DSM-G600, DNS-3xx and NSA-220 Hack Forum

magore · 2007-01-13 23:05:42

The following is the serial console log of the DNS-323 while booting with no disks

** LOADER **
** MARVELL BOARD: RD-88F5181-POS-NAS LE

U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2

DRAM CS[0] base 0x00000000 size 64MB
DRAM Total size 64MB
[8192kB@ff800000] Flash: 8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: MV88F5181 Rev 3
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

Init usb device.
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot: 0
## Booting image at ff820000 ...
Image Name: Linux-2.6.6-arm2
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1232560 Bytes = 1.2 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at ff9a0000 ...
Image Name: Ramdisk
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 5848966 Bytes = 5.6 MB
Load Address: 00800000
Entry Point: 00800000
Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux.............................................................
....................... done, booting the kernel.
Linux version 2.6.6-arm2 (jack@SWTEST2) (gcc version 3.3.3) #21 Thu Nov 9 10:22:
37 CST 2006
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
CPU: D VIPT write-back cache
CPU: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000

- Warning - This LSP release was tested only with U-Boot release 1.4.2

Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 16384
DMA zone: 16384 pages, LIFO batch:4
Normal zone: 0 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none

PID hash table entries: 512 (order 9: 4096 bytes)
Console: colour dummy device 80x30
Memory: 64MB 0MB 0MB 0MB = 64MB total
Memory: 56480KB available (2149K code, 437K data, 88K init)
Calibrating delay loop... 331.77 BogoMIPS
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
POSIX conformance testing by UNIFIX
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 5711K
NET: Registered protocol family 16

Marvell DB-88f5x81 Development Board (LSP Version 1.3.1) -- POS-NAS

Detected Tclk 166000000 and SysClk 166000000
Marvell USB EHCI Host controller
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers disabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered
usbcore: registered new driver hub
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
o Ethernet descriptors in DRAM
o DRAM SW cache-coherency
o Checksum offload
o Loading network interface 'egiga0'
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi2 : Marvell SCSI to SATA adapter
scsi3 : Marvell SCSI to SATA adapter
Using anticipatory io scheduler
physmap flash device: 800000 at ff800000
Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
Using physmap partition definition
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "MTD1"
0x00010000-0x00020000 : "MTD2"
0x00020000-0x001a0000 : "Linux Kernel"
0x001a0000-0x007d0000 : "File System"
0x007d0000-0x00800000 : "u-boot"
ehci_platform ehci_platform143610: at 0xf1050100, irq 17
ehci_platform ehci_platform143610: new USB bus registered, assigned bus number 1

ehci_platform ehci_platform143610: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-2
9
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
mice: PS/2 mouse device common for all mice
md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 88K
init started: BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary
init started: BusyBox v1.00-pre1 (2006.07.17-10:17+0000) multi-call binary
Starting pid 132, console /dev/ttyS0: '/etc/rc.sh'
Check MTD block device V2.01.0516200
MTDC: Mount MTD1 done.
MTDC: Mount MTD2 done.
MTDC: No need to copy file.
** Mounting /etc/fstab
umount: proc: not mounted
umount: proc: not mounted
umount: /image.cfs: not mounted
umount: /image.cfs: not mounted
** check raid Config version
Don't Update raidtab2web
** copy mtd1 files
cp: /sys/mtd1/firmwareupdate: No such file or directory
cp: /sys/mtd1/raidtab: No such file or directory
mv: /sys/mtd1/firmwareupdate: No such file or directory
mv: /sys/mtd1/restore: No such file or directory
mv: /sys/mtd1/format_ok: No such file or directory
mv: /sys/mtd1/pls_sync: No such file or directory
mv: /sys/mtd1/pls_chmod_a2: No such file or directory
mv: /sys/mtd1/pls_chmod_b2: No such file or directory
** link lib **
** link web **
** link /usr/bin **
** link /usr/sbin **
** link /usr/local/LPRng **
<rtc>: getRTC time= 7/1/13 Sat 13:56:55
<fan script start>
** set loopback interface
MAC = 00:19:5B:68:5C:EC
egiga0: mac address changed
** Activate Gigabit Interface
** execute rc.init.sh
egiga0: link down
Setting hostname .... disk
Partitions = 0
raid_status = 0
raid_mode = 1
Get mtd magic_num = 0
Serial Number =
Serial Number =
swap = 0
NORMAL mode
get IP = 192.168.200.77
Set Timezone=-5
1.Set Date & time ...(command: sntp -r ntp1.dlink.com &)
egiga0: link up<5>, full duplex<5>, speed 1 Gbps<5>
2.Set Date & time ...(command: sntp -r ntp.dlink.com.tw &)
sntp: using NTP server ntp.dlink.com.tw (61.63.11.145)
NTP Server connected successfully!!!
System time: 2007/1/13 Sat 13:57:29
check button V2.17.12042006
Jan 13 13:57:29 crond[393]: crond 2.3.2 dillon, started, log level 8

1.02(1.02.1208.2006)
12/08/2006
op_server v2.01.06012006
mfg_search
create /tmp/fatmount script file
mount FAT storage devices
kill: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]

UPnP AV / MediaServer v1.02.0317.2006.

** Get MAC Addr
mount: /dev/sda is not a valid block device
mount: /dev/sdb is not a valid block device
mount: /dev/sdc is not a valid block device
UPNPAV_MGR: lock resource.
Starting pid 432, console /dev/ttyS0: '/bin/sh'

BusyBox v1.00-pre1 (2006.07.17-10:17+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

No found HD

skydreamer · 2007-01-13 23:26:41

Thanks for that. Is this FW 1.02?

rguerra · 2007-01-14 04:03:11

How did you manage the get the log? Curious, as one thing i'd like to see is a way to directly boot into debian without having to chroot.

Last edited by rguerra (2007-01-14 04:03:30)

magore · 2007-01-14 21:40:43

Hi,
Sorry I should have supplied this sooner:

I connected a MAX 3232 (3.3v version of the common MAX232 part) converter to CON4
With the power botton facing you and component side up the signals are Left to Right [3.3V,TX,RX,GND]
I bought the connectors from Digikey - WM1722-ND female housing and WM1775-ND pins, the RS232 converter is a Digikey MAX3232ECPE+-ND 16 pin dip part (note the odd +-ND suffix is correct)

Note on Terminology: TX is the outgoing 3.3 volt CMOS signal FROM the Marvell 88F5181 ARM CPU and RX is the ingoing signal TO the CPU.

Baud rate is 115200 baud - 8 bits, no parity

Warning: Do not use 5v signals - you might damage the CPU

Notes: so far the only character that has effect is CTRL C

Hitting Any key aborts the U-BOOT 3 second count down - but does not enter the u-boot monitor 8(
Once booted CTRL C restarts the Busybox 2 line prompt - all other keys only echo back what you type - the bash shell does not seem to see any of this input 8(

I will have to work on this some more - I am looking at the u-boot sources now - the version string in the GPL source code matches the prompt - so perhaps it will help.

If the u-boot is fully functional we can use it to set the environment variables that effect booting.
For example we could set it to boot the kernel over the network - useful for trying custom kernels without flashing.

There is another 10 pin connector on the board - left of the CPU called CON5 - I am hoping this has jtag pins - I need to do some testing - perhaps some of the people working on the DSM-G600 will have some insight ?

*** UPDATE ***
Magic code to break into shell is 5784468
type 5784468 followed by return
**************
I looked at the ash.c source - see busybox-1.00-pre1/shell/ash.c
Look for is_interactive

Last edited by magore (2007-01-15 01:56:58)

Paul · 2007-01-31 16:40:18

Init usb device.

if you plug in an usb memory stick or usb hard drive, does uboot recognize the device?

KRH · 2007-01-31 17:08:48

so where in sweden do i buy the stuff to make a seriel connection or jtag as i have a LTP cabel to my linksys router i can use

Apskaft · 2007-01-31 19:05:27

You can always find these things at Elfa. Not 100% sure the link is correct. You need to doublecheck and most likely get some capacitors as well. /Apan

tobyg · 2007-02-07 06:18:00

I would just like to say I've confirmed everything here. Control-C does not break out. Pressing any key to abort the boot sequence just aborts the countdown, it doesn't actually let you into anything different. The magic code to get into terminal/busybox works fine.

I took a bit different route. I followed the "USB Connection" procedure here: http://www.nslu2-linux.org/wiki/HowTo/AddASerialPort

I went to my local Fry's (Chicagoland) and snagged a Future Data cable. I could not find the exact ones they mentioned on the site there, but I found a smiliar one that had the big 'bump' in the middle. Cracked it open and confirmed it was the same PL-2303 chip. Wire colors are different but if you follow the diagram here http://www.i-hacked.com/images/stories/ … pinout.jpg you can figure it out. On mine, the top (TX) was blue, connected that to RX on the DNS-323. 4th wire down (RX) on mine is yellow, connected that to TX on the DNS-323. Ground, I just conneced the shielding from the cable to a post on the back of the DNS-323. My RX and TX work fine, as I can read everything and get into the shell just fine. I just can't abort the u-boot, so we may not have a good way of reloading the firmware if we 'brick' it.

Thanks for the info magore about what pins were what. Worked great for me. Now, we just need to make the serial port useful by breaking into the uboot.

fonz · 2007-03-05 13:09:57

magore, thank you for providing this info. I'd like to start experimenting
myself, but I'm a complete n00b wrt hardware (but I have some kernel
programming experience that could be useful). Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

I'd like to be as sure as possible before connecting any self-made cable.
The box was expensive ;-)

sala · 2007-03-05 16:12:42

fonz wrote:
Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....

http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector

fonz · 2007-03-19 00:30:08

sala wrote:
fonz wrote:
Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....
http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector

Thank you for the pointers, I have a working serial console now. Two notes:
- In the schematic http://dns323.kood.org/dsmg600/howto:serial_connector, I had to switch Pins 2 and 3 on the COM Port (RD and TD),
using a female-to-female 1:1 serial cable that connects the pc with a male 9-pin sub-d on the board with the MAX3232
- It only worked after I disabled hardware flow control for the serial port in minicom (-s)

PS: I've made a few photos: http://www.inreto.de/dns323/Fotos/

Last edited by fonz (2007-03-19 01:28:39)

sala · 2007-03-19 17:32:50

fonz wrote:
sala wrote:
fonz wrote:
Can you provide more
details on how to create the serial cable, e.g. part lists, schematics,
pictures, related web links....
http://dns323.kood.org/hardware:serial
http://dns323.kood.org/dsmg600/howto:serial_connector
Thank you for the pointers, I have a working serial console now. Two notes:
- In the schematic http://dns323.kood.org/dsmg600/howto:serial_connector, I had to switch Pins 2 and 3 on the COM Port (RD and TD),
using a female-to-female 1:1 serial cable that connects the pc with a male 9-pin sub-d on the board with the MAX3232
- It only worked after I disabled hardware flow control for the serial port in minicom (-s)

PS: I've made a few photos: http://www.inreto.de/dns323/Fotos/

Sorry, schematic should be 1 3 2 4, but about flow control "Serial Port Settings" says "Flow Control None"

fonz · 2007-03-19 17:36:55

sala wrote:
Sorry, schematic should be 1 3 2 4, but about flow control "Serial Port Settings" says "Flow Control None"

Must have missed the "Serial Port Settings". But it also says baud-rate 9600, and my DNS-323 works well with 115200.
Anyway, it works, and I'm happy ;-)

magore · 2007-03-24 22:36:58

It is interesting that their pinout chart matches CON4 on the DNS323 - but their MAX3232 diagram does not match their documentation. I Verified the DNS323 TWIKI docs are correct. Pin 2 of CON4 is certainly the outgoing TX from the Marvell CPU and pin 3 is the ingoing RX to the Marvell CPU.

Tester · 2007-03-25 15:20:38

I can not type any command.

I get the full boot log, but if I type something, I get only weird characters.

115200 8n1 no flow and no parity.

Tried also some other baud rates or other data/stop bits variation w/o success.

I'm using putty, with COM settings FIFO on on max buffers.

Any clue ?

Thanks

Last edited by Tester (2007-03-25 15:21:56)

Tester · 2007-03-26 23:47:41

It was my interface.
Managed it with the PL-2303 USB to RS232 Interface... as tobyg explained...

MSW · 2007-03-30 22:25:03

Finally have a working adapter... took a while to get a few problems sorted out. Make sure your capacitors have a 104 code on them ;-)

Thanks to everyone who provided the information for doing this!

I'm going to be building another one of these next week, and I plan on taking step-by-step photos of the process. If anyone is interested I'll post a link.

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2007-01-13 23:05:42

Serial consol log of DNS-323 boot

#2 2007-01-13 23:26:41

Re: Serial consol log of DNS-323 boot

#3 2007-01-14 04:03:11

Re: Serial consol log of DNS-323 boot

#4 2007-01-14 21:40:43

Re: Serial consol log of DNS-323 boot

#5 2007-01-31 16:40:18

Re: Serial consol log of DNS-323 boot

#6 2007-01-31 17:08:48

Re: Serial consol log of DNS-323 boot

#7 2007-01-31 19:05:27

Re: Serial consol log of DNS-323 boot

#8 2007-02-07 06:18:00

Re: Serial consol log of DNS-323 boot

#9 2007-03-05 13:09:57

Re: Serial consol log of DNS-323 boot

#10 2007-03-05 16:12:42

Re: Serial consol log of DNS-323 boot

fonz wrote:

#11 2007-03-19 00:30:08

Re: Serial consol log of DNS-323 boot

sala wrote:

fonz wrote:

#12 2007-03-19 17:32:50

Re: Serial consol log of DNS-323 boot

fonz wrote:

sala wrote:

fonz wrote:

#13 2007-03-19 17:36:55

Re: Serial consol log of DNS-323 boot

sala wrote:

#14 2007-03-24 22:36:58

Re: Serial consol log of DNS-323 boot

#15 2007-03-25 15:20:38

Re: Serial consol log of DNS-323 boot

#16 2007-03-26 23:47:41

Re: Serial consol log of DNS-323 boot

#17 2007-03-30 22:25:03

Re: Serial consol log of DNS-323 boot

Board footer