Serial access to uBoot on the NS-K330

Almost a month ago I obtained an NS-K330 “NAS”  — a tiny embedded computer with one 10/100Mbps LAN port and two USB 2.0 ports, intended for home use as a ultra-cheap Network Attached Storage unit. This post describes my experiments with connecting to the device’s serial port and uBoot boot loader

The basic details

The NS-K330 is based on a 250MHz Cavium Networks “CNS2132” ARM processor with 32MB RAM. More basic details can be found in my earlier post.

The NS-K330 utilises an old version of uBoot as its boot loader. Normally this is completely hidden to the end user, but you can get access to uBoot via the on-board serial port. uBoot access is essential if you want to do low-level re-flashing of the unit (which I do).

Adding serial port access

The NS-K330’s serial interface expects “TTL level” voltages (3.3-5V) rather than traditional RS232 voltages (which can be as high as +/-12V). I used a cheap USB-Serial interface to plug my NSK-330 into my home FreeBSD desktop (this cable from DealExtreme). My first jury-rigged interface involved plugging the wires themselves into the appropriate holes on the NS-K330’s PCB. (Edit: I later upgraded to a 3-pin header on the PCB and a 3-pin plug on the serial cable, inserted through a hole cut into the plastic case.)

The NS-K330’s uBoot defaults to 38400 baud, 8 data bits, no parity and one stop bit. Since the USB-Serial cable comes up as /dev/cuaU0 on my FreeBSD box, the following line provides access the NS-K330’s serial port.

cu -l /dev/cuaU0 -s 38400

Powerup the NS-K330 and boot to SnakeOS Linux

The serial interface ‘just worked’. First, I watched the console while the NS-K330 did a complete boot into SnakeOS (Linux).

[gja@gjadesktop] /home/gja# cu -l /dev/cuaU0 -s 38400
Connected

U-Boot 1.1.4 (Mar  3 2008 - 16:51:36)

U-Boot code: 00000000 -> 0001A410  BSS: -> 0001F354
IRQ Stack: 00e6ff7c
FIQ Stack: 00e6ef7c
RAM Configuration:
Bank #0: 00000000 32 MB
Flash Manufacturer: Unknown(0x1c)
Flash:  0 kB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
PLL clock at 250MHz
CPU clock at 250MHz
AHB clock at 125MHz
APB clock at 62MHz
Hit any key to stop autoboot:  3
kernel:30060000-301e0000
 0
## Starting application at 0x00600000 ...
Uncompressing Linux.................................................................. done, booting the kernel.
Linux version 2.6.16-gazineu (root@snaker01) (gcc version 3.4.6) #13 Mon Jun 21 21:43:59 BRT 2010
CPU: FA526id(wb) [66015261] revision 1 (ARMv4)
Machine: STAR STR8100
Warning: bad configuration page, trying to continue
Ignoring unrecognised tag 0x00000000
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 8192 bytes, associativity 2, 16 byte lines, 256 sets
CPU0: D cache: 8192 bytes, associativity 2, 16 byte lines, 256 sets
PLL clock at 250MHz
CPU clock at 250MHz
AHB clock at 125MHz
APB clock at 62MHz
Built 1 zonelists
Kernel command line: mtdparts=m25p80:256k(boot)ro,128k(config),960k(kernel)ro,2688k(initrd)ro,4032k@0x0000(web),4032k@0x0000(flash) root=31:03 ro rootfstype=jffs2
PID hash table entries: 256 (order: 8, 4096 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 32MB = 32MB total
Memory: 30348KB available (1808K code, 160K data, 76K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
PCI clock at 33M
PCI: bus0: Fast back to back transfers disabled
PCI Bridge not found
PCI map irq: 00:00.00 slot 0, pin 1, irq: 0
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
str8100_led_init: Registered NAS 652 led device driver.
NetWinder Floating Point Emulator V0.97 (extended precision)
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
fuse init (API version 7.8)
fuse distribution version: 2.7.4
io scheduler noop registered
io scheduler cfq registered (default)
str8100_rtc.o: rtc module version 1.0.0
str8100_wdt.o: watchdog module version 1.0.1
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x78000000 (irq = 9) is a 16550A
serial8250: ttyS1 at MMIO 0x78800000 (irq = 10) is a 16550A
loop: loaded (max 8 devices)
Star NIC Driver(for Linux Kernel 2.6) - Star Semiconductor
    rxring.vir_addr=0xFFC00000 rxring.phy_addr=0x00390000
    txring.vir_addr=0xFFC01000 txring.phy_addr=0x00391000
Star Internal PHY
MAC Addr: 08:0a:0b:0c:0d:0e

star_nic_init_module: internal phy patch included.
star_nic_init_module: scatter/gather enabled.

STR8100 SPI: init
m25p80 spi1.0: m25p64 (8192 Kbytes)
Creating 6 MTD partitions on "m25p80":
0x00000000-0x00040000 : "BOOT"
0x00040000-0x00060000 : "CFG"
0x00060000-0x00150000 : "KERNEL"
0x00150000-0x003f0000 : "INITRD"
0x00000000-0x003f0000 : "WEB"
0x00000000-0x003f0000 : "ALL"
str8100-ehci str8100-ehci: str8100-ehci
str8100-ehci str8100-ehci: new USB bus registered, assigned bus number 1
str8100-ehci str8100-ehci: irq 24, io mem 0xcc000000
str8100-ehci str8100-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2005 April 22 USB 1.1 'Open' Host Controller (OHCI) Driver (STR8100)
str8100-ohci str8100-ohci: str8100-ohci
str8100-ohci str8100-ohci: new USB bus registered, assigned bus number 2
str8100-ohci str8100-ohci: irq 23, io mem 0xc4000000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Empty flash at 0x00296914 ends at 0x0029fff0
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing init memory: 76K
init started: BusyBox v1.14.2 (2010-06-21 19:41:28 BRT)
starting pid 236, tty '': '/usr/share/snake/rc.sysinit'
Reset config: NO
Starting Network
MAC Addr: ac:de:48:4e:fd:b1
eth0:star_nic_lan_open
star_nic_enable: starting patch check.
udhcpc (v1.14.2) started
IP Address changed, reloading networked services...
Sending discover...
Sending select for 10.1.1.51...
Lease of 10.1.1.51 obtained, lease time 1800
IP Address changed, reloading networked services...
Starting Syslog service...
Starting CRON service...
Starting SFTP/SSHD service...
[526] Jan 25 19:13:42 Running in background

Please press Enter to activate this console. Starting HTTPD service...

starting pid 531, tty '/dev/ttyS0': '/bin/sh'

BusyBox v1.14.2 (2010-06-21 19:41:28 BRT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# �pool.ntp.org: Unknown host

# help

Built-in commands:
------------------
        . : [ [[ alias bg break cd chdir continue echo eval exec exit
        export false fg hash help jobs kill let local printf pwd read
        readonly return set shift source test times trap true type ulimit
        umask unalias unset wait

#
# ifconfig
eth0      Link encap:Ethernet  HWaddr AC:DE:48:4E:FD:B1
          inet addr:10.1.1.51  Bcast:10.1.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:192 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:61899 (60.4 KiB)  TX bytes:1654 (1.6 KiB)
          Base address:0x2000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

#

	[...pressed "reset" button...]

Rebooting...(retval=0(0x0)
starting pid 552, tty '': '/usr/share/snake/rc.reboot'
Shutting down Swap service...
swapoff: can't stat '/usb/sdb1/swapfile': No such file or directory
Shutting down Transmission service...
killall: transmission-daemon: no process killed
Restarting system.
.

U-Boot 1.1.4 (Mar  3 2008 - 16:51:36)

U-Boot code: 00000000 -> 0001A410  BSS: -> 0001F354

	[...and so forth, as before...]

Reboot and break into uBoot

As before, but this time hit <space> just after uBoot starts (at the “Hit any key to stop autoboot:” prompt). This breaks the boot sequence, and drops you to the uBoot console.

[gja@gjadesktop] /home/gja# cu -l /dev/cuaU0 -s 38400
Connected
U-Boot 1.1.4 (Mar  3 2008 - 16:51:36)

U-Boot code: 00000000 -> 0001A410  BSS: -> 0001F354
IRQ Stack: 00e6ff7c
FIQ Stack: 00e6ef7c
RAM Configuration:
Bank #0: 00000000 32 MB
Flash Manufacturer: Unknown(0x1c)
Flash:  0 kB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
PLL clock at 250MHz
CPU clock at 250MHz
AHB clock at 125MHz
APB clock at 62MHz
Hit any key to stop autoboot:  3
kernel:30060000-301e0000
 0
Star Equuleus #
Star Equuleus #
Star Equuleus #
Star Equuleus # ?
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
Star Equuleus #
Star Equuleus # printenv
bootcmd=go 0x600000
bootdelay=3
baudrate=38400
ethaddr=00:aa:bb:cc:dd:10
ipaddr=192.168.0.1
serverip=192.168.0.100
netmask=255.255.255.0
cpu_clock=250
stdin=serial
stdout=serial
stderr=serial

Environment size: 192/65532 bytes
Star Equuleus #
Star Equuleus # bdinfo
arch_number = 0x0000032A
env_t       = 0x00000000
boot_params = 0x00000100
DRAM bank   = 0x00000000
-> start    = 0x00000000
-> size     = 0x02000000
ethaddr     = 00:AA:BB:CC:DD:10
ip_addr     = 192.168.0.1
baudrate    = 38400 bps
Star Equuleus #
Star Equuleus # tftpboot
Check Link Status .Up
Waiting 3 seconds ..
*** Warning: no boot file name; using 'C0A80001.img'
TFTP from server 192.168.0.100; our IP address is 192.168.0.1
Filename 'C0A80001.img'.
Load address: 0x800000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
	[...etc... ^C triggers an "abort"...]
Abort
Star Equuleus #
Star Equuleus # go 0x00600000
## Starting application at 0x00600000 ...
Uncompressing Linux.................................................................. done, booting the kernel.
	[...etc... we've now booted SnakeOS...]

Conclusion

Yup, the serial interface works, I can access and control uBoot for flashing new firmware…. onwards to more experimentation!

Advertisements

One comment

  1. Interesting article!
    I’m going to buy a NS-K330 and I’m interested in OpenWrt.
    Is “cu -l /dev/cuaU0 -s 38400” valid also on Linux?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: