DS214play救砖

今天闲着没事，把昨天救活的ds214play重新装了一次系统，结果进度条在大概走到这个位置的时候，我把群晖助手卸载更新，结果重新打开的时候还能装，但是进度条卡在4%这里，之后关机重启只有电源键那个蓝灯和lan在闪，status那个灯不亮，一声蜂鸣也没有了，感觉是安装的时候半路关掉，导致了BIOS芯片(SPI Flash)数据损坏


没办法，只能自己修了，之前正好看到过这个帖子教你怎么救砖，里面提到了群晖bios芯片内部的结构，虽然是DS213j但是可以拿来利用
https://forum.synology.com/enu/viewtopic.php?t=84141
这里还有个帖子教你怎么用TTL线，可以看启动时候的log
https://forum.synology.com/enu/viewtopic.php?f=39&t=125574

所以直接开拆，由于拆的时候，这里的图片是弄好安装的时候拍的
首先把硬盘架旁边的两个卡扣往外顶，然后把机壳向后推，不需要工具用手就可以


然后拆掉硬盘架的5个螺钉，其中一个黑的在后面



然后把固定主板的4个自攻钉拆掉，把主板拿出来，先把后面那边拿出来，再到前面



JP3这个是TTL接口，有的机器写的是JP2，第2脚是地线，然后4、6分别是RX和TX

CPU旁边这个就是8M的Flash芯片，这种25的SPI Flash一般的编程器都可以读写

这是我的编程器，淘宝买的便宜货，可以读写Flash然后还带有TTL功能，而且价格还便宜，弄路由器、修电脑一个就够，缺点是读写速度好像不够快而且有时候写入的数据会有问题


把TTL线接好以后，在putty按照这个设置，然后打开COM端口，就可以看到启动的时候有啥不对劲了



截取其中的一段来看看

1. [    1.763338] vgaarb: device added: PCI:0000:01:02.0,decodes=io+mem,owns=none,locks=none
   
2. [    1.771250] vgaarb: loaded
   
3. [    1.773943] vgaarb: bridge control possible 0000:01:02.0
   
4. [    1.779607] SCSI subsystem initialized
   
5. [    1.784453] PCI: Using ACPI for IRQ routing
   
6. [    1.789514] Switching to clocksource hpet
   
7. [    1.793694] AppArmor: AppArmor Filesystem Enabled
   
8. [    1.798476] pnp: PnP ACPI init
   
9. [    1.801541] ACPI: bus type pnp registered
   
10. [    1.806261] pnp: PnP ACPI: found 2 devices
    
11. [    1.810342] ACPI: ACPI bus type pnp unregistered
    
12. [    1.859026] pci 0000:00:01.0: PCI bridge to [bus 01-01]
    
13. [    1.864231] pci 0000:00:01.0:   bridge window [mem 0xc0000000-0xdfffffff]
    
14. [    1.870991] pci 0000:00:1c.0: PCI bridge to [bus 02-02]
    
15. [    1.876193] pci 0000:00:1c.0:   bridge window [io  0x9000-0x9fff]
    
16. [    1.882263] pci 0000:00:1c.0:   bridge window [mem 0xbfe00000-0xbfefffff]
    
17. [    1.889028] pci 0000:00:1c.0:   bridge window [mem 0xbfc00000-0xbfcfffff 64bit pref]
    
18. [    1.896741] pci 0000:03:00.0: BAR 2: assigned [mem 0xbfd00000-0xbfd01fff 64bit]
    
19. [    1.904021] pci 0000:03:00.0: BAR 2: set to [mem 0xbfd00000-0xbfd01fff 64bit] (PCI address [0xbfd00000-0xbfd01fff])
    
20. [    1.914412] pci 0000:03:00.0: BAR 0: assigned [mem 0xbfd02000-0xbfd0207f 64bit]
    
21. [    1.921691] pci 0000:03:00.0: BAR 0: set to [mem 0xbfd02000-0xbfd0207f 64bit] (PCI address [0xbfd02000-0xbfd0207f])
    
22. [    1.932083] pci 0000:03:00.0: BAR 4: assigned [io  0xa000-0xa07f]
    
23. [    1.938148] pci 0000:03:00.0: BAR 4: set to [io  0xa000-0xa07f] (PCI address [0xa000-0xa07f])
    
24. [    1.946632] pci 0000:00:1c.1: PCI bridge to [bus 03-03]
    
25. [    1.951828] pci 0000:00:1c.1:   bridge window [io  0xa000-0xafff]
    
26. [    1.957892] pci 0000:00:1c.1:   bridge window [mem 0xbfd00000-0xbfdfffff]
    
27. [    1.964651] pci 0000:00:1c.1:   bridge window [mem 0xbfb00000-0xbfbfffff 64bit pref]
    
28. [    1.972414] pci 0000:00:1c.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
    
29. [    1.979104] pci 0000:00:1c.1: PCI INT B -> GSI 17 (level, low) -> IRQ 17
    
30. [    1.985923] NET: Registered protocol family 2
    
31. [    1.990382] IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
    
32. [    2.988520] TCP established hash table entries: 65536 (order: 7, 524288 bytes)
    
33. [    2.996231] TCP bind hash table entries: 65536 (order: 7, 524288 bytes)
    
34. [    3.003385] TCP: Hash tables configured (established 65536 bind 65536)
    
35. [    3.009898] TCP reno registered
    
36. [    3.013028] UDP hash table entries: 256 (order: 1, 8192 bytes)
    
37. [    3.018849] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
    
38. [    3.025290] NET: Registered protocol family 1
    
39. [    3.029877] RPC: Registered named UNIX socket transport module.
    
40. [    3.035771] RPC: Registered udp transport module.
    
41. [    3.040446] RPC: Registered tcp transport module.
    
42. [    3.045123] RPC: Registered tcp NFSv4.1 backchannel transport module.
    
43. [    3.051705] ACPI: PCI Interrupt Link [LUSB] enabled at IRQ 46
    
44. [    3.057471] pci 0000:01:0d.0: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
    
45. [    3.067461] pci 0000:01:0d.0: PCI INT A disabled
    
46. [    3.072065] pci 0000:01:0d.1: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
    
47. [    3.082035] pci 0000:01:0d.1: PCI INT A disabled
    
48. [    3.086640] pci 0000:01:0d.2: PCI INT A -> Link[LUSB] -> GSI 46 (level, high) -> IRQ 46
    
49. [    3.096600] pci 0000:01:0d.2: PCI INT A disabled
    
50. [    3.101242] pci 0000:02:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
    
51. [    3.107929] pci 0000:02:00.0: PCI INT A disabled
    
52. [    3.112698] Trying to unpack rootfs image as initramfs...
    
53. [    3.118112] Freeing initrd memory: 4096k freed
    
54. [    3.127851] platform rtc_cmos: registered platform RTC device (no PNP device found)
    
55. [    3.138800] microcode: CPU0 sig=0x30662, pf=0x10, revision=0x205
    
56. [    3.144797] microcode: CPU1 sig=0x30662, pf=0x10, revision=0x205
    
57. [    3.150784] microcode: CPU2 sig=0x30662, pf=0x10, revision=0x205
    
58. [    3.156768] microcode: CPU3 sig=0x30662, pf=0x10, revision=0x205
    
59. [    3.162933] microcode: Microcode Update Driver: v2.00 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
    
60. [    3.172170] audit: initializing netlink socket (disabled)
    
61. [    3.177569] type=2000 audit(946684815.964:1): initialized
    
62. [    3.183612] highmem bounce pool size: 64 pages
    
63. [    3.196173] VFS: Disk quotas dquot_6.5.2
    
64. [    3.200294] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
    
65. [    3.209111] msgmni has been set to 818
    
66. [    3.213353] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
    
67. [    3.220715] io scheduler noop registered
    
68. [    3.224620] io scheduler deadline registered
    
69. [    3.228878] io scheduler cfq registered (default)
    
70. [    3.233684] intelce_gpio 0000:01:0b.1: CE5300 GPIO controller detected.
    
71. [    3.240335] ACPI: PCI Interrupt Link [LIDL] enabled at IRQ 39
    
72. [    3.246078] intelce_gpio 0000:01:0b.1: PCI INT B -> Link[LIDL] -> GSI 39 (level, high) -> IRQ 39
    
73. [    3.255763] Synology Evansport 2 bay GPIO Init
    
74. [    3.261177] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
    
75. [    3.267636] serial8250: ttyS0 at I/O 0x3f8 (irq = 38) is a GEN3_serial
    
76. [    3.284964] serial8250: ttyS1 at I/O 0x2f8 (irq = 38) is a GEN3_serial
    
77. [    3.301174] serial8250: ttyS2 at I/O 0x3e8 (irq = 38) is a 8250
    
78. [    3.333064] ACPI: PCI Interrupt Link [LUAR] enabled at IRQ 38
    
79. [    3.338809] serial 0000:01:0b.0: PCI INT A -> Link[LUAR] -> GSI 38 (level, high) -> IRQ 38
    
80. [    3.347054] serial 0000:01:0b.0: PCI INT A disabled
    
81. [    3.352487] brd: module loaded
    
82. [    3.355550] lpc_sch 0000:00:1f.0: Decode of the SMBus I/O range disabled
    
83. [    3.362312] Loading iSCSI transport class v2.0-870.
    
84. [    3.367905] ACPI: PCI Interrupt Link [LSAT] enabled at IRQ 47
    
85. [    3.373647] ahci 0000:00:0e.0: PCI INT A -> Link[LSAT] -> GSI 47 (level, high) -> IRQ 47
    
86. [    3.381776] ahci 0000:00:0e.0: forcing PORTS_IMPL to 0x3
    
87. [    3.387083] ahci: SSS flag set, parallel bus scan disabled
    
88. [    3.404761] ahci 0000:00:0e.0: AHCI 0001.0300 32 slots 2 ports 3 Gbps 0x3 impl SATA mode
    
89. [    3.412815] ahci 0000:00:0e.0: flags: 64bit ncq sntf ilck stag pm led clo pmp pio slum part ems apst
    
90. [    3.461572] scsi0 : ahci
    
91. [    3.464421] scsi1 : ahci
    
92. [    3.467191] ata1: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe100 irq 64
    
93. [    3.474561] ata2: SATA max UDMA/133 abar m2048@0xbfffe000 port 0xbfffe180 irq 64
    
94. [    3.800437] ata1: SATA link down (SStatus 0 SControl 300)
    
95. [    4.139886] ata2: SATA link down (SStatus 0 SControl 300)
    
96. [    4.152301] sata_sil24 0000:03:00.0: enabling device (0000 -> 0003)
    
97. [    4.158555] sata_sil24 0000:03:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
    
98. [    4.191490] Refined TSC clocksource calibration: 1599.999 MHz.
    
99. [    4.197304] Switching to clocksource tsc
    
100. [    5.165456] scsi2 : sata_sil24
     
101. [    5.168761] ata3: SATA max UDMA/100 host m128@0xbfd02000 port 0xbfd00000 irq 17
     
102. [    7.250903] ata3: SATA link down (SStatus 0 SControl 0)
     
103. [    7.257066] Intel(R) SPI FLASH CONTROLLER Driver built on Jun 29 2017 @ 07:32:39
     
104. [    7.271778] ce5xx-spi-flash 0000:01:17.0: csr iobase 0xdffe0100, iosize 0x100 , mapped to 0xdae0e100
     
105. [    7.280868] ce5xx-spi-flash 0000:01:17.0: mem iobase 0xd8000000, iosize 0x4000000 , mapped to 0xdae80000
     
106. [    7.290604] m25p80 spi1.0: found n25q064, expected m25p80
     
107. [    7.295982] m25p80 spi1.0: n25q064 (8192 Kbytes)
     
108. [    7.300831] Creating 6 MTD partitions on "spi1.0":
     
109. [    7.305605] 0x000000000000-0x0000000d0000 : "RedBoot"
     
110. [    7.311459] 0x0000000d0000-0x0000003d0000 : "zImage"
     
111. [    7.317165] 0x0000003d0000-0x0000007d0000 : "rd.gz"
     
112. [    7.322798] 0x0000007d0000-0x0000007e0000 : "vendor"
     
113. [    7.327844] vender Mac1 checksum error ucSum:0x00 Buf:0x00 Sum:0.
     
114. [    7.333907] vender Mac2 checksum error ucSum:0x00 Buf:0x00 Sum:0.
     
115. [    7.339970] vender Mac3 checksum error ucSum:0x00 Buf:0x00 Sum:0.
     
116. [    7.346035] vender Mac4 checksum error ucSum:0xa1 Buf:0x3d Sum:161.
     
117. [    7.352268] vender Mac5 checksum error ucSum:0x6d Buf:0x4e Sum:365.
     
118. [    7.358501] vender Mac6 checksum error ucSum:0x37 Buf:0x2c Sum:311.
     
119. [    7.364734] vender Mac7 checksum error ucSum:0x7f Buf:0x34 Sum:383.
     
120. [    7.370970] serial number='1480LTN00000'
     
121. [    7.375551] 0x0000007e0000-0x0000007f0000 : "RedBoot Config"
     
122. [    7.382115] 0x0000007f0000-0x000000800000 : "FIS directory"
     
123. [    7.388571] ce4100_spi 0000:01:0b.4: PCI INT B -> Link[LIDL] -> GSI 39 (level, high) -> IRQ 39
     
124. [    7.397159] spi_pdata is d9999798
     
125. [    7.400474] ssp type is CE5X00 SSP
     
126. [    7.405199] ce5xxx-spi_slv 0000:01:15.0: PCI INT A -> Link[LIDL] -> GSI 39 (level, high) -> IRQ 39
     
127. [    7.434845] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI
     
128. [    7.441860] e1000: Copyright (c) 1999-2006 Intel Corporation.
     
129. [    7.447667] ACPI: PCI Interrupt Link [LGBE] enabled at IRQ 45
     
130. [    7.453413] e1000 0000:01:0c.0: PCI INT A -> Link[LGBE] -> GSI 45 (level, high) -> IRQ 45
     
131. [    7.532575] e1000 0000:01:0c.0: eth0: (PCI:33MHz:32-bit) 00:11:32:34:87:28
     
132. [    7.539432] e1000 0000:01:0c.0: eth0: Intel(R) PRO/1000 Network Connection
     
133. [    7.546694] i8042: PNP: No PS/2 controller found. Probing ports directly.
     
134. [    8.587182] i8042: No controller found
     
135. [    8.591015] i2c /dev entries driver
     
136. [    8.594640] ACPI: PCI Interrupt Link [LI2C] enabled at IRQ 40
     
137. [    8.600388] ce4100_i2c 0000:01:0b.2: PCI INT C -> Link[LI2C] -> GSI 40 (level, high) -> IRQ 40
     
138. [    8.609489] I2C: i2c-0: PXA I2C adapter
     
139. [    8.613750] I2C: i2c-1: PXA I2C adapter
     
140. [    8.618013] I2C: i2c-2: PXA I2C adapter
     
141. [    8.622281] I2C: i2c-3: PXA I2C adapter
     
142. [    8.626503] coretemp coretemp.0: Unable to read TjMax from CPU 0
     
143. [    8.632508] coretemp coretemp.0: Using relative temperature scale!
     
144. [    8.638682] coretemp coretemp.0: Unable to read TjMax from CPU 1
     
145. [    8.644674] coretemp coretemp.0: Using relative temperature scale!
     
146. [    8.650886] Syno_HddMon: Initialization completed.
     
147. [    8.655656] md: linear personality registered for level -1
     
148. [    8.661109] md: raid0 personality registered for level 0
     
149. [    8.666391] md: raid1 personality registered for level 1
     
150. [    8.671673] md: raid10 personality registered for level 10
     
151. [    8.677129] md: raid6 personality registered for level 6
     
152. [    8.682411] md: raid5 personality registered for level 5
     
153. [    8.687693] md: raid4 personality registered for level 4
     
154. [    8.693445] device-mapper: ioctl: 4.22.0-ioctl (2011-10-19) initialised: dm-devel@redhat.com
     
155. [    8.701848] cpuidle: using governor ladder
     
156. [    8.705925] oprofile: using NMI interrupt.
     
157. [    8.710576] TCP cubic registered
     
158. [    8.713790] NET: Registered protocol family 17
     
159. [    8.718241] Registering the dns_resolver key type
     
160. [    8.723076] Using IPI No-Shortcut mode
     
161. [    8.727224] registered taskstats version 1
     
162. [    8.731928] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
     
163. [    8.738537] md: Waiting for all devices to be available before autodetect
     
164. [    8.745290] md: If you don't use raid, use raid=noautodetect
     
165. [    8.751387] md: Autodetecting RAID arrays.
     
166. [    8.755469] md: Scanned 0 and added 0 devices.
     
167. [    8.759890] md: autorun ...
     
168. [    8.762665] md: ... autorun DONE.
     
169. [    8.766196] EXT3-fs (md0): error: unable to read superblock
     
170. [    8.771877] EXT2-fs (md0): error: unable to read superblock
     
171. [    8.777539] EXT4-fs (md0): unable to read superblock
     
172. [    8.782515] List of all partitions:
     
173. [    8.785989] 1f00             832 mtdblock0  (driver?)
     
174. [    8.791020] 1f01            3072 mtdblock1  (driver?)
     
175. [    8.796051] 1f02            4096 mtdblock2  (driver?)
     
176. [    8.801079] 1f03              64 mtdblock3  (driver?)
     
177. [    8.806107] 1f04              64 mtdblock4  (driver?)
     
178. [    8.811128] 1f05              64 mtdblock5  (driver?)
     
179. [    8.816158] No filesystem could mount root, tried:  ext3 ext2 ext4
     
180. [    8.822307] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(9,0)
     
181. [    8.830533] Pid: 1, comm: swapper/0 Not tainted 3.2.40 #15132
     
182. [    8.836244] Call Trace:
     
183. [    8.838687]  [<c13b2140>] ? panic+0x57/0x13c
     
184. [    8.842938]  [<c14fcadb>] ? mount_block_root+0x283/0x283
     
185. [    8.848223]  [<c14fcbd8>] ? mount_root+0x3c/0x50
     
186. [    8.852814]  [<c14fcd2e>] ? prepare_namespace+0x142/0x172
     
187. [    8.858182]  [<c14fc7b9>] ? kernel_init+0x150/0x155
     
188. [    8.863032]  [<c14fc669>] ? start_kernel+0x2a9/0x2a9
     
189. [    8.867970]  [<c13b7e36>] ? kernel_thread_helper+0x6/0xd

复制代码

这两行比较好玩，应该就是说引导的时候有什么文件没法载入，猜的八九不离十了

1. [    8.816158] No filesystem could mount root, tried:  ext3 ext2 ext4
   
2. [    8.822307] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(9,0)

复制代码

既然有了TTL，本来可以像老外一样直接用putty写入，但是俺linux太差，还是只能拆掉芯片用编程器写入吧，正好这里也有ROM的组成，自己凑一个吧

1. [    7.305605] 0x000000000000-0x0000000d0000 : "RedBoot"
   
2. [    7.311459] 0x0000000d0000-0x0000003d0000 : "zImage"
   
3. [    7.317165] 0x0000003d0000-0x0000007d0000 : "rd.gz"
   
4. [    7.322798] 0x0000007d0000-0x0000007e0000 : "vendor"
   
5. [    7.375551] 0x0000007e0000-0x0000007f0000 : "RedBoot Config"
   
6. [    7.382115] 0x0000007f0000-0x000000800000 : "FIS directory"

复制代码

用风枪烙铁把闪存拆下来，放到编程器读取


保存出来用winhex打开，按照上面的长度把Redboot、rd、zimage保存出来，等会要比较
比如导出rd这一段，先按alt+g，跳转到3d0000，在5上面按右键，选择选块起始，然后跳转到7d0000，在FF上面按右键，选择结束，选好之后就按另存为新文件




然后去群晖官网下载最新的pat文件，用winzip可以解压出这些文件

其中RedBoot.msys、zImage、rd.bin这三个文件会用到，其他的不用管

打开beyond compare比较编程器读出来的文件和pat解压出来的文件，这里发现是rd那段有很多地方变成了空白

于是回到winhex，用下载的rd.bin填充到编程器读取的文件里


之后保存，用编程器写入，再把flash芯片焊上主板，开机测试下，如果听到哔的一声，而且群晖助手能搜索到的话，那就装回去吧


顺便附上编程器刷入的文件，这里的序列号和mac地址要自己改
https://pan.baidu.com/s/1dEZ3QQt

不错不错，还是黑的折腾简单啊。直接u盘拔下来就行。

学习了

参观一下，为啥在升级过程中去更新群晖助手啊

楼主巧手~~赞一个

kernel 发表于 2017-7-6 23:39
不错不错，还是黑的折腾简单啊。直接u盘拔下来就行。

X86的和ARM 的机器不一样好吧！

diy大神。

大神很是强啊

kingzwj168 发表于 2017-7-7 11:50
参观一下，为啥在升级过程中去更新群晖助手啊

因为以为群晖助手根本不会按照我的设置去设置新安装的NAS，可能是版本太老还是怎么的，比如IP地址和密码什么的，其实是要等够500秒才会上传配置，我一般刷新到DSM上线了就开始用了，从来不会等够那么多时间

楼主这动手能力也太强了吧，文章收藏了。

楼主太厉害了，学习了！

这个实在是佩服。

请教一下。DS214PLAY的MAC地址在哪里改，我的SN是正确的已经核对过了。


MAC和SN我都改过了。现在刷完BIOS ，开机不上电了。怎么办？

superyijia 发表于 2017-9-26 14:44
请教一下。DS214PLAY的MAC地址在哪里改，我的SN是正确的已经核对过了。

开机不上电？我的也是这个情况，然后发现应该是某个电容或者电感有点问题，时不时就会不开机，后面也是无解自己变好的
MAC地址好像在vendor里面，我的文章没写吗？

大神 这都可以 上次也差点成砖 后来自己好了

楼主太厉害了，学习了！

链接失效了，求分享一份，谢谢

yweiqiang 发表于 2020-7-15 09:16
链接失效了，求分享一份，谢谢，yweiqiang@sina.com

需要啥？

easy113 发表于 2020-9-25 08:31
需要啥？

百度网盘里的