General NAS-Central Forums

Welcome to the NAS community
It is currently Fri Aug 18, 2017 10:43 am

All times are UTC




Post new topic Reply to topic  [ 4 posts ] 
Author Message
 Post subject: Iomega 150d hacking
PostPosted: Mon May 16, 2016 8:51 am 
Offline

Joined: Mon May 16, 2016 8:46 am
Posts: 3
Dear NAS Central.
I purchased an used Iomega 150d and I make some analysis with the target to flash a recent linux kernel to improuve the current SW (as an example using openmediavault).

I open the box and I found the serial line (see attached picture).

Here some interessting info gatehered from the current linux kernel.

/ # cat /proc/cpuinfo
processor : 0
cpu : e300
revision : 1.1 (pvr 8083 0011)
bogomips : 263.16
chipset : 8347E
Vendor : Freescale Inc.
Machine : mpc8347E sys
core clock : 396 MHz
bus clock : 264 MHz
PVR : 0x80830011
SVR : 0x80520011
PLL setting : 0x6
Memory : 256 MB

/ # cat /proc/mtd
dev: size erasesize name
mtd0: 00170000 00010000 "kernel"
mtd1: 00590000 00010000 "cramfs"
mtd2: 00050000 00010000 "bootloader"
mtd3: 000b0000 00010000 "jffs2"

/ # cat /proc/meminfo
MemTotal: 256528 kB
MemFree: 244864 kB
Buffers: 1672 kB
Cached: 3616 kB
SwapCached: 0 kB
Active: 3064 kB
Inactive: 2796 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 256528 kB
LowFree: 244864 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
Mapped: 1896 kB
Slab: 4144 kB
CommitLimit: 128264 kB
Committed_AS: 45752 kB
PageTables: 100 kB
VmallocTotal: 720896 kB
VmallocUsed: 8584 kB
VmallocChunk: 712188 kB

The box mount a legacy uboot bootloader:

IOMEGA=> version

U-Boot 1.1.4 (USI Develop) (Nov 20 2006 - 16:50:23) MPC83XX


I try with buildroot to build the linux-4.4.3.
Due the old U-Boot version is not possible to use the standard uImage, but it is needed to set the cuImage target (the one embedding the device tree).

I start using the default configuration arch/powerpc/configs/mpc83xx_defconfig,
and the default device tree mpc834x_mds.

In order to enable the console output during the first linux boot stage I added the following line at the end of the device tree file:

chosen {
linux,stdout-path = "/soc8349/serial@4500";
};

The kernel is compiled and I get the cuImage.mpc834x_mds image.

Then I load it on the machine and execute:

tftp 0x10000000 cuImage.mpc834x_mds
Speed: 1000, full duplex
Using Freescale TSEC0 device
TFTP from server 192.168.178.36; our IP address is 192.168.178.10
Filename 'cuImage.mpc834x_mds'.
Load address: 0x10000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################################
done
Bytes transferred = 2157489 (20ebb1 hex)
IOMEGA=> bootm 0x10000000
## Booting image at 10000000 ...
Image Name: Linux-4.4.3
Image Type: PowerPC Linux Kernel Image (gzip compressed)
Data Size: 2157425 Bytes = 2.1 MB
Load Address: 00500000
Entry Point: 005001f8
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Memory <- <0x0 0x20000000> (512MB)
ethernet0: local-mac-address <- xx:xx:xx:xx:xx:xx
ethernet1: local-mac-address <- xx:xx:xx:xx:xx:xx
CPU clock-frequency <- 0x179a7b00 (396MHz)
CPU timebase-frequency <- 0x3ef1480 (66MHz)
CPU bus-frequency <- 0xfbc5200 (264MHz)

zImage starting: loaded at 0x00500000 (sp: 0x1ffb2ce8)
Allocating 0x439a88 bytes for kernel ...
gunzipping (0x00000000 <- 0x0050e000:0x00940fe8)...done 0x422920 bytes

Linux/PowerPC load: root=/dev/mtdblock1 ro rootfstype=cramfs devfs=mount console=ttyS0,115200 init=/linuxrc
Finalizing device tree... flat tree at 0x94d120


But at this point the process crash and the system is reset.
It should be something near the handover between the first kenel boot stage and the vmlinux start, but I do not have a jtag to proceed the investigation.

Any suggestion?

Bye.


Top
 Profile  
 
 Post subject: Re: Iomega 150d hacking
PostPosted: Mon May 16, 2016 10:26 am 
Offline

Joined: Mon May 16, 2016 8:46 am
Posts: 3
Here the picture to get access to the serial console.

Bye.


You do not have the required permissions to view the files attached to this post.


Top
 Profile  
 
 Post subject: Re: Iomega 150d hacking
PostPosted: Mon May 16, 2016 7:51 pm 
Offline

Joined: Mon Jun 16, 2008 10:45 am
Posts: 6022
Quote:
/ # cat /proc/meminfo
MemTotal: 256528 kB

Memory <- <0x0 0x20000000> (512MB)
Some inconsistency?


Top
 Profile  
 
 Post subject: Re: Iomega 150d hacking
PostPosted: Fri May 20, 2016 5:59 am 
Offline

Joined: Mon May 16, 2016 8:46 am
Posts: 3
This is not realy an inconsistency.
The Iomega150 have a dimm module as main memory.
The default version mount a 256MB module, and this was the situation when I capture the memory info.
After I installed a 1GB dimm (purchased on e-bay at 10$).
Currently the uboot and linux can find only 512MB, I will fix it later (if possible).

But the problem is not related to this.

Bye.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group