DSM-G600, DNS-3xx and NSA-220 Hack Forum

sala · 2009-03-12 21:07:03

Code:

Modification in V3.11(AFB.0)C0 | 03/02/2009

[New Feature]
Copy/Sync for Copy Button feature
Link Capture Browser Plug-in: Supports IE (for Windows) and Firefox (for all)
Support IPOD web-streaming
Show UPS Current Capacity
Show Temperature, CPU Loading, Memory Usage, Fan Speed
Support 3TB volume size (with two 1.5TB HD installed)
Share Browser supports Rename File/Folder
PPPoE Client Support (also supported in NDU client)
FTP Server supports Customize Passive Mode Port Range
AutoUpload
- Automatically Upload Files to Flickr or YouTube
- Having log when en-queued files, file uploaded
FTP Uploadr
Media Server:
- DLNA 1.5 Support
- Add file-extension support for: MKV, MKA, FLAC, M2TS
- XBOX360 Support
- Add file-extension support for:
-- Picture: ico, jpe, pcd, pnm, ppm, qti, qtf, qtif
-- Video: ogm, dat, iso, ts, rmvb, dv, mjpg, mp4ps, m2p, qt, hdmov,
-- Audio: ac3, aif, aiff, at3p, au, snd, dts, rmi, mp1, mp2, ogg, L16, rm, ram, m4p
Download Service:
- Support Configure Maximum Number of Seeding Job
- Two Keep Seeding Criteria Support: Upload/Download Ratio and Seeding Time
- Resume Completed Torrent Job to Do Seeding Again.
- Support Show Detail Job Information and Configure Comment for Each Job
- Support Download Service Download Period Control
- Support IP Filter Table Management
- Support Encryption in BT Protocol
- Open Share Browser on Location of Completed Job to See Download Files.
- Download Service Notification (RSS Server): Notify Downloaded File from Download Service / Broadcatching Torrent Job
Broadcatching:
- Support encoding other than UTF-8
UPS shutdown capacity
SSL: HTTPS, FTPS, Force HTTPS support, CA Management Support

[Enhancement]
Enhance FTP Download Throughput

[Bug Fix]
Fix issue: When Raid1 is built by FW other than V3.10, using V3.10 FW can not repair or resync the Raid1 when it downgrade.
Fixed: The sort result of download service "Time Left" is not correct.
Keep the sorting setting in download service page after some actions.
Fixed: When hostname is as long as 15 character, media server will failed to startup.
Fixed: When there are over 100 shares, can not use ftp (login success but will lost connection).
Fixed: When set DNS IP address as 0.0.0.0 in GUI, DNS setting will all loss.
Fixed: FTP Uploadr: When description of server is non-ascii, it cause description shows “undefined” and will not list other following server.
Fixed: Download Service limit active torrents not work immediately.
Fixed: When share name contains &, the zyshd will dead.
Fixed: When no HD access, HD still be awaken every about half hour.
Fixed: With Web publish, it can not show file with size over 2G.
Fixed: Broadcatching downloaded file path changes when pause/resume task.
Broadcatching supports more encodings of RSS feeds (such as windows-1251, big5, GB, …) other than UTF-8.
The default permission type of auto-share is changed back to public.
Fixed: if you insert USB-drive and publish its automatically created Share to Media server, then, after re-inserting that drive, the share will not appear in the Media server list.
Fixed: Can not Support >2TB Volume Size. (Now it can support 3TB Volume Size with two 1.5TB HD)
Fixed: Flickr Upload can not work with Chinese Screen Name.
Fixed: HD sleep time not accuracy. (Now the actual sleep time is in range of setting number +/- 1 minutes).
Fixed: If play *.mp3 file name with Chinese words on web file manager.
Fixed: NSA can not stop whole print queues when there are two or more jobs

For NSA-220: ftp://ftp2.zyxel.com/NSA-220/firmware/
For NSA-220 plus: ftp://ftp2.zyxel.com/NSA-220_Plus/firmware/

I must say, this update looks mighty fine. I definitely make some time at the weekend to update my NSA-220.

sala · 2009-03-14 15:45:18

Update! This update did brick my NSA-220. So use with caution!
There are german zyxel forum at http://www.zyxelforum.de/network-attach … 0-f17.html but I can't understand what they are talking.

In here some people might have same problem:
http://translate.google.com/translate?p … ry_state0=

Anyways. It did update correctly but after reboot it never came up again.

Code:

Bootbase V20061226 | 12/26/2006 10:58:17
DRAM0 Size: 128 MB
DRAM POST: Testing:  130976K...OK

DRAM0 Test SUCCESS !

System Memory Mapping
        RAM0: 0x00000000~0x07FFFFFF (128 MB)
        Bootbase: 0x00000000~0x00006547
        Stack: 0x00006548~0x00018D47

Found 28F128J3 at address 0xF8000000
Boot-up Bootext...

Bootext V20081118 | 11/18/2008 20:03:45
Flash Detect....
Found Intel 28F128J3 flash at memory address 0xf8000000

System Memory Mapping
        Flash0: Intel 28F128J3 at 0xF8000000 (16MB; Block0~Block127)
        RAM0: 0x00000000~0x07ffffff (128MB)
        Bootloader: 0x00020000~0x00045783
        Stack: 0x00045784~0x0005d283
        Flash Temp Buffer: 0x07fe0000~0x07ffffff (128KB)
vendername = ZyXEL Communications Corp.
productname = ZyXEL NSA220
featurebit [0] [1] = D1 01
MAC = 00 19 CB 82 93 3B
CountryCode = FF
EngDebugFlag = 01

Hit ESC key to stop boot-up kernel...  1
Squash Root FS...
Boot-up Linux...2.6.18.6

Uncompressing Linux.............................................................
Linux version 2.6.18.6 (root@Trinity) (gcc version 3.4.3 (MontaVista 3.4.3-25.09
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ), cr=b0053177
Machine: MV-88fxx81
parse_tag_initrd2: phys_initrd_start->0x2000000 ,phys_initrd_size->0xc00000
Memory policy: ECC disabled, Data cache writeback
check_initrd:initrd_node = 0x0
end_pfn -> 0x8000
node == 0x0, initrd_node = 0x0
initrd_start -> 0xc2000000, initrd_end -> 0xc2c00000

 mv_map_io
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists.  Total pages: 32768
Kernel command line: rootfstype=squashfs root=/dev/mtdblock1 ro mtdparts=physmac
--------
init irq----------------------------------------------------------------
boardInfoTbl[0].boardName=ZyXEL-NSA220-DDR1
PID hash table entries: 1024 (order: 10, 4096 bytes)

~~~~ timer init
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 113792KB available (2997K code, 617K data, 120K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs... it is
Freeing initrd memory: 12288K
NET: Registered protocol family 16

-------------------nmv_init--------------------------------------------------
Jackson boardId=00000014
0x10100  1=00820473
0x10100  1=00820473
0x10100  2=00820473
...................mvCpuIfInit
 config_device_cs Error : Unknown board

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size  64MB
PEX0_IO ....base f2000000, size   1MB
PCI0_MEM ....base e4000000, size  64MB
PCI0_IO ....base f2200000, size  64KB
INTER_REGS ....base f1000000, size   1MB
DEVICE_CS0 ....base fa000000, size  16MB
DEVICE_CS1 ....base f0000000, size  16MB
DEVICE_CS2 ....base fb000000, size  16MB
DEV_BOOCS ....base f8000000, size  16MB

  Marvell Development Board (LSP Version 1.10.3_DB_NAS)-- ZyXEL-NSA220-DDR1  So2

 Detected Tclk 166000000 and SysClk 166666667
Marvell USB EHCI Host controller #0: c2bf4a00
Marvell USB EHCI Host controller #1: c2bf4800
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
use IDMA acceleration in copy to/from user buffers. used channels 2 and 3
Done.
init kernel log netlink done
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
Marvell Gigabit Ethernet Driver 'egiga':
~~~GPIODOR2 F1010100=00820473
~~~~~~~~~~~~~~SMI2 F1072004=00019140
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface 'egiga0'
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~egiga_init_module ok
e100: Intel(R) PRO/100 Network Driver, 3.5.10-k2-NAPI
e100: Copyright(c) 1999-2005 Intel Corporation
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
  Vendor: SAMSUNG   Model: HD753LJ           Rev: 1AA0
  Type:   Direct-Access                      ANSI SCSI revision: 03
SCSI device sda: 1465149168 512-byte hdwr sectors (750156 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back w/ FUA
SCSI device sda: 1465149168 512-byte hdwr sectors (750156 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back w/ FUA
 sda: sda1 sda2 sda3 sda4
sd 1:0:0:0: Attached scsi disk sda
sd 1:0:0:0: Attached scsi generic sg0 type 0
----cmdline parser init---
physmap platform flash device: 01000000 at f8000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
cfi_cmdset_0001: Erase suspend on write enabled
4 cmdlinepart partitions found on MTD device physmap-flash.0
Creating 4 MTD partitions on "physmap-flash.0":
0x00000000-0x00220000 : "kernel"
mtd: Giving out device 0 to kernel
0x00220000-0x00f00000 : "initrd"
mtd: Giving out device 1 to initrd
0x00f00000-0x00fe0000 : "etc"
mtd: Giving out device 2 to etc
0x00fe0000-0x01000000 : "bootbase"
mtd: Giving out device 3 to bootbase
ehci_platform ehci_platform.4523: EHCI Host Controller
ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000
ehci_platform ehci_platform.4523: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.16781: EHCI Host Controller
ehci_platform ehci_platform.16781: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.16781: irq 12, io mem 0x00000000
ehci_platform ehci_platform.16781: USB 0.0 started, EHCI 1.00, driver 10 Dec 204
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
sl811: driver sl811-hcd, 19 May 2005
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: bitmap version 4.39
device-mapper: ioctl: 4.7.0-ioctl (2006-06-24) initialised: dm-devel@redhat.com
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
VFP support v0.3: not present
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
SQUASHFS error: sb_bread failed reading block 0x3336
SQUASHFS error: Unable to read cache block [ccda17:f5b]
SQUASHFS error: Unable to read inode [ccda17:f5b]
VFS: Cannot open root device "mtdblock1" or unknown-block(31,1)
Please append a correct "root=" boot option
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,1)

As we can see from bootlog, kernel and bootext (thank god!) is flashed correctly but user space is messed up or not fashed at all.

Mijzelf · 2009-03-14 18:36:00

Am I right when I presume this problem is caused by the flashing (done by the previous firmware) and not by the new firmware? Or does the binary contain a corrupted filesystem?
Anyway, if I can help with a dump of my mtd blocks, let me know.

sala · 2009-03-14 18:42:08

Thanks for the help.

I think it might be because of browser. Maybe session was timeouted or something bad in browser cache.

Right now I don't care about zyxel firmware. I'am about to get Gentoo hdd-boot working correctly, after which I will try to find some way to flash firmware or just some parts of it (kernel, userpace).

sala · 2009-03-15 18:59:26

I did run compare to my failed firmware upgrade and firmware file. It shows that it some random point it did just stop flashing (flash app did die) or the firmware was only partially uploaded to nsa-220 from my browser. In both situations I think zyxel could make it better.

a) Before flashing make sure that image is complete. If not, then ask user to reupload it.
b) Before restarting nsa-220, check mtd for it's content. If it does not have firmware programed successfully, then check firmware image again and try to reflash. If firmware image is invalid then ask user to reupload it.

Attachments:

failflash.jpg, Size: 113,154 bytes, Downloads: 462

sala · 2009-03-26 14:50:12

For now looks like zyxel has pulled 3.11 firmware off form all official sites.

If someone is interested then here is working mirror http://gpl.pri.ee/?dir=./FIRMWARE

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2009-03-12 21:07:03

v3.11 firmware for NSA-220 and NSA-220+

Code:

#2 2009-03-14 15:45:18

Re: v3.11 firmware for NSA-220 and NSA-220+

Code:

#3 2009-03-14 18:36:00

Re: v3.11 firmware for NSA-220 and NSA-220+

#4 2009-03-14 18:42:08

Re: v3.11 firmware for NSA-220 and NSA-220+

#5 2009-03-15 18:59:26

Re: v3.11 firmware for NSA-220 and NSA-220+

#6 2009-03-26 14:50:12

Re: v3.11 firmware for NSA-220 and NSA-220+

Board footer