Home Media Stock Configuration

From NAS-Central Iomega Wiki
Jump to: navigation, search

Information

This page documents the default configuration of the IOMega Home Media Network Hard Drive. It is based on information obtained from an analysis of the 500 GB version.

Bootloader

The device seems to include evidence that uboot is used in this device. There is a version of uboot in /boot/ on my device:

 root@Iomega-09681e:/boot# ls -la /boot/
 total 112
 drwxrwxrwx  2 root root   4096 Dec 31  1969 .
 drwxrwxrwx 27 root root   4096 Dec 27 14:18 ..
 -rw-r--r--  1 root root 101336 Dec 31  1969 u-boot.pkg

If I run strings on this I can see how it boots the device. The bootargs match that of the running kernel. It appears to load the kernel from the hard disk at a specific location:

 bootargs=elevator=cfq panic=20 root=/dev/sda1 console=ttyS0,115200 init=/linuxrc
 bootcmd=run select0 load boot || run select0 load2 boot || run lightled select1 load extinguishled boot || run lightled select1 load2 extinguishled boot || lightled
 bootdelay=2
 baudrate=115200
 ethaddr=00:30:e0:00:00:01
 ipaddr=172.31.0.128
 serverip=172.31.0.100
 autoload=n
 netmask=255.255.0.0
 bootfile="uImage"
 select0=ide dev 0
 select1=ide dev 1
 load=ide read 0x48500000 12c 1644
 load2=ide read 0x48500000 2a6e 1644
 lightled=ledfail 1
 extinguishled=ledfail 0
 boot=bootm 48500000

Also the version of uboot in this file is 1.1.2.

Operating System

Appears to be based on Debian Lenny:

 root@Iomega-09681e:~# cat /etc/debian_version 
 5.0.3

Swap is not provided by a swap partition but by a 512 MB file at /usr/local/swap

 root@Iomega-09681e:~# cat /proc/swaps 
 Filename				Type		Size	Used	Priority
 /usr/local/swap                        file		524280  0	-1

Partitioning & File Systems

Partitions

There are two Linux RAID partitions on the disk:

 Disk /dev/sda: 500.1 GB, 500107862016 bytes
 255 heads, 63 sectors/track, 60801 cylinders
 Units = cylinders of 16065 * 512 = 8225280 bytes
 Disk identifier: 0xbdb850e8
  
    Device Boot      Start         End      Blocks   Id  System
 /dev/sda1               4         515     4112640   fd  Linux RAID autodetect
 /dev/sda2             516       60801   484247295   fd  Linux RAID autodetect
 /dev/sda3               1           3       24097   da  Non-FS data

File Systems

The first smaller one is formatted as ext3 and the second large partition is xfs:

 root@Iomega-09681e:~# blkid 
 /dev/sda1: UUID="86635f6a-3e10-4cdd-ad2b-f95c9f48a2db" TYPE="ext3" 
 /dev/sda2: UUID="4f83b964-121b-4925-a1f8-b1876f64f300" TYPE="xfs"

First Partition Analysis

sda3 in the list of partitions above is actually at the beginning of the disk. Actually, it begins at sector 1, directly after the mbr. I think the startcode in the SoC is just smart enough to execute everything starting at sector 1. The partition contains raw data.

U-Boot

Comparing the u-boot in /boot/ with the start of sda3:

 root@Iomega-09681e:~# cmp /dev/sda3 /boot/u-boot.pkg  
 cmp: EOF on /boot/u-boot.pkg

It matches! So the first 101336 of this partition is u-boot.

Environment

A snippet of code from /etc/init.d/gmac proves that there is also environment space here, stored at two places:

for blk in 239 10846 ; do
        eval `dd if=/dev/sda skip=${blk} count=16 2> /dev/null | readenv | grep ethaddr`
        if [ -n "${ethaddr}" -a "${ethaddr}" != "${mfgMAC}" ] ; then
                break
        fi
done

Note that the offset is given relative to the start of the disk, not the partition.
Running 'dd if=/dev/sda skip=239 count=16 2> /dev/null | readenv' gives:

ethaddr=00:D0:B8:09:68:1E
bootcmd=run select0 load boot || run select0 load2 boot || run lightled select1 load extinguishled boot || run    lightled select1 load2 extinguishled boot || lightled
bootdelay=2
baudrate=115200
autoload=n
bootfile="uImage"
select0=ide dev 0
select1=ide dev 1
load=ide read 0x48500000 12c 1644
load2=ide read 0x48500000 2a6e 1644
lightled=ledfail 1
extinguishled=ledfail 0
boot=bootm 48500000
stdin=serial
stdout=serial
stderr=serial
bootargs=elevator=cfq panic=20 root=/dev/sda1 console=ttyS0,115200 init=/linuxrc

Using offset 10846 gives the same result.

Kernel

A snippet of the script pre_code from the 2.040 firmware update:

console "write kernel"
dd if=uImage of=/dev/sda                bs=512 seek=300
dd if=uImage of=/dev/sda                bs=512 seek=10862

This code is executed when the current firmware is 1.028 or 1.029. And indeed there are two kernels on the partition. By the way, the uImage provided with the 2.040 update is 1495088 bytes. The offsets 12c and 2a6e after the 'load' and 'load2' environment variables equal the 300 and 10862 offsets.

Everything twice

Seeing all this you'd expect a second copy of u-boot somewhere around 10500. And indeed I found it at 10608.

Map

So we have

sector     1-198    u-boot 1
sector   239-255    environment 1
sector   300-3221   kernel 1
sector 10608-10805  u-boot 2
sector 10846-10862  environment 2
sector 10862-13782  kernel 2
sector 48194        end of sda3

Maybe there is some data between kernel 1 and u-boot 2? Let's have a look:

root@Iomega-09681e:~# dd if=/dev/sda skip=3222 | cmp /dev/zero
/dev/zero - differ: char 3781633, line 1

Nope.
After kernel 2?

root@Iomega-09681e:~# dd if=/dev/sda skip=13783 | cmp /dev/zero
/dev/zero - differ: char 17619970, line 1

Neither.

LED Control

There is a utility for LED & other controls called mcucmd

 mcucmd ver 1.6 C6 platform
 usage: mcucmd <command> [level]
   Note: LED commands will obtain brightness value from auth file
   commands:
     led_ok
     led_nok
     led_err
     led_brightness
     led_step
     led_flipflop
     led_reset
     gauge_ok
     gauge_medium
     gauge_warning
     gauge_critical
     gauge_blink
     hdd_off
     poweroff
     restartrequest
     version

Linux Kernel

Version 2.063 firmware ships with Linux 2.6.24.4

Here is the stock dmesg:

   Linux version 2.6.24.4 (gp@mactel1.local) (gcc version 4.3.2 (crosstool-NG-1.3.1) ) #1 Mon Jun 1 11:21:53 MDT 2009
   CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
   Machine: Oxsemi NAS
   Ignoring unrecognised tag 0x00000000
   Memory policy: ECC disabled, Data cache writeback
   On node 0 totalpages: 16384
     DMA zone: 128 pages used for memmap
     DMA zone: 0 pages reserved
     DMA zone: 16256 pages, LIFO batch:3
     Normal zone: 0 pages used for memmap
     Movable zone: 0 pages used for memmap
   CPU0: D VIVT write-back cache
   CPU0: I cache: 32768 bytes, associativity 4, 32 byte lines, 256 sets
   CPU0: D cache: 32768 bytes, associativity 4, 32 byte lines, 256 sets
   Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
   Kernel command line: elevator=cfq panic=20 root=/dev/sda1 console=ttyS0,115200 init=/linuxrc mem=64M poweroutage=yes
   PID hash table entries: 256 (order: 8, 1024 bytes)
   Console: colour dummy device 80x30
   Using fractional divider baud 115200, clock 183333333 dlf 80
   console [ttyS0] enabled
   Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
   Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
   Memory: 64MB = 64MB total
   Memory: 61860KB available (2712K code, 156K data, 104K init)
   Calibrating delay loop... 183.09 BogoMIPS (lpj=915456)
   Security Framework initialized
   Mount-cache hash table entries: 512
   CPU: Testing write buffer coherency: ok
   net_namespace: 64 bytes
   NET: Registered protocol family 16
   Number of DMA channels = 5, version = 4
   Allocating 891 SRAM generic DMA descriptors
   Chip Id: die-id 0x07a039ebec80 read back 0xbeefcafe
   PCI: bus0: Fast back to back transfers enabled
   SCSI subsystem initialized
   libata version 3.00 loaded.
   NET: Registered protocol family 2
   IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
   TCP established hash table entries: 2048 (order: 2, 16384 bytes)
   TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
   TCP: Hash tables configured (established 2048 bind 2048)
   TCP reno registered
   Power button driver registered
   Recovery button driver registered
   SGI XFS with no debug enabled
   io scheduler noop registered
   io scheduler anticipatory registered
   io scheduler deadline registered
   io scheduler cfq registered (default)
   Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
   serial8250: ttyS0 at MMIO 0x44300000 (irq = 24) is a 16550A
   RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize
   loop: module loaded
   Driver 'sd' needs updating - please use bus_type methods
   ox810sata: OX810 sata core.
   scsi0 : oxnassata
   ata1: SATA max UDMA/133 irq 18
   ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
   ata1.00: ATA-8: ST3500418AS, CC44, max UDMA/133
   ata1.00: 976773168 sectors, multi 0: LBA48 NCQ (depth 0/32)
   ata1.00: configured for UDMA/133
   scsi 0:0:0:0: Direct-Access     ATA      ST3500418AS      CC44 PQ: 0 ANSI: 5
   sd 0:0:0:0: [sda] 976773168 512-byte hardware sectors (500108 MB)
   sd 0:0:0:0: [sda] Write Protect is off
   sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
   sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
   sd 0:0:0:0: [sda] 976773168 512-byte hardware sectors (500108 MB)
   sd 0:0:0:0: [sda] Write Protect is off
   sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
   sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
    sda: sda1 sda2 sda3
   sd 0:0:0:0: [sda] Attached SCSI disk
   ox810sata: OX810 sata core.
   scsi1 : oxnassata
   ata2: SATA max UDMA/133 irq 18
   ata2: SATA link down (SStatus 0 SControl 300)
   mice: PS/2 mouse device common for all mice
   Registered led device: oxnas-leds:bright
   Registered led device: oxnas-leds:state
   Registered led device: oxnas-leds:gauge
   TCP cubic registered
   NET: Registered protocol family 1
   NET: Registered protocol family 17
   kjournald starting.  Commit interval 5 seconds
   EXT3 FS on sda1, internal journal
   EXT3-fs: mounted filesystem with ordered data mode.
   VFS: Mounted root (ext3 filesystem).
   Freeing init memory: 104K
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Using fractional divider baud 115200, clock 183333333 dlf 80
   Probing for Synopsis GMAC, unit 0
   eth0: PHY is ICPlus 1001
   eth0: GMAC ver = 51, vendor ver = 17 at 0xe8000000, IRQ 8
   eth0: Found PHY at address 1, type 0x02430d90 -> 10/100/1000
   eth0: Ethernet addr: 00:d0:b8:09:68:1e
   thermAndFan: initializing - ox810
   usbcore: registered new interface driver usbfs
   usbcore: registered new interface driver hub
   usbcore: registered new device driver usb
   10 Dec 2004 USB 2.0 'Enhanced' Host Controller (EHCI) Driver@e7000000 Device ID register 42fa05
   oxnas-ehci oxnas-ehci.0: OXNAS EHCI Host Controller
   oxnas-ehci oxnas-ehci.0: new USB bus registered, assigned bus number 1
   oxnas-ehci oxnas-ehci.0: irq 7, io mem 0x00000000
   oxnas-ehci oxnas-ehci.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
   usb usb1: configuration #1 chosen from 1 choice
   hub 1-0:1.0: USB hub found
   hub 1-0:1.0: 3 ports detected
   usbcore: registered new interface driver libusual
   Initializing USB Mass Storage driver...
   usbcore: registered new interface driver usb-storage
   USB Mass Storage support registered.
   usbcore: registered new interface driver usblp
   Adding 524280k swap on /usr/local/swap.  Priority:-1 extents:139 across:601340k
   eth0: PHY is ICPlus 1001
   CoPro: Programming start address as 0x9801e000 (basic adr = 0x9801e000)
   Resetting GMAC
   GMAC reset complete
   eth0: PHY is ICPlus 1001
   eth0: link down
   eth0: link up, 1000Mbps, full-duplex, using pause, lpa 0xCDE1