[HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Don't miss a thing. Post your questions and discussion about other uncategorized NAS features here.
buffmanjeff
Starting out
Posts: 12
Joined: Mon May 18, 2015 12:56 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by buffmanjeff »

jelinek.01 wrote: Tue Feb 26, 2019 1:53 am
habee wrote: Tue Jul 04, 2017 4:53 am by the way, i just found a new bios (QW37AR33) on the italian Qnap-Forum: http://www.qnapclub.it/viewtopic.php?t=14065

You can flash it directly from ssh-console:

cd /share/Public/
wget http://download.qnap.com/Storage/tsd/bios/QW37AR33.zip
unzip QW37AR33.zip
chmod +x flashrom
./flashrom -p internal -w QW37AR33.BIN
reboot

It has many more options, and they might have fixed something. Unfortunately there is no changelog. But it is dated from 2016-05-10.
The previous file (QW37AR32) http://eu1.qnap.com/Storage/tsd/bios/QW37AR32.zip had a changelog where many options have been changed in comparison to QW37AR22 which was on my machine
Finally :-)
It has ended by just modifying the link:
http://download.qnap.com/Storage/tsd/bios/QW37AR36.zip

Now let's try to revive the machine.
Is this the latest version still? How did it work out for you?
jelinek.01
New here
Posts: 4
Joined: Fri Mar 22, 2013 2:49 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by jelinek.01 »

It seems to be, there is no mention about newer version.
Unfortunately it didn't help, my NAS Is still dead.
QNAP support responded to the inquiry about new motherboard, much more expensive than a new NAS.
I'm going to build a new one with Turris Omnia.
RockenRod
New here
Posts: 3
Joined: Wed May 29, 2019 10:28 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by RockenRod »

@Buggy82 - Thanks so much for your work it has helped me.

I can confirm the JSPI1 header pin assignment on the QNAP mainboard for my TS-EC1679U-RP is the same also.
I used a FLASH programmer to recover mine.

JSPI1
1 Voltage (VCC)
2 Ground (GND)
3 Chip Select (CS)
4 Clock (CLK)
5 Data Output (DO / MISO)
6 Data Input (DI / MOSI)
7 NC
8 NC

Please note I made a custom cable to patch from my programmer to the FLASH chip header JSPI1.
I had a lot of problems initially with it but soon realised the cable needed to be kept under 30cm (ish) to reduce errors in programming/reading over SPI.

I used a MiniPro TL866A EEPROM Programmer. My board had a 16 pin SOIC PCT25VF064C FLASH chip 8bit (Byte) x 8Mbit = 64Mbit. I selected an SST25VF064C device in the software which is the same specs (actually just a rebrand it appears).
I wired my cable to the 8 pin SOIC but you could do either 8 or 16 pins as they are compatible, just different pinouts.
m.raczka
New here
Posts: 9
Joined: Fri May 13, 2016 6:15 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by m.raczka »

Hi.
I am trying to resurect my dead TS-453 Pro that gives no beeps, hdmi outpu ets.
I managed to connect via raspi to bios chip but was unable to erase it or flas with a new one.
Has anyone experienced anything similar?

Here is flashrom ouput:

Code: Select all

Found Winbond flash chip "W25Q64.W" (8192 kB, SPI).
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00000fff: 0x1000
ERASE FAILED!
Looking for another erase function.
Trying erase function 1... 0x000000-0x007fff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00007fff: 0x8000
ERASE FAILED!
Looking for another erase function.
Trying erase function 2... 0x000000-0x00ffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0x10000
ERASE FAILED!
Looking for another erase function.
Trying erase function 3... 0x000000-0x7fffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x007fffff: 0x800000
ERASE FAILED!
Looking for another erase function.
Trying erase function 4... 0x000000-0x7fffff:EFAILED at 0x00000000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x007fffff: 0x800000
ERASE FAILED!
Looking for another erase function.
Trying erase function 5... not defined. No usable erase functions left.
FAILED!
Your flash chip is in an unknown state.
Please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!
angry_pete
First post
Posts: 1
Joined: Mon Aug 12, 2019 6:05 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by angry_pete »

Thanks for your detailed thread. I would love to give it a try but Qnap refuses to provide us with a bios file. :evil:
Just like the quality of the cases the support is getting worse every year.
Andy750turbo
New here
Posts: 4
Joined: Mon Jan 23, 2017 11:15 pm
Location: Warrington

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by Andy750turbo »

For anyone who may be interested i also have successfully flashed the Bios chip on my TS-453 Pro (QW37 Rev 1.7 motherboard) with a Minipro TL866A and 1.8v adapter. That said, it did not solve my problem... The NAS still gets stuck with the LED screen saying 'System Booting>>>>>' with no beeps at all, my connected monitor is blank with no POST message or any message at all for that matter. So i've run out of options really, i'll likely just buy a new NAS (obviously not a QNAP again due to extortionate prices they want to have the mobo replaced) I'll likely forgo all the bells and whistles and go for a Drobo instead.

Now i thought you might like to know that the JSPI1 pins on my mobo connected to different pins on the bios chip to the guide at the beginning of this thread. When i tried to read the chip with the pin connections recommended in the guide with my Minipro TL866 i got an error message saying that no chip was detected. I checked which pins connected to which pins and this is what i got:
20190913_114707.jpg
When i came to use the minipro software i found that there was no option to program the chip via the ICSP port as below: The option was greyed out
20190913_102521.jpg
So i had to connect it through the 40 pin interface instead. Opting for safety i decided to buy an adapter to drop the voltage down to the chip voltage 1.8v as the programmer could only supply 3.3v. FYi i bought the adapter from Ebay, just search for '1.8v ADAPTER | BIOS MOTHERBOARD MX25U1635 MX25U6435 TL866'

I mounted the adapter into the programmer as can be seen above, i then used short jumper cables with a male fitting on one end and a female on the other and fitted them onto the JSPI1 pins on the motherboard:
20190913_102241.jpg
I wired the slots in the 1.8v adapter to the JSPI1 pins like this:
JSPI1 mobo Pins to MiniproTL866A Programmer.jpg
20190913_100047.jpg
20190913_100155.jpg
20190913_100256.jpg
I connected the programmer by USB to the PC, opened the software. i chose the correct chip in the 'Select IC' dropdown menu (in my case the bios chip is a Winbond W25Q64FSIG, so i chose the option for 'W25Q64F 1.8v @SOIC8'
20190913_100941.jpg
I then opened the 'Device' dropdown menu and and asked it to 'Read' It successfully picked up the chip. From the same dropdown menu i chose to 'Erase'
I checked the chip was blank from the 'Device' dropdown menu by choosing 'Blank check', again this was successful.

Now i needed to program it, i went and chose the 'Program' option from the 'Device' dropdown, it opened up a file search box, i pointed it to where i'd saved the BIOS software to and chose the .bin file
20190913_101034.jpg
You can still download the BIOS file from the Polish Qnap site mentioned earlier in this thread.
20190913_101118.jpg
i left the options as default, pressed ok and the programmer set itself running. this can take a few minutes to finish, so be patient. Eventually it finished with a message that it was successful.

Hopefully this will be useful to someone, even though my issue does not seem to down to the BIOS :-/
You do not have the required permissions to view the files attached to this post.
pechnase
New here
Posts: 4
Joined: Sat Mar 12, 2011 10:24 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by pechnase »

I have a question regarding powering the BIOS-flash chip during reflash procedure:
- is the NAS in power ON state or is the BIOS-chip powered from the programmer?
- or does the 1.8V from the NAS power only the level shifter of the programmer?

Thanks for your reply
pechnase

-------------------------------------------
TS-219P+, 2 x Samsung HD204UI with FW update
RAID1, ext4
-------------------------------------------
tonybailey9
First post
Posts: 1
Joined: Tue Nov 19, 2019 12:08 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by tonybailey9 »

Hi all I have a tas268 and upon starting I get the screen below via hdmi.
Nas will restart for 1 hour plus
Qnap have told me the mainboard has gone
Can anyone help me please
You do not have the required permissions to view the files attached to this post.
User avatar
dolbyman
Guru
Posts: 35024
Joined: Sat Feb 12, 2011 2:11 am
Location: Vancouver BC , Canada

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by dolbyman »

dont think this thread helps with your android based unit

no idea how to flash it...and qnap already gave up

Id see some android phone forums ..if there is some dead phone flash methods...although there is sadly no system image available from qnap to flash
derbnogod
First post
Posts: 1
Joined: Wed Feb 11, 2015 10:04 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by derbnogod »

Had to perform this procedure yesterday on my TS-851 and had multiple failures with the resistive network used to bring the voltage from the rpi into the 1.65-1.9 range. Switched to native 3.3V and had success after adding a couple decoupling capacitors to the power rail. Thanks for the hard work, you resurrected my unit.
vfiler
New here
Posts: 3
Joined: Tue Dec 05, 2017 3:21 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by vfiler »

Recently I got a dead TS 253 Pro from a friend. He told me it has been gone due to a failed firmware update.
After connecting to power, LED1 did not turn to green
Pressing power button: no beep, no HDMI signal, LED5 and 7 are red (no disks were connected), LED3 lits blue.

I removed all parts - DOM Flash, RAM, Battery, FAN. After reconnecting to power, LED1 turned to green.
But after powering on - no success. LED1 turns off, still no beep, no signal, all other LEDs get the same status like before.

Should i give it a try and follow the steps to flash it with my Raspberry, or is it just wasting time?
Board is QW59 Rev. 1.2

Thanks for any advice
coolquasar
New here
Posts: 2
Joined: Thu Aug 13, 2020 12:04 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by coolquasar »

buggy82 - Hey buddy, Any insights to this problem I have, will be really helpful

Long story short: When turned on, it is a hit and miss that POST will be success and system boots up

viewtopic.php?f=50&t=156389
User avatar
yujungchang
Starting out
Posts: 35
Joined: Sun Sep 20, 2020 11:54 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by yujungchang »

Bought a TS-453 Pro recently from a Ebay seller, however it has the same problem(no beep, no HDMI output and nothing) as everyone here. Since the seller provides a full refund without having to send it back(Canada), I decided to take it apart and see if a simple SPI reflash will fix the issue, as few successful stories. Unfortunately as I suspected, it does not do anything for majority of the people. After reflashing the BIOS and powering it up couple times, the image read back is exactly the same. That means either the CPU failed to fetch/execute any code or the BIOS does not run long enough to write back some data to the flash. By the way, the pin header for the SPI is exactly the same as the Dediprog header, which is commonly used in the PC development.
SPI_Header.jpg

I also captured the pin 1 CLK on the LPC header(LPC_CN1) to see if it's the same as C2000 Atom LPC defect. Although the clock capture looks different than this capture, https://youtu.be/Y8_emfoR_MI?t=788, I felt it is probably the same issue and just shows up as a different failure pattern. I also noticed the low of the LPC clock is quite high, probably not normal. Voltage measured with a multimeter will show ~2.4V if you don't have a scope. I also probed the Fintek F71869AD pin 38(PCICLK) and it seems that's the same clk as LPC header, 25 MHz. The pin39(CLKIN) is clocked at 24 MHz (but looks clean/good), so some clocks are still good. Plus there's no clock(low) to the SPI (actually the clk is only transmitted when there're transactions), pin 1(Vcc), 3(CS), 5(SO) are high. That explains why the system failed to boot and unchanged SPI image after power up.
LPC_Clock.jpg

After doing some Google search, I saw this issue discussed below matches exactly the same as my system, but the workaround doesn't work well for me [updated status below]. Tried lower the resistor to 100 ohm and the low is still around 1V(with High reduced to ~2V), but this might be the solution for some lucky ones.
https://community.intel.com/t5/Processo ... rue#M46864
we have measured that the LPC CLK signal is clearly degraded, and most often that the negative cycle transistor is broken, meaning that the clock signal is swinging between 1.6 and 3.3V, not 0V and 3.3V. We have tried to put a 120 ohm resistor between the degraded clock signal and 0V, and that seems to solve the problem, the computer boots again.
Continuously trying in the evening, I actually got it to boot with the resistor back to 120 Ohm (fine tune might be needed for a specific system). It seems it has a higher chance to boot if the processor is heated up hours before it is ready to boot (without fan and leave it on even if it hung). Most the time it hung at various places on the 1st boot(post code B2 or during decompress/booting to kernel). After power cycle and if it booted successfully with 2 beeps, it seems running fine afterward, only good until next cold boot.


Still trying to boot after an hour wait the next day, looks like I might have to warm it up a lot longer before it was able to boot last night. After waiting over 2.5 hours, it is finally showing signs of booting again (hung randomly) and this is with 120 Ohm. After more testing, it seems 100 Ohm works much better on my system.
This was captured when it was repeatable booting last night (with 120 Ohm). That big dip and more stable in the clock might be what's making it boot.
booting.jpg
This is when it was cold (not booting) this morning with nothing changed in the setup
No_boot_cold.jpg
When more than 5 hours of warm up still failed to boot (with 120 Ohm), it boots immediately after I reduced the resistor to 100 Ohm.
Boot with 100 Ohm.jpg

Final thought, it seems the 100 Ohm might be the solution for my system. When it failed in the earlier test, it's probably because I forgot to put back the memory after testing various conditions. It boots right away consistently(except few times, but failed more frequent in a colder temperature) with that 100 Ohm in place between the LPC-CN1(10-pin connector, next to 4-pin COM1 connector), pin 1 (LPC CLK) and ground (pin 8 or 10). I think the EC was in a messed up state when it failed to boot (after power down), but this is what you can do ~ power button override, yank the power cord, wait a minute, plug it back in and it boots up the next time for me. From chatting with my friend, the rework might cause clock buffer degradation even faster with this strong pull down to the clock. Even though it works now and the boot is repeatable, not sure how long can it last? The comments in the youtube link above suggested some failed after 6 months and some can last longer.

Also this LPC clk is fed into the Fintek F71869AD, which acts as the EC for the onboard power management, as well as the FSC (fan speed controller). Once the clock went wild, the CPU/EC lost the communication, the system will either hang, reboot or log fan errors(if lucky) as some have seen. When that happened, power cycle the system without G3 (mechanical off) does not fix the problem for me and the system continue to fail to boot until removing the power cord. It's very easy to reproduce this problem. Once the system boots up to QTS, those bad things happened immediately as soon as I disconnect the resistor.

Besides replacing the CPU (which is a riskier/costly option), an alternative clock from LPCCLK1 or other clock source might be a solution as well. The problem for that is it will be a challenge to find/cut the trace from the LPCCLK0 and hook it up to an alternative clk source without a board file.

[Update] Saw this youtube video after I posted this https://youtu.be/c5k8FWe6u60 Apparently he went through the same debug couple months earlier than me and recorded his finding as well.

Also received a donor TS-451+ from a nice Ebay seller and just need to pay the shipping. Below is the update for that system.
He said the system no longer works and planned to drop it off to the e-waste recycler. I purchased some spare drive trays from him and when he mentioned his TS-451+ failed, I offered him the detail on how he might be able to fix it. Instead he offered me the system with just the shipping and sure, my curiosity kicked in and planned to find out what happened to that system.

However when I received the system and to my surprise, it was not as bad as I thought. I do see the deteriorate LPC clock (see below, measured 1.7V with a multimeter), from both high and low (they should be close to a perfect square). Since it wasn't really as bad as the one I have, the system actually boots up without the need for a rework. After further testing, it seems the DIMM1 slot went bad and maybe that was what caused the issue. The system will boot if both DIMMs are populated. Although it detects both DIMM properly, beeps once and boots to load the Linux, it failed and hung there and no 2nd beep. With just a single DIMM in DIMM1 slot, there's no beep and nothing, except few reboots or hung. Also the drive slot 3/4 (the 2 away from the USB/Power button) are not working as well. From measuring the voltages, the EP602 MOSFET seems doing what it was told to do(signal is 12V, input 12V and output 0V). Turns out the problem was from the cable(pin 5 not connected to ground) that I used, see viewtopic.php?f=50&t=157649.

Over time I'm sure this one eventually will fail as well. It's just for now both the upper/lower are failing equally, so don't know whether a pull up or down is better for this. When one side failed more than the other, it will be easier to determine which rework makes it better.
TS-451+.jpg
You do not have the required permissions to view the files attached to this post.
Last edited by yujungchang on Fri Jan 15, 2021 10:25 am, edited 1 time in total.
XDD missile launch @Taiwan https://www.thingiverse.com/thing:5448224

[How to] Recover no beep / dead Intel based Qnap x53/x51 (2014~2016?) viewtopic.php?f=45&t=157459
[How to] Debug the SATA backplane power issue (models w/ a brick power supply viewtopic.php?f=50&t=157649
[How to] Enable onboard SATA connectors on the x53/x51 (Total 4+2 SATA drives for a 4 bay model) viewtopic.php?f=97&t=157816
buggy82
Getting the hang of things
Posts: 86
Joined: Thu Mar 20, 2008 11:54 pm

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by buggy82 »

Hey guys,

long time since I was here. I´m glad this How-To helped revive some devices and sparked the courage with some to even attempt to fix it. Of course other hardware issues, that lead to system failures cannot be fixed by a "simple" BIOS reflash, but if you are out of other options, it is probably still worth a try.

Thanks for everyone posting their approach and their setup. I really admire the knowledge and dedication from guys like @yujungchang and many others here and the willingness to share their results with us.

Cheers and Chapeau!
buggy82
TS 409 Pro - decommissioned
TS 559 Pro+ - degraded to an iSCSI target, disabled all services
TS 651 + UX 800P 3xRAID5 (as Storage Pool 1), actually RAID50 + 1 Single Drive (test VMs/temp data, QTS apps)
Eulogium
New here
Posts: 9
Joined: Tue Aug 02, 2016 5:30 am

Re: [HowTo] QNAP BIOS recovery of completely dead mainboard [SPI flash method] [x51, x53]

Post by Eulogium »

Hey @buggy82, I am trying to reflash a TS-251+ using your original instructions, but I am stuck at the stage after connecting the wires. When I run "flashrom -E -V -p linux_spi:dev=/dev/spidev0.0" I get a print-out of what looks like flashrom attempting to identify a rom, ultimately saying No EEPROM/flash device found. Maybe I did not connect the wires properly?
Post Reply

Return to “Miscellaneous”