Page 3 of 3

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Thu Mar 28, 2019 9:03 am
by buffmanjeff
jelinek.01 wrote:
Tue Feb 26, 2019 1:53 am
habee wrote:
Tue Jul 04, 2017 4:53 am
by the way, i just found a new bios (QW37AR33) on the italian Qnap-Forum: http://www.qnapclub.it/viewtopic.php?t=14065

You can flash it directly from ssh-console:

cd /share/Public/
wget http://download.qnap.com/Storage/tsd/bios/QW37AR33.zip
unzip QW37AR33.zip
chmod +x flashrom
./flashrom -p internal -w QW37AR33.BIN
reboot

It has many more options, and they might have fixed something. Unfortunately there is no changelog. But it is dated from 2016-05-10.
The previous file (QW37AR32) http://eu1.qnap.com/Storage/tsd/bios/QW37AR32.zip had a changelog where many options have been changed in comparison to QW37AR22 which was on my machine
Finally :-)
It has ended by just modifying the link:
http://download.qnap.com/Storage/tsd/bios/QW37AR36.zip

Now let's try to revive the machine.
Is this the latest version still? How did it work out for you?

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Thu Mar 28, 2019 11:32 am
by jelinek.01
It seems to be, there is no mention about newer version.
Unfortunately it didn't help, my NAS Is still dead.
QNAP support responded to the inquiry about new motherboard, much more expensive than a new NAS.
I'm going to build a new one with Turris Omnia.

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Sat Jun 01, 2019 2:00 am
by RockenRod
@Buggy82 - Thanks so much for your work it has helped me.

I can confirm the JSPI1 header pin assignment on the QNAP mainboard for my TS-EC1679U-RP is the same also.
I used a FLASH programmer to recover mine.

JSPI1
1 Voltage (VCC)
2 Ground (GND)
3 Chip Select (CS)
4 Clock (CLK)
5 Data Output (DO / MISO)
6 Data Input (DI / MOSI)
7 NC
8 NC

Please note I made a custom cable to patch from my programmer to the FLASH chip header JSPI1.
I had a lot of problems initially with it but soon realised the cable needed to be kept under 30cm (ish) to reduce errors in programming/reading over SPI.

I used a MiniPro TL866A EEPROM Programmer. My board had a 16 pin SOIC PCT25VF064C FLASH chip 8bit (Byte) x 8Mbit = 64Mbit. I selected an SST25VF064C device in the software which is the same specs (actually just a rebrand it appears).
I wired my cable to the 8 pin SOIC but you could do either 8 or 16 pins as they are compatible, just different pinouts.

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Sun Aug 04, 2019 4:17 am
by m.raczka
Hi.
I am trying to resurect my dead TS-453 Pro that gives no beeps, hdmi outpu ets.
I managed to connect via raspi to bios chip but was unable to erase it or flas with a new one.
Has anyone experienced anything similar?

Here is flashrom ouput:

Code: Select all

Found Winbond flash chip "W25Q64.W" (8192 kB, SPI).
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00000fff: 0x1000
ERASE FAILED!
Looking for another erase function.
Trying erase function 1... 0x000000-0x007fff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00007fff: 0x8000
ERASE FAILED!
Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0x10000
ERASE FAILED!
Looking for another erase function.
Trying erase function 3... 0x000000-0x7fffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x007fffff: 0x800000
ERASE FAILED!
Looking for another erase function.
Trying erase function 4... 0x000000-0x7fffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x007fffff: 0x800000
ERASE FAILED!
Looking for another erase function.
Trying erase function 5... not defined. No usable erase functions left.
FAILED!
Your flash chip is in an unknown state.
Please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Mon Aug 12, 2019 6:13 pm
by angry_pete
Thanks for your detailed thread. I would love to give it a try but Qnap refuses to provide us with a bios file. :evil:
Just like the quality of the cases the support is getting worse every year.

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Fri Sep 13, 2019 8:14 pm
by Andy750turbo
For anyone who may be interested i also have successfully flashed the Bios chip on my TS-453 Pro (QW37 Rev 1.7 motherboard) with a Minipro TL866A and 1.8v adapter. That said, it did not solve my problem... The NAS still gets stuck with the LED screen saying 'System Booting>>>>>' with no beeps at all, my connected monitor is blank with no POST message or any message at all for that matter. So i've run out of options really, i'll likely just buy a new NAS (obviously not a QNAP again due to extortionate prices they want to have the mobo replaced) I'll likely forgo all the bells and whistles and go for a Drobo instead.

Now i thought you might like to know that the JSPI1 pins on my mobo connected to different pins on the bios chip to the guide at the beginning of this thread. When i tried to read the chip with the pin connections recommended in the guide with my Minipro TL866 i got an error message saying that no chip was detected. I checked which pins connected to which pins and this is what i got:
20190913_114707.jpg
When i came to use the minipro software i found that there was no option to program the chip via the ICSP port as below: The option was greyed out
20190913_102521.jpg
So i had to connect it through the 40 pin interface instead. Opting for safety i decided to buy an adapter to drop the voltage down to the chip voltage 1.8v as the programmer could only supply 3.3v. FYi i bought the adapter from Ebay, just search for '1.8v ADAPTER | BIOS MOTHERBOARD MX25U1635 MX25U6435 TL866'

I mounted the adapter into the programmer as can be seen above, i then used short jumper cables with a male fitting on one end and a female on the other and fitted them onto the JSPI1 pins on the motherboard:
20190913_102241.jpg
I wired the slots in the 1.8v adapter to the JSPI1 pins like this:
JSPI1 mobo Pins to MiniproTL866A Programmer.jpg
20190913_100047.jpg
20190913_100155.jpg
20190913_100256.jpg
I connected the programmer by USB to the PC, opened the software. i chose the correct chip in the 'Select IC' dropdown menu (in my case the bios chip is a Winbond W25Q64FSIG, so i chose the option for 'W25Q64F 1.8v @SOIC8'
20190913_100941.jpg
I then opened the 'Device' dropdown menu and and asked it to 'Read' It successfully picked up the chip. From the same dropdown menu i chose to 'Erase'
I checked the chip was blank from the 'Device' dropdown menu by choosing 'Blank check', again this was successful.

Now i needed to program it, i went and chose the 'Program' option from the 'Device' dropdown, it opened up a file search box, i pointed it to where i'd saved the BIOS software to and chose the .bin file
20190913_101034.jpg
You can still download the BIOS file from the Polish Qnap site mentioned earlier in this thread.
20190913_101118.jpg
i left the options as default, pressed ok and the programmer set itself running. this can take a few minutes to finish, so be patient. Eventually it finished with a message that it was successful.

Hopefully this will be useful to someone, even though my issue does not seem to down to the BIOS :-/

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Thu Nov 14, 2019 1:02 am
by pechnase
I have a question regarding powering the BIOS-flash chip during reflash procedure:
- is the NAS in power ON state or is the BIOS-chip powered from the programmer?
- or does the 1.8V from the NAS power only the level shifter of the programmer?

Thanks for your reply

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Tue Nov 19, 2019 12:55 am
by tonybailey9
Hi all I have a tas268 and upon starting I get the screen below via hdmi.
Nas will restart for 1 hour plus
Qnap have told me the mainboard has gone
Can anyone help me please

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Tue Nov 19, 2019 1:16 am
by dolbyman
dont think this thread helps with your android based unit

no idea how to flash it...and qnap already gave up

Id see some android phone forums ..if there is some dead phone flash methods...although there is sadly no system image available from qnap to flash

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Thu Apr 23, 2020 6:03 am
by derbnogod
Had to perform this procedure yesterday on my TS-851 and had multiple failures with the resistive network used to bring the voltage from the rpi into the 1.65-1.9 range. Switched to native 3.3V and had success after adding a couple decoupling capacitors to the power rail. Thanks for the hard work, you resurrected my unit.

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Sun Aug 09, 2020 6:21 pm
by vfiler
Recently I got a dead TS 253 Pro from a friend. He told me it has been gone due to a failed firmware update.
After connecting to power, LED1 did not turn to green
Pressing power button: no beep, no HDMI signal, LED5 and 7 are red (no disks were connected), LED3 lits blue.

I removed all parts - DOM Flash, RAM, Battery, FAN. After reconnecting to power, LED1 turned to green.
But after powering on - no success. LED1 turns off, still no beep, no signal, all other LEDs get the same status like before.

Should i give it a try and follow the steps to flash it with my Raspberry, or is it just wasting time?
Board is QW59 Rev. 1.2

Thanks for any advice

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Thu Aug 13, 2020 1:29 pm
by coolquasar
buggy82 - Hey buddy, Any insights to this problem I have, will be really helpful

Long story short: When turned on, it is a hit and miss that POST will be success and system boots up

viewtopic.php?f=50&t=156389

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Posted: Sun Oct 18, 2020 6:51 am
by yujungchang
Bought a TS-453 Pro recently from a Ebay seller, however it has the same problem(no beep, no HDMI output and nothing) as everyone here. Since the seller provides a full refund without having to send it back(Canada), I decided to take it apart and see if a simple SPI reflash will fix the issue, as few successful stories. Unfortunately as I suspected, it does not do anything for majority of the people. After reflashing the BIOS and powering it up couple times, the image read back is exactly the same. That means either the CPU failed to fetch/execute any code or the BIOS does not run long enough to write back some data to the flash. By the way, the pin header for the SPI is exactly the same as the Dediprog header, which is commonly used in the PC development.
SPI_Header.jpg

I also captured the pin 1 CLK on the LPC header(LPC_CN1) to see if it's the same as C2000 Atom LPC defect. Although the clock capture looks different than this capture, https://youtu.be/Y8_emfoR_MI?t=788, I felt it is probably the same issue and just shows up as a different failure pattern. I also noticed the low of the LPC clock is quite high, probably not normal. Voltage measured with a multimeter will show ~2.4V if you don't have a scope. I also probed the Fintek F71869AD pin 38(PCICLK) and it seems that's the same clk as LPC header, 25 MHz. The pin39(CLKIN) is clocked at 24 MHz (but looks clean/good), so some clocks are still good. Plus there's no clock(low) to the SPI (actually the clk is only transmitted when there're transactions), pin 1(Vcc), 3(CS), 5(SO) are high. That explains why the system failed to boot and unchanged SPI image after power up.
LPC_Clock.jpg

After doing some Google search, I saw this issue discussed below matches exactly the same as my system, but the workaround doesn't work well for me [updated status below]. Tried lower the resistor to 100 ohm and the low is still around 1V(with High reduced to ~2V), but this might be the solution for some lucky ones.
https://community.intel.com/t5/Processo ... rue#M46864
we have measured that the LPC CLK signal is clearly degraded, and most often that the negative cycle transistor is broken, meaning that the clock signal is swinging between 1.6 and 3.3V, not 0V and 3.3V. We have tried to put a 120 ohm resistor between the degraded clock signal and 0V, and that seems to solve the problem, the computer boots again.
Continuously trying in the evening, I actually got it to boot with the resistor back to 120 Ohm (fine tune might be needed for a specific system). It seems it has a higher chance to boot if the processor is heated up hours before it is ready to boot (without fan and leave it on even if it hung). Most the time it hung at various places on the 1st boot(post code B2 or during decompress/booting to kernel). After power cycle and if it booted successfully with 2 beeps, it seems running fine afterward, only good until next cold boot.


Still trying to boot after an hour wait the next day, looks like I might have to warm it up a lot longer before it was able to boot last night. After waiting over 2.5 hours, it is finally showing signs of booting again (hung randomly) and it seems 100 Ohm works better on my system.
This was captured when it was repeatable booting last night (with 120 Ohm). That big dip and more stable in the clock might be what's making it boot.
booting.jpg
This is when it was cold (not booting) this morning with nothing changed in the setup
No_boot_cold.jpg
When more than 5 hours of warm up still failed to boot (with 120 Ohm), it boots immediately after I reduced the resistor to 100 Ohm.
Boot with 100 Ohm.jpg

Final thought, it seems the 100 Ohm might be the solution for my system. When it failed in the earlier test, it's probably because I forgot to put back the memory after testing various conditions. It boots right away consistently(except once) after cool down with that 100 Ohm in place between pin 1 (LPC CLK) and ground (pin 8 or 10). From chatting with my friend, the rework might cause clock buffer degradation even faster with this strong pull down to the clock. Even though it works now and the boot is repeatable, not sure how long can it last?

Also this LPC clk is fed into the Fintek F71869AD, which acts as the EC for the onboard power management, as well as the FSC (fan speed controller). Once the clock went wild, the CPU/EC lost the communication, the system will either hang, reboot or log fan errors(if lucky) as some have seen. When that happened, power cycle the system without G3 (mechanical off) does not fix the problem for me and the system continue to fail to boot until removing the power cord. It's very easy to reproduce this problem. Once the system boots up to QTS, those bad things happened immediately as soon as I disconnect the resistor.

Besides replacing the CPU (which is a riskier/costly option), an alternative clock from LPCCLK1 or other clock source might be a solution as well. The problem for that is it will be a challenge to find/cut the trace from the LPCCLK0 and hook it up to an alternative clk source without a board file.