DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2007-01-13 23:05:42

magore
Member
Registered: 2007-01-05
Posts: 25

Serial consol log of DNS-323 boot

The following is the serial console log of the DNS-323 while booting with no disks

** LOADER **             
** MARVELL BOARD: RD-88F5181-POS-NAS LE                                       

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2                                                           

DRAM CS[0] base 0x00000000   size  64MB                                       
DRAM Total size  64MB                     
[8192kB@ff800000] Flash:  8 MB                             
Addresses 20M - 0M are saved for the U-Boot usage.                                                 
Mem malloc Initialization (20M - 16M): Done                                           
*** Warning - bad CRC, using default environment                                               


Soc: MV88F5181 Rev 3                   
CPU: ARM926 (Rev 0) running @ 500Mhz                                   
SysClock = 166Mhz , TClock = 166Mhz                                   


Init usb device.                 
PCI 0: PCI Express Root Complex Interface                                         
PCI 1: Conventional PCI, speed = 33000000                                         
Hit any key to stop autoboot:  0                               
## Booting image at ff820000 ...                               
   Image Name:   Linux-2.6.6-arm2                                 
   Image Type:   ARM Linux Kernel Image (uncompressed)                                                     
   Data Size:    1232560 Bytes =  1.2 MB                                       
   Load Address: 00008000                         
   Entry Point:  00008000                         
   Verifying Checksum ... OK                           
OK 
## Loading Ramdisk Image at ff9a0000 ...                                       
   Image Name:   Ramdisk                       
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)                                                         
   Data Size:    5848966 Bytes =  5.6 MB                                       
   Load Address: 00800000                         
   Entry Point:  00800000                         
   Verifying Checksum ... OK                           

Starting kernel ...                   

Uncompressing Linux.............................................................                                                                               
....................... done, booting the kernel.                                                 
Linux version 2.6.6-arm2 (jack@SWTEST2) (gcc version 3.3.3) #21 Thu Nov 9 10:22:                                                                               
37 CST 2006           
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)                                                     
CPU: D VIPT write-back cache                           
CPU: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets                                                                   
CPU: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024                                                               
Machine: MV-88fxx81                   
Using UBoot passing parameters structure                                       
Sys Clk = 166000000, Tclk = 166000000                                     


- Warning - This LSP release was tested only with U-Boot release 1.4.2                                                                     

Memory policy: ECC disabled, Data cache writeback                                                 
On node 0 totalpages: 16384                           
  DMA zone: 16384 pages, LIFO batch:4                                     
  Normal zone: 0 pages, LIFO batch:1                                   
  HighMem zone: 0 pages, LIFO batch:1                                     
Built 1 zonelists                 
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none                                                                               

PID hash table entries: 512 (order 9: 4096 bytes)                                                 
Console: colour dummy device 80x30                                 
Memory: 64MB 0MB 0MB 0MB = 64MB total                                     
Memory: 56480KB available (2149K code, 437K data, 88K init)                                                           
Calibrating delay loop... 331.77 BogoMIPS                                         
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)                                                             
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)                                                           
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)                                                         
CPU: Testing write buffer coherency: ok                                       
POSIX conformance testing by UNIFIX                                   
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd                                                                               
Freeing initrd memory: 5711K                           
NET: Registered protocol family 16                                 

        Marvell DB-88f5x81 Development Board (LSP Version 1.3.1) -- POS-NAS                                                                           

Detected Tclk 166000000 and SysClk 166000000                                             
Marvell USB EHCI Host controller                               
pexBarOverlapDetect: winNum 2 overlap current 0                                               
mvPexInit:Warning :Bar 2 size is illigal                                       
it will be disabled                   
please check Pex and CPU windows configuration                                             
PCI: bus0: Fast back to back transfers disabled                                               
PCI: bus1: Fast back to back transfers enabled                                             
SCSI subsystem initialized                         
usbcore: registered                   
usbcore: registered new driver hub                                 
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.                                                     
VFS: Disk quotas dquot_6.5.1                           
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)                                                         
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled                                                                           
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A                                       
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize                                                                     
loop: loaded (max 8 devices)                           
Marvell Gigabit Ethernet Driver 'egiga':                                       
  o Ethernet descriptors in DRAM                               
  o DRAM SW cache-coherency                           
  o Checksum offload                   
  o Loading network interface 'egiga0'                                     
scsi0 : Marvell SCSI to SATA adapter                                   
scsi1 : Marvell SCSI to SATA adapter                                   
scsi2 : Marvell SCSI to SATA adapter                                   
scsi3 : Marvell SCSI to SATA adapter                                   
Using anticipatory io scheduler                               
physmap flash device: 800000 at ff800000                                       
Amd/Fujitsu Extended Query Table v1.3 at 0x0040                                               
number of CFI chips: 1                     
cfi_cmdset_0002: Disabling fast programming due to code brokenness.                                                                   
cmdlinepart partition parsing not available                                           
RedBoot partition parsing not available                                       
Using physmap partition definition                                 
Creating 5 MTD partitions on "Physically mapped flash":                                                       
0x00000000-0x00010000 : "MTD1"                             
0x00010000-0x00020000 : "MTD2"                             
0x00020000-0x001a0000 : "Linux Kernel"                                     
0x001a0000-0x007d0000 : "File System"                                     
0x007d0000-0x00800000 : "u-boot"                               
ehci_platform ehci_platform143610: at 0xf1050100, irq 17                                                       
ehci_platform ehci_platform143610: new USB bus registered, assigned bus number 1                                                                               

ehci_platform ehci_platform143610: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-2                                                                               
9
hub 1-0:1.0: USB hub found                         
hub 1-0:1.0: 1 port detected                           
usbcore: registered new driver usblp                                   
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver                                                                 
mice: PS/2 mouse device common for all mice                                           
md: linear personality registered as nr 1                                         
md: raid0 personality registered as nr 2                                       
md: raid1 personality registered as nr 3                                       
md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27                                                   
NET: Registered protocol family 2                                 
IP: routing cache hash table of 512 buckets, 4Kbytes                                                   
TCP: Hash tables configured (established 4096 bind 8192)                                                       
NET: Registered protocol family 1                                 
NET: Registered protocol family 17                                 
md: Autodetecting RAID arrays.                             
md: autorun ...               
md: ... autorun DONE.                     
RAMDISK: Compressed image found at block 0                                         
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended                                                                     
VFS: Mounted root (ext2 filesystem).                                   
Freeing init memory: 88K                       
init started:  BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary                                                                           
init started:  BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary                                                                           
Starting pid 132, console /dev/ttyS0: '/etc/rc.sh'                                                 
Check MTD block device V2.01.0516200                                 
        MTDC: Mount MTD1 done.                             
        MTDC: Mount MTD2 done.                             
        MTDC: No need to copy file.                                   
** Mounting /etc/fstab                     
umount: proc: not mounted                         
umount: proc: not mounted                         
umount: /image.cfs: not mounted                               
umount: /image.cfs: not mounted                               
** check raid Config version                           
Don't Update raidtab2web                       
** copy mtd1 files                 
cp: /sys/mtd1/firmwareupdate: No such file or directory                                                       
cp: /sys/mtd1/raidtab: No such file or directory                                               
mv: /sys/mtd1/firmwareupdate: No such file or directory                                                       
mv: /sys/mtd1/restore: No such file or directory                                               
mv: /sys/mtd1/format_ok: No such file or directory                                                 
mv: /sys/mtd1/pls_sync: No such file or directory                                                 
mv: /sys/mtd1/pls_chmod_a2: No such file or directory                                                     
mv: /sys/mtd1/pls_chmod_b2: No such file or directory                                                     
** link lib **             
** link web **             
** link /usr/bin **                   
** link /usr/sbin **                   
** link /usr/local/LPRng **                           
<rtc>: getRTC time= 7/1/13 Sat 13:56:55                                       
<fan script start>                 
** set loopback interface                         
MAC = 00:19:5B:68:5C:EC                       
egiga0: mac address changed                           
** Activate Gigabit Interface                             
** execute rc.init.sh                     
egiga0: link down                 
Setting hostname .... disk                         
Partitions = 0             
raid_status = 0               
raid_mode = 1             
Get mtd magic_num = 0                     
Serial Number =               
Serial Number =               
swap = 0       
NORMAL mode           
get IP = 192.168.200.77                       
Set Timezone=-5               
1.Set Date & time ...(command: sntp -r ntp1.dlink.com &)                                                       
egiga0: link up<5>, full duplex<5>, speed 1 Gbps<5>                                                   
2.Set Date & time ...(command: sntp -r ntp.dlink.com.tw &)                                                         
sntp: using NTP server ntp.dlink.com.tw (61.63.11.145)                                                     
NTP Server connected successfully!!!                                   
System time: 2007/1/13 Sat 13:57:29                                   
check button V2.17.12042006                           
Jan 13 13:57:29 crond[393]: crond 2.3.2 dillon, started, log level 8                                                                   

1.02(1.02.1208.2006)
12/08/2006
op_server v2.01.06012006
mfg_search
create /tmp/fatmount script file
mount FAT storage devices
kill: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]

UPnP AV / MediaServer v1.02.0317.2006.

** Get MAC Addr
mount: /dev/sda is not a valid block device
mount: /dev/sdb is not a valid block device
mount: /dev/sdc is not a valid block device
UPNPAV_MGR: lock resource.
Starting pid 432, console /dev/ttyS0: '/bin/sh'


BusyBox v1.00-pre1 (2006.07.17-10:17+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

No found HD

Offline

 

#2 2007-01-13 23:26:41

skydreamer
Member
From: At the Atlantic Coast
Registered: 2007-01-06
Posts: 232

Re: Serial consol log of DNS-323 boot

Thanks for that. Is this FW 1.02?

Offline

 

#3 2007-01-14 04:03:11

rguerra
Member
Registered: 2006-12-20
Posts: 25

Re: Serial consol log of DNS-323 boot

How did you manage the get the log? Curious, as one thing i'd like to see is a way to directly boot into debian without having to chroot.

Last edited by rguerra (2007-01-14 04:03:30)

Offline

 

#4 2007-01-14 21:40:43

magore
Member
Registered: 2007-01-05
Posts: 25

Re: Serial consol log of DNS-323 boot

Hi,
   Sorry I should have supplied this sooner:

I connected a MAX 3232 (3.3v version of the common MAX232 part) converter to CON4
With the power botton facing you and component side up the signals are Left to Right [3.3V,TX,RX,GND]
I bought the connectors from Digikey - WM1722-ND female housing and WM1775-ND pins, the RS232 converter is a Digikey MAX3232ECPE+-ND 16 pin dip part (note the odd +-ND suffix is correct)

Note on Terminology: TX is the outgoing 3.3 volt CMOS signal FROM the Marvell 88F5181 ARM CPU and RX is the ingoing signal TO the CPU.

Baud rate is 115200 baud - 8 bits, no parity

Warning: Do not use 5v signals - you might damage the CPU

Notes: so far the only character that has effect is CTRL C

Hitting Any key aborts the U-BOOT 3 second count down - but does not enter the u-boot monitor 8(
Once booted CTRL C restarts the Busybox 2 line prompt - all other keys only echo back what you type - the bash shell does not seem to see any of this input 8(

I will have to work on this some more - I am looking at the u-boot sources now - the version string in the GPL source code matches the prompt - so perhaps it will help.

If the u-boot is fully functional we can use it to set the environment variables that effect booting.
For example we could set it to boot the kernel over the network - useful for trying custom kernels without flashing.

There is another 10 pin connector on the board - left of the CPU called CON5 - I am hoping this has jtag pins - I need to do some testing - perhaps some of the people working on the DSM-G600 will have some insight ?


***  UPDATE ***
Magic code to break into shell is 5784468
type 5784468 followed by return
**************
I looked at the ash.c source - see busybox-1.00-pre1/shell/ash.c
Look for is_interactive

Last edited by magore (2007-01-15 01:56:58)

Offline

 

#5 2007-01-31 16:40:18

Paul
Member
From: Landshut, Germany
Registered: 2007-01-19
Posts: 35
Website

Re: Serial consol log of DNS-323 boot

Init usb device.

if you plug in an usb memory stick or usb hard drive, does uboot recognize the device?

Offline

 

#6 2007-01-31 17:08:48

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Serial consol log of DNS-323 boot

so where in sweden do i buy the stuff to make a seriel connection or jtag as i have a LTP cabel to my linksys router i can use smile


First user to fun_plug the dns-323.

Offline

 

#7 2007-01-31 19:05:27

Apskaft
Member
From: Karlskrona, Sweden
Registered: 2007-01-09
Posts: 165

Re: Serial consol log of DNS-323 boot

You can always find these things at Elfa. Not 100% sure the link is correct. You need to doublecheck and most likely get some capacitors as well. /Apan

Offline

 

#8 2007-02-07 06:18:00

tobyg
Member
Registered: 2007-01-31
Posts: 42

Re: Serial consol log of DNS-323 boot

I would just like to say I've confirmed everything here.  Control-C does not break out.  Pressing any key to abort the boot sequence just aborts the countdown, it doesn't actually let you into anything different.  The magic code to get into terminal/busybox works fine. 

I took a bit different route.  I followed the "USB Connection" procedure here: http://www.nslu2-linux.org/wiki/HowTo/AddASerialPort

I went to my local Fry's (Chicagoland) and snagged a Future Data cable.  I could not find the exact ones they mentioned on the site there, but I found a smiliar one that had the big 'bump' in the middle.  Cracked it open and confirmed it was the same PL-2303 chip.  Wire colors are different but if you follow the diagram here http://www.i-hacked.com/images/stories/ … pinout.jpg you can figure it out.  On mine, the top (TX) was blue, connected that to RX on the DNS-323.  4th wire down (RX) on mine is yellow, connected that to TX on the DNS-323.  Ground, I just conneced the shielding from the cable to a post on the back of the DNS-323.  My RX and TX work fine, as I can read everything and get into the shell just fine.  I just can't abort the u-boot, so we may not have a good way of reloading the firmware if we 'brick' it.

Thanks for the info magore about what pins were what.  Worked great for me.  Now, we just need to make the serial port useful by breaking into the uboot.

Offline

 

#9 2007-03-05 13:09:57

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Serial consol log of DNS-323 boot

magore, thank you for providing this info. I'd like to start experimenting
myself, but I'm a complete n00b wrt hardware (but I have some kernel
programming experience that could be useful). Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

I'd like to be as sure as possible before connecting any self-made cable.
The box was expensive ;-)

Offline

 

#10 2007-03-05 16:12:42

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Serial consol log of DNS-323 boot

fonz wrote:

Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#11 2007-03-19 00:30:08

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Serial consol log of DNS-323 boot

sala wrote:

fonz wrote:

Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector

Thank you for the pointers, I have a working serial console now. Two notes:
- In the schematic http://dns323.kood.org/dsmg600/howto:serial_connector, I had to switch Pins 2 and 3 on the COM Port (RD and TD),
  using a female-to-female 1:1 serial cable that connects the pc with a male 9-pin sub-d on the board with the MAX3232
- It only worked after I disabled hardware flow control for the serial port in minicom (-s)

PS: I've made a few photos: http://www.inreto.de/dns323/Fotos/

Last edited by fonz (2007-03-19 01:28:39)

Offline

 

#12 2007-03-19 17:32:50

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Serial consol log of DNS-323 boot

fonz wrote:

sala wrote:

fonz wrote:

Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector

Thank you for the pointers, I have a working serial console now. Two notes:
- In the schematic http://dns323.kood.org/dsmg600/howto:serial_connector, I had to switch Pins 2 and 3 on the COM Port (RD and TD),
  using a female-to-female 1:1 serial cable that connects the pc with a male 9-pin sub-d on the board with the MAX3232
- It only worked after I disabled hardware flow control for the serial port in minicom (-s)

PS: I've made a few photos: http://www.inreto.de/dns323/Fotos/

Sorry, schematic should be 1 3 2 4, but about flow control "Serial Port Settings" says "Flow Control None"


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#13 2007-03-19 17:36:55

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Serial consol log of DNS-323 boot

sala wrote:

Sorry, schematic should be 1 3 2 4, but about flow control "Serial Port Settings" says "Flow Control None"

Must have missed the "Serial Port Settings". But it also says baud-rate 9600, and my DNS-323 works well with 115200.
Anyway, it works, and I'm happy ;-)

Offline

 

#14 2007-03-24 22:36:58

magore
Member
Registered: 2007-01-05
Posts: 25

Re: Serial consol log of DNS-323 boot

It is interesting that their pinout chart matches CON4 on the DNS323 - but their MAX3232 diagram does not match their documentation. I Verified the DNS323 TWIKI docs are correct. Pin 2 of CON4 is certainly the outgoing TX from the Marvell CPU and pin 3 is the ingoing RX to the Marvell CPU.

Offline

 

#15 2007-03-25 15:20:38

Tester
Member
Registered: 2007-02-23
Posts: 23

Re: Serial consol log of DNS-323 boot

I can not type any command.

I get the full boot log, but if I type something, I get only weird characters.

115200 8n1 no flow and no parity.

Tried also some other baud rates or other data/stop bits variation w/o success.

I'm using putty, with COM settings FIFO on on max buffers.

Any clue ?

Thanks

Last edited by Tester (2007-03-25 15:21:56)

Offline

 

#16 2007-03-26 23:47:41

Tester
Member
Registered: 2007-02-23
Posts: 23

Re: Serial consol log of DNS-323 boot

It was my interface.
Managed it with the PL-2303 USB to RS232 Interface... as tobyg explained...

Offline

 

#17 2007-03-30 22:25:03

MSW
New member
Registered: 2007-01-31
Posts: 2

Re: Serial consol log of DNS-323 boot

Finally have a working adapter... took a while to get a few problems sorted out. Make sure your capacitors have a 104 code on them ;-)

Thanks to everyone who provided the information for doing this!

I'm going to be building another one of these next week, and I plan on taking step-by-step photos of the process. If anyone is interested I'll post a link.

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB