File:  [NetBSD Developer Wiki] / wikisrc / ports / sandpoint / instlinkstation.mdwn
Revision 1.3: download - view: text, annotated - select for diffs
Fri Sep 4 22:30:35 2015 UTC (7 years, 2 months ago) by phx
Branches: MAIN
CVS tags: HEAD
Restore images.

    1: Introduction
    2: ============
    3: 
    4: <table>
    5: <tbody>
    6: <tr class="odd">
    7: <td align="left"><p>This document describes in depth how to prepare your Buffalo LinkStation for installing NetBSD/sandpoint. In this example we use a LinkStation HD-HLAN, which is the same board as a classic KuroBox. The software installation instructions are valid for the whole LinkStation/KuroBox family:</p>
    8: <ul>
    9: <li>LinkStation HD-HLAN (LS1/PPC)</li>
   10: <li>LinkStation HD-HGLAN (Gigabit ethernet)</li>
   11: <li>TeraStation HD-HTGL</li>
   12: <li>TeraStation Pro TS-TGL</li>
   13: <li>KuroBox classic (HD-HLAN board)</li>
   14: <li>KuroBox HG (HD-HGLAN board)</li>
   15: <li>KuroBox/T4 (TS-TGL board)</li>
   16: </ul></td>
   17: <td align="left"><img src="http://www.netbsd.org/images/ports/sandpoint/ls1_front.jpg" alt="HD-HLAN front view" /></td>
   18: </tr>
   19: </tbody>
   20: </table>
   21: 
   22: Accessing the serial interface
   23: ==============================
   24: 
   25: We need a serial console to get access to the firmware. That includes
   26: soldering a four pin header onto the board and building (or buying) a
   27: serial adapter from the LinkStation's TTL levels to RS232 levels.
   28: 
   29: Disassemble the HD-HLAN
   30: -----------------------
   31: 
   32: Unfortunately the LinkStation was not meant to be opened by customers,
   33: so Buffalo didn't make it easy. On the top and bottom of the case there
   34: is a small tab besides the grey frame, which you have to press down
   35: (e.g. with a screwdriver) to be able to move the frame to the front. On
   36: the photo below the location is marked red.
   37: 
   38: KuroBox with tab marked
   39: After a few millimeters the grey piece snaps free and comes up. You need
   40: quite some force to do that, because the shiny front bezel is secured by
   41: two hidden screws (one in the top and another in the bottom of the
   42: bezel). With enough force and skill you may be able to tear the screws
   43: out of the case (fortunately the screws are small). They remain in the
   44: shiny bezel. You may want to shorten the screws with a file now.
   45: 
   46: HD-HLAN half opened
   47: Before the case can be opened you have to remove a screw hidden under a
   48: sticker, below the fan (marked on the right side of the picture). Then
   49: press the four tabs on the top and bottom to remove the upper half of
   50: the case. Remove another four screws to be able to lift the board.
   51: 
   52: Locate the serial header
   53: ------------------------
   54: 
   55: Look out for a 4-pin header, called `J1`, which is usually unpopulated.
   56: The pin assignments are:
   57: 
   58: <table>
   59: <tbody>
   60: <tr class="odd">
   61: <td align="left"><table>
   62: <tbody>
   63: <tr class="odd">
   64: <td align="left"><strong>Pin number</strong></td>
   65: <td align="left"><strong>Function</strong></td>
   66: </tr>
   67: <tr class="even">
   68: <td align="left">1</td>
   69: <td align="left">TXD</td>
   70: </tr>
   71: <tr class="odd">
   72: <td align="left">2</td>
   73: <td align="left">RXD</td>
   74: </tr>
   75: <tr class="even">
   76: <td align="left">3</td>
   77: <td align="left">3.3V</td>
   78: </tr>
   79: <tr class="odd">
   80: <td align="left">4</td>
   81: <td align="left">GND</td>
   82: </tr>
   83: </tbody>
   84: </table></td>
   85: <td align="left"><img src="http://www.netbsd.org/images/ports/sandpoint/ls1_ser_pins.jpg" alt="Header pin assignments" /></td>
   86: </tr>
   87: </tbody>
   88: </table>
   89: 
   90: Solder the missing header and enable write access
   91: -------------------------------------------------
   92: 
   93: I would suggest to solder the 4-pin header on the back side of the PCB,
   94: because it is better accessible when opening the case. It is advisable
   95: to use an angled header to avoid problems closing the case. You also
   96: have to bridge `R76`, which is unoccupied. This is needed to enable
   97: write-access for the serial console. You may want to mark pin 1 of the
   98: header, before installing the board again.
   99: 
  100: <table>
  101: <tbody>
  102: <tr class="odd">
  103: <td align="left"><img src="http://www.netbsd.org/images/ports/sandpoint/ls1_ser_header.jpg" alt="Soldered header" /></td>
  104: <td align="left"><img src="http://www.netbsd.org/images/ports/sandpoint/ls1_R76.jpg" alt="Bridging R76" /></td>
  105: </tr>
  106: </tbody>
  107: </table>
  108: 
  109: Connect a serial cable
  110: ----------------------
  111: 
  112: The serial port on LinkStation and KuroBox devices is using 3.3V TTL
  113: levels, which have to be converted into regular RS232 levels by a level
  114: shifter circuit. If you are not anxious using a soldering iron you find
  115: detailed instructions how to build such a converter here:
  116: 
  117: -   Serial adapter for 3.3V TTL
  118: 
  119: Make sure that the layout of the plug fits to the pinout of the
  120: LinkStation's serial header, as shown above.
  121: 
  122: Another option is to buy such a converter. There are solutions for a
  123: standard RS232 interface and for an USB interface. Look out for:
  124: 
  125: -   RS232 level shifter / breakout board (MAX3232 based)
  126: -   USB to TLL serial level shifter / breakout board (FT232 based)
  127: 
  128: Now you can connect with any terminal program to the LinkStation's
  129: serial console. The easiest approach may be to use NetBSD's `tip(1)` command
  130: to make a direct console connection at 57600bps.
  131: 
  132:     # tip -57600 console
  133: 
  134: Note that when using a serial connection via USB you may have to make an
  135: entry for `/dev/ttyU0` in `/etc/remote`.
  136: 
  137: Replace the firmware with U-Boot
  138: ================================
  139: 
  140: The LinkStations run with a proprietary firmware, which doesn't give you
  141: any control about the boot process. So our next step is to replace it
  142: with [U-Boot](http://www.denx.de/wiki/U-Boot/).
  143: 
  144: Getting root access
  145: -------------------
  146: 
  147: We need root access on the vendor's Linux installation to be able to
  148: flash a new firmware. Without the original disk it will become much more
  149: difficult. You would either have to find a way to install the system
  150: onto a new disk with the help of a second machine, or use the JTAG port
  151: to flash the new firmware directly into the chip (in the last case you
  152: can skip all sections until ?).
  153: 
  154: For the KuroBox you can skip this section. The root password is known to
  155: be `kuro`. Also telnet access is enabled. The default IP of the KuroBox
  156: is `192.168.11.150`.
  157: 
  158: Make a new user over the LinkStation's web interface. We can use it to
  159: log in over the serial port.
  160: 
  161: Add a new user on the GUI
  162: Log in into the new account and create a CGI file under `/www` which
  163: makes `/etc/passwd` writeable for all users.
  164: 
  165:     BUFFALO INC. Link Station series HD-HLAN (HIDETADA)
  166: 
  167:     BUFFALO login: 
  168:     Password: 
  169:     Linux (none) 2.4.17_mvl21-sandpoint #990 2004xxxx 13:39:00 JST ppc unknown
  170:     Besucher@BUFFALO:~$ 
  171:     Besucher@BUFFALO:~$ 
  172: 
  173: `exploit.cgi` should look like this:
  174: 
  175:     #!/bin/sh
  176:     chmod 666 /etc/passwd
  177: 
  178: Then enter the URL `http://mylinkstation/cgi-bin3/exploit.cgi` into your
  179: browser. When all went well, `/etc/passwd` is writeable now. Edit it
  180: with `vi` and copy your user password (`/Jg58Gq9427qY` in this example)
  181: over the current root password. Now you can log in with the same
  182: password into the root account.
  183: 
  184:     root:dwqa1LabM8BgA:0:0:root:/root:/bin/bash
  185:     bin:*:1:1:bin:/bin:
  186:     daemon:*:2:2:daemon:/usr/sbin:
  187:     sys:*:3:3:sys:/dev:
  188:     adm:*:4:4:adm:/var/adm:
  189:     sync:*:6:8:sync:/bin:/bin/sync
  190:     shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
  191:     halt:*:8:10:halt:/sbin:/sbin/halt
  192:     operator:*:12:0:operator:/root:
  193:     ftp:*:15:14:ftp:/usr/sbin:/bin/false
  194:     nobody:*:99:99:nobody:/home:/bin/sh
  195:     Besucher:/Jg58Gq9427qY:101:1000::/home:/bin/bash
  196: 
  197: The CGI exploit, which I described above, probably does not work with
  198: all Linkstation firmware releases. It may fail with versions after 1.45.
  199: I was able to do it with 1.47 though. An alternative to this method
  200: would be to connect the hard disk to a second machine, which can mount
  201: the Linux file system, and replace the root password there.
  202: 
  203: Flashing U-Boot
  204: ---------------
  205: 
  206: To transfer the new firmware onto the LinkStation we first have to
  207: configure FTP access (already enabled for KuroBox). Enable the server
  208: and allow write access for registered users to the shared folders (e.g.
  209: `share`).
  210: 
  211: Enable FTP access with the GUI
  212: Get an appropriate U-Boot firmware image from
  213: <http://www.genbako.com/u-boot_loader/>:
  214: 
  215: -   LinkStation HD-HLAN or KuroBox classic
  216: -   LinkStation HD-HGLAN or KuroBox HG
  217: 
  218: Transfer the firmware into the `share` folder on the LinkStation.
  219: 
  220:     $ 
  221:     Connected to 192.168.0.9.
  222:     220 BUFFALO FTP server ready
  223:     Name (192.168.0.9:user): 
  224:     331 Password required for Besucher.
  225:     Password: 
  226:     230 User Besucher logged in.
  227:     Remote system type is UNIX.
  228:     Using binary mode to transfer files.
  229:     ftp> 
  230:     250 CWD command successful.
  231:     ftp> 
  232:     local: u-boot-hd.flash.bin remote: u-boot-hd.flash.bin
  233:     229 Entering Extended Passive Mode (|||1045|)
  234:     150 Opening BINARY mode data connection for u-boot-hd.flash.bin
  235:     100% |***********************************|   170 KiB    6.07 MiB/s    00:00
  236:     ETA
  237:     226 Transfer complete.
  238:     174640 bytes sent in 00:00 (4.86 MiB/s)
  239:     ftp> 
  240: 
  241: The next step is dangerous. Any fault, like a wrong firmware or an
  242: interrupted flashing process, will turn your LinkStation into a brick.
  243: 
  244: The boot loader firmware can be accessed from Linux through `/dev/fl2`.
  245: There is no `dd` so we will use `cat`. Log in as root on the serial
  246: console, go to the shared folder where we uploaded the new firmware and
  247: flash it.
  248: 
  249:     root@BUFFALO:~# 
  250:     root@BUFFALO:/mnt/share# 
  251:     total 176
  252:     -rw-rw-rw-    1 Besucher hdusers    174640 May 13 15:43 u-boot-hd.flash.bin
  253:     root@BUFFALO:/mnt/share# 
  254: 
  255: The Diag and Disk Full LEDs will flash red during this process. This is
  256: normal. After a few seconds the LEDs are off again and the prompt
  257: returns. To make sure the process was successful, you should reread the
  258: firmware from the flash and compare it with the original. Therefore you
  259: have to download the new image, as this Linux installation also got no
  260: `cmp`.
  261: 
  262:     root@BUFFALO:/mnt/share# 
  263: 
  264: Here the downloaded image differs at character 174641. But that is ok,
  265: because the firmware is only 174640 bytes large and we downloaded the
  266: whole flash contents.
  267: 
  268:     $ 
  269:     cmp: EOF on u-boot-hd.flash.bin: char 174641, line 891
  270: 
  271: Reboot your LinkStation and cross fingers. When all went well, the
  272: following lines will appear on your serial console:
  273: 
  274:     U-Boot 1.1.4 LiSt 2.1.0 (Sep 21 2006 - 00:22:56) LinkStation / KuroBox
  275: 
  276:     CPU:   MPC8245 Revision 1.4 at 196.608 MHz: 16 kB I-Cache 16 kB D-Cache
  277:     DRAM:  64 MB
  278:     FLASH:  4 MB
  279:     *** Warning - bad CRC, using default environment
  280: 
  281:             00  0b  1317  0985  0200  ff
  282:             00  0c  1095  0680  0101  ff
  283:             00  0e  1033  0035  0c03  ff
  284:             00  0e  1033  0035  0c03  ff
  285:             00  0e  1033  00e0  0c03  ff
  286:     Net:   COMET#0
  287: 
  288: This precompiled U-Boot defaults to the `netcat` console. So we have to
  289: wait about 20 seconds before an error is printed and the console returns
  290: to serial.
  291: 
  292:     next_cons_choice: Unexpected code: 0x33
  293:     stdin :   serial
  294:     stdout:   serial
  295:     stderr:   serial
  296:     IDE:   Bus 0: OK 
  297:       Device 0: Model: SAMSUNG SP1604N Firm: TM100-30 Ser#: S013J20XC0xxxx
  298:                 Type: Hard Disk
  299:                 Supports 48-bit addressing
  300:                 Capacity: 152627.8 MB = 149.0 GB (312581808 x 512)
  301:     Boot in 08 seconds ('s' to stop)...
  302: 
  303: Here you should press `s` to stop booting and change some environment
  304: variables to make U-Boot default to serial.
  305: 
  306:     => 
  307:     => 
  308:     => 
  309:     => 
  310: 
  311: Enter `reset` to reboot into interactive mode with serial console. At
  312: this point we no longer need the original Linux installation and we are
  313: ready for NetBSD.
  314: 
  315: First installation
  316: ==================
  317: 
  318: The altboot bootloader
  319: ----------------------
  320: 
  321: The `altboot(8)` program functions as a bridge between the U-Boot
  322: firmware and the NetBSD kernel startup environment. NAS firmware often
  323: provides no means to boot a kernel from disk or from the network and
  324: doesn't initialize all hardware correctly. We will also use it to pass a
  325: bootinfo list to the kernel.
  326: 
  327: The `altboot` boot loader has to be loaded and started using U-Boot. For
  328: the first installation we have to load it over the network with TFTP
  329: protocol, using the command `tftpboot`. Later we can put `altboot` into
  330: the flash memory and copy it from there.
  331: 
  332: When not already done, enable TFTP on your working system in
  333: `/etc/inetd.conf` and restart `inetd`. Then copy `altboot.bin` from the
  334: sandpoint distribution into `/tftpboot`. On the LinkStation we have to
  335: tell U-Boot its client address and the `tftpd` server address. Our
  336: working system's server address is `192.168.0.5` in this example, and
  337: the LinkStation is at `192.168.0.102`.
  338: 
  339:     => 
  340:     => 
  341:     => 
  342:     Saving Environment to Flash...
  343:     Un-Protected 1 sectors
  344:     Erasing Flash...
  345:     Flash erase: first = 54 @ 0xfff60000
  346:                  last  = 54 @ 0xfff60000
  347:     Flash erase: Done
  348:     Erased 1 sectors
  349:     Writing to Flash... done
  350:     Protected 1 sectors
  351: 
  352: Load `altboot.bin` into memory. The binary is relocated at 0x1000000, so
  353: type:
  354: 
  355:     => 
  356:     Using COMET#0 device
  357:     TFTP from server 192.168.0.5; our IP address is 192.168.0.102
  358:     Filename 'altboot.bin'.
  359:     Load address: 0x1000000
  360:     Loading: ##############
  361:     done
  362:     Bytes transferred = 70844 (114bc hex)
  363: 
  364: Boot the INSTALL kernel with altboot
  365: ------------------------------------
  366: 
  367: Now you can use `altboot` to launch the `netbsd-INSTALL_KURO` kernel for
  368: installing NetBSD. It is important to take `netbsd-INSTALL_KURO` instead of
  369: `netbsd-INSTALL`, because LinkStation and KuroBox systems have the UARTs
  370: swapped, i.e. they are using the second UART for the serial console. You
  371: may choose to load the installation kernel with TFTP or from NFS. TFTP
  372: was described above and for NFS there is a documentation at [The Network
  373: File
  374: System](http://www.NetBSD.org/docs/guide/en/chap-net-services.html#chap-net-services-nfs).
  375: But in both cases you have to set up a DHCP server, which is explained
  376: in the [DHCP Howto](http://www.NetBSD.org/docs/network/dhcp.html). An
  377: appropriate `dhcpd.conf` entry could look like this:
  378: 
  379:             host linkstation {
  380:                     hardware ethernet 00:07:40:xx:xx:xx;
  381:                     fixed-address 192.168.0.102;
  382:                     next-server 192.168.0.5;
  383:                     option root-path "/export/linkstation/root";
  384:             }
  385: 
  386: The `root-path` option is only needed when using NFS and should match
  387: your exported NFS directory. Uncompress `netbsd-INSTALL_KURO.gz` from
  388: the NetBSD/sandpoint distribution and copy it into the NFS or TFTP
  389: directory. Then start the DHCP, NFS or TFTP server and boot the
  390: installation kernel from the firmware either with
  391: 
  392:     => 
  393: 
  394: or from NFS:
  395: 
  396:     => 
  397: 
  398: Our bootloader configures the hardware, determines the IP address, loads
  399: the kernel via network and launches it:
  400: 
  401:     ## Starting application at 0x01000000 ...
  402: 
  403:     >> NetBSD/sandpoint altboot, revision 1.5 (Fri Feb 18 23:21:15 CET 2011)
  404:     >> KuroBox, cpu 195 MHz, bus 97 MHz, 64MB SDRAM
  405:     channel 0 present
  406:     wd0: <SAMSUNG SP1604N> DMA LBA LBA48 152627 MB
  407:     wd0: no disklabel
  408:     MAC address 00:07:40:xx:xx:xx
  409:     100Mbps-FDX
  410:     loading "netbsd-INSTALL_KURO" 5142988+110988=0x502f98
  411:     entry=0x00090000, ssym=0x00592b58, esym=0x00592f98
  412:     ksyms: Symbol table not found
  413:     ksyms: String table not found
  414:     ksyms: Perhaps the kernel is stripped?
  415:     Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
  416:         2006, 2007, 2008, 2009, 2010, 2011
  417:         The NetBSD Foundation, Inc.  All rights reserved.
  418:     Copyright (c) 1982, 1986, 1989, 1991, 1993
  419:         The Regents of the University of California.  All rights reserved.
  420: 
  421:     NetBSD 5.99.45 (INSTALL_KURO) #0: Thu Feb 10 11:36:46 UTC 2011
  422:         builds@b6.netbsd.org:/home/builds/ab/HEAD/sandpoint/201102100300Z-obj/home/builds/ab/HEAD/src/sys/arch/sandpoint/compile/INSTALL_KURO
  423:     total memory = 65536 KB
  424:     avail memory = 57984 KB
  425:     OpenPIC Version 1.2: Supports 1 CPUs and 26 interrupt sources.
  426:     mainbus0 (root)
  427:     cpu0 at mainbus0: 8245 (Revision 0.4), ID 0 (primary)
  428:     cpu0: HID0 0x90c000<DOZE,DPM,ICE,DCE>, powersave: 1
  429:     eumb0 at mainbus0
  430:     com0 at eumb0 unit 1: ns16550a, working fifo
  431:     com0: console
  432:     ociic0 at eumb0
  433:     iic0 at ociic0: I2C bus
  434:     rs5c372rtc0 at iic0 addr 0x32: RICOH RS5C372[AB] Real-time Clock
  435:     satmgr0 at eumb0 unit 0: button manager (kurobox)
  436:     pci0 at mainbus0 bus 0
  437:     pchb0 at pci0 dev 0 function 0
  438:     pchb0: vendor 0x1057 product 0x0006 (rev. 0x14)
  439:     tlp0 at pci0 dev 11 function 0: ADMtek AN985 Ethernet, pass 1.1
  440:     tlp0: interrupting at irq 16
  441:     tlp0: Ethernet address 00:07:40:xx:xx:xx
  442:     ukphy0 at tlp0 phy 1: OUI 0x00e092, model 0x0001, rev. 1
  443:     ukphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
  444:     cmdide0 at pci0 dev 12 function 0: Silicon Image 0680 (rev. 0x02)
  445:     cmdide0: primary channel wired to native-PCI mode
  446:     cmdide0: using irq 17 for native-PCI interrupt
  447:     atabus0 at cmdide0 channel 0
  448:     cmdide0: secondary channel wired to native-PCI mode
  449:     atabus1 at cmdide0 channel 1
  450:     ohci0 at pci0 dev 14 function 0: vendor 0x1033 product 0x0035 (rev. 0x43)
  451:     ohci0: interrupting at irq 19
  452:     ohci0: OHCI version 1.0
  453:     usb0 at ohci0: USB revision 1.0
  454:     ohci1 at pci0 dev 14 function 1: vendor 0x1033 product 0x0035 (rev. 0x43)
  455:     ohci1: interrupting at irq 19
  456:     ohci1: OHCI version 1.0
  457:     usb1 at ohci1: USB revision 1.0
  458:     ehci0 at pci0 dev 14 function 2: vendor 0x1033 product 0x00e0 (rev. 0x04)
  459:     ehci0: interrupting at irq 19
  460:     ehci0: companion controllers, 3 ports each: ohci0 ohci1
  461:     usb2 at ehci0: USB revision 2.0
  462:     biomask 8000038 netmask 8000038 ttymask 8000038
  463:     uhub0 at usb0: vendor 0x1033 OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
  464:     uhub1 at usb1: vendor 0x1033 OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
  465:     uhub2 at usb2: vendor 0x1033 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
  466:     wd0 at atabus0 drive 0: <SAMSUNG SP1604N>
  467:     wd0: 149 GB, 310101 cyl, 16 head, 63 sec, 512 bytes/sect x 312581808 sectors
  468:     boot device: tlp0
  469:     root on md0a dumps on md0b
  470:     root file system type: ffs
  471:     erase ^H, werase ^W, kill ^U, intr ^C, status ^T
  472:     Terminal type? [vt100]
  473: 
  474: Just follow the usual procedure to install a NetBSD system.
  475: 
  476: Sandpoint installation window
  477: Post installation steps
  478: =======================
  479: 
  480: After a successful installation you want to make the system boot
  481: standalone when switched on, without the need for a serial console. So
  482: you have to modify the `bootcmd` in U-Boot's environment and write the
  483: `altboot.bin` binary to the Flash ROM.
  484: 
  485: On the LinkStation and KuroBox the last 128K or the Flash ROM are known
  486: to be unused, so we can put `altboot` there. Load `altboot.bin` into
  487: memory at `0x1000000` again, as explained above, and execute the
  488: following commands to write it to Flash ROM:
  489: 
  490:     => 
  491:     Un-Protected 9 sectors
  492:     => 
  493: 
  494:     Flash erase: first = 62 @ 0xfffe0000
  495:                  last  = 70 @ 0xffffe000
  496:     Flash erase: Done
  497:     Erased 9 sectors
  498:     => 
  499:     => 
  500:     Using COMET#0 device
  501:     TFTP from server 192.168.0.5; our IP address is 192.168.0.102
  502:     Filename 'altboot.bin'.
  503:     Load address: 0x1000000
  504:     Loading: ##############
  505:     done
  506:     Bytes transferred = 70844 (114bc hex)
  507:     => 
  508:     Copy to Flash... done
  509:     => 
  510:     Total of 131072 bytes were the same
  511:     => 
  512:     Protected 9 sectors
  513:     => 
  514: 
  515: Finally adapt the `bootcmd` environment string to autoboot `altboot` and
  516: start the `netbsd` kernel (which is the default name) from `wd0` on each
  517: reboot:
  518: 
  519:     => 
  520:     => 
  521:     => 
  522: 
  523: The `\` is important for `setenv` not to misinterpret the `;` as the end
  524: of the command.
  525: 
  526: Have fun with your mini NetBSD server!

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb