2021 03:34PM by twizzter.

twizzter,

> Altough i've managed to
> extract rd and zimage from syno PAT update,
> i couldn't find bootloader in none of update files.
> Is it possible to download or compile stock
> bootloader image intended for this particular
> board/CPU? (88F6-BIA2)

This DS210j board is Marvell Kirkwood 88F6281, so the bootloader for DS213 might work.

> When looked at bootlogs of other similiar
> devices, like ds110j:
>

> 0x00000000-0x00080000 : "RedBoot"
> 0x00080000-0x00280000 : "zImage"
> 0x00280000-0x003c0000 : "rd.gz"
> 0x003c0000-0x003d0000 : "vendor"
> 0x003d0000-0x003f0000 : "RedBoot Config"
> 0x003f0000-0x00400000 : "FIS directory"

>
> This layout seemed more reasonable to me.

Correct.

> Does anyone can confirm first memory layout, or
> give a hint how to extract such information?

This is DS213 mtd layout.

[    7.364601][    T1] 0x000000000000-0x000000080000 : "RedBoot"
[    7.371383][    T1] 0x000000080000-0x000000280000 : "zImage"
[    7.377942][    T1] 0x000000280000-0x0000003c0000 : "rd.gz"
[    7.384453][    T1] 0x0000003c0000-0x0000003d0000 : "vendor"
[    7.391052][    T1] 0x0000003d0000-0x0000003f0000 : "RedBoot config"
[    7.398293][    T1] 0x0000003f0000-0x000000400000 : "FIS directory"

See here how to extract to mtd0 from flash, and how to use serial consle to boot with mtd0.

https://forum.doozan.com/read.php?3,108294,111084#msg-111084

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thanks for quick answer Bodhi.

Used kwboot and only kwb which worked was uboot.2015.10-tld-1.nsa310.mtd0.kwb. Other files were not able to boot at all or hanged during ram detection.


So currently i'm at:

U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43 -0800)
ZyXEL NSA310 1-Bay Power Media Server 
 
 
SoC:   Kirkwood 88F6281_A1
DRAM:  256 MiB (ECC not enabled)
WARNING: Caches not enabled
NAND:  0 MiB
*** Warning - readenv() failed, using default environment
 
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
PHY reset timed out
MV88E1318 PHY initialized on egiga0
Hit any key to stop autoboot:  0 
NSA310>

Should i see SPI flash memory in log at this moment? Since old flash chip was fried i'm afraid of damaged CPUs SPI interface. "sflash info" gives unknown command.

Noob question - since i found working uboot image, can i just merge it with DS210's dedicated rd, zimage and flash it?



Edited 1 time(s). Last edit at 03/01/2021 02:01PM by twizzter.

twizzter,

>
> Used kwboot and only kwb which worked was
> uboot.2015.10-tld-1.nsa310.mtd0.kwb. Other files
> were not able to boot at all or hanged during ram
> detection.

That's good to hear. But have you tried uboot.2017.07-tld-1.t5325.mtd0.kwb or uboot.2017.07-tld-1.dreamplug.mtd0.kwb?


Note that it's not only the RAM size, but the DDR type also, that caused the hang. Usually we can boot a larger RAM Kirkwood u-boot on a box, if the DDR is the same type and speed (e.g. DDR2 vs DDR3)

> So currently i'm at:
> U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43
> -0800)
> ZyXEL NSA310 1-Bay Power Media Server
>
>
> SoC: Kirkwood 88F6281_A1
> DRAM: 256 MiB (ECC not enabled)
> WARNING: Caches not enabled
> NAND: 0 MiB
> *** Warning - readenv() failed, using default
> environment
>
> In: serial
> Out: serial
> Err: serial
> Net: egiga0
> PHY reset timed out
> MV88E1318 PHY initialized on egiga0
> Hit any key to stop autoboot: 0
> NSA310>

Great 1st step in unbricking this box!

> Should i see SPI flash memory in log at this
> moment? Since old flash chip was fried i'm afraid
> of damaged CPUs SPI interface. "sflash info" gives
> unknown command.

No, since the NSA310 use NAND flash, there is no SPI configured in this u-boot.

> Noob question - since i found working uboot image,
> can i just merge it with DS210's dedicated rd,
> zimage and flash it?

It will not work (the u-boot image was built for NAND flash).

At this point, the best next step is:

1. Find the mtd0 backup for this 210j box. kwboot it and flash it in u-boot console.

or

2. Boot into Debian on USB from the NSA310 u-boot. We need the DTB for this DS210j box from somewhere. Once you are in Debian, it is easier to make sure the SPI flash is working and can be flashed to. There might be a Synology procdure to restore to factory (either in u-boot or in Linux).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thanks for explanation.

Quote
bodhi
have you tried
> uboot.2017.07-tld-1.t5325.mtd0.kwb or
> uboot.2017.07-tld-1.dreamplug.mtd0.kwb?

Tried as well. T5325 does not boot, dreamplug stops at ram detection. Pitty, because SPI was ready according to log ;)

Dumped flash from working 110j to try its uboot, no luck again.

At this moment i'm running out of ideas. Probably need to dump uboot from working unit or...Compile my own one?

Googled for syno uboots, found something at https://github.com/zkrx/u-boot-syno I've seen scripts named "ds210j.sh" Could it be useful to cook ubot image?

twizzter,

Try kwboot with this file:

https://github.com/zkrx/u-boot-syno/blob/master/image/mtd0.dmp.orig

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Unfortunately, box does not boot from this image. Weird, as according to Syno's website 210j and 211j are equipped with same hw base components - 88F6281+DDR2 128 MB.

Edit:
Tried to kickstart using NSA310 uboot and TFTPd 210's zimage+rd:

U-Boot 2015.10-tld-1 (Nov 06 2015 - 16:19:43 -0800)
ZyXEL NSA310 1-Bay Power Media Server 
 
 
SoC:   Kirkwood 88F6281_A1
DRAM:  256 MiB (ECC not enabled)
WARNING: Caches not enabled
NAND:  0 MiB
*** Warning - readenv() failed, using default environment
 
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
PHY reset timed out
MV88E1318 PHY initialized on egiga0
Hit any key to stop autoboot:  0 
NSA310> setenv ipaddr 192.168.1.50
NSA310> setenv serverip 192.168.1.10
NSA310> tftpboot 0x2000000 zImage
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'zImage'.
Load address: 0x2000000
Loading: T 
 
TFTP error: First block is not block 1 (0)
Starting again
 
NSA310> tftpboot 0x2000000 zImage
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'zImage'.
Load address: 0x2000000
Loading: #################################################################
	 #########################################
	 7.5 MiB/s
done
Bytes transferred = 1551032 (17aab8 hex)
NSA310> tftpboot 0x8000000 rd.bin
Using egiga0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.50
Filename 'rd.bin'.
Load address: 0x8000000
Loading: #################################################################
	 ###
	 7.5 MiB/s
done
Bytes transferred = 995110 (f2f26 hex)
NSA310> bootm 0x2000000 0x8000000
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-2.6.32.12
   Created:      2016-04-26   8:30:18 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1550968 Bytes = 1.5 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 08000000 ...
   Image Name:   synology_88f6281_210j 5967
   Created:      2016-04-26   9:42:51 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    995046 Bytes = 971.7 KiB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
Using machid 0x118f from environment
 
Starting kernel ...
 
Uncompressing Linux... done, booting the kernel.

And that's it. No change after 20min, i suppose won't boot :)



Edited 1 time(s). Last edit at 03/05/2021 01:59PM by twizzter.

Update: I searched within various PAT update files and found DS212j uboot, thought it's worth trying because of similar CPU/mem architecture. I flashed memory with image composed of 212jboot+210jrd+210jzimage. Device boots but hangs up on kernel boot:

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: Synology Disk Station LE

U-Boot 1.1.4 (Apr  3 2012 - 20:15:28) Marvell version: 3.4.4

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 0068B43C

Soc: 88F6281 A1 (DDR2)
CPU running @ 800Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz

DRAM CAS Latency = 6 tRP = 6 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 128MB
DRAM CS[1] base 0x08000000   size 128MB
DRAM Total size 256MB  16bit width
[4096kB@f8000000] Flash:  4 MB
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
Using default environment


CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled

Module 1 is AUDIO

USB 0: host mode
PEX 0: interface detected no Link.

Synology Model: DS212j
Fan Status: Not Good
Fan 1: Not Good

Net:   egiga0 [PRIME], egiga1
Hit any key to stop autoboot:  0
## Booting image at f8080000 ...
   Image Name:   Linux-2.6.32.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1550968 Bytes =  1.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at f8280000 ...
   Image Name:   synology_88f6281_210j 5967
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    995046 Bytes = 971.7 kB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Running out of ideas. Would really appreciate if somebody could help with dumped 210j bootloader image.

twizzter,

You should add earlyprintk to the bootargs. If this Synology kernel was built with that, then hopefully it will show more log.

Interrupt u-boot countdown

Quote

> U-Boot 1.1.4 (Apr 3 2012 - 20:15:28) Marvell version: 3.4.4
....
> Hit any key to stop autoboot: 0

And

printenv

Let's see what the bootargs look like, and then add earlyprintk=serial to the end of that.

If you are not sure then post the serial log with printenv here, I'll help changing the envs.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thanks for the hint! Printenv says:

Marvell>> printenv
bootcmd=bootm F8080000 F8280000
baudrate=115200
loads_echo=0
ipaddr=192.168.101.224
serverip=192.168.101.111
rootpath=/mnt/ARM_FS/
netmask=255.255.0.0
stdin=serial
stdout=serial
stderr=serial
console=console=ttyS0,115200 mtdparts=cfi_flash:0x380000(root),0x80000(uboot)ro
mainlineLinux=no
CASset=min
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
MALLOC_len=1
ethprime=egiga0
netbsd_en=no
vxworks_en=no
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:egiga0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
bootdelay=3
disaMvPnp=no
mvPhoneConfig=mv_phone_config=dev0:fxs,dev1:fxo
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
bootargs=console=ttyS0,115200 ip=off initrd=0x00800040,4M root=/dev/md0 rw syno_hw_version=DS212j ihd_num=2 netif_num=1
ethact=egiga0
ethaddr=00:00:5f:ff:00:00
eth1addr=00:01:5f:ff:00:01

Environment size: 1095/4092 bytes

I have added earlyprint by doing "set earlyprintk serial" then booted by "bootm F8080000 F8280000", but seen no details upon booting.

The earlyprintk is part of the kernel bootargs.

Currently

bootargs=console=ttyS0,115200 ip=off initrd=0x00800040,4M root=/dev/md0 rw syno_hw_version=DS212j ihd_num=2 netif_num=1

At the u-boot prompt,

setenv bootargs 'console=ttyS0,115200 ip=off initrd=0x00800040,4M root=/dev/md0 rw syno_hw_version=DS212j ihd_num=2 netif_num=1 earlyprintk=serial'

And continue booting

boot

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Apparently kernel does not contain earlyprintk:

Marvell>> setenv bootargs 'console=ttyS0,115200 ip=off initrd=0x00800040,4M root=/dev/md0 rw syno_hw_version=DS212j ihd_num=2 netif_num=1 earlyprintk=serial'
Marvell>> printenv
bootcmd=bootm F8080000 F8280000
baudrate=115200
loads_echo=0
ipaddr=192.168.101.224
serverip=192.168.101.111
rootpath=/mnt/ARM_FS/
netmask=255.255.0.0
stdin=serial
stdout=serial
stderr=serial
console=console=ttyS0,115200 mtdparts=cfi_flash:0x380000(root),0x80000(uboot)ro
mainlineLinux=no
CASset=min
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
MALLOC_len=1
ethprime=egiga0
netbsd_en=no
vxworks_en=no
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:egiga0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end) $(mvPhoneConfig); bootm 0x2000000;
bootdelay=3
disaMvPnp=no
mvPhoneConfig=mv_phone_config=dev0:fxs,dev1:fxo
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
ethact=egiga0
ethaddr=00:00:5f:ff:00:00
eth1addr=00:01:5f:ff:00:01
bootargs=console=ttyS0,115200 ip=off initrd=0x00800040,4M root=/dev/md0 rw syno_hw_version=DS212j ihd_num=2 netif_num=1 earlyprintk=serial

Environment size: 1114/4092 bytes
Marvell>> bootm F8080000 F8280000
## Booting image at f8080000 ...
   Image Name:   Linux-2.6.32.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1550968 Bytes =  1.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at f8280000 ...
   Image Name:   synology_88f6281_210j 5967
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    995046 Bytes = 971.7 kB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Aditionally, mtest hangs up at "Pattern 00000000 Writing..." - not sure if it happens because of obvious hardware differences between ds212j(256 MB) bootloader running on 210j board(128MB) or maybe hardware is just damaged.

twizzter,

> Apparently kernel does not contain earlyprintk:

Too bad, that makes debugging quite difficult.


> Aditionally, mtest hangs up at "Pattern 00000000
> Writing..." - not sure if it happens because of
> obvious hardware differences between ds212j(256
> MB) bootloader running on 210j board(128MB) or
> maybe hardware is just damaged.

Usually, once the bootloader has started and run OK, when it loads the kernel, the memory is the real capacity. And it passes that to the kernel.

But in case boot loader behaves badly, then if the board has less RAM than the bootloader thinks then the kernel would freeze like what we see here.

So it is best that you find to correct uboot image and kwboot with that.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)