Rooting the Iomega iConnect

Iomega iConnect

The Iomega iConnect is a Marvell Kirkwood (ARM) Linux-based NAS device which comes with 4 USB ports, GbE and wireless support (802.11g). The iConnect contains the same processor as the SheevaPlug, has 256MB RAM memory and 512MB flash memory.

Getting console access

The iConnect has a pin header near the Kensington hole using which you can connect to the serial console. See console access.

Installing Debian (to an external USB drive)

Make sure you have console access first (in the future, it will likely be possible to install Debian without opening up the device; in any case, you are probably voiding your warranty anyway by installing custom software). Then, simply follow the instructions for OpenRD on Martin Michlmayr’s website. A problem is that the installer does not recognize the iConnect and thus does not know how to change the thing to boot the kernel. You will have to do this yourself; either use mkimage to create uImage/uInitrd from the Debian kernel/initrd in /boot or use a kernel for the SheevaPlug (available here) without initrd (much easier) which are already in uImage format. Put the kernel on /boot, then go to U-boot and tell it to load the uImage (ext2load command) and then use bootm to boot. Note that you have to set the root partition through the bootargs variable.

If you use a Mac to connect to the serial port, chances are that the menu-based installer does not work (so choose the text-based if you get garbled characters). There are some documented issues with the partition manager in the current installer. Another problem is that OS X will crash if you unplug the USB-to-serial device while a program is still using it. So remember to kill screen or your terminal program before unplugging.

Installing Debian to internal Flash

  • Install Debian to USB (see above)
  • Check whether the MTD layout detected by Debian matches the one specified in U-Boot by Iomega (otherwise, change it by setting the mtdparts= parameter at boot time); use cat /proc/mtd, it should say:

    dev:    size   erasesize  name
    mtd0: 000c0000 00020000 "uboot"
    mtd1: 00020000 00020000 "env"
    mtd2: 00300000 00020000 "zImage"
    mtd3: 00300000 00020000 "initrd"
    mtd4: 1f400000 00020000 "boot"
  • Make sure that your kernel supports UBIFS and does not need an initrd to boot (i.e. the SheevaPlug kernels at work fine; I was told that the stock Debian kernels for Kirkwood can be used too; this kernel of course is already in /boot). UBIFS is faster, better and safer than JFFS2, but JFFS2 will also work fine. If you are compiling your own kernel or want to use one from the SheevaPlug archive, check whether it boots before continuing (to make sure that any problems you encounter are not due to a faulty kernel).
  • Back up all your mtd partitions (i.e. with nanddump)
  • Erase mtd2 (flash_eraseall -j /dev/mtd2)
  • Write kernel to mtd2 (nandwrite -pm /dev/mtd2 uImage; watch out for flash errors; if they occur, redo eraseall+nandwrite)
  • Create a UBIFS filesystem on /dev/mtd4:

    ubiformat /dev/mtd4 -s 512
    ubiattach /dev/ubi_ctrl -m 4
    ubimkvol /dev/ubi0 -N rootfs -m
    mkdir /mnt/mtd
    mount -t ubifs ubi0:rootfs /mnt/mtd
  • Mount the root partition without /proc and /sys to copy it to the UBI filesystem:

    mkdir /tmp/root
    mount -o bind / /tmp/root
    cd /tmp/root
    cp -rf ./ /mnt/mtd

    . This copies your root filesystem to the UBIFS. UBI can compress stuff so if your root partition is larger than 512MB, it will work (up to 700MB I think will do).

  • Change /mnt/mtd/etc/fstab to make the root partition mount: add

    /dev/root	/	ubifs	defaults,noatime,rw	0	0

    as first line

  • umount /tmp/root, shutdown -r now
  • Change boot parameters in U-boot so that the kernel is loaded from NAND:

    setenv bootcmd_nand 'nand read.e 0x2000000 0x100000 0x300000'
    setenv bootcmd 'run bootcmd_nand; bootm'
    setenv bootargs 'console=ttyS0,115200 mtdparts=orion_nand:0xc0000@0x0(uboot),0x20000@0xa0000(env),0x300000@0x100000(zImage),0x300000@0x540000(initrd),0x1f400000@0x980000(boot) ubi.mtd=2 root=ubi0:rootfs rootfstype=ubifs'
  • Try to boot this way; if it works, use saveenv to save this as the default

It’s probably easier and faster to just use debootstrap or something else to create the UBIFS partition and then copy it to the NAND (due to slow write speeds of most USB sticks, installation can take an hour or two). Also, the menu-based Debian installer did not work over the USB serial connection, so I had to use the text-based one. There are also some known problems with the partition manager but that’s all documented at Martin Michlmayr‘s site.

Getting root access to the factory-installed Linux installation

  • Connect the iConnect to the network (by cable if you have not set it up yet)
  • Go to http://storage.local./support.html (substitute ‘storage’ with the name you gave the device if you have already set it up – ‘storage’ is the default name)
  • Set an administrator password
  • Enable support access (SSH)
  • Restart the device
  • Log-in to the device (ssh root@storage.local); the password is “soho”+ your admin password (if your password is ‘foo’, the the password you need to use for ssh is ‘sohofoo’).

Note that the default software (which is a flavour of Debian) is not very suitable to install custom applications on, since the filesystems are contained in an image that is mounted through a loopback (and thus have very little free space). Using console access, it is probably possible to install your own OS.

Device information

This is on a brand new iConnect (with factory-installed Linux):

df –si

Filesystem             Size   Used  Avail Use% Mounted on
rootfs                  53M   4.5M    48M   9% /
/dev/root.old          4.9M   2.0M   2.7M  43% /initrd
none                    53M   4.5M    48M   9% /
ubi0:boot              478M   125M   348M  27% /boot
/dev/loop0             279M   279M      0 100% /mnt/apps
/dev/loop1             5.1M   1.5M   3.4M  31% /etc
/dev/loop2              62k    62k      0 100% /oem
tmpfs                  131M      0   131M   0% /mnt/apps/lib/init/rw
tmpfs                  131M      0   131M   0% /dev/shm

cat /proc/cpuinfo (the CPU is clocked at 1GHz, whereas the SheevaPlug is clocked at 1.2GHz)

Processor	: Feroceon 88FR131 rev 1 (v5l)
BogoMIPS	: 992.87
Features	: swp half thumb fastmult edsp 
CPU implementer	: 0x56
CPU architecture: 5TE
CPU variant	: 0x2
CPU part	: 0x131
CPU revision	: 1

Hardware	: Marvell RD-88F6281 Reference Board
Revision	: 0000
Serial		: 0000000000000000


Linux version ( (gcc version 4.3.2 (crosstool-NG-1.3.1) ) #1 PREEMPT Mon Jan 25 13:57:26 EST 2010
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
CPU: VIVT data cache, VIVT instruction cache
Machine: Marvell RD-88F6281 Reference Board
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 65536
free_area_init_node: node 0, pgdat c03f354c, node_mem_map c04b0000
  Normal zone: 512 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 65024 pages, LIFO batch:15
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: console=ttyS0,115200 mtdparts=orion_nand:0xc0000@0x0(uboot),0x20000@0xa0000(env),0x300000@0x100000(zImage),0x300000@0x540000(initrd),0x1f400000@0x980000(boot)
PID hash table entries: 1024 (order: 10, 4096 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256MB = 256MB total
Memory: 253056KB available (3632K code, 901K data, 124K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 992.87 BogoMIPS (lpj=4964352)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
net_namespace: 520 bytes
NET: Registered protocol family 16
Kirkwood: MV88F6281-A0, TCLK=200000000.
Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.
initial MPP regs: 21111111 00003311 33331100 33333333 00000333 00000000 00000000
  final MPP regs: 21111111 00003311 33331100 33333333 00000333 00000000 00000000
pci 0000:00:00.0: reg 10 64bit mmio: [0xf1000000-0xf10fffff]
pci 0000:00:00.0: reg 18 32bit mmio: [0x000000-0xfffffff]
pci 0000:00:00.0: supports D1 D2
pci 0000:00:01.0: reg 10 32bit mmio: [0x40000000-0x4000ffff]
PCI: bus0: Fast back to back transfers disabled
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Using static regulatory domain info
cfg80211: Regulatory domain: US
	(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
	(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
	(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
Switched to high resolution mode on CPU 0
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (no cpio magic); looks like an initrd
Freeing initrd memory: 1736K
msgmni has been set to 498
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
console [ttyS0] enabled
brd: module loaded
loop: module loaded
Driver 'sd' needs updating - please use bus_type methods
MV-643xx 10/100/1000 ethernet driver version 1.4
mv643xx_eth smi: probed
net eth0: port 0 with MAC address 00:d0:b8:0c:a0:ed
NAND device: Manufacturer ID: 0xad, Chip ID: 0xdc (Hynix NAND 512MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 2343 at 0x0000124e0000
Bad eraseblock 2490 at 0x000013740000
Bad eraseblock 3606 at 0x00001c2c0000
5 cmdlinepart partitions found on MTD device orion_nand
Creating 5 MTD partitions on "orion_nand":
0x000000000000-0x0000000c0000 : "uboot"
0x0000000a0000-0x0000000c0000 : "env"
0x000000100000-0x000000400000 : "zImage"
0x000000540000-0x000000840000 : "initrd"
0x000000980000-0x00001fd80000 : "boot"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
orion-ehci orion-ehci.0: Marvell Orion EHCI
orion-ehci orion-ehci.0: new USB bus registered, assigned bus number 1
orion-ehci orion-ehci.0: irq 19, io mem 0xf1050000
orion-ehci orion-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
uhci_hcd: USB Universal Host Controller Interface driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver ums-usbat
mice: PS/2 mouse device common for all mice
input: gpio-keys as /class/input/input0
rtc-mv rtc-mv: rtc core: registered rtc-mv as rtc0
i2c /dev entries driver
lm63 0-004c: Alert/tach pin configured for alert output
lm63 0-004c: PWM clock 360 kHz, output frequency 7826 Hz
lm63 0-004c: PWM output active high, manual mode
Registered led device: led_level
Registered led device: power_blue_led
Registered led device: power_red_led
Registered led device: usb_1_led
Registered led device: usb_2_led
Registered led device: usb_3_led
Registered led device: usb_4_led
Registered led device: otb_led
mv_xor_shared mv_xor_shared.0: Marvell shared XOR driver
mv_xor_shared mv_xor_shared.1: Marvell shared XOR driver
mv_xor mv_xor.0: Marvell XOR: ( xor cpy )
mv_xor mv_xor.1: Marvell XOR: ( xor fill cpy )
mv_xor mv_xor.2: Marvell XOR: ( xor cpy )
mv_xor mv_xor.3: Marvell XOR: ( xor fill cpy )
oprofile: using timer interrupt.
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
rtc-mv rtc-mv: setting system clock to 2010-04-02 10:18:35 UTC (1270203515)
RAMDISK: gzip image found at block 0
VFS: Mounted root (ext2 filesystem) on device 1:0.
usb 1-1: new high speed USB device using orion-ehci and address 2
usb 1-1: configuration #1 chosen from 1 choice
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "boot"
UBI: MTD device size:            500 MiB
UBI: number of good PEBs:        3997
UBI: number of bad PEBs:         3
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 3997
UBI: number of PEBs reserved for bad PEB handling: 39
UBI: max/mean erase counter: 2/1
UBI: background thread "ubi_bgt0d" started, PID 486
UBIFS: mounted UBI device 0, volume 0, name "boot"
UBIFS: file system size:   508225536 bytes (496314 KiB, 484 MiB, 3939 LEBs)
UBIFS: journal size:       25417728 bytes (24822 KiB, 24 MiB, 197 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  4952683 bytes (4836 KiB)
ufsd: module license 'Commercial product' taints kernel.
Disabling lock debugging due to kernel taint
ufsd: driver 8.1 (013_A) LBD=OFF with ioctl loaded at bf000000
NTFS read/write support included
Hfs+/HfsX read/write support included

=== pAd = d1512000, size = 478904 ===

<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xd1500000, csr_addr=0xd1500000!
ra0 (): not using net_device_ops yet
usbcore: registered new interface driver hiddev
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
usbcore: registered new interface driver usblp
Freeing init memory: 124K
RX DESC ffc18000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
PhyMode=9, DesiredPhyMode=9
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
NVM is Efuse and its size =2d[2d0-2fc] 
RTMPSetPhyMode: channel is out of range, use first channel=1 
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
 AUX_CTRL = 0x                             c02
====> rt30xx Read PowerLevelMode =  0x1.
====> rt30xx F Write 0x83 Command = 0x1.
eth0: link up, 1000 Mb/s, full duplex, flow control disabled