Help unbricking DS418

I'm kinda new to linux and Synology, 1-2 years, and being used to windows, I killed power while upgrading from DSM 6 to DSM 7. DON'T do that! Mistakes make you learn so much.... :( I tried my best following bignellrp's post https://forum.doozan.com/read.php?3,100059

Here's where I am at. Console up and running, i can set and save env's but cant get eht0 turned on for TFTP. USB START recognizes the controllers but wont see usb storage device (i tried several down to FAT16) so....

I resorted to ymodem zimage and rd.bin using Teraterm using the same memory locations from bignellrp's post. uboot shows the correct file size transferred. I tried files from DSM 6 & 7. When I attempt bootm 0x2000000 0x8000000 i get the following error.

Wrong Image Format for bootm command
ERROR: can't get kernal image!

I have a working DS418 and I compared the ENV variables and everything matches. Then I commpared terminal output on boot and noticed the following; (trying to keep the post short and ledgible, I'll post more if needed)

WORKING UNIT:

SPI start addr(remap) = 0x88200000
DDR start addr = 0x0b000000
reading byte size = 0x002f0000
Uncompressed size: 7766536 = 0x768208

SPI start addr(remap) = 0x881c0000
DDR start addr = 0x0b000000
reading byte size = 0x00040000
Uncompressed size: 785544 = 0xBFC88

SPI start addr(remap) = 0x88100000
DDR start addr = 0x01f00000
reading byte size = 0x00010000

SPI start addr(remap) = 0x884f0000
DDR start addr = 0x02200000
reading byte size = 0x003ff000
Start Boot Setup ...



BRICK

SPI start addr(remap) = 0x88200000
DDR start addr = 0x0b000000
reading byte size = 0x002f0000

SPI start addr(remap) = 0x881c0000
DDR start addr = 0x0b000000
reading byte size = 0x00040000
Uncompressed size: 785544 = 0xBFC88

SPI start addr(remap) = 0x88100000
DDR start addr = 0x01f00000
reading byte size = 0x00010000

SPI start addr(remap) = 0x884f0000
DDR start addr = 0x02200000
reading byte size = 0x003ff000
Start Boot Setup ...


Any assistance is greatly appreciated.

6



Edited 1 time(s). Last edit at 03/29/2022 04:26PM by sixn3is7.

I found this post but there is no reference to the commands used and I could not figure out how to dump the good image and copy it to the brick. this seems like the easiest solution.

https://stackoverflow.com/questions/65574291/uboot-bad-gzipped-data-synology-ds418j

six,

Strange that I could not find a DS418+ on Synology product list.

> Wrong Image Format for bootm command
> ERROR: can't get kernal image!

Please post the entire boot log (from u-boot banner) until this error.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

oops, you are correct. Just a plain ol DS418. Confused with my DS420+

This is the entire output from power-on

C1:80000000
C2
?
C3h
hwsetting size: 00000BDC
C4
f
5-5
Goto FSBL: 0x10100000
<=============================================>
fsbl_main: sys_secure_type = 0x0000BEEE
fsbl_main: sys_boot_type = 0x00000001
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000
sys_hwsetting_size:00000C00
sys_bootcode_size:00062C80
sys_secure_fsbl_size:00010B00
sys_secure_os_size:00000000
sys_bl31_size:00000000
sys_rsa_key_fw_size:00000000
sys_rsa_key_tee_size:00000000
sys_rescue_size:00026388

HwSetting:
hwsetting_blk_no:88120800
hwsetting_total_size:00000C80
hwsetting_blk_count:00000C80

Bootcode:
bootcode_blk_no:88121480
bootcode_total_size:00062CA0
bootcode_blk_count:00062CA0

FSBL:
secure_fsbl_blk_no:88184120
secure_fsbl_total_size:00010B20
secure_fsbl_blk_count:00010B20

TEE OS:
secure_os_blk_no:88194C40
secure_os_total_size:00000000
secure_os_blk_count:00000000

BL31:
bl31_blk_no:88194C40
bl31_total_size:00000000
bl31_blk_count:00000000

RSA Key Fw:
rsa_key_fw_blk_no:88194C40
rsa_key_fw_total_size:00000000
rsa_key_fw_blk_count:00000000

RSA Key TEE:
rsa_key_tee_blk_no:88194C40
rsa_key_tee_total_size:00000000
rsa_key_tee_blk_count:00000000

Rescue:
rescue_blk_no:88194C40
rescue_total_size:000263A8
rescue_blk_count:000263A8
********** FW_TYPE_BOOTCODE **********
fwInfo->fwType: 00000001
fwInfo->isGolden: 00000001
fwInfo->ddrReadAddr: 00520000
fwInfo->ddrDestAddr: 00020000
fwInfo->flashType: 00000001
fwInfo->flashUnitSize: 00000001
fwInfo->flashOffset: 88121480
fwInfo->dataSize: 00062CA0
body_size:00062C80
flash_unit_no:88121480
flash_unit_count:00062CA0
real_size:00062C58
sha256 Fw
j bootcode jump address:00020000
64b


U-Boot 2012.07-g68fd7ba (Nov 20 2018 - 11:17:34)

CPU : Cortex-A53 quad core - AARCH32
Board: Realtek QA Board
DRAM: 2 GiB
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
nor flash id [0x00c22017]
sector 256k en: 0
sector 64k en: 1
sector 32k en: 0
sector 4k en: 1
page_program : 1
max capacity : 0x00800000
spi type name : MX 64Mbit
Factory: NOR
Factory: pp:0, seq#:0x2, size:0x200
------------can't find tmp/factory/000BootParam.h
[ENV] read_env from factory failed
[ENV] Using default environment variables

In: serial
Out: serial
Err: serial
RTK_set_power_saving_config:Default POWERE_ON_S5 not set

Synology Model: DS418

SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
Net: Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
*** Reboot-Action invalid ***
Hit Esc or Tab key to enter console mode or rescue linux: 0
------------can't find tmp/factory/recovery
======== Checking into android recovery ====

check_acpu_boot_notification, boot-reason : 0xf11c52b3
check_rtc_expire:RTC not detected in factory
customize_check_normal_boot: power up by button

SPI start addr(remap) = 0x88200000
DDR start addr = 0x0b000000
reading byte size = 0x002f0000

SPI start addr(remap) = 0x881c0000
DDR start addr = 0x0b000000
reading byte size = 0x00040000
Uncompressed size: 785544 = 0xBFC88

SPI start addr(remap) = 0x88100000
DDR start addr = 0x01f00000
reading byte size = 0x00010000

SPI start addr(remap) = 0x884f0000
DDR start addr = 0x02200000
reading byte size = 0x003ff000
Start Boot Setup ...
Start Audio Firmware ...
Start A/V Firmware ...
[dbocndcdi1_nmg]o d1e2 9[50 x0ch7:i psh
iClfta:s s6i flyBeonngtdih:n g2 ] 0
x000008gm0t0_,t ensutm i=n g 0rext0u0r0n0s00 0010 P
B (PAc)u
r_[vFWal]:k y[li0nx_0b0r] inaugt oup
hnwews_etvtail:ng [
0x0F2]i nfiosrhc key_lpwinm_
bring_temp hwsetting
[ACPU] Set protect, start: 0x00000000 end: 0x00001000 moduleid:6
HDMI Raw Enable: AC3 DTS MPEG2 AAC DDP

SPDIF Raw Enable: AC3 DTS MPEG2 AAC

Force 2ch Format: DTS DTSHD AC3 DDP MLP AAC WMAPRO


@@@@@@@One Step TV System magic number = 0xffffffff, addr = 0xa001f800@@@@@@@

@@@@One Step magic number not match! use fw default TV System!
HDMIOff = 0
[VO]vo->is_hdmi_off_clock_on:0
[VO_SetVideoStandard]st 25 p 1 1 0
[VO_SetVideoStandard]dp_standard:1067002368 data0 0x00000004 data1 0x00000000
[VO_SetVideoStandard]HDMIoff 0 is_tve_on 0 user_cvbs_off 1
lvds.format 0 port_setting 0x00000381 lvds_wb 0
[VO setTVStandard 25 3D 0 0]

(TVE) TVE_DAC_mode 0,cmd->enProg 1!!
~~comp 0, ch2 0, mode_3D 0!!
SetVideoStandard return!

(VO_ConfigHDMI_InfoFrame) L:264, is_hdmi_plugin 1, hdmiMode 1!!Mode 1 dataByte1 0x00000040 0x000000a8 0x00000000
dataByte4 0x00000000 0x00000000 int0 0x00000001

(HDMI_3D) mode 1, HDMI_gen 1, En_3D 0, Format_3D 0 scramble:0!!RGB_or_YCbCr:2 Pixel_Colocrt:2 Deep_Color:0 Deep_Depth:0
@@vo->hdr_ctrl.trans:0 HDMI_gen_dynamic_range_master_infoframe
@@set C1C0 to 2(BT709),set EC2EC1EC0 to 0

go back SET_HDMI!!boot_info 0xa0000000 magic 0x7ff7ffff en 255


EXPORT ENV AT 0x10000000, ENV size info:0x00002000,0x00001ffc,0x00000004
rtk_preload_bootimages_spi : header info
0x00000c00 0x00062c80 0x00010b00 0x00000000
0x00000000 0x00000000 0x00000000 0x00026388
0x00000000
rtk_preload_bootimages_spi : load U-Boot 64 from 0x88194c40 to 0x01500000 with size 0x00026388
check factory flag
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x00028000
Jumping to 2nd bootloader...


U-Boot 2015.07-g428cfe7-dirty (May 16 2018 - 10:29:38 +0800)

CPU : Cortex-A53 Quad Core
Board: Realtek QA Board
DRAM: 2 GiB
mapping memory 0x20000000-0x40000000 non-cached
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
rtk_plat_set_fw not port yet, use default configs
Not raw Image, Starting Decompress Image.gz...


Error: Bad gzipped data
Decompress FAIL!!
ERROR do_booti failed!
Realtek>

Sorry, looks like I can't provide much help! I'm not familiar with Realtek SoC boards.

bignellrp has the DS414 which is a Marvell Armada XP SoC.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Is what it is. Thanks for the quick reply. I will post when I figure it out.

Would you mind looking at terminal log from the good unit and see if anything rings a bell?

sixn3is7 Wrote:
-------------------------------------------------------
> Would you mind looking at terminal log from the
> good unit and see if anything rings a bell?

SPI start addr(remap) = 0x88200000 
DDR start addr = 0x0b000000 
reading byte size = 0x002f0000 
Uncompressed size: 7766536 = 0x768208 


BRICK 

SPI start addr(remap) = 0x88200000 
DDR start addr = 0x0b000000 
reading byte size = 0x002f0000

Just what you already knew, the image looks like it was corrupted. So it was not recognized as a compressed image.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Can you point me somewhere to learn how to pull an image from my working unit and then write it to the brick? I have google but cant find what I need or not using the right search terms.

Six,

Since you have SPI flash, here is my released Dreamplug u-boot installation thread.

https://forum.doozan.com/read.php?3,42359

Important part is to know which SPI MTD has the kernel image on your box.

The Dreamplug MTDs

cat /proc/mtd

Expected Outputs: 
dev:    size   erasesize  name
mtd0: 00080000 00001000 "u-boot"
mtd1: 00010000 00001000 "u-boot env"
mtd2: 00010000 00001000 "dtb"

Here is how you would dump each mtd

3. Backup your current stock mtds for future restoration, should you decide to go back to stock 
mkdir -p /tmp/sdc1
mount -o noatime /dev/sdc1 /tmp/sdc1
cd /tmp/sdc1/boot

dd if=/dev/mtd0 of=mtd0 bs=512k conv=sync
dd if=/dev/mtd1 of=mtd1 bs=64k conv=sync
dd if=/dev/mtd2 of=mtd2 bs=64k conv=sync

I can't find my example for SPI flash. But here is an example flashing the images to NAND flash.

https://forum.doozan.com/read.php?3,42599,44024#msg-44024

In u-boot console, you would find out if it has sf command. And look at the help info to see how to use the sf command to probe the flash device, and reading the image into RAM, and then write it to flash.

Try this

help sf
sf probe

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

These commands are not available and the available commands change depending on if I halt uboot or let it fail attempting to load the kernel. There are some SPI R/W commands and others but I am getting beyond my realm of knowledge. I purchased a CH341A programmer and, assuming the MX25L6433f flash is where my issue is, I should be able to pull an image from the good unit and program it to the brick. This is definitly more in my realm of experience. I will lift and isolate VCC so I'm not trying to power other chips on the board. I will provide details if I get it to work.

Thanks for you help and quick response.

6

Happy to say I was successful. I desoldered both good & bad MX25L6433F flash chips and, with a CH341A programmer from Amzaon, I was able to get the brick working again.

Important notes: I did the 3.3V mod on the CH341A programmer as I did not want to risk damaging the memory chips. The chip clip that came with the programmer sucked so I choose to desolder the chips.

I read both good and bad chip 3 times and saved each file. An MD5 check showed that good and bad don't match and also showed 3 matching reads for each chip. The data at 007EF000 - 007EF030 holds MAC's and Serial Number. Using a hex editor, the MAC's are in hex and the serial number decodes as text.

Edit and save a good copy and change the data at 007EF000 - 007EF030 to reflect MAC's & serial number of the bad unit.

Erase and then reprogram the bad chip. Read the chip and save. Do an MD5 check and if it all matches.......

Resolder both and cross your fingers

Very cool to see them both boot.

After Some playing around I think I could have done the whole thing without desoldering using RTK SPI and memory commands at the Uboot prompt... Oh well, I got what I needed.

Thanks again fro your help.

Congrats!

Quote

After Some playing around I think I could have done the whole thing without desoldering using RTK SPI and memory commands at the Uboot prompt... Oh well, I got what I needed.

That would have been great to have. Not a lot of people can perform the hardware chip desoldering/soldering like you did. A software solution canbe repeated by everybody.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)