General NAS-Central Forums

Welcome to the NAS community
It is currently Sat Dec 16, 2017 4:56 pm

All times are UTC




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Linksys MediaHub
PostPosted: Tue Aug 17, 2010 7:58 pm 
Offline

Joined: Sat May 29, 2010 6:37 pm
Posts: 160
I have a NAS which is not listed here, tho i wonder who else owns this device as well.

I have the NMH-300 which should contain the Marvell Orion chip running at 500 MHZ.

I know it runs uBoot, since on install, the device leaves a uImage file on the hdd.

Anyone ever tried installing it's own system on this device?

Just curious...:)


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Fri Jul 13, 2012 10:03 am 
Offline

Joined: Sat May 29, 2010 6:37 pm
Posts: 160
A huge bump to this thread, but with some nice information!

I managed to get a serial connection working on this device, the serial connector on this board looks like:
http://arm.prutsertjes.nl/img/NMH300/IMG_5143.JPG

If I visualize this header it would look like:
Code:
. 1
. .
6 5
8 7
. 9
Where . are the missing pins and the numbers the corresponding pin numbers

Where the serial pinout is as follows:
Code:
9 = GND
7 = RXD
5 = TXD

Upon starting the NAS, uBoot looks like this:
Code:
         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
 \___/    |____/ \___/ \___/ \__|  ** LOADER **
 ** MARVELL BOARD: RD-88F5182-NAS-2-Q LE

U-Boot 1.1.4 (Jun  2 2009 - 00:56:52) Marvell version: 2.4.3-NMS300_v1.6

U-Boot code: 00200000 -> 00270128  BSS: -> 00281398

Soc: 88F5182 A2 (DDR2)
CPU running @ 400Mhz
SysClock = 200Mhz , TClock = 166Mhz

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB  32bit width
[512kB@fff80000]  Flash: 512 kB
Addresses 4M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (4M - 3M): Done
NAND:  64 MB@0xf8000000
Board Type: LED2

CPU : ARM926 (Rev 0)
88F5182 A2 streaming disabled

USB 0: host mode
USB 1: host mode
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0

The default parameters for the uBoot environment are:
Code:
Marvell>> printenv
bootcmd=bootdetect ; run sataboot0; run sataboot1; run rescue
bootdelay=1
baudrate=115200
loads_echo=0
ipaddr=10.0.7.254
serverip=10.0.7.2
rootpath=/mnt/ARM_FS/
cpuName=926
bootargs=console=ttyS0,115200
CASset=min
MALLOC_len=1
ethprime=egiga0
hddboot0=setenv bootargs $(hddboot_bootargs) ; ide reset ; ext2load ide 0:2 0x400000 /uImage ; bootm 0x400000
hddboot1=setenv bootargs $(hddboot_bootargs) ; ide reset ; ext2load ide 1:2 0x400000 /uImage ; bootm 0x400000
hddboot_bootargs=root=/dev/sda2 mtdparts=cfi_flash_0:512k(u-boot);Samsung_nand:3072k(kernel),61440k(rootfs),-(settings) console=ttyS0,115200 init=/linuxrc
rescue=setenv bootargs $(rescue_bootargs) ; nboot 0x400000 0 0 ; bootm 0x400000
rescue_bootargs=root=/dev/mtdblock2 mtdparts=cfi_flash_0:512k(u-boot);Samsung_nand:3072k(kernel),61440k(rootfs),-(settings) console=ttyS0,115200 init=/linuxrc
nfsboot=setenv bootargs $(nfsboot_bootargs) nfsroot=$(serverip):$(nfsroot) ip=::::MediaHub:egiga0:dhcp ; tftp 0x400000 uImage; bootm 0x400000
nfsboot_bootargs=root=/dev/nfs mtdparts=cfi_flash_0:512k(u-boot);Samsung_nand:3072k(kernel),61440k(rootfs),-(settings) console=ttyS0,115200 init=/linuxrc
BootMode=0
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
ethaddr=00:00:00:00:51:81
eth1addr=00:00:00:00:51:82
pciMode=host
usb0Mode=host
usb1Mode=host
ethact=egiga0
SysMode=0
stdin=serial
stdout=serial
stderr=serial
enaDebugLed=yes
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
disaMvPnp=no
overEthAddr=no

Environment size: 1561/4092 bytes


The next thing to accomplish is to actually boot a own kernel (using one from a edmini v2), but will have to revive the NAS first, I've enabled cpu stream and now the NAS hangs, that is being discussed in another topic here, when the NAS is functional again I will continue my posts in this thread.


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Mon Oct 08, 2012 9:18 am 
Offline

Joined: Mon Oct 08, 2012 9:14 am
Posts: 1
langerak, a good analysis! Thanks a lot for sharing!


________________
play swf


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Mon Jan 21, 2013 4:35 pm 
Offline

Joined: Sat May 29, 2010 6:37 pm
Posts: 160
I managed to get the device working again! That results in Debian squeeze now being bootable on this device as follows:

- First insert a disk in the NAS, this will let the NAS deploy it's software to disk and will reboot using that software.
- I removed the disk, hooked that up to my linux box and copied the uImage and kernel libs.
- I have prepared a new disk with the following layout
256MB swap
rest for EXT3 filesystem
- I have created a squeeze rootfs with debootstrap and placed that on the new disk along with the kernel libs.
- On the NAS I've loaded and booted the kernel image via TFTP, as the current uBoot won't load from ext3 partitions > 256MB.
- Completed the setup of debootstrap and corrected the fstab / inittab entries
- Finished!

Leds:
The leds on the device are controllable via uBoot and GPIO:
Code:
gpio pins:

2 -> red led for disk 1
13 -> red led for disk 2
19 -> blue power led
22 -> red power led
Marvell>> gpio cfg 2 out dis dis

The example below will lit up the red led for disk 1, if the second "dis" is set to "en", it will start blinking. The "out" turns the led on, setting it to "in", will dim it.

Fan control:
uBoot has control over the fan, but the controls are strange, off means on and vice-versa. What also is possible is to write data into registers that control the fan, altho I don't understand how to control it:
Code:
Marvell>> fan show all

0000: 0x1b, 0x1b, 0x10, 0x6e, 0x50, 0x00, 0x00, 0x60, 0xf0, 0x70, 0x70, 0x00, 0x00, 0x00, 0x00, 0x50,
0010: 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0020: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0030: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0040: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0050: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0060: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0070: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0080: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0090: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00a0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00b0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00c0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00d0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00e0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00f0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x87, 0x4d,

Marvell>> fan off
Marvell>> fan show all

0000: 0x24, 0x24, 0x10, 0x6e, 0x50, 0x00, 0x00, 0x60, 0xf0, 0xf0, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x50,
0010: 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0020: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0030: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0040: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0050: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0060: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0070: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0080: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0090: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00a0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00b0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00c0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00d0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00e0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00f0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x87, 0x4d,

Marvell>> fan on
Marvell>> fan show all

0000: 0x25, 0x25, 0x10, 0x6e, 0x50, 0x00, 0x00, 0x60, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50,
0010: 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0020: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0030: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0040: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0050: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0060: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0070: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0080: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0090: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00a0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00b0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00c0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00d0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00e0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
00f0: 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x87, 0x4d,


Kernel:
The kernel is quite antique, but is able to run along with Debian Squeeze, if somebody is able to help me with how to patch kernel sources? Maybe we can get a more modern kernel compiled for this device. The current kernel is:
Code:
root@nmh300:/media# uname -a
Linux nmh300 2.6.22.19 #1 Mon Jun 1 23:58:22 PDT 2009 armv5tejl GNU/Linux

I've tried compiling a new orion5x kernel for this device (kernel 3.7.6), which loads fine, but when booted it hangs for a second and resets the device. Also playing with arcnumbers did not help.

uBoot:
And also uBoot is quite antique with not being able to load uImages from partitions that extend 256MB. Also Linksys has locked the bootcmd parameter, making it not able to run a different boot scheme.
It also refers to this:
Code:
bootcmd=bootdetect ; run sataboot0; run sataboot1; run rescue
BootMode=0

But when showing all environment variables, only rescue exists, the rest is absent, also, when creating a variable for, lets say, sataboot0, it saves, but won't load and seems to default to something else, and i think it's being changed with BootMode, but also this parameter cannot be changed.

Booting:
Booting is currently only possible with the console hooked up and loading the kernel from tftp. I guess this can only be fixed when flashing a new uboot on the device.


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Mon Mar 04, 2013 11:52 am 
Offline

Joined: Sat May 29, 2010 6:37 pm
Posts: 160
I contacted Linksys for GPL source code request, I want to know I they can deliver the used Uboot sources. If I manage to get these, are there any people here that want to help creating a new uboot for this NAS? I'm new to this, but would like to know how to create / build this myself.


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Mon Apr 22, 2013 12:08 pm 
Offline

Joined: Sat May 29, 2010 6:37 pm
Posts: 160
It seems that building a new uBoot is not totally necessary, because I've managed to get a 3.8.7 kernel booting on the NAS. I've taken the config of the RD88F5182 board, as which the NAS is identifying itself and that kernel is booting.

The only bad thing is that uBoot thinks it's machine id is 20e / 526, which leads me to a "Altiva" board. Hacking the machine ID to 526 for the RD88F5182 board results in a booting kernel. It's dirty, I know, but it works :).

There are some limitations with the current uBoot, being:
1. The kernel image may not be bigger than 2MB
2. The partition containing the kernel may not be bigger than 300MB.

The first one is not really a problem if you compress the kernel using LZMA and have only the needed options compiled in, the rest can be activated as module (like NFS for example).

The second one can be problematic, because the default params of Linksys expect the kernel and filesystem on a 2nd partition and may not be bigger than 300MB. But I've managed to bypass this restriction by creating a bigger partition next to the 2nd one and placing the filesystem there and hard coding the boot parameters in the kernel config which overrides the uBoot ones!

So I am left with only creating a kernel patch I guess to support this device. Everything seems to work with the used board config, like SATA and ethernet. Only the buttons, fan and leds need to be mapped accordingly. I've already changed the config to support the right I2C chip and address and lit up the power LED, which will else be flickering the whole time...


Top
 Profile  
 
 Post subject: Re: Linksys MediaHub
PostPosted: Thu Sep 29, 2016 6:11 am 
Offline

Joined: Thu Sep 29, 2016 5:30 am
Posts: 1
I know this is a very old box now, but I have one of these that I was thinking of tinkering with, and came across this thread. (The thing was always such a piece of crap running the stock Linksys/Cisco image. So, before chucking it, I thought I'd give hacking it a try.)

After getting the serial console going, and playing around with U-boot for a bit, I thought I'd go a slightly different route, and play around with the existing image before trying to cobble up my own. After mounting the NAS's drive with an external enclosure on my Linux box, it seemed a straightforward task of modifying /etc/conf/passwd (which is symlink'd to /etc/passwd), to blank out the root password. But that still left me unable to log in. After digging a bit more, it appears they have this huge PHP blob in /etc/init.d/rc.bootup, invoked from /etc/init.d/rcS, which, among other things, recreates the passwd file during bootup. The file /etc/inc/func_user.inc holds the key, specifically the function userfunc_users_commit(), with the following:
Code:
/* build passwd file */
$root_hash = crypt("giveit2me");
$pwstr  = "root:{$root_hash}:0:0::/:/bin/sh\n";
$pwstr .= "nobody:x:99:99:Nobody:/:/bin/nologin\n";
$pwstr .= "ftp:x:14:14:FTP User:/var/ftp:/bin/nologin\n";

So, root password is 'giveit2me'. Tried that on the serial console, and it worked just fine. Next steps will be to try to understand the processes they have running on the box, and maybe find a toolchain I can use to recreate their kernel.
Anyway, just wanted to share, in case others wanted to dink around with root access through the serial console as well.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 8 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group