OpenWrt Forum Archive

Topic: port kamikaze on synology USB Station

The content of this topic has been archived on 13 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi,

I'm trying to port kamikaze on USB station from synology.
Here  the harware description
- platform : RDC R3210-G
- ram  : A2V28S40CTP-G6 (16 MB)
- flash : S29AL032D90TF103 (4 MB)

Do you think this port is possible ?
And what the best way to make this port ?

Post some pictures (of the main board) and a bootlog and I might be able to advise.

You may find more help on the macsat forum  http://www.macsat.com/macsat/index.php

the pics are below but I don't know how to get the bootlog.
Probably I need to install serial cable, but I'm trying to identify serial port (hope is one of the 3 connectors !).

BOARD
http://lh5.ggpht.com/_E2_YNeJS0qE/SawCd7HN1FI/AAAAAAAAABI/EB-IK3AAnYk/BOARD_USBstation.jpg
http://lh6.ggpht.com/_E2_YNeJS0qE/SawDvVWYAtI/AAAAAAAAABk/UdOreHq18z8/BOARD2_USBstation.JPG

FLASH
http://lh6.ggpht.com/_E2_YNeJS0qE/SawCeVgYNxI/AAAAAAAAABQ/pFf1DlUI05A/FLASH_USBstation.jpg

RAM
http://lh5.ggpht.com/_E2_YNeJS0qE/SawCehYOkwI/AAAAAAAAABY/AH-CTkjBZzU/RAM_USBstation.jpg

Hi, all.

I have already donated one which is OEM of synology USB Station.
logitec lan-hdps/u2
http://www.logitec.co.jp/products/lan/lanhdpsu2.html

I heard it was brought to Florian. (Gabor, right? :-) )

Here is bootlog from serial console.

+Ethernet eth0: MAC address 00:00:01:02:03:04
IP: 192.168.123.123/255.255.0.0, Gateway: 192.168.1.1
Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version v2_0 - built 11:09:30, Jan 23 2006

Platform: PC (I386)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x000f0000, 0x00071ff0-0x000a0000 available
Synology Redboot Version 1.0

== Executing boot script in 1.000 seconds - enter ^C to abort

mem_size: 1000000
initrd d60000 len 2a0000
Linux version 2.4.22-uc0 (root@LinuxImage) (gcc version 3.3.4) #1 Wed Apr 12 13:45:51 CST 2006
BIOS-provided physical RAM map:
 BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
 BIOS-e801: 0000000000100000 - 0000000001000000 (usable)
Synology Hareware Version: SUS201_V1
16MB LOWMEM available.
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
DMI not present.
Kernel command line: console=ttyS0,115200 syno_hw_version=SUS201_V1
Initializing CPU#0
Calibrating delay loop... 44.33 BogoMIPS
Memory: 10868k/16384k available (1217k kernel code, 5128k reserved, 461k data, 56k init, 0k highmem)
Checking if this processor honours the WP bit even in supervisor mode... Ok.
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
CPU: Cyrix Cx486SLC
Checking 'hlt' instruction... OK.
Checking for popad bug... OK.
POSIX conformance testing by UNIFIX
mtrr: v1.40 (20010327) Richard Gooch (rgooch@atnf.csiro.au)
mtrr: detected mtrr type: none
PCI: Using configuration type 1
PCI: Probing PCI hardware
PCI: Probing PCI hardware (bus 00)
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
kinoded started
Journalled Block Device driver loaded
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 6144K size 1024 blocksize
physmap flash device: 400000 at ffc00000
 Amd/Fujitsu Extended Query Table v1.3 at 0x0040
Physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition
Creating 6 MTD partitions on "Physically mapped flash":
0x003e0000-0x00400000 : "redboot"
0x00300000-0x003e0000 : "kernel"
0x00060000-0x00300000 : "ramdisk"
0x00040000-0x00060000 : "sysconf"
0x00020000-0x00040000 : "defconf"
0x00000000-0x00020000 : "synocfg"
Mac0 00:11:32:00:bd:e6
vender Mac1 checksum error ucSum:0x00 Buf:0x00 Sum:0.
Vender partition MacNum:1 retlen:64
physmap: no partition info available, registering whole flash at once
Creating 6 MTD partitions on "Physically mapped flash":
0x003e0000-0x00400000 : "redboot"
0x00300000-0x003e0000 : "kernel"
0x00060000-0x00300000 : "ramdisk"
0x00040000-0x00060000 : "sysconf"
0x00020000-0x00040000 : "defconf"
0x00000000-0x00020000 : "synocfg"
Mac0 00:11:32:00:bd:e6
vender Mac1 checksum error ucSum:0x00 Buf:0x00 Sum:0.
Vender partition MacNum:1 retlen:64
rdc: RDC R6040 net driver, version 0.5 (9July2004)
rdc: RDC R6040 net driver, version 0.5 (9July2004)
rdc: RDC R6040 net driver, version 0.5 (9July2004)
SCSI subsystem driver Revision: 1.00
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
ehci_hcd 00:0a.1: RDC Semiconductor, Inc. RDC USB Host 2.0
ehci_hcd 00:0a.1: irq 14, pci mem c1c0e000
usb.c: new USB bus registered, assigned bus number 1
PCI: 00:0a.1 PCI cache line size set incorrectly (32 bytes) by BIOS/FW.
PCI: 00:0a.1 cache line size too large - expecting 16.
ehci_hcd 00:0a.1: USB 2.0 enabled, EHCI 1.00, driver 2003-Jun-19/2.4
hub.c: USB hub found
hub.c: 2 ports detected
USB_DEVICE: This is hub. No need to call_policy_interface.
host/usb-ohci.c: USB OHCI at membase 0xc1c10000, IRQ 15
host/usb-ohci.c: usb-00:0a.0, RDC Semiconductor, Inc. RDC USB Host 1.1
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
USB_DEVICE: This is hub. No need to call_policy_interface.
usb.c: registered new driver usblp
printer.c: v0.11: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
RAMDISK: cramfs filesystem found at block 0
RAMDISK: Loading 2428 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 2688k freed
VFS: Mounted root (cramfs filesystem).
Freeing unused kernel memory: 56k freed
Un-tar system config from /dev/mtd3...
Successfully un-tar system config.
Generating directory struct for /var...
Mounting proc filesystem...
Hostname LANHDPS
192.168.1.2     LANHDPS
Kernel time zone has been update (-540).
Starting syslogd...
done.
Using /lib/modules/synobios.o
synobios: load, major number 201
Starting hwmonitor...
Network interfaces: lo eth0
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 iB)  TX bytes:0 (0.0 iB)

eth0      Link encap:Ethernet  HWaddr 00:11:32:00:BD:E6
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 iB)  TX bytes:0 (0.0 iB)
          Interrupt:10 Base address:0xe800

Add default router 192.168.1.1
Starting inetd...
Starting crond...

Local package initialization:
synobios_ioctl: synobios_ioctl: SYNOIO_NEXTEVENT event id 102
synobios_ioctl: synobios_ioctl: SYNOIO_NEXTEVENT event id 103
Starting cupsd...
Starting Samba...
start thttpd
start findhostd
System configured, skip manutild
.

Sun Sep 28 16:11:07 JST 2008

LANHDPS login: admin
Password:
warning: cannot change to home directory
SynoPassword:

I hope these help you.

regards,
zukky

Thank for the bootlog yapoo ,

Do you remember which of the 3 connectors was the serial one ???
JP1 : 3 pins , 1 row
JP2 : 6 pins , 1 row
JP3 : 6 pins , 2 rows (suppose is this one ??)

and what is the pinout ??

Sorry, I can't paste your pic URLs, and I'm not typing them out! :-/.

However, you are in luck.  It's running a more-or-less standard version of Redboot so it probably knows how to boot a 2.6 linux kernel.  Next you need to make up a serial cable and then break into the boot with CTRL-C.  It will be running a boot script immediately after boot which will contain the offsets of the kernel and rootfs, but I'm not sure if you can find out what it is from the prompt because it's usually compiled into redboot.  You need to find these offsets.  Once you know those you can make your own firmware by flashing into the same area (but be careful since I'm not sure if redboot will prevent itself from being overwritten).  Redboot will be at the top of memory, it's usually 132KB long, so it will likely be starting at 0xfffe0000

Most versions of redboot contain commands for dumping memory areas. On a 4MB device flash will start at address 0xffc00000.  By dumping memory at various offsets you should be able to figure out where the rootfs and kernel start, then it should be a simple matter of reflashing with your own data.

I forget the specifics of the redboot commands, but there is a help function (type 'help'), so long as it's been compiled in, of course!

You could make life a lot easier for yourself if you simply use a USB root system with this device.  You can then follow very similar instructions to these:

http://bifferos.bizhat.com/kernel/
http://bifferos.bizhat.com/rootfs/

This way you don't need a new OpenWrt profile but can just use the existing AMIT tgz.

Hope this helps,

biff.

Thanks,
Of course, this will help.

I've already have a look on the biffer board and I think to make usb boot first.
Do you know if booting on usb will allow to acces (and to change) the flash OS, without using serial cable ??

noonoon wrote:

I've already have a look on the biffer board and I think to make usb boot first.
Do you know if booting on usb will allow to acces (and to change) the flash OS, without using serial cable ??

If you want to re-flash without the serial cable, then you need to have two things:

1) An option to flash firmware using the web interface to the device
2) An example 'upgrade' firmware that you've obtained from the web site of the supplier.

But without either redboot access, or an example firmware you cannot know the layout of the flash, so you don't know at what offset to put the kernel.  You can make a guess that kernel is at the start of the flash, of course, but you'd have to be either very good or very lucky to put together a rootfs that boots, detects network hardware, configures networking and provides a dropbear shell for you to log into without the console for diagnostic.  I think we can safely say you won't manage this.

Go and buy yourself a mobile phone data cable - they are very inexpensive if purchased off Ebay.

Hi.

> noonoon.
I forgot the pinout. Sorry.  But it was not difficult, maybe...

> bifferos.
Good board. It is better, if it has PoE.

regards,
zukky

Hi,

I'm back and I receive the serial cable !!
So I identified the serial connector (picture below) and copy the bootlog

http://lh6.ggpht.com/_E2_YNeJS0qE/SbgBJ6baxZI/AAAAAAAAACE/CWp_knJQjnQ/serial_pinout.jpg

the bootlog difference with the yapoo one

$ diff bootlog.txt bootlog_yapoo.txt
6c6
< Non-certified release, version v2_0 - built 13:45:06, Apr 12 2006
---
> Non-certified release, version v2_0 - built 11:09:30, Jan 23 2006
59c59
<  Amd/Fujitsu Extended Query Table v1.1 at 0x0040
---
>  Amd/Fujitsu Extended Query Table v1.3 at 0x0040
71c71
< Mac0 00:11:32:01:79:c5
---
> Mac0 00:11:32:00:bd:e6
82c82
< Mac0 00:11:32:01:79:c5
---
> Mac0 00:11:32:00:bd:e6
119c119
< RAMDISK: Loading 2468 blocks [1 disk] into ram disk... done.
---
> RAMDISK: Loading 2428 blocks [1 disk] into ram disk... done.
127,129c127,129
< Hostname USBStation
< 192.168.1.99    USBStation
< Kernel time zone has been update (-60).
---
> Hostname LANHDPS
> 192.168.1.2     LANHDPS
> Kernel time zone has been update (-540).
144c144,145
< eth0      Link encap:Ethernet  HWaddr 00:11:32:01:79:C5
---
> eth0      Link encap:Ethernet  HWaddr 00:11:32:00:BD:E6
>           inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
147c148
<           TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
---
>           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
149c150
<           RX bytes:0 (0.0 iB)  TX bytes:120 (120.0 iB)
---
>           RX bytes:0 (0.0 iB)  TX bytes:0 (0.0 iB)
151a153
> Add default router 192.168.1.1
165c167
< Wed Mar 11 12:41:52 CET 2009
---
> Sun Sep 28 16:11:07 JST 2008
167c169
< USBStation login: admin
---
> LANHDPS login: admin

and the redboot version

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version v2_0 - built 13:45:06, Apr 12 2006

Platform: PC (I386)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x000f0000, 0x00071ff0-0x000a0000 available
Synology Redboot Version 1.0

The mtd partition and redboot are the same.
But can not go further because of the SynoPassword ??

I can dump memory, but I don't know how to recognize rootfs and kernel offset?
Do they correspond to the mtd kernel and ramdisk ??
I'm not sure of the manip I need to do to load the rootfs and the kernel image ?
The redboot command is "lo -r -b <base_address> filename"  and I suppose that the size of the file does not be larger than the partition size, but cause I'm a noob, I prefer ask before acting.

thanks

noonoon wrote:

I can dump memory, but I don't know how to recognize rootfs and kernel offset?

Good point.  Not sure I would either, so I guess you have to find/compile kernel of the same version, and take a look at it!

Hey guys,

i got the same synology USB-Station, and i'm trying to get the bootlog.

I made a serial cable witch use TXD, RXD, and Ground. I dont really understand the use of the VDD... Do i have to plug the device on a power-plug in the meantime?

Thanks !

hello,

is there any way to hack the new : USB STATION 2 from synology ?

The discussion might have continued from here.