Question about DS118 USB to TTL?

[ericavd]

Hi,

I have a DS118 picked up in junkyard. It's not totally bricked, but often fail to boot to the end. Even I get to DSM install webpage, I still can't install DSM to HDD. It just failed in the mid of installing DSM. It seems already upgraded to DSM7.2.1.

 

I checked its spec. It's using Realtek RTD1296. DS218, DS218play, and DS418 also use the same chip.

 

Searching the Internet, I am inspired by this post: https://forum.doozan.com/read.php?2,135588,135872#msg-135872

I also found some examples for Marvell solution from here: https://conetix.com.au/blog/synology-nas-bootrom-recovery/

 

I have a USB to TTL converter but never used it. I took it out from a storage box, plugged it on DS118, and connect the USB side to a laptop. Using PuTTY to connect DS118, I press ESC key and then power DS118 on. I can get to Realtek bootloader console. This is the boot message:

*********************************************************************************************************

 

C1:80000000
C2
?
C1:80000000
C2
?
C3h
hwsetting size: 000006DC
C4
f
5-5
Goto FSBL: 0x10100000
<=============================================>
fsbl_main: sys_secure_type = 0x0000BEEE
fsbl_main: sys_boot_type = 0x00000001
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000
sys_hwsetting_size:00000700
sys_bootcode_size:00062BC0
sys_secure_fsbl_size:00010B00
sys_secure_os_size:00000000
sys_bl31_size:00000000
sys_rsa_key_fw_size:00000000
sys_rsa_key_tee_size:00000000
sys_rescue_size:000262E8

HwSetting:
hwsetting_blk_no:88120800
hwsetting_total_size:00000780
hwsetting_blk_count:00000780

Bootcode:
bootcode_blk_no:88120F80
bootcode_total_size:00062BE0
bootcode_blk_count:00062BE0

FSBL:
secure_fsbl_blk_no:88183B60
secure_fsbl_total_size:00010B20
secure_fsbl_blk_count:00010B20

TEE OS:
secure_os_blk_no:88194680
secure_os_total_size:00000000
secure_os_blk_count:00000000

BL31:
bl31_blk_no:88194680
bl31_total_size:00000000
bl31_blk_count:00000000

RSA Key Fw:
rsa_key_fw_blk_no:88194680
rsa_key_fw_total_size:00000000
rsa_key_fw_blk_count:00000000

RSA Key TEE:
rsa_key_tee_blk_no:88194680
rsa_key_tee_total_size:00000000
rsa_key_tee_blk_count:00000000

Rescue:
rescue_blk_no:88194680
rescue_total_size:00026308
rescue_blk_count:00026308
********** FW_TYPE_BOOTCODE **********
fwInfo->fwType: 00000001
fwInfo->isGolden: 00000001
fwInfo->ddrReadAddr: 00520000
fwInfo->ddrDestAddr: 00020000
fwInfo->flashType: 00000001
fwInfo->flashUnitSize: 00000001
fwInfo->flashOffset: 88120F80
fwInfo->dataSize: 00062BE0
body_size:00062BC0
flash_unit_no:88120F80
flash_unit_count:00062BE0
real_size:00062B98
sha256 Fw
j bootcode jump address:00020000
64b


U-Boot 2012.07-g0eddcfc (Aug 21 2017 - 17:30:18)

CPU  : Cortex-A53 quad core - AARCH32
Board: Realtek QA Board
DRAM:  1 GiB
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
nor flash id [0x00c22017]
sector 256k en: 0
sector  64k en: 1
sector  32k en: 0
sector   4k en: 1
page_program  : 1
max capacity  : 0x00800000
spi type name : MX 64Mbit
Factory: NOR
Factory: pp:1, seq#:0x16, size:0x800
------------can't find tmp/factory/000BootParam.h
[ENV] read_env from factory failed
[ENV] Using default environment variables

In:    serial
Out:   serial
Err:   serial
RTK_set_power_saving_config:Default POWERE_ON_S5 not set

Synology Model: DS118

SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
SYNO_CTRL_FAN_PERSISTER Pin not implement
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
*** Reboot-Action invalid ***
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery

Press Esc Key

Enter console mode, disable watchdog ...

********************************************************************************

 

I typed "help" and got the following available commands under Realtek command prompt:

Quote

 

Realtek> help
b2ndbc  - load 2nd stage bootcode
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootr   - boot realtek platform
crc32   - checksum calculation
date    - get/set/reset date & time
dcache  - enable or disable data cache
env     - environment handling commands
factory - FACTORY sub system
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatwrite- write file into a dos filesystem
fdt     - flattened device tree utility commands
gettime - get timer val elapsed
go      - start application at address 'addr' or start running fw
goru    - start rescue linux from usb
gpt     - GUID Partition Table
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
keyset  - keyset - write keyset file into factory area
loady   - load binary file over serial line (ymodem mode)
lzmadec - lzma Decompress from mem to mem
md      - memory display
mtest   - simple RAM read/write test
mtest2  - simple RAM read/write test
mw      - memory write (fill)
ping    - send ICMP ECHO_REQUEST to network host
pmic    - GMT-G2227 PMIC commands
pwm     - Control PWM 0,1,2,3
reset   - Perform RESET of the CPU
rtkrng  - rng utility
rtkspi  - spi flash utility
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
source  - run script from memory
syno_pwoff- bring the system down

tftp    - download image from TFTP server
tftpput - TFTP put command, for uploading files to a server
uart_write- for uart mp tool burn mac and sn key

unzip   - unzip a memory region
usb     - USB sub-system
Realtek>

 

 

Now, I wonder if anything I can do to this DS118. I am not hoping to restore it, just want to do experiment with serial console.

 

 

Edited January 13 by ericavd