Synology DS218 Bricked

Hi all, can you please someone help me with rescue my Synology DS218? During update from 6.2 to 7.0 there was power outage, after that my Synology does not start. I am able to connect the serial line, here is what i see after power on:

C3h
hwsetting size: 00000B94
C4
f
5-5
Goto FSBL: 0x10100000
<=============================================>
fsbl_main: sys_secure_type = 0x0000BEEE
fsbl_main: sys_boot_type = 0x00000001
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000
sys_hwsetting_size:00000BC0
sys_bootcode_size:00062C80
sys_secure_fsbl_size:00010B00
sys_secure_os_size:00000000
sys_bl31_size:00000000
sys_rsa_key_fw_size:00000000
sys_rsa_key_tee_size:00000000
sys_rescue_size:00026388

HwSetting:
hwsetting_blk_no:88120800
hwsetting_total_size:00000C40
hwsetting_blk_count:00000C40

Bootcode:
bootcode_blk_no:88121440
bootcode_total_size:00062CA0
bootcode_blk_count:00062CA0

FSBL:
secure_fsbl_blk_no:881840E0
secure_fsbl_total_size:00010B20
secure_fsbl_blk_count:00010B20

TEE OS:
secure_os_blk_no:88194C00
secure_os_total_size:00000000
secure_os_blk_count:00000000

BL31:
bl31_blk_no:88194C00
bl31_total_size:00000000
bl31_blk_count:00000000

RSA Key Fw:
rsa_key_fw_blk_no:88194C00
rsa_key_fw_total_size:00000000
rsa_key_fw_blk_count:00000000

RSA Key TEE:
rsa_key_tee_blk_no:88194C00
rsa_key_tee_total_size:00000000
rsa_key_tee_blk_count:00000000

Rescue:
rescue_blk_no:88194C00
rescue_total_size:000263A8
rescue_blk_count:000263A8
********** FW_TYPE_BOOTCODE **********
fwInfo->fwType: 00000001
fwInfo->isGolden: 00000001
fwInfo->ddrReadAddr: 00520000
fwInfo->ddrDestAddr: 00020000
fwInfo->flashType: 00000001
fwInfo->flashUnitSize: 00000001
fwInfo->flashOffset: 88121440
fwInfo->dataSize: 00062CA0
body_size:00062C80
flash_unit_no:88121440
flash_unit_count:00062CA0
real_size:00062C68
sha256 Fw
j bootcode jump address:00020000
64b


U-Boot 2012.07-gcde0b30 (Oct 18 2018 - 14:09:16)

CPU  : Cortex-A53 quad core - AARCH32
Board: Realtek QA Board
DRAM:  2 GiB
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
nor flash id [0x00c22017]
sector 256k en: 0
sector  64k en: 1
sector  32k en: 0
sector   4k en: 1
page_program  : 1
max capacity  : 0x00800000
spi type name : MX 64Mbit
Factory: NOR
Factory: pp:1, seq#:0xa, size:0x400
------------can't find tmp/factory/000BootParam.h
[ENV] read_env from factory failed
[ENV] Using default environment variables

In:    serial
Out:   serial
Err:   serial
RTK_set_power_saving_config:Default POWERE_ON_S5 not set

Synology Model: DS218

SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
*** Reboot-Action invalid ***
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery
======== Checking into android recovery ====

check_acpu_boot_notification, boot-reason : 0x28864000
check_rtc_expire:RTC not detected in factory
customize_check_normal_boot: ACRECOVERY detected
customize_check_normal_boot: device normal boot from AC-Recovery

SPI start addr(remap) = 0x88200000
DDR start addr        = 0x0b000000
reading byte size     = 0x002f0000

SPI start addr(remap) = 0x881c0000
DDR start addr        = 0x0b000000
reading byte size     = 0x00040000
Uncompressed size: 785544 = 0xBFC88

SPI start addr(remap) = 0x88100000
DDR start addr        = 0x01f00000
reading byte size     = 0x00010000

SPI start addr(remap) = 0x884f0000
DDR start addr        = 0x02200000
reading byte size     = 0x003ff000
Start Boot Setup ...
Start Audio Firmware ...
Start A/V Firmware ...
hdbocndcdi1_nmg]o d1e2 9[50 x0ch7:i ps
0iClfta:s s6i flyBeonngtdih:n g2 ]
 P00000g8m0t0_,t ensumt i=ng   r0ext0u00r0n0s0 0001
urB (PAc)
p _[vFaW]lk:y [li0xn0_0b]r iangu tuo
[ nhewsw_evtatli:n g
_0x02F]i nfisohr ceky_plwimn
 bring_temp hwsetting
[ACPU] Set protect, start: 0x00000000 end: 0x00001000 moduleid:6
HDMI Raw Enable: AC3 DTS MPEG2 AAC DDP

SPDIF Raw Enable: AC3 DTS MPEG2 AAC

Force 2ch Format: DTS DTSHD AC3 DDP MLP AAC WMAPRO


@@@@@@@One Step TV System magic number = 0xffffffff, addr = 0xa001f800@@@@@@@

@@@@One Step magic number not match! use fw default TV System!
HDMIOff = 0
[VO]vo->is_hdmi_off_clock_on:0
[VO_SetVideoStandard]st 25 p 1 1 0
[VO_SetVideoStandard]dp_standard:1067002368 data0  0x00000004 data1  0x00000000
[VO_SetVideoStandard]HDMIoff 0 is_tve_on 0 user_cvbs_off 1
lvds.format 0 port_setting  0x00000381 lvds_wb 0
[VO setTVStandard 25 3D 0 0]

(TVE) TVE_DAC_mode 0,cmd->enProg 1!!
~~comp 0, ch2 0, mode_3D 0!!
SetVideoStandard return!

(VO_ConfigHDMI_InfoFrame) L:264, is_hdmi_plugin 1, hdmiMode 1!!Mode 1 dataByte1  0x00000040  0x000000a8  0x00000000
dataByte4  0x00000000  0x00000000 int0  0x00000001

(HDMI_3D) mode 1, HDMI_gen 1, En_3D 0, Format_3D 0 scramble:0!!RGB_or_YCbCr:2 Pixel_Colocrt:2 Deep_Color:0 Deep_Depth:0
@@vo->hdr_ctrl.trans:0 HDMI_gen_dynamic_range_master_infoframe
@@set C1C0 to 2(BT709),set EC2EC1EC0 to 0

 go back SET_HDMI!!boot_info  0xa0000000 magic  0xffffffff en 255


EXPORT ENV AT 0x10000000, ENV size info:0x00002000,0x00001ffc,0x00000004
rtk_preload_bootimages_spi : header info
 0x00000bc0 0x00062c80 0x00010b00 0x00000000
 0x00000000 0x00000000 0x00000000 0x00026388
 0x00000000
rtk_preload_bootimages_spi : load U-Boot 64 from 0x88194c00 to 0x01500000 with size 0x00026388
check factory flag
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x00028000
Jumping to 2nd bootloader...


U-Boot 2015.07-g428cfe7-dirty (May 16 2018 - 10:29:38 +0800)

CPU  : Cortex-A53 Quad Core
Board: Realtek QA Board
DRAM:  2 GiB
mapping memory 0x20000000-0x40000000 non-cached
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
rtk_plat_set_fw not port yet, use default configs
Not raw Image, Starting Decompress Image.gz...


Error: Bad gzipped data
Decompress FAIL!!
ERROR do_booti failed!
Realtek>

Realtek> printenv
ata_hdd_detect=syno_hdd_detect=4,5
ata_hdd_enable=syno_hdd_enable=85,86
baudrate=115200
bootargs=ip=off console=ttyS0,115200 root=/dev/md0 rw syno_hdd_detect=4,5 syno_hdd_enable=85,86 syno_castrated_xhc=xhci-hcd.5.auto@1 HddHotplug=2 syno_usb_vbus_gpio=23@xhci-hcd.2.auto@0,17@xhci-hcd.5.auto@0,22@xhci-hcd.8.auto@0 syno_hw_version=DS218 hd_power_on_seq=2 ihd_num=2 netif_num=1 audio_version=1012363 syno_fw_version=M.506 U-boot=2012.07-gcde0b30 (Oct 18 2018 - 14:09:16)
bootcmd=bootr
bootcode2nd_loadaddr=0x00021000
bootcode2ndtmp_loadaddr=0x01500000
bootdelay=0
ethact=r8168#0
ethaddr=00:10:20:30:40:50
fdt_loadaddr=0x01F00000
gatewayip=192.168.100.254
ipaddr=192.168.100.1
kernel_loadaddr=0x03000000
mtd_part=mtdparts=rtk_nand:
netmask=255.255.255.0
rescue_audio=bluecore.audio
rescue_dtb=rescue.sata.dtb
rescue_rootfs=rescue.root.sata.cpio.gz_pad.img
rescue_vmlinux=sata.uImage
rootfs_loadaddr=0x02200000
rtk_spi_boot=rtkspi read 0x00100000 0x0b000000 0x002f0000;lzmadec 0x0b000000 0x03000000 0x002f0000;rtkspi read 0x000c0000 0x0b000000 0x00040000;lzmadec 0x0b000000 0x01b00000 0x00040000;rtkspi read 0x00000000 0x01f00000 0x00010000;rtkspi read 0x003f0000 0x02200000 0x003ff000
serverip=192.168.100.2
syno_boot_dev=/dev/md0
syno_bootargs=env set bootargs ip=off console=ttyS0,115200 root=$syno_boot_dev rw $ata_hdd_detect $ata_hdd_enable $syno_usb_vbus_setting $syno_castrated_xhc_setting $syno_extra_args $syno_vbus_setting syno_hw_version=$syno_hw_version hd_power_on_seq=$syno_hdd_powerup_seq ihd_num=$syno_hdd_powerup_seq netif_num=$syno_net_if_num $syno_phys_memsize $syno_ahci_remap audio_version=1012363 syno_fw_version=M.506
syno_castrated_xhc_setting=syno_castrated_xhc=xhci-hcd.5.auto@1
syno_extra_args=HddHotplug=2
syno_hdd_powerup_seq=2
syno_hw_version=DS218
syno_net_if_num=1
syno_vbus_setting=syno_usb_vbus_gpio=23@xhci-hcd.2.auto@0,17@xhci-hcd.5.auto@0,22@xhci-hcd.8.auto@0

Environment size: 1961/8188 bytes

Then i downloaded DS218 firmware pat file, untar it and send zImage file to the Synology by serial line - could not start

Realtek> loadb
## Ready for binary (kermit) download to 0x03000000 at 115200 bps...
## Total Size      = 0x002d8215 = 2982421 Bytes
## Start Addr      = 0x03000000
Realtek> bootm
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Realtek> bootm 0x03000000
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Realtek> booti 0x03000000
Not raw Image, Starting Decompress Image.gz...


Error: Bad gzipped data
Decompress FAIL!!
Realtek>

Can you please give me an advice or point what i should do next?
Thanks a lot!

HerdekDedek,

I don't have the Realtek SoC Synology, so not familiar with its FW.

Base on this error:

------------can't find tmp/factory/000BootParam.h
[ENV] read_env from factory failed
[ENV] Using default environment variables

All I can recommend is that, perhaps you can find a bootlog with envs listing on a good DS218 box and see if they are the same as one you've listed above.

Realtek> printenv

Usually the u-boot internal environment variables are not what the box u-boot expects to see. Most implementations of u-boot use a default envs image that has necessary settings to boot the box.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

@HerdekDedek
My DS218 has damaged SPI Flash memory (MX25L6433F) and can't be used. I have replaced it with a brand new but downloaded dump is unfortunatelly partialy damaged too. I'm trying to restore u-boot but without luck.

C1:80000000
C2
?
C3h
hwsetting size: 00000B94
C4
f
5-5verify fsbl fail
0000003BC7
C1:80000000
C2
?uu3-1

==========SPI chip desoldered============

C1:80000000
C2
?
C3h0000009
C1:80000000
C2
?uu3-1

=========================================

I have access to d/g/r> shell and DS respond to Kylin USB MP Tool (Realtek) on rear USB3.0 port. I think we need dump from working machine, replace MAC address + S/N (calculate checksum) and upload it... Another two cases with non working DS (another models but with same RTD1296 as SoC) that I found on the internet was repaired by the same way. Attempts to restore bootloader / kernel failed.

Ace Ventura, have you managed to recover that device? Same problem here.
I've extracted uboot, zimage and RD from pat file, rebuilded flash image but device wont start, ending with 5-5verify fsbl fail as well.

Sniffed booting process using logic analyzer:
-at first CPU reads data block 0x20800-0x2143C
-next, reads longer block 0x084060-0x94D60

Both steps seemed to be a proper readout from bootloader area (i've compared logged data with source bin)
Aditionally i made a compare between "old" bricked dump and fresh uboot file - whole bootloader area (0x0-0xF9777) looked identical - i suspect issues are not caused by damaged uboot, but maybe something else.
Tried with multiple versions of bootloader (found at least two different uboot files during fiddling inside pat files)
Appears that cpu doesn't proceed outside of bootloader code area.

What could be wrong with virgin uboot, extracted from PAT?



Edited 2 time(s). Last edit at 11/18/2021 04:55AM by twizzter.

twizzter:
Unfortunately I have not been able to repair the NAS yet. The u-boot record extracted from the archive is the same as in flash memory too. I uploaded the original read content to uloz.to - you can try to compare it. Your suspicion that the problem lies elsewhere will be correct. There's probably some other check, as in the form of a CRC sum for the serial number.

EEPROM dump

Thanks for your reply.

Did a quick insight into dumps we have now.
Datablocks 0x20800-0x2143C and 0x084060-0x94D60 are the same.
Since both of our devices are bricked, this knowledge does not solve anything ;)

Quote

There's probably some other check, as in the form of a CRC sum for the serial number.

In my case CPU hasn't proceed to the readout of a vendor area, and dump you have provided appears to have proper MAC, S/N and checksums as well. Haven't found more of S/N or MAC instances in file.

That's weird. Even new, empty flash chip filled only with virgin-PAT-extracted-bootloader fails to verify...bootloader :)
Hardware failure? Couldn't find much information about RTD1296 booting process.


I suppose the only rescue would be to obtain a full dump from working device, check if it runs at all on another device, and modify it later to have proper MAC and S/N.

I just found a post on a another website with the exact same ISSUE and he believes it is a ram memory related issue. However, the processor may also be at fault.

I also find Realtek Bootcode Manual with detailed instructions.

I tried to search the Russian sites as well, but I couldn't find any image. I'll put the device in a drawer and see what next.

I took a shot and replaced ram chips transplanted from cheap laptop ram module. No luck.
Seems like faulty CPU.
Aliexpress offers those, marked as 1296PB-VA1-CG and 1296PB-VB0-CG.

Marking on mine was:
RTD1296PB
I61CCE2
GJ03A1

Guess i need NDA'd datasheet to check for differences between VA1/VB0 versions



Edited 1 time(s). Last edit at 01/27/2022 02:48PM by twizzter.

Same problem here with DS118. RAM already replaced without any change.
Interesting fact, when I first got the device, it sometimes (1 out of 10) booted without any issue until it stuck unresponsive after some minutes.
Maybe some kind of unstable voltage issue one cpu or mem line?

Replacing the CPU worked in my case. Not sure if reballing of old one could fix it, or maybe chip itself was faulty.



Edited 1 time(s). Last edit at 12/02/2022 06:15PM by twizzter.