Welcome! Log In Create A New Profile

Advanced

Unbrick Synology DS918+

Posted by superchromix 
Unbrick Synology DS918+
December 10, 2021 10:33AM
Hi,

I'm attempting to unbrick a Synology DS918+. Purchased this unit second hand, and it arrived DOA. No information on its history.

Upon connecting power and pressing the power button, the blue power light switches on and blinks. The fans spin up. The unit does not beep, and the blue light blinks endlessly. The network connection is never active and the hard disk activity lights to not illuminate.

I have connected to the serial port header through an opening on the bottom of the unit. As described elsewhere, I connected to pins 2, 4, and 6 using a USB to UART adapter. The connection is correct, as I am able to test it using an identical, working, DS918+ unit.

On the working unit I get a long boot sequence output that starts with the following text:

                             GNU GRUB  version 2.00

   Press "CTRL-C" for boot menu or it boots automatically in 0s.
  Booting `SYNOLOGY_2'

  Checking file [/zImage]...Passed.
  Checking file [/rd.gz]...Passed.

          Serial: xxxxxxxxxxxxx
   Custom Serial: Empty or invalid checksum.
            MAC1: xxxxxxxxxxxx
            MAC2: xxxxxxxxxxxx
            MAC3: Empty or invalid checksum.
            MAC4: Empty or invalid checksum.
            MAC5: Empty or invalid checksum.
            MAC6: Empty or invalid checksum.
            MAC7: Empty or invalid checksum.
            MAC8: Empty or invalid checksum.
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.4.59+ (root@build3) (gcc version 4.9.3 20150311 (prerelease) (crosstool-NG 1.20.0) ) #25556 SMP PREEMPT Thu Mar 18 13:00:35 CST 2021
[    0.000000] Command line: root=/dev/md0 earlyprintk=apl console=ttyS2,115200n8 ihd_num=4 netif_num=2 HddHotplug=1 SataPortMap=23 sata_remap=0>2:1>3:2>0:3>1 syno_hw_version=DS918+ vender_format_version=2 syno_hdd_detect=18,179,176,175 syno_hdd_enable=21,20,19,9 syno_usb_vbus_gpio=13@0000:00:15.0@1,11@0000:00:15.0@2 sn=xxxxxxxxxxxxx macs=xxxxxxxxxxxx,xxxxxxxxxxxx
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000] x86/fpu: xstate_offset[3]:  960, xstate_sizes[3]:   64
[    0.000000] x86/fpu: xstate_offset[4]: 1024, xstate_sizes[4]:   64
[    0.000000] x86/fpu: Supporting XSAVE feature 0x01: 'x87 floating point registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x02: 'SSE registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x08: 'MPX bounds registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x10: 'MPX CSR'
[    0.000000] x86/fpu: Enabled xstate features 0x1b, context size is 1088 bytes, using 'standard' format.
[    0.000000] e820: BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x0000000000057fff] usable
[    0.000000] BIOS-e820: [mem 0x0000000000058000-0x0000000000058fff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000000059000-0x0000000000085fff] usable
[    0.000000] BIOS-e820: [mem 0x0000000000086000-0x00000000000fffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000000fffffff] usable
[    0.000000] BIOS-e820: [mem 0x0000000010000000-0x0000000012150fff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000012151000-0x0000000067c17fff] usable
[    0.000000] BIOS-e820: [mem 0x0000000067c18000-0x0000000067c18fff] ACPI NVS
[    0.000000] BIOS-e820: [mem 0x0000000067c19000-0x0000000067c42fff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000067c43000-0x0000000067c7dfff] usable
[    0.000000] BIOS-e820: [mem 0x0000000067c7e000-0x0000000068c7dfff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000068c7e000-0x000000007822efff] usable
[    0.000000] BIOS-e820: [mem 0x000000007822f000-0x000000007aebefff] reserved
[    0.000000] BIOS-e820: [mem 0x000000007aebf000-0x000000007afbefff] ACPI NVS
[    0.000000] BIOS-e820: [mem 0x000000007afbf000-0x000000007affefff] ACPI data
[    0.000000] BIOS-e820: [mem 0x000000007afff000-0x000000007affffff] usable
[    0.000000] BIOS-e820: [mem 0x000000007b000000-0x000000007fffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000d3709000-0x00000000d370afff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000e0000000-0x00000000e3ffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000fed01000-0x00000000fed01fff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000ff800000-0x00000000ffffffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000017fffffff] usable
[    0.000000] bootconsole [earlyser0] enabled
[    0.000000] NX (Execute Disable) protection: active
[    0.000000] extended physical RAM map:
[    0.000000] reserve setup_data: [mem 0x0000000000000000-0x0000000000057fff] usable
[    0.000000] reserve setup_data: [mem 0x0000000000058000-0x0000000000058fff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000000059000-0x0000000000085fff] usable
[    0.000000] reserve setup_data: [mem 0x0000000000086000-0x00000000000fffff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000000100000-0x0000000001d646c7] usable
[    0.000000] reserve setup_data: [mem 0x0000000001d646c8-0x0000000001d646d7] usable
[    0.000000] reserve setup_data: [mem 0x0000000001d646d8-0x000000000fffffff] usable
[    0.000000] reserve setup_data: [mem 0x0000000010000000-0x0000000012150fff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000012151000-0x0000000067c17fff] usable
[    0.000000] reserve setup_data: [mem 0x0000000067c18000-0x0000000067c18fff] ACPI NVS
[    0.000000] reserve setup_data: [mem 0x0000000067c19000-0x0000000067c42fff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000067c43000-0x0000000067c7dfff] usable
[    0.000000] reserve setup_data: [mem 0x0000000067c7e000-0x0000000068c7dfff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000068c7e000-0x000000007822efff] usable
[    0.000000] reserve setup_data: [mem 0x000000007822f000-0x000000007aebefff] reserved
[    0.000000] reserve setup_data: [mem 0x000000007aebf000-0x000000007afbefff] ACPI NVS
[    0.000000] reserve setup_data: [mem 0x000000007afbf000-0x000000007affefff] ACPI data
[    0.000000] reserve setup_data: [mem 0x000000007afff000-0x000000007affffff] usable
[    0.000000] reserve setup_data: [mem 0x000000007b000000-0x000000007fffffff] reserved
[    0.000000] reserve setup_data: [mem 0x00000000d3709000-0x00000000d370afff] reserved
[    0.000000] reserve setup_data: [mem 0x00000000e0000000-0x00000000e3ffffff] reserved
[    0.000000] reserve setup_data: [mem 0x00000000fed01000-0x00000000fed01fff] reserved
[    0.000000] reserve setup_data: [mem 0x00000000ff800000-0x00000000ffffffff] reserved
[    0.000000] reserve setup_data: [mem 0x0000000100000000-0x000000017fffffff] usable
[    0.000000] efi: EFI v2.50 by INSYDE Corp.
[    0.000000] efi:  ACPI 2.0=0x7affe014  SMBIOS=0x78757000  SMBIOS 3.0=0x78755000
[    0.000000] SMBIOS 3.0.0 present.
[    0.000000] Kernel/User page tables isolation: disabled
[    0.000000] e820: last_pfn = 0x180000 max_arch_pfn = 0x400000000
[    0.000000] x86/PAT: Configuration [0-7]: WB  WT  UC- UC  WB  WT  UC- UC
[    0.000000] e820: last_pfn = 0x7b000 max_arch_pfn = 0x400000000
[    0.000000] Using GB pages for direct mapping
[    0.000000] RAMDISK: [mem 0x3746a000-0x37a2cfff]
[    0.000000] ACPI: Early table checksum verification disabled
[    0.000000] ACPI: RSDP 0x000000007AFFE014 000024 (v02 INSYDE)

On the bricked unit, there is no output on the serial connection when it is powered on.

If I remove the memory DIMM from the bricked unit, and power on, a repeating error message appears on the serial output of the bricked unit while the blue power light is flashing:

Memory training failed.  Stuck in a dead loop: Acting

This confirms, at least, that the serial port of the bricked unit is functional.

From what I've read on this and other forums, I think I should attempt to restore the U-boot to this device? I have downloaded the .pat file containing the firmware for the DS918, and I can find the U-boot files contained in that package.

I also have a Raspberry Pi available to help with this process.

I read in other threads a procedure involving "kwboot", which is used to restore the Uboot firmware.

Otherwise, I'm completely new to all of this. If anyone has suggestions, including how to proceed with kwboot, I would greatly appreciate it.

Thanks!



Edited 2 time(s). Last edit at 12/10/2021 10:37AM by superchromix.
Re: Unbrick Synology DS918+
December 10, 2021 02:47PM
superchromix,

I'm not familiar with this box. But its specifications states that it is a quad-core Intel Celeron, thus it has BIOS and uses GRUB instead of u-boot as boot loader. Your serial log confirmed that.

> This confirms, at least, that the serial port of
> the bricked unit is functional.

Yes.

> this device? I have downloaded the .pat file
> containing the firmware for the DS918, and I can
> find the U-boot files contained in that package.

Not sure why there are u-boot files there.

> I read in other threads a procedure involving
> "kwboot", which is used to restore the Uboot
> firmware.

kwboot only works with Marvell Kirkwood, Dove, and Armada SoCs. It is not applicable to your box.

Sorry, not sure I can help. I can only guess that the fact that you dont get the GRUB banner, means that it might have been corrupted.

Try this: run serial console, and when your serial console terminal wait for input/output, repeatedly type Control-C while power up. If GRUB was not too damaged then it might stop at some point and give you the menu.

============

And perhaps you can find a recovery FW and procedure at Synology site. They are good in providing GPL sources and recovery procedures for their boxes.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Unbrick Synology DS918+
December 10, 2021 05:07PM
Thanks for the info!

Regarding the uboot files in the Synology .pat file:

You're correct - there are no "uboot" files in the package I downloaded from Synology. I must have been confused after reading other posts describing recovering other Synology models which do use the uboot system.

What I did find in the Synology package is a folder called "flashupdate_6.2-25556-s2_all", where 6.2-25556 is the version number of the Synology OS (DSM). The folder contains the following files:

27-Aug-21  08:01 PM         9,142,600     bios.ROM
27-Aug-21  08:01 PM               333     checksum.syno
27-Aug-21  08:01 PM                55     grub_cksum.syno
27-Aug-21  08:01 PM                98     GRUB_VER
27-Aug-21  08:01 PM         1,046,607     H2OFFT-Lx64
27-Aug-21  08:01 PM            40,543     platform.ini
27-Aug-21  08:01 PM         6,060,520     rd.gz
27-Aug-21  08:01 PM         4,400,070     updater
27-Aug-21  08:01 PM               441     VERSION
27-Aug-21  08:01 PM         3,470,752     zImage

The H2OFFT-Lx64 is the updater program for the Insyde H2O BIOS. It seems like when you download a system update for the Synology, one of the things it does is re-flash the onboard BIOS. It looks like these files are all that's required to do that.

What I don't understand is where this is all physically stored on the motherboard. I've attached some pictures to this post.

There is a Altera Max V FPGA chip (5M80Z) with a white label (DS918+ V1.2) located close to a 10-pin header which is a JTAG port (can be connected to with e.g. a Byteblaster USB).

There is also a removable daughter board, which is essentially a USB flash drive. The memory chip on that board is labeled with the model number of the NAS and the DSM version (DSM 6.1 15254_2).

From what I understand so far, these are the flash-able components on the motherboard. It looks like the USB flash drive could store a full copy of the DSM OS. Where is the Insyde BIOS stored, however? Is that the FPGA?

If this NAS isn't booting due to a problem with the BIOS, or a problem with the GRUB bootloader, I might be able to fix it by re-writing one, or both, of these components.

Connecting to the daughter board is simple enough, since it should mount on any PC just like a regular flash disk. How to use H2OFFT-Lx64 to flash the BIOS, however, I have no idea.

This is where I've gotten to. Thanks again for your advice and suggestions! Any further insights would be most welcome.
Attachments:
open | download - IMG_1081.jpg (736.9 KB)
open | download - IMG_1079b.jpg (853.6 KB)
Re: Unbrick Synology DS918+
December 10, 2021 05:47PM
A short update:

I've identified another chip on the motherboard which may potentially be the BIOS chip.

The chip is a Winbond 25Q128FWSQ

128M-BIT SERIAL FLASH MEM ORY WITH DUAL/QUAD SPI & QPI

It has 8 pins and is soldered to the back side of the motherboard.
Re: Unbrick Synology DS918+
December 10, 2021 06:09PM
superchromix Wrote:
-------------------------------------------------------
> A short update:
>
> I've identified another chip on the motherboard
> which may potentially be the BIOS chip.
>
> The chip is a Winbond 25Q128FWSQ
>
> 128M-BIT SERIAL FLASH MEM ORY WITH DUAL/QUAD SPI &
> QPI
>
> It has 8 pins and is soldered to the back side of
> the motherboard.

That's probably the BIOS. Winbond 8-pin serial flash chips are commonly for BIOS.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Unbrick Synology DS918+
January 17, 2022 04:52PM
Pulled the flash chip off the board, and read its contents to disk.

Saved binary file is 16MB.

bios.ROM file in the Synology package is 9142600 bytes.

If I want to reflash the bios chip, how to figure out at what offset to start reflashing..?

and, where is the checksum stored...?
Re: Unbrick Synology DS918+
January 17, 2022 06:24PM
> If I want to reflash the bios chip, how to figure
> out at what offset to start reflashing..?
>
> and, where is the checksum stored...?

No idea.

Anybody can chime in?

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Unbrick Synology DS918+
January 18, 2022 10:30AM
My 2 cents. I think the checksum is to prevent the flasher from flashing a damaged file. And you can ask binwalk what is inside the 16MB backup file.
Author:

Your Email:


Subject:


Spam prevention:
Please, enter the code that you see below in the input field. This is for blocking bots that try to post this form automatically. If the code is hard to read, then just try to guess it right. If you enter the wrong code, a new image is created and you get another chance to enter it right.
Message: