DSM-G600, DNS-3xx and NSA-220 Hack Forum

I exchanged proc-arm926.S and proc-macros.S, and changed 0x800000 in 0x02000000 in main.c and reboot.S. The linker complained:

WARNING: "v4wbi_tlb_fns" [/home/mijzelf/dns323-reloaded-0.7.167/reloaded.ko] undefined!
WARNING: "v4wb_user_fns" [/home/mijzelf/dns323-reloaded-0.7.167/reloaded.ko] undefined!
WARNING: "v5tj_early_abort" [/home/mijzelf/dns323-reloaded-0.7.167/reloaded.ko] undefined!
WARNING: "support_wait_for_interrupt" [/home/mijzelf/dns323-reloaded-0.7.167/reloaded.ko] undefined!
WARNING: "mv_orion_ver" [/home/mijzelf/dns323-reloaded-0.7.167/reloaded.ko] undefined!

and I couldn't load the module

insmod: cannot insert `reloaded.ko': Unknown symbol in module (-1): No such file or directory

I suppose one of the exchanged .S files contained those symbols. Will look at it later.

Last edited by Mijzelf (2009-03-09 17:56:52)

Finally it worked! Starting with Fonz' original sources, I exchanged proc-arm926.S and proc-macros.S. The were some missing functionpointers in  proc-arm926.S, and I just skipped them. There were 2 variables needed, mv_orion_ver and support_wait_for_interrupt, and I added them to main.c, loaded with the right values.

Sala's kernel seemed not to use a rdinit, so I didn't use one either. I created a 0 byte file, and the command

/sbin/insmod reloaded.ko kernel=zImage initrd=0_byte_file cmdline="rootfstype=squashfs root=/dev/mtdblock1 ro mtdparts=physmap-flash.0:2432k(kernel),12928k(initrd),896k(etc),-(bootbase) console=ttyS0,115200n8 mem=128M init=/linuxrc"

rebooted the box with the new kernel. For the moment I used the standard kernel, with only /proc/config.gz added. And after rebooting the file was there!

Sources and kernelmodule here

I think I can simply change rootfstype and root in cmdline, to boot a different system, but I'll try that later.

If you are using my precompiled kernel then you cant change or pass cmdline to kernel because of nature of hdd boot patch. Even if you can then its not going to booting original firmware because I did made this image minimal as possible, so it misses some features needed by firmware.

If you like I can send you my configured genlink tarball which you can extract to resierfs formated sda3.

Mijzelf wrote:

Would it be hard to change the kernel and tarball to boot from sdc1 instead? In that case it would be nice trying, I'd like not to touch the original firmware and harddisks.

Well, you can compile hddboot kernel with # CONFIG_CMDLINE_OVERRIDE is not set

Mijzelf wrote:

I did made this image minimal as possible

Is this for any special reason?

Yes, since kernel image will be un-compressed into memory, its just takes up space for no reason. Instead I just compile in features which are really needed to boot and for rest you can use modules.

Mijzelf wrote:

sala wrote:

Mijzelf wrote:

Would it be hard to change the kernel and tarball to boot from sdc1 instead? In that case it would be nice trying, I'd like not to touch the original firmware and harddisks.

Well, you can compile hddboot kernel with # CONFIG_CMDLINE_OVERRIDE is not set

This will revert the boot process to the old situation, I suppose? Do you have a reason to presume that this kernel will boot from sdc1, where the stock kernel doesn't?

Ah, I did misunderstand you. Stock should read passed cmdline parameter correctly. CONFIG_CMDLINE_OVERRIDE in my patch is used to force kernel to ignore all passed cmdline parameters (from bootloader or from any other loader).
I think that module is not passing cmdline correctly to kernel. For DSM-G600 kernel did need some extra patching in order to read passed custom cmdline root device http://dns323.kood.org/dsmg600/howto:lo … or_loading

So I bought a TTL-232R-3v3 and hooked it up. When trying to boot the last lines are:

md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
Root-NFS: No NFS server available, giving up.
VFS: Unable to mount root fs via NFS, trying floppy.
VFS: Cannot open root device "sdc1" or unknown-block(2,0)
Please append a correct "root=" boot option
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(2,0)

In order to find out if my kernel can boot from partitions at all, I copied the firmwaretree to sdb2, an ordinary ext3 volume. This worked.
So why doesn't it boot from usb stick? sdc1 is a valid ext3 partition. The reload script and zImage are on it. The only kernelmodules which are loaded before the script is executed are:

##### SATA modules
insmod /lib/modules/libata.ko
insmod /lib/modules/ahci.ko

###### file system modules
insmod /lib/modules/reiserfs.ko
insmod /lib/modules/fat.ko
insmod /lib/modules/msdos.ko
insmod /lib/modules/vfat.ko
insmod /lib/modules/ntfs.ko
insmod /lib/modules/udf.ko
insmod /lib/modules/isofs.ko
modprobe fuse

#### lm85 module
insmod /lib/modules/hwmon-vid.ko
insmod /lib/modules/lm85.ko

None of these have anything to do with USB, I thought

Hello, I'm back.

This time I'm trying to port reloaded.ko to yet another NAS, the 'Iomega Home Media Network Hard Drive', with a oxnas SoC, running kernel 2.6.24.4.
I started with dns323-reloaded-0.7.167, exchanged proc-arm926.S and proc-macros.S by the ones from the 2.6.24.4 sourcetree. I had to edit proc-arm926.S to remove some pointers to external functions/variables, and had to edit main.c because sys_open and friends are no longer available. The module compiles fine, but when I try to load it I get

insmod: error inserting 'reloaded.ko': -1 Unknown symbol in module

dmesg says:

reloaded: Unknown parameter `panic'

According to linux/include/linux/kernel.h, the function is available:

cat linux/include/linux/kernel.h | grep panic
extern struct atomic_notifier_head panic_notifier_list;
extern long (*panic_blink)(long time);
NORET_TYPE void panic(const char * fmt, ...)
extern int oops_in_progress;        /* If set, an oops, panic(), BUG() or die() is in progress */
extern int panic_timeout;
extern int panic_on_oops;
extern int panic_on_unrecovered_nmi;

I wonder if the two different ' around panic in dmesg mean something.

Any suggestions?

The kernel is reloaded using the command:

insmod reloaded.ko kernel=/path/to/zImage initrd=/path/to/initrd cmdline="cmdline params"

bootdelay is just added to the cmdline params.

BTW, are you talking about a NAS? I don't think noapic and acpi=off do anything on a dedicated ARM computer.

Mijzelf wrote:

Finally it worked! Starting with Fonz' original sources
,...

Sources and kernelmodule here

Tried to download this source and got this:

wget http://download397.mediafire.com/667ku0 … nsa220.tgz
--2011-02-23 09:47:43--  http://download397.mediafire.com/667ku0 … nsa220.tgz
Resolving download397.mediafire.com... 38.114.197.181
Connecting to download397.mediafire.com|38.114.197.181|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2011-02-23 09:47:43 ERROR 403: Forbidden.

Is there another link??

Thanks, I got it now.

BTW, the dowmload from Mediafire did not work for me using my Seamonkey browser.

MrUmunhum wrote:

This code still uses 'sys_open' and 'sys_read'?  Is that right??

Yes. I have changed that for some other NAS:

static struct file* file_open(const char* path, int flags, int rights)
{
    struct file* filp = NULL;
    mm_segment_t oldfs;
    int err = 0;

    oldfs = get_fs();
    set_fs(get_ds());
    filp = filp_open(path, flags, rights);
    set_fs(oldfs);
    if(IS_ERR(filp)) {
        err = PTR_ERR(filp);
        return NULL;
    }
    return filp;
}

static void file_close(struct file* file) {
    filp_close(file, NULL);
}

int file_read(struct file* file, unsigned long long offset, unsigned char* data, unsigned int size)
{
    mm_segment_t oldfs;
    int ret;

    oldfs = get_fs();
    set_fs(get_ds());

    ret = vfs_read(file, data, size, &offset);

    set_fs(oldfs);
    return ret;
}

static void load_file(char *filename, int count, unsigned long *segments)
{
//        mm_segment_t old_fs = get_fs();
        int i;
        struct file *fd = 0;

        void *ptr;
        unsigned long c = 0;

        int segc = 0;

//        set_fs(KERNEL_DS);
        if ((fd = file_open(filename, O_RDONLY, 0)) == 0)
                panic("%s: open failed \n", filename);
        while (c < count) {

        retry:
                while (!(ptr = kmalloc(segment_size, GFP_KERNEL))) {
                        if (segment_size == MIN_SEGMENT_SIZE)
                                panic("load_file: Out of memory\n");
                        segment_size >>= 1;
                }
                if (virt_to_phys(ptr) < MIN_ADDR) {
                        printk("not using %d bytes reserved memory at %p / %p\n", segment_size, ptr, __virt_to_phys(ptr));
                        goto retry;
                }

                i = file_read(fd, 0, ptr, segment_size);
                printk("loaded %d of %d bytes at %p / %p\n", i, count, ptr, __virt_to_phys(ptr));
                if (i > 0) {
                        *segments++ = virt_to_phys(ptr);
                        *segments++ = (unsigned long)i;
                        c += i;
                        segc++;
                }
                if (i < 0)
                        panic("load_file: read error\n");
        }
        *segments = 0;
        file_close(fd);
        printk("%s: OK (%d segments)\n", filename, segc);
//        set_fs(old_fs);
}