Freecom SilverStore 2-Drive NAS Hardware Documentation

NAS Freecom SilverStore NAS is based on the Marvell Feroceon of SoC 88F6282 the rev the A1 running at 1000Mhz frequency, the name on the motherboard HNC-N2 LE.

Freecom_SilverStore.jpg

  • CPU: Marvell 88F6282 (ARMADA 300) @1.6GHz
  • Stock bootloader is locked to boot only Stock OS by checking signature.
  • MB has place for soldering second RAM IC

The board includes:

  • one chip RAM 128 MB Download now (the Samsung K4B1G1646G , there is a place in the second pinout)
  • NAND flash 128MB (the Samsung K9F1G08U0D )
  • USB 3.0 controller D720200F1
  • Ethernet controller the Marvell 88E1318
  • Fan Controller ADT7473
SilverStore_Motherboard_Small.jpg

Freecom Silverstore 2-NAS hardware and firmware hacking

Default root access (manufacturer's default root password)

User Id : root
Password: 3Y58grfv

Serial Port

SilverStore_uart_pinout_Small.jpg

Boot

U-Boot Bootloader boot log

                        _ _
        |  /  | __ _ _ ____   ___| | |
        | |/| |/ _` | '  / / _  | |
        | |  | | (_| | |    V /  / | |
        |_|  |_|__,_|_|    _/ _|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _  / _  / _ | __| 
| |_| |_| |_) | (_) | (_) | |_ 
 _/    |____/ _/ _/ __|

** uboot_ver:v0.0.9 **

** MARVELL BOARD: HNC-N2 LE

U-Boot 1.1.4 (Nov 9 2011 - 17:49:26) Marvell version: 3.5.9 U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006CFB00

Soc: 88F6282 A1CPU running @ 1000Mhz L2 running @ 333Mhz SysClock = 400Mhz , TClock = 200Mhz

DRAM (DDR3) CAS Latency = 6 tRP = 6 tRAS = 15 tRCD=6 DRAM CS[0] base 0x00000000 size 128MB DRAM Total size 128MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done NAND:128 MB Found ADT7473, program PWM1 … OK Flash: 0 kB

Marvell Serial ATA Adapter Integrated Sata device found

CPU : Marvell Feroceon (Rev 1) Scanning partition header:

Streaming disabled Write allocate disabled

USB 0: host mode PEX 0: PCI Express Root Complex Interface PEX interface detected Link X1 PEX 1: interface detected no Link. Net: egiga0 [PRIME] Hit any key to stop autoboot: 0

Saving Environment to NAND… Erasing redundant Nand… 0x000c0000 0x000c0000 Writing to redundant Nand… Erasing Nand...Writing to Nand… done

Bootloader Environment

Marvell>> printenv
baudrate=115200
loads_echo=0
ipaddr=10.4.52.165
serverip=10.4.52.7
rootpath=/srv/ubuntu
netmask=255.255.255.0
run_diag=yes
MALLOC_len=1
ethprime=egiga0
bootargs_root=root=/dev/ram0 rootfstype=cramfs init=/etc/rc.preroot initrd=0x800000,0x1000000
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
standalone=fsload 0x2000000 $(image_name);setenv bootargs $(console) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x2000000;
lcd0_enable=0
lcd0_params=640x480-16@60
ethaddr=00:50:43:12:29:32
ethmtu=1500
mvNetConfig=mv_net_config=(00:11:88:0f:62:81,0:1:2:3),mtu=1500
usb0Mode=host
nandEcc=1bit
netretry=no
rcvrip=169.254.100.100
loadaddr=0x02000000
autoload=no
image_multi=yes
uboot_ver=v0.0.9
mfgtest_state=final_tested_ok
mfgmodel=HNC-N2
ethact=egiga0
stdin=serial
stdout=serial
stderr=serial
mainlineLinux=no
enaMonExt=no
enaCpuStream=no
enaWrAllo=no
pexMode=RC
disL2Cache=no
setL2CacheWT=yes
disL2Prefetch=yes
enaICPref=yes
enaDCPref=yes
sata_dma_mode=yes
netbsd_en=no
vxworks_en=no
console=console=ttyS0,115200 mtdparts=nand_mtd:0x000a0000@0x0(uboot),0x00040000@0x000a0000(param),0x00280000@0x000e0000(preroot),
0x00380000@0x00360000(uimage),0x076e0000@0x006e0000(rootfs),0x00240000@0x07dc0000(misc),128m@0x0(flash)
bootcmd_f=nand reset; nand read.e 0x800000 0x00100000 0x00199800; check_crc32 PrEr;
bootcmd=nand reset; nand read.e 0x800000 0x00100000 0x00199800; check_crc32 PrEr; nand reset; 
nand read.e 0x40000 0x00380000 0x0027d400; check_crc32 KrNl; setenv bootargs $(console) $(bootargs_root);
bootm 0x40000; bootdelay=3
disaMvPnp=no
enaAutoRecovery=yes
pcieTune=no
pcieTune1=no
bootcmd=""

Environment size: 1411/131067 bytes

Sections in the NAND-flash:

  • uboot 0x0-0xA0000
  • param 0xA0000-0xE0000
  • preroot 0xE0000-0x360000
  • rootfs 0x6E0000-0x7DC0000
  • misc 0x7DC0000-0x8000000
The environment variable bootcmd bootloader each time you start the device is initialized to the factory state (special thanks to the manufacturer), which greatly complicates the launch of a custom operating system on the device. It contains the following commands:

nand reset; nand read.e 0x800000 0x00100000 0x00199800; check_crc32 PrEr; nand reset; 
nand read.e 0x40000 0x00380000 0x00380800; check_crc32 KrNl; 
setenv bootargs $ (console) $ ( bootargs_root); bootm 0x40000;

As I gpt intp the device section preroot, its image is not separate and proprietary utility refuses to restore it, he decided, just in case sdampit NAS loader, it may be useful to someone to revive a bricked device.

Dump Loader can be downloaded here.

To start the device must be killed to connect to its serial console via USB-UART cable and use the utility kwboot, you can download it here. Next, run the utility command:

sudo ./kwboot -p -t /dev/ttyUSB0 -b ./SilverStore_u_boot_dump.bin
And then push the device power button.

References

Other Marvell Kirkwood based devices

Generic Documentation