DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2008-12-09 22:15:25

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Fonz' reloaded.ko on an NSA-220

I'm the proud owner of a Zyxel NSA-220. This has comparable hardware to the DNS-323. The kernel has some problems for me:
1) It doesn't have EABI support, and as far as I could find this makes it impossible to chroot Debian.
2) It doesn't support IPv6, and I can't add it with a module, due to a bug in the kernel.
3) It doesn't support USB sound. I can add it with kernelmodules, but I can play only one stream. If the stream ends, the kernel crashes.

In order to load my own kernel, I was looking at the reloaded module here: http://www.inreto.de/dns323/reloaded/dn … -0.7.167/. Reading the code it seems to me that the new kernel and initrd are loaded to memory, after which the processor reboots. No trace of the previous boot remains in memory. Right? So this doesn't cost any extra memory, besides the difference in size of both kernels and initrd's?

I have the sources of my firmware kernel, and I want to compile it with the extra stuff I need, by changing .config. Then I load this kernel with the firmware initrd. This should give me the wanted functionality, without disabling the Zyxel firmware.
A few questions:
1) The lack of EABI keeps me from chrooting Debian, can the presence of EABI keep me from running the firmware stuff?
2) The NSA-220 can run a script at boot, comparable to the fun_plug construction, but called much earlier, before the HD's are mounted and the services are started. When I reload the kernel here, I need a way to see if it's reloaded already, to avoid a loop. Any suggestions?
3) The contents of /proc/cmdline is

Code:

rootfstype=squashfs root=/dev/mtdblock1 ro mtdparts=physmap-flash.0:2432k(kernel),12928k(initrd),896k(etc),-(bootbase) console=ttyS0,115200n8 mem=128M init=/linuxrc

. I suppose this is the commandline provided to the kernel. It seems the size and the location of the kernel is provided here. Can that give a problem when providing a kernel which isn't located at flash.0? Of course I can change the size, but I can't provide a location. The location is on USB stick, which isn't available when boot starts.

Offline

 

#2 2008-12-10 21:24:42

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

1) It doesn't have EABI support, and as far as I could find this makes it impossible to chroot Debian.

You can't use the armel port, but 'standard' Debian/arm should work.

Mijzelf wrote:

In order to load my own kernel, I was looking at the reloaded module here: http://www.inreto.de/dns323/reloaded/dn … -0.7.167/. Reading the code it seems to me that the new kernel and initrd are loaded to memory, after which the processor reboots. No trace of the previous boot remains in memory. Right? So this doesn't cost any extra memory, besides the difference in size of both kernels and initrd's?

Correct.

Mijzelf wrote:

I have the sources of my firmware kernel, and I want to compile it with the extra stuff I need, by changing .config. Then I load this kernel with the firmware initrd. This should give me the wanted functionality, without disabling the Zyxel firmware.
A few questions:
1) The lack of EABI keeps me from chrooting Debian, can the presence of EABI keep me from running the firmware stuff?
2) The NSA-220 can run a script at boot, comparable to the fun_plug construction, but called much earlier, before the HD's are mounted and the services are started. When I reload the kernel here, I need a way to see if it's reloaded already, to avoid a loop. Any suggestions?
3) The contents of /proc/cmdline is ...Of course I can change the size, but I can't provide a location. The location is on USB stick, which isn't available when boot starts.

1) The kernel can support both EABI and OABI binaries:

Code:

CONFIG_AEABI=y
CONFIG_OABI_COMPAT=y

2) You can append a custom string to the kernel version that will be shown in 'uname -r', e.g. '2.6.25.1-ffp'.

Code:

CONFIG_LOCALVERSION="-ffp"

I think, for older kernels this setting is in linux/Makefile and not in .config.

3) No idea. Try and error...

Offline

 

#3 2008-12-13 19:50:05

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

You can't use the armel port, but 'standard' Debian/arm should work.

Are you sure about that? I've tried several 'distros' (if distro is the word here) for the DNS-323 and the NSLU2. Further I've tried to cdebootstrap both Etch and Lenny (cdebootstrap -aarm). All attemps ended in 'Invalid instruction', when executing 'chroot debian /bin/bash', or 'chroot debian /bin/sh'

Offline

 

#4 2008-12-13 19:54:42

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

'Invalid instruction'

Could be a floating point issue. If the debian arm port uses hardware floating point instructions (I think it does), you need matching floating point emulation in the kernel. Does your kernel have CONFIG_FPE_NWFPE enabled?

Offline

 

#5 2008-12-13 20:23:06

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

I don't think so. From .config:

Code:

#
# At least one emulation must be selected
#
# CONFIG_FPE_NWFPE is not set
CONFIG_FPE_FASTFPE=y
CONFIG_VFP=y

Is there a way to ask the kernel itself?

Last edited by Mijzelf (2008-12-13 20:24:08)

Offline

 

#6 2008-12-13 20:30:26

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

Code:

# CONFIG_FPE_NWFPE is not set
CONFIG_FPE_FASTFPE=y
CONFIG_VFP=y

That's the wrong options for Debian/arm. See below.

Mijzelf wrote:

Is there a way to ask the kernel itself?

Yes, if you have enabled /proc/config.gz:

Code:

# zgrep FP /proc/config.gz 
CONFIG_FPE_NWFPE=y
# CONFIG_FPE_NWFPE_XP is not set
# CONFIG_FPE_FASTFPE is not set
# CONFIG_VFP is not set

Offline

 

#7 2008-12-13 20:39:16

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

And the enabling of /proc/config.gz is done in .config, I suppose? I don't have an /proc/config.gz.

Will enabling CONFIG_FPE_NWFPE break my firmware?
Does this mean I don't need EABI?

Offline

 

#8 2008-12-13 20:47:08

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

And the enabling of /proc/config.gz is done in .config, I suppose? I don't have an /proc/config.gz.

I think it's these two:

Code:

CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y

Mijzelf wrote:

Will enabling CONFIG_FPE_NWFPE break my firmware?

Don't know, but that's possible.

Mijzelf wrote:

Does this mean I don't need EABI?

If possible, use EABI. Because of the different floating point and ABI issues, it can be tricky to find a working configuration. Generally, the floating point emulation is awfully slow, really, really slow. That's why ffp is compiled using a soft-float toolchain. ffp also uses OABI for compatibily reasons.

There's some documentation about Debian OABI/EABI and floats here: http://wiki.debian.org/ArmEabiPort

Offline

 

#9 2008-12-14 06:56:09

mpalmer
Member
From: Australia
Registered: 2008-10-19
Posts: 13

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

I'm the proud owner of a Zyxel NSA-220. This has comparable hardware to the DNS-323. The kernel has some problems for me:
1) It doesn't have EABI support, and as far as I could find this makes it impossible to chroot Debian.

Somewhat tangential to your topic, but if you want to run Debian, consider installing it natively.  http://www.cyrius.com/journal/debian/or … nk/dns-323 has all the latest info.  If "comparable" means "something like" rather than "rebadged, with the same innards", then you might need to do some porting work.  I've documented the process I went through for the DNS-323 at http://www.hezmatt.org/~mpalmer/blog/ge … s_323.html

- Matt

Offline

 

#10 2008-12-14 15:15:42

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

'Comparable' means 'A two drive NAS with the same processor running Linux', in this case. So yes, I should have to do some porting. For the moment that is beyond my scope. One step a time. But thanks for the link, it's interesting reading.

Offline

 

#11 2008-12-30 13:13:37

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

I'm stuck while compiling reloaded.ko. I changed symlink linux to point to the root of the kernelsources, created this 'script':

Code:

#!/bin/sh

export PATH=/opt/montavista/pro/devkit/arm/v5t_le/bin:${PATH}
export FUN_TARGET=arm_v5t_le
make all

I had to edit proc-arm926.S:

Code:

#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
#include <asm/constants.h>
#else
#include <asm/asm-offsets.h>
#endif

While I have kernel 2.6.18, it yet has a asm/asm-offsets.h, and no asm/constants.h. So I changed the condition.
Now I get this output:

Code:

make -C linux M=/home/mijzelf/dns323-reloaded-0.7.167 CROSS_COMPILE=arm_v5t_le- ARCH=arm modules
make[1]: Entering directory `/home/mijzelf/NSA-220/nsa220/linux-2.6.18.6'
  AS [M]  /home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.o
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S: Assembler messages:
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S:366: Error: undefined symbol PTE_SMALL_AP_MASK used as an immediate value
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S:367: Error: undefined symbol PTE_TYPE_MASK used as an immediate value
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S:368: Error: undefined symbol PTE_TYPE_SMALL used as an immediate value
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S:371: Error: undefined symbol PTE_SMALL_AP_URO_SRW used as an immediate value
/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.S:374: Error: undefined symbol PTE_SMALL_AP_UNO_SRW used as an immediate value
make[2]: *** [/home/mijzelf/dns323-reloaded-0.7.167/proc-arm926.o] Error 1
make[1]: *** [_module_/home/mijzelf/dns323-reloaded-0.7.167] Error 2
make[1]: Leaving directory `/home/mijzelf/NSA-220/nsa220/linux-2.6.18.6'
make: *** [all] Error 2

Offline

 

#12 2009-01-01 19:16:58

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

OK, I sorted that part. Had to include <asm/pgtable-hwdef.h> in proc-arm926.S.

Offline

 

#13 2009-01-01 21:47:23

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

Status so far:
1) I've builded a kernel, in which I added support for /proc/config.gz and ipv6. This gave me a file vmlinux, 4862752 bytes.
2) Copied initrd: dd -if=/dev/mtd1 of=initrd. This makes a file of 12928kB.
3) Tried to gunzip this file. This fails, so I assume it's not compressed.
4) Build reloaded.ko, with the same toolchain as I used to build the kernel. 16589 bytes.
5) The box has 2 devices mounted, /dev/md0, and /dev/sdc1 (the usbstick). I stopped and killed everything until I could remount them readonly.
6) Used this script:

Code:

#!/bin/sh

CMDLINE=` cat /proc/cmdline `

/sbin/insmod reloaded.ko machtype=526 kernel=vmlinux initrd=initrd cmdline=\"$CMDLINE\"

First I had a typo in 'vmlinux', then I got a 'could not insmod, permission denied'. I solved the typo, and then the prompt didn't return, as expected.

But: as far a I could investigate, the box did not reboot. It had no samba, ssh, ftp of http available, after waiting for about 15 minutes. (Normally they are available in less than a minute). But I could ping the box.

Which options do I have to find out what is going wrong?

Offline

 

#14 2009-01-01 23:13:24

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

- use 'make zImage' to build the kernel. it will compile arch/arm/boot/zImage, pass the zImage file to realoded.ko instead of vmlinux
- also note that reloaded.ko must not be compiled for the kernel it's going to boot, but for the original kernel.

Offline

 

#15 2009-01-03 20:20:19

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

Tried that. BTW, zImage already existed. It was about 1 minute younger than vmlinux, but *much* smaller, 1849176 bytes. This time I couldn't ping the box after the script run, and it didn't return in network either.
I suppose initrd or zImage is wrong. Succeeded in mounting ./initrd (had to compile a loop.ko for that), so I suppose that's not the problem. Will retry with a kernel with a firmware default .config soon.

Offline

 

#16 2009-01-11 17:11:07

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

I build a kernel with the .config which is packed with the sources provided by ZyXEL. Tried to reload twice. The first time my both ssh sessions froze, but my (permanent) ping just continued. I rebooted the box after 15 minutes, and retried. This time ssh froze, and ping started to give timeouts. The box didn't come back again.

The kernel in flash is 2490368 bytes. (dd if=/dev/mtd0 of=./kernel.flash). On my build system there are 3 'kernelish' files, linux/vmlinux (4850717 bytes) linux/arch/arm/boot/Image (3792944 bytes) and linux/arch/arm/boot/zImage (1842632 bytes).
I suppose the flash kernel should be one of these, but none of the sizes fit, or comes close. I tried to reload with kernel.flash either, but it didn't work.

I'm pretty sure my build environment (which is provided by ZyXEL) is OK. I have build several kernel modules which just work.

Ideas?

Offline

 

#17 2009-01-16 23:58:28

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

Searching further.

In my build environment I found a file ras.bin which is identical to my 'flash kernel'. This file starts with 384kB of something which looks like an extended bootloader, according to the strings it contains. Then a header of 48 bytes, and then zImage. The remaining 254472 bytes are just filled with zero's. So 48 bytes header + zImage + zero's is exactly 2MB.

In reloaded main.c I found this:

Code:

/* current array sizes:
   200 for kernel
   280 for initrd

   mean segment size is 32k,
   two longs needed per segment

   kernel < 200/2 * 32k = 3.2M
   initrd < 280/2 * 32k = 4.3M
*/

My initrd is 12.6MB. This will cause troubles, I suppose?

What about the machtype? I've been reading about this, and found it fuzzy. AFAIU the bootloader has to put the machtype in a register before calling the kernel, so the kernel can do board specific things. Sounds smart, but is this not just moving the trouble to the bootloader? I have searched in the kernelsources if I could find the entry point, to see where it's stored, but no luck.
How do I find the machtype for my kernel?

Offline

 

#18 2009-01-17 00:17:39

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

How do I find the machtype for my kernel?

Have a look at arch/arm/tools/mach-types
Also, look at the arch/arm/mach-*/*-setup.c files.

Offline

 

#19 2009-02-04 22:03:47

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

The mach-types files is identical to the vanilla version, and there is no nsa220-ish device in it.
A grep on nsa220 in the linux directory (after a build, with all temporary files present) learned that almost all hits were in the arch/arm/mach-mv88fxx81 directory. So I suppose 859 is the needed machtype.
I changed reboot.S: 137, 280->809, to meet my initrd size.
Alas it still didn't reboot.

Offline

 

#20 2009-02-27 13:29:51

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Fonz' reloaded.ko on an NSA-220

You can try to use proc-arm926.S and proc-macros.S off from NSA-220 kernel.


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#21 2009-02-27 14:57:05

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Fonz' reloaded.ko on an NSA-220

is there a boot log somewhere for the nas-220?

i found there are two hardcoded addresses in reload.S which I took from u-boot output of the dns-323. it might be needed to change them for the nsa-220.
one of them is also in main.c (t->u.initrd.start = 0x800000;)

Offline

 

#22 2009-03-01 01:50:26

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Fonz' reloaded.ko on an NSA-220

I did attach reboot log to this post.
859 should be correct machtype for zyxel kernel.

Code:

mv88fxx81               MACH_MV88fxx81          MV88fxx81               859

Attachments:
Attachment Icon nsa220-reboot.txt, Size: 21,714 bytes, Downloads: 1,507

DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#23 2009-03-01 20:49:34

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

Wait, wait, now you're going too fast. What did you do to get this bootlog?

Offline

 

#24 2009-03-01 20:54:59

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Fonz' reloaded.ko on an NSA-220

Mijzelf wrote:

Wait, wait, now you're going too fast. What did you do to get this bootlog?

I didn't do anything yet, it' simple reboot log. I have had no time to test reloader out. But I am sure that machtype is 859. If you're using initrd you will need to modify some addresses in reload.S as fonz mentioned. But additionally you may try to use proc-arm926.S and proc-macros.S off from zyxel kernel when you're compiling reloader module.


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#25 2009-03-03 21:30:34

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 709

Re: Fonz' reloaded.ko on an NSA-220

I'm trying to find the hardcoded addresses in reboot.S (there is no reload.S). I suppose it's 0x8000 for the kernel and 0x800000 for initrd. This fits with the DNS-323 bootlog I found here. Unfortunately I'm not able to find corresponding addresses in the bootlog Sala posted. Maybe initrd starts at 0x2000000, but that's a quarter of the total memory range? Isn't that weird?

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB