DS214play救砖
本帖最后由 easy113 于 2017-7-6 23:33 编辑今天闲着没事，把昨天救活的ds214play重新装了一次系统，结果进度条在大概走到这个位置的时候，我把群晖助手卸载更新，结果重新打开的时候还能装，但是进度条卡在4%这里，之后关机重启只有电源键那个蓝灯和lan在闪，status那个灯不亮，一声蜂鸣也没有了，感觉是安装的时候半路关掉，导致了BIOS芯片(SPI Flash)数据损坏
没办法，只能自己修了，之前正好看到过这个帖子教你怎么救砖，里面提到了群晖bios芯片内部的结构，虽然是DS213j但是可以拿来利用
https://forum.synology.com/enu/viewtopic.php?t=84141
这里还有个帖子教你怎么用TTL线，可以看启动时候的log
https://forum.synology.com/enu/viewtopic.php?f=39&t=125574
所以直接开拆，由于拆的时候，这里的图片是弄好安装的时候拍的
首先把硬盘架旁边的两个卡扣往外顶，然后把机壳向后推，不需要工具用手就可以
然后拆掉硬盘架的5个螺钉，其中一个黑的在后面
然后把固定主板的4个自攻钉拆掉，把主板拿出来，先把后面那边拿出来，再到前面
JP3这个是TTL接口，有的机器写的是JP2，第2脚是地线，然后4、6分别是RX和TX
CPU旁边这个就是8M的Flash芯片，这种25的SPI Flash一般的编程器都可以读写
这是我的编程器，淘宝买的便宜货，可以读写Flash然后还带有TTL功能，而且价格还便宜，弄路由器、修电脑一个就够，缺点是读写速度好像不够快而且有时候写入的数据会有问题
把TTL线接好以后，在putty按照这个设置，然后打开COM端口，就可以看到启动的时候有啥不对劲了
截取其中的一段来看看
[ 1.763338] vgaarb: device added: PCI:0000:01:02.0,decodes=io+mem,owns=none,locks=none
[ 1.771250] vgaarb: loaded
[ 1.773943] vgaarb: bridge control possible 0000:01:02.0
[ 1.779607] SCSI subsystem initialized
[ 1.784453] PCI: Using ACPI for IRQ routing
[ 1.789514] Switching to clocksource hpet
[ 1.793694] AppArmor: AppArmor Filesystem Enabled
[ 1.798476] pnp: PnP ACPI init
[ 1.801541] ACPI: bus type pnp registered
[ 1.806261] pnp: PnP ACPI: found 2 devices
[ 1.810342] ACPI: ACPI bus type pnp unregistered
[ 1.859026] pci 0000:00:01.0: PCI bridge to
[ 1.864231] pci 0000:00:01.0: bridge window
[ 1.870991] pci 0000:00:1c.0: PCI bridge to
[ 1.876193] pci 0000:00:1c.0: bridge window
[ 1.882263] pci 0000:00:1c.0: bridge window
[ 1.889028] pci 0000:00:1c.0: bridge window
[ 1.896741] pci 0000:03:00.0: BAR 2: assigned
[ 1.904021] pci 0000:03:00.0: BAR 2: set to (PCI address )
[ 1.914412] pci 0000:03:00.0: BAR 0: assigned
[ 1.921691] pci 0000:03:00.0: BAR 0: set to (PCI address )
[ 1.932083] pci 0000:03:00.0: BAR 4: assigned
[ 1.938148] pci 0000:03:00.0: BAR 4: set to (PCI address )
[ 1.946632] pci 0000:00:1c.1: PCI bridge to
[ 1.951828] pci 0000:00:1c.1: bridge window
[ 1.957892] pci 0000:00:1c.1: bridge window
[ 1.964651] pci 0000:00:1c.1: bridge window
[ 1.972414] pci 0000:00:1c.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[ 1.979104] pci 0000:00:1c.1: PCI INT B -> GSI 17 (level, low) -> IRQ 17
[ 1.985923] NET: Registered protocol family 2
[ 1.990382] IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 2.988520] TCP established hash table entries: 65536 (order: 7, 524288 bytes)
[ 2.996231] TCP bind hash table entries: 65536 (order: 7, 524288 bytes)
[ 3.003385] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.009898] TCP reno registered
[ 3.013028] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 3.018849] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 3.025290] NET: Registered protocol family 1
[ 3.029877] RPC: Registered named UNIX socket transport module.
[ 3.035771] RPC: Registered udp transport module.
[ 3.040446] RPC: Registered tcp transport module.
[ 3.045123] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.051705] ACPI: PCI Interrupt Link enabled at IRQ 46
[ 3.057471] pci 0000:01:0d.0: PCI INT A -> Link -> GSI 46 (level, high) -> IRQ 46
[ 3.067461] pci 0000:01:0d.0: PCI INT A disabled
[ 3.072065] pci 0000:01:0d.1: PCI INT A -> Link -> GSI 46 (level, high) -> IRQ 46
[ 3.082035] pci 0000:01:0d.1: PCI INT A disabled
[ 3.086640] pci 0000:01:0d.2: PCI INT A -> Link -> GSI 46 (level, high) -> IRQ 46
[ 3.096600] pci 0000:01:0d.2: PCI INT A disabled
[ 3.101242] pci 0000:02:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[ 3.107929] pci 0000:02:00.0: PCI INT A disabled
[ 3.112698] Trying to unpack rootfs image as initramfs...
[ 3.118112] Freeing initrd memory: 4096k freed
[ 3.127851] platform rtc_cmos: registered platform RTC device (no PNP device found)
[ 3.138800] microcode: CPU0 sig=0x30662, pf=0x10, revision=0x205
[ 3.144797] microcode: CPU1 sig=0x30662, pf=0x10, revision=0x205
[ 3.150784] microcode: CPU2 sig=0x30662, pf=0x10, revision=0x205
[ 3.156768] microcode: CPU3 sig=0x30662, pf=0x10, revision=0x205
[ 3.162933] microcode: Microcode Update Driver: v2.00 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
[ 3.172170] audit: initializing netlink socket (disabled)
[ 3.177569] type=2000 audit(946684815.964:1): initialized
[ 3.183612] highmem bounce pool size: 64 pages
[ 3.196173] VFS: Disk quotas dquot_6.5.2
[ 3.200294] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 3.209111] msgmni has been set to 818
[ 3.213353] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 3.220715] io scheduler noop registered
[ 3.224620] io scheduler deadline registered
[ 3.228878] io scheduler cfq registered (default)
[ 3.233684] intelce_gpio 0000:01:0b.1: CE5300 GPIO controller detected.
[ 3.240335] ACPI: PCI Interrupt Link enabled at IRQ 39
[ 3.246078] intelce_gpio 0000:01:0b.1: PCI INT B -> Link -> GSI 39 (level, high) -> IRQ 39
[ 3.255763] Synology Evansport 2 bay GPIO Init
[ 3.261177] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[ 3.267636] serial8250: ttyS0 at I/O 0x3f8 (irq = 38) is a GEN3_serial
[ 3.284964] serial8250: ttyS1 at I/O 0x2f8 (irq = 38) is a GEN3_serial
[ 3.301174] serial8250: ttyS2 at I/O 0x3e8 (irq = 38) is a 8250
[ 3.333064] ACPI: PCI Interrupt Link enabled at IRQ 38
[ 3.338809] serial 0000:01:0b.0: PCI INT A -> Link -> GSI 38 (level, high) -> IRQ 38
[ 3.347054] serial 0000:01:0b.0: PCI INT A disabled
[ 3.352487] brd: module loaded
[ 3.355550] lpc_sch 0000:00:1f.0: Decode of the SMBus I/O range disabled
[ 3.362312] Loading iSCSI transport class v2.0-870.
[ 3.367905] ACPI: PCI Interrupt Link enabled at IRQ 47
[ 3.373647] ahci 0000:00:0e.0: PCI INT A -> Link -> GSI 47 (level, high) -> IRQ 47
[ 3.381776] ahci 0000:00:0e.0: forcing PORTS_IMPL to 0x3
[ 3.387083] ahci: SSS flag set, parallel bus scan disabled
[ 3.404761] ahci 0000:00:0e.0: AHCI 0001.0300 32 slots 2 ports 3 Gbps 0x3 impl SATA mode
[ 3.412815] ahci 0000:00:0e.0: flags: 64bit ncq sntf ilck stag pm led clo pmp pio slum part ems apst
[ 3.461572] scsi0 : ahci
[ 3.464421] scsi1 : ahci
[ 3.467191] ata1: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe100 irq 64
[ 3.474561] ata2: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe180 irq 64
[ 3.800437] ata1: SATA link down (SStatus 0 SControl 300)
[ 4.139886] ata2: SATA link down (SStatus 0 SControl 300)
[ 4.152301] sata_sil24 0000:03:00.0: enabling device (0000 -> 0003)
[ 4.158555] sata_sil24 0000:03:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
[ 4.191490] Refined TSC clocksource calibration: 1599.999 MHz.
[ 4.197304] Switching to clocksource tsc
[ 5.165456] scsi2 : sata_sil24
[ 5.168761] ata3: SATA max UDMA/100 host m128@0xbfd02000 port 0xbfd00000 irq 17
[ 7.250903] ata3: SATA link down (SStatus 0 SControl 0)
[ 7.257066] Intel(R) SPI FLASH CONTROLLER Driver built on Jun 29 2017 @ 07:32:39
[ 7.271778] ce5xx-spi-flash 0000:01:17.0: csr iobase 0xdffe0100, iosize 0x100 , mapped to 0xdae0e100
[ 7.280868] ce5xx-spi-flash 0000:01:17.0: mem iobase 0xd8000000, iosize 0x4000000 , mapped to 0xdae80000
[ 7.290604] m25p80 spi1.0: found n25q064, expected m25p80
[ 7.295982] m25p80 spi1.0: n25q064 (8192 Kbytes)
[ 7.300831] Creating 6 MTD partitions on "spi1.0":
[ 7.305605] 0x000000000000-0x0000000d0000 : "RedBoot"
[ 7.311459] 0x0000000d0000-0x0000003d0000 : "zImage"
[ 7.317165] 0x0000003d0000-0x0000007d0000 : "rd.gz"
[ 7.322798] 0x0000007d0000-0x0000007e0000 : "vendor"
[ 7.327844] vender Mac1 checksum error ucSum:0x00 Buf:0x00 Sum:0.
[ 7.333907] vender Mac2 checksum error ucSum:0x00 Buf:0x00 Sum:0.
[ 7.339970] vender Mac3 checksum error ucSum:0x00 Buf:0x00 Sum:0.
[ 7.346035] vender Mac4 checksum error ucSum:0xa1 Buf:0x3d Sum:161.
[ 7.352268] vender Mac5 checksum error ucSum:0x6d Buf:0x4e Sum:365.
[ 7.358501] vender Mac6 checksum error ucSum:0x37 Buf:0x2c Sum:311.
[ 7.364734] vender Mac7 checksum error ucSum:0x7f Buf:0x34 Sum:383.
[ 7.370970] serial number='1480LTN00000'
[ 7.375551] 0x0000007e0000-0x0000007f0000 : "RedBoot Config"
[ 7.382115] 0x0000007f0000-0x000000800000 : "FIS directory"
[ 7.388571] ce4100_spi 0000:01:0b.4: PCI INT B -> Link -> GSI 39 (level, high) -> IRQ 39
[ 7.397159] spi_pdata is d9999798
[ 7.400474] ssp type is CE5X00 SSP
[ 7.405199] ce5xxx-spi_slv 0000:01:15.0: PCI INT A -> Link -> GSI 39 (level, high) -> IRQ 39
[ 7.434845] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI
[ 7.441860] e1000: Copyright (c) 1999-2006 Intel Corporation.
[ 7.447667] ACPI: PCI Interrupt Link enabled at IRQ 45
[ 7.453413] e1000 0000:01:0c.0: PCI INT A -> Link -> GSI 45 (level, high) -> IRQ 45
[ 7.532575] e1000 0000:01:0c.0: eth0: (PCI:33MHz:32-bit) 00:11:32:34:87:28
[ 7.539432] e1000 0000:01:0c.0: eth0: Intel(R) PRO/1000 Network Connection
[ 7.546694] i8042: PNP: No PS/2 controller found. Probing ports directly.
[ 8.587182] i8042: No controller found
[ 8.591015] i2c /dev entries driver
[ 8.594640] ACPI: PCI Interrupt Link enabled at IRQ 40
[ 8.600388] ce4100_i2c 0000:01:0b.2: PCI INT C -> Link -> GSI 40 (level, high) -> IRQ 40
[ 8.609489] I2C: i2c-0: PXA I2C adapter
[ 8.613750] I2C: i2c-1: PXA I2C adapter
[ 8.618013] I2C: i2c-2: PXA I2C adapter
[ 8.622281] I2C: i2c-3: PXA I2C adapter
[ 8.626503] coretemp coretemp.0: Unable to read TjMax from CPU 0
[ 8.632508] coretemp coretemp.0: Using relative temperature scale!
[ 8.638682] coretemp coretemp.0: Unable to read TjMax from CPU 1
[ 8.644674] coretemp coretemp.0: Using relative temperature scale!
[ 8.650886] Syno_HddMon: Initialization completed.
[ 8.655656] md: linear personality registered for level -1
[ 8.661109] md: raid0 personality registered for level 0
[ 8.666391] md: raid1 personality registered for level 1
[ 8.671673] md: raid10 personality registered for level 10
[ 8.677129] md: raid6 personality registered for level 6
[ 8.682411] md: raid5 personality registered for level 5
[ 8.687693] md: raid4 personality registered for level 4
[ 8.693445] device-mapper: ioctl: 4.22.0-ioctl (2011-10-19) initialised: dm-devel@redhat.com
[ 8.701848] cpuidle: using governor ladder
[ 8.705925] oprofile: using NMI interrupt.
[ 8.710576] TCP cubic registered
[ 8.713790] NET: Registered protocol family 17
[ 8.718241] Registering the dns_resolver key type
[ 8.723076] Using IPI No-Shortcut mode
[ 8.727224] registered taskstats version 1
[ 8.731928] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 8.738537] md: Waiting for all devices to be available before autodetect
[ 8.745290] md: If you don't use raid, use raid=noautodetect
[ 8.751387] md: Autodetecting RAID arrays.
[ 8.755469] md: Scanned 0 and added 0 devices.
[ 8.759890] md: autorun ...
[ 8.762665] md: ... autorun DONE.
[ 8.766196] EXT3-fs (md0): error: unable to read superblock
[ 8.771877] EXT2-fs (md0): error: unable to read superblock
[ 8.777539] EXT4-fs (md0): unable to read superblock
[ 8.782515] List of all partitions:
[ 8.785989] 1f00 832 mtdblock0(driver?)
[ 8.791020] 1f01 3072 mtdblock1(driver?)
[ 8.796051] 1f02 4096 mtdblock2(driver?)
[ 8.801079] 1f03 64 mtdblock3(driver?)
[ 8.806107] 1f04 64 mtdblock4(driver?)
[ 8.811128] 1f05 64 mtdblock5(driver?)
[ 8.816158] No filesystem could mount root, tried:ext3 ext2 ext4
[ 8.822307] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(9,0)
[ 8.830533] Pid: 1, comm: swapper/0 Not tainted 3.2.40 #15132
[ 8.836244] Call Trace:
[ 8.838687][<c13b2140>] ? panic+0x57/0x13c
[ 8.842938][<c14fcadb>] ? mount_block_root+0x283/0x283
[ 8.848223][<c14fcbd8>] ? mount_root+0x3c/0x50
[ 8.852814][<c14fcd2e>] ? prepare_namespace+0x142/0x172
[ 8.858182][<c14fc7b9>] ? kernel_init+0x150/0x155
[ 8.863032][<c14fc669>] ? start_kernel+0x2a9/0x2a9
[ 8.867970][<c13b7e36>] ? kernel_thread_helper+0x6/0xd
这两行比较好玩，应该就是说引导的时候有什么文件没法载入，猜的八九不离十了
[ 8.816158] No filesystem could mount root, tried:ext3 ext2 ext4
[ 8.822307] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(9,0)既然有了TTL，本来可以像老外一样直接用putty写入，但是俺linux太差，还是只能拆掉芯片用编程器写入吧，正好这里也有ROM的组成，自己凑一个吧
[ 7.305605] 0x000000000000-0x0000000d0000 : "RedBoot"
[ 7.311459] 0x0000000d0000-0x0000003d0000 : "zImage"
[ 7.317165] 0x0000003d0000-0x0000007d0000 : "rd.gz"
[ 7.322798] 0x0000007d0000-0x0000007e0000 : "vendor"
[ 7.375551] 0x0000007e0000-0x0000007f0000 : "RedBoot Config"
[ 7.382115] 0x0000007f0000-0x000000800000 : "FIS directory"
用风枪烙铁把闪存拆下来，放到编程器读取
保存出来用winhex打开，按照上面的长度把Redboot、rd、zimage保存出来，等会要比较
比如导出rd这一段，先按alt+g，跳转到3d0000，在5上面按右键，选择选块起始，然后跳转到7d0000，在FF上面按右键，选择结束，选好之后就按另存为新文件
然后去群晖官网下载最新的pat文件，用winzip可以解压出这些文件
其中RedBoot.msys、zImage、rd.bin这三个文件会用到，其他的不用管
打开beyond compare比较编程器读出来的文件和pat解压出来的文件，这里发现是rd那段有很多地方变成了空白
于是回到winhex，用下载的rd.bin填充到编程器读取的文件里
之后保存，用编程器写入，再把flash芯片焊上主板，开机测试下，如果听到哔的一声，而且群晖助手能搜索到的话，那就装回去吧
顺便附上编程器刷入的文件，这里的序列号和mac地址要自己改
https://pan.baidu.com/s/1dEZ3QQt
不错不错，还是黑的折腾简单啊。直接u盘拔下来就行。 {:8_218:}学习了 参观一下，为啥在升级过程中去更新群晖助手啊 楼主巧手~~赞一个 kernel 发表于 2017-7-6 23:39
不错不错，还是黑的折腾简单啊。直接u盘拔下来就行。
X86的和ARM 的机器不一样好吧！ diy大神。 大神很是强啊 kingzwj168 发表于 2017-7-7 11:50
参观一下，为啥在升级过程中去更新群晖助手啊
因为以为群晖助手根本不会按照我的设置去设置新安装的NAS，可能是版本太老还是怎么的，比如IP地址和密码什么的，其实是要等够500秒才会上传配置，我一般刷新到DSM上线了就开始用了，从来不会等够那么多时间 楼主这动手能力也太强了吧，文章收藏了。 楼主太厉害了，学习了！ 这个实在是佩服。 本帖最后由 superyijia 于 2017-9-27 09:12 编辑
请教一下。DS214PLAY的MAC地址在哪里改，我的SN是正确的已经核对过了。
MAC和SN我都改过了。现在刷完BIOS ，开机不上电了。怎么办？
superyijia 发表于 2017-9-26 14:44
请教一下。DS214PLAY的MAC地址在哪里改，我的SN是正确的已经核对过了。
开机不上电？我的也是这个情况，然后发现应该是某个电容或者电感有点问题，时不时就会不开机，后面也是无解自己变好的
MAC地址好像在vendor里面，我的文章没写吗？ 大神 这都可以 上次也差点成砖 后来自己好了 楼主太厉害了，学习了！ 本帖最后由 yweiqiang 于 2021-3-29 00:55 编辑
链接失效了，求分享一份，谢谢 yweiqiang 发表于 2020-7-15 09:16
链接失效了，求分享一份，谢谢，yweiqiang@sina.com
需要啥？ 本帖最后由 yweiqiang 于 2021-3-29 00:55 编辑
easy113 发表于 2020-9-25 08:31
需要啥？
百度网盘里的
页:
[1]