Re: Bricked Synology DS213 (Kirkwood) so close November 15, 2020 07:26PM |
Admin Registered: 14 years ago Posts: 19,325 |
Quote
/tftproot/ds213.mtd0
/tftproot/ds213.mtd1
/tftproot/ds213.mtd2
/tftproot/ds213.mtd3
/tftproot/ds213.mtd4
/tftproot/ds213.mtd5
kwboot -t -B 115200 /dev/ttyUSB0 -b ds213.mtd0 -p
sflash protect off sflash infoExpected Output
Flash Base Address : 0xf8000000 Flash Model : ST N25Q064 Manufacturer ID : 0x20 Device Id : 0xba17 Sector Size : 64K Number of sectors : 128 Page Size : 256 Write Protection : Off
tftpboot 0x800000 ds213.mtd0 sflash write 0x800000 0x000000000000 0x00090000 tftpboot 0x800000 ds213.mtd1 sflash write 0x800000 0x000000090000 0x00300000 tftpboot 0x800000 ds213.mtd2 sflash write 0x800000 0x000000390000 0x00440000 tftpboot 0x800000 ds213.mtd3 sflash write 0x800000 0x0000007d0000 0x00010000 tftpboot 0x800000 ds213.mtd4 sflash write 0x800000 0x0000007e0000 0x00010000 tftpboot 0x800000 ds213.mtd5 sflash write 0x800000 0x0000007f0000 0x00010000
Re: Bricked Synology DS213 (Kirkwood) so close November 22, 2020 06:58PM |
Registered: 4 years ago Posts: 78 |
Marvell>> tftpboot 0x800000 ds213.mtd2 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.9 Filename 'ds213.mtd2'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########################## done Bytes transferred = 4456448 (440000 hex) Marvell>> sflash write 0x000000390000 0x00440000 Usage: sflash - read, write or erase the external SPI Flash. Marvell>> tftpboot 0x800000 ds213.mtd1 Unknown command 'tftpboot' - try 'help' Marvell>> tftpboot 0x800000 ds213.mtd1 Unknown command 'tftpboot' - try 'help' Marvell>> tftpboot 0x800000 ds213.mtd1 Unknown command 'tftpboot' - try 'help' Marvell>> tftpboot 0x800000 ds213.mtd1 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.9 Filename 'ds213.mtd1'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################## done Bytes transferred = 3145728 (300000 hex) Marvell>> sflash write 0x000000090000 0x00300000 Usage: sflash - read, write or erase the external SPI Flash.
Re: Bricked Synology DS213 (Kirkwood) so close November 22, 2020 07:52PM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close November 22, 2020 07:56PM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close November 23, 2020 10:00AM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close November 23, 2020 04:04PM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close November 23, 2020 04:16PM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close November 24, 2020 12:21AM |
Admin Registered: 14 years ago Posts: 19,325 |
Quote
tftpboot/sflash went smoothly and after a reset the box was discovered by the Synology software and allowed a fresh upgrade of the OS. After that, the web interface presented the normal login and indicated the box was healthy.
Quote
After the box was up and running I installed the second drive and it would not complete the boot. I removed the drive and again it would not complete the boot, but the web interface indicated it had crashed and to remove the volume and re-install.
Re: Bricked Synology DS213 (Kirkwood) so close November 24, 2020 09:41AM |
Registered: 4 years ago Posts: 78 |
For the next step you will need the serial number and original MAC from the sticker and a hex editor (I use hexeditor). First we create an empty 64 kB vender partition: $ dd if=/dev/zero of=vender.img bs=1024 count=64 The MAC address is stored in the first 6 bytes and the 7th byte contains a checksum. The checksum is calculated by taking the sum of the bytes in the MAC address. The following C program can be used to calculate the checksum. The checksum is stored in an unsigned char, which is not large enough to store the total. It will flow over give the rest, which is larger than multiples of 256 bytes: #include <stdio.h> int main() { unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF}; for (i = 0; i < 6; i++) { chksum += rgAddr; } printf("Checksum: 0x%X\n", chksum); return 0; } The first three bytes are the Synology part, the last three bytes needs to be changed to your MAC address. Compile with $ gcc -o checksum mac_checksum.c This MAC example 00:11:32:FF:FF:FF will give a checksum of 0x40. Insert these bytes into the image: $ hexeditor -b vender.img 00000000 00 11 32 FF FF FF 40 The serial number is written like this. For example: SN=1350LAN009999,CHK=999 00000020 53 4e 3d 31 33 35 30 4c 41 4e 30 30 31 39 39 39 00000030 2c 43 48 4b 3d 39 39 39 Use an ascii to hex converter to generate the hex values. The checksum is calculated on next reboot automatically and can be inserted later. We use a dummy of 999 for now. Once u-boot is working again, you can flash the updated vender image from u-boot (see below how to do this). Now insert the vender data into the flash image: $ dd if=vender.img of=flash.rom bs=1 seek=$((0x7d0000)) The flash.rom image is now ready to be flashed onto the chip. The RedBoot_Config and FIS_directory partitions are not needed.
Re: Bricked Synology DS213 (Kirkwood) so close November 24, 2020 05:44PM |
Admin Registered: 14 years ago Posts: 19,325 |
printenv
Re: Bricked Synology DS213 (Kirkwood) so close December 08, 2020 06:02PM |
Registered: 4 years ago Posts: 78 |
92 % [......................................................................] 94 % [......................................................................] 95 % [......................................................................] 97 % [......................................................................] 98 % [..........................................................] [Type Ctrl-\ + c to quit] __ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** LOADER ** ** MARVELL BOARD: Synology Disk Station LE U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9 U-Boot code: 00600000 -> 0067FFF0 BSS: -> 0068B3D4 Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz SysClock = 500Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7 DRAM CS[0] base 0x00000000 size 512MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done Using default environment [8192kB@f8000000] Flash: 8 MB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled USB 0: host mode PEX 0: interface detected no Link. PEX 1: PCI Express Root Complex Interface PEX interface detected Link X1 Synology Model: DS213 Fan Status: Good Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 0 Marvell>> sflash protect off Marvell>> Marvell>> setenv ipaddr 192.168.0.100 Marvell>> setenv serverip 192.168.0.11 Marvell>> sflash info Flash Base Address : 0xf8000000 Flash Model : ST N25Q064 Manufacturer ID : 0x20 Device Id : 0xba17 Sector Size : 64K Number of sectors : 128 Page Size : 256 Write Protection : Off Marvell>> tftpboot 0x800000 ds213.mtd0 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd0'. Load address: 0x800000 Loading: ################################################################# ################################################### done Bytes transferred = 589824 (90000 hex) Marvell>> sflash write 0x800000 0x000000000000 0x00090000 Marvell>> tftpboot 0x800000 ds213.mtd1 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd1'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################## done Bytes transferred = 3145728 (300000 hex) Marvell>> sflash write 0x800000 0x000000090000 0x00300000 Marvell>> tftpboot 0x800000 ds213.mtd2 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd2'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########################## done Bytes transferred = 4456448 (440000 hex) Marvell>> sflash write 0x800000 0x000000390000 0x00440000 Marvell>> tftpboot 0x800000 ds213.mtd3 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd3'. Load address: 0x800000 Loading: ############# done Bytes transferred = 65536 (10000 hex) Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000 Marvell>> Marvell>> tftpboot 0x800000 ds213.mtd4 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd4'. Load address: 0x800000 Loading: ############# done Bytes transferred = 65536 (10000 hex) Marvell>> sflash write 0x800000 0x0000007e0000 0x00010000 Marvell>> tftpboot 0x800000 ds213.mtd5 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.100 Filename 'ds213.mtd5'. Load address: 0x800000 Loading: ############# done Bytes transferred = 65536 (10000 hex) Marvell>> sflash write 0x800000 0x0000007f0000 0x00010000 Marvell>>
Re: Bricked Synology DS213 (Kirkwood) so close December 08, 2020 07:38PM |
Admin Registered: 14 years ago Posts: 19,325 |
Quote
Printenv does show a ethaddr (which is a MAC address, but does not match the label) setenv ethaddr MAC-on-Label and then printenv again shows that env gone from the list.
Re: Bricked Synology DS213 (Kirkwood) so close December 08, 2020 08:01PM |
Registered: 4 years ago Posts: 78 |
>Quote
Printenv does show a ethaddr (which is a
> MAC address, but does not match the label) setenv
> ethaddr MAC-on-Label and then printenv again shows
> that env gone from the list.
Re: Bricked Synology DS213 (Kirkwood) so close December 09, 2020 03:26AM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close December 09, 2020 09:29AM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close December 09, 2020 02:33PM |
Registered: 4 years ago Posts: 78 |
#include <stdio.h> int main() { unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF}; for (i = 0; i < 6; i++) { chksum += rgAddr; } printf("Checksum: 0x%X\n", chksum); return 0; }
Re: Bricked Synology DS213 (Kirkwood) so close December 09, 2020 04:30PM |
Registered: 4 years ago Posts: 78 |
#include <stdio.h> int main() { unsigned char chksum = 0; int i = 0; unsigned char rgAddr[6] = {0x00, 0x11, 0x32, 0xFF, 0xFF, 0xFF}; for (i = 0; i < 6; i++) { chksum += rgAddr;} printf("Checksum: 0x%X\n", chksum); return 0; }
Re: Bricked Synology DS213 (Kirkwood) so close December 09, 2020 09:24PM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close December 10, 2020 06:57PM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close December 10, 2020 10:58PM |
Admin Registered: 14 years ago Posts: 19,325 |
Quote
Well. that worked to a point. After the box restarted It was visible to the synology assistant, and to the web admin
Re: Bricked Synology DS213 (Kirkwood) so close December 10, 2020 11:57PM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close December 11, 2020 11:07AM |
Registered: 4 years ago Posts: 78 |
root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0 picocom v3.1 port is : /dev/ttyUSB0 flowcontrol : none baudrate is : 115200 parity is : none databits are : 8 stopbits are : 1 escape is : C-a local echo is : no noinit is : no noreset is : no hangup is : no nolock is : no send_cmd is : sz -vv receive_cmd is : rz -vv -E imap is : omap is : emap is : crcrlf,delbs, logfile is : none initstring : none exit_after is : not set exit is : no Type [C-a] [C-h] to see available commands Terminal ready � __ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** LOADER ** ** MARVELL BOARD: Synology Disk Station LE U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9 U-Boot code: 00600000 -> 0067FFF0 BSS: -> 0068B3D4 Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz SysClock = 500Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7 DRAM CS[0] base 0x00000000 size 512MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done Using default environment [8192kB@f8000000] Flash: 8 MB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled USB 0: host mode PEX 0: interface detected no Link. PEX 1: PCI Express Root Complex Interface PEX interface detected Link X1 Synology Model: DS213 Fan Status: Good Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 0 Marvell>> setenv serverip 192.168.0.11 Marvell>> setenv ipaddr 192.163.0.240 Marvell>> sflash protect off Marvell>> sflash info Flash Base Address : 0xf8000000 Flash Model : ST N25Q064 Manufacturer ID : 0x20 Device Id : 0xba17 Sector Size : 64K Number of sectors : 128 Page Size : 256 Write Protection : Off Marvell>> tftpboot 0x800000 ds213.mtd0 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.240 Filename 'ds213.mtd0'. Load address: 0x800000 Loading: ################################################################# ################################################### done Bytes transferred = 589824 (90000 hex) Marvell>> sflash write 0x800000 0x000000000000 0x00090000 Marvell>> tftpboot 0x800000 ds213.mtd1 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.240 Filename 'ds213.mtd1'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################## done Bytes transferred = 3145728 (300000 hex) Marvell>> sflash write 0x800000 0x000000090000 0x00300000 Marvell>> tftpboot 0x800000 ds213.mtd2 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.240 Filename 'ds213.mtd2'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ########################## done Bytes transferred = 4456448 (440000 hex) Marvell>> sflash write 0x800000 0x000000390000 0x00440000 Marvell>> tftpboot 0x800000 ds213.mtd3 Using egiga0 device TFTP from server 192.168.0.11; our IP address is 192.168.0.240 Filename 'ds213.mtd3'. Load address: 0x800000 Loading: ############# done Bytes transferred = 65535 (ffff hex) Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000 Marvell>> ------------------ boot after flash ----------------- root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0 picocom v3.1 port is : /dev/ttyUSB0 flowcontrol : none baudrate is : 115200 parity is : none databits are : 8 stopbits are : 1 escape is : C-a local echo is : no noinit is : no noreset is : no hangup is : no nolock is : no send_cmd is : sz -vv receive_cmd is : rz -vv -E imap is : omap is : emap is : crcrlf,delbs, logfile is : none initstring : none exit_after is : not set exit is : no Type [C-a] [C-h] to see available commands Terminal ready � __ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** LOADER ** ** MARVELL BOARD: Synology Disk Station LE U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9 U-Boot code: 00600000 -> 0067FFF0 BSS: -> 0068B3D4 Soc: 88F6282 A1CPU running @ 2000Mhz L2 running @ 500Mhz SysClock = 500Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7 DRAM CS[0] base 0x00000000 size 512MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done Using default environment [8192kB@f8000000] Flash: 8 MB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled USB 0: host mode PEX 0: interface detected no Link. PEX 1: PCI Express Root Complex Interface PEX interface detected Link X1 Synology Model: DS213 Fan Status: Good Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 0 ## Booting image at f8090000 ... Image Name: Linux-2.6.32.12 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1553512 Bytes = 1.5 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK ## Loading Ramdisk Image at f8390000 ... Image Name: synology_88f6282_213 25426 Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 3297004 Bytes = 3.1 MB Load Address: 00800000 Entry Point: 00800000 Verifying Checksum ... Bad Data CRC
Re: Bricked Synology DS213 (Kirkwood) so close December 11, 2020 05:34PM |
Admin Registered: 14 years ago Posts: 19,325 |
root@ubuntu20:/tftproot# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0 .... U-Boot 1.1.4 (Apr 19 2012 - 18:47:44) Marvell version: 3.5.9 .... Hit any key to stop autoboot: 0
Marvell>> tftpboot 0x800000 ds213.mtd1 Marvell>> tftpboot 0x800000 ds213.mtd2
Marvell>> tftpboot 0x800000 ds213.mtd3 Bytes transferred = 65535 (ffff hex) Marvell>> sflash write 0x800000 0x0000007d0000 0x00010000
Quote
hex 0x00010000 = decimal 65536
Re: Bricked Synology DS213 (Kirkwood) so close December 11, 2020 08:08PM |
Registered: 4 years ago Posts: 78 |
Re: Bricked Synology DS213 (Kirkwood) so close December 11, 2020 10:23PM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close December 14, 2020 12:33PM |
Registered: 4 years ago Posts: 78 |
root@debian:/boot# flash_unlock /dev/mtd0 root@debian:/boot# flashcp -v ds213.mtd0 /dev/mtd0 ds213.mtd0 won't fit into /dev/mtd0! root@debian:/boot# cat /proc/mtd dev: size erasesize name mtd0: 00080000 00001000 "RedBoot" mtd1: 00200000 00001000 "zImage" mtd2: 00140000 00001000 "rd.gz" mtd3: 00010000 00001000 "vendor" mtd4: 00020000 00001000 "RedBoot config" mtd5: 00010000 00001000 "FIS directory"
Re: Bricked Synology DS213 (Kirkwood) so close December 15, 2020 03:17AM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close January 22, 2021 10:11AM |
Registered: 4 years ago Posts: 12 |
Re: Bricked Synology DS213 (Kirkwood) so close January 23, 2021 03:19AM |
Admin Registered: 14 years ago Posts: 19,325 |
Re: Bricked Synology DS213 (Kirkwood) so close January 23, 2021 05:35AM |
Registered: 4 years ago Posts: 12 |