Synology Diskstation Installation

Open the case and search for a 6-pin header, which is labeled COM1 or JP2. The left photo shows a DS-101g+ and the right photo a DS-106j. Note that the serial header is rotated by 180 degrees between these two models:

Serial header pin assignments:

Watch out for the thick, white angle, which marks pin 1.

The serial port on Synology NAS boxes is using 3.3V TTL levels, which have to be converted into regular RS232 levels by a level shifter circuit. If you are not anxious using a soldering iron you find detailed instructions how to build such a converter here:

This picture shows the installed serial adapter. When the installation is completed, and the Diskstation is available over the network, you can remove the serial adapter again. You will only need it in emergency situations.

Another option is to buy such a converter. There are solutions for a standard RS232 interface and for an USB interface. Look out for:

Provided the serial converter is installed and working correctly you should be able to connect to the firmware's serial console. Synology is using PPCBoot. Most models have version 2.0.0 installed, but the newer ones have network support and limited functionality (read below).

Now you can connect with any terminal program to the Diskstation's serial console. The easiest approach may be to use NetBSD's tip(1) command to make a direct console connection at 115200bps.

# tip -115200 console

Note that when using a serial connection via USB you may have to make an entry for /dev/ttyU0 in /etc/remote. Immediately after switching your Diskstation on it will beep shortly, and you should see the following messages. Type CTRL-C within one second to avoid autobooting. In old firmwares (2005) you have three seconds and may press any key.

PPCBoot 2.0.0 (Jan 30 2007 - 14:27:41)

CPU:   MPC8245 Revision 1.4 at 199.999 MHz: 16 kB I-Cache 16 kB D-Cache
I2C:   ready
DRAM:  DRAM BANK = 1
MAX_DRAM_SIZE = 2000000
MCCR1 = 75a80000
MCCR4 = 35363331
MSAR1 = 0
EMSAR1 = 0
MEAR1 = 1f
EMEAR1 = 0
MSAR2 = 0
EMSAR2 = 0
MEAR2 = 0
EMEAR2 = 0
MBER = 32000001
PICR1 = 141b98
PICR2 = 40604
32 MB
addr_sp=1f2ff78, id=1f2ff98, addr=1fc0000
FLASH: flash id = 49
vendor = 1, flash id = 49 (flash_id:49)
 2 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   SK98#0
Press Ctrl+C to abort autoboot in 1 second

The altboot(8) utility functions as a bridge between the Synology firmware and the NetBSD kernel startup environment. NAS firmware often provides no means to boot a kernel from disk or from the network and doesn't initialize all hardware correctly. We will also use it to pass a bootinfo list to the kernel.

The altboot boot loader has to be loaded into RAM at 0x1000000 and started using PPCBoot / U-Boot. Usually there are three ways to invoke it:

The last option is prefered once the installation is completed, but obviously it is not possible for the first time boot. Newer firmwares (2007) support the use of the network interface by setting the ipaddr and serverip environment variables with setenv. Once you have set up TFTP and DHCP (read below) you can download altboot like this:

_MPC824X > setenv ipaddr 192.168.0.106
_MPC824X > setenv serverip 192.168.0.5
_MPC824X > tftpload 1000000 altboot.bin
ARP broadcast 1
TFTP from server 192.168.0.5; our IP address is 192.168.0.106
Filename 'altboot.bin'.
Load address: 0x1000000
Loading: ###############
done
Bytes transferred = 74732 (123ec hex)

The old firmware (2005) doesn't activate the network at all, so we have to download altboot into RAM with Kermit protocol over the serial line.

Install kermit(1) from pkgsrc(7) or compile and install it yourself. To set up the file transfer you have to provide the following commands to kermit:

set line /dev/tty00
set speed 115200
set carrier-watch off
set flow-control none
robust
set file type bin

For convenience you can write them into a file which you can pass as an argument to kermit.

Load altboot into memory using Kermit protocol. The binary is relocated at 0x1000000, so type:

_MPC824X > loadb 1000000
## Ready for binary (kermit) download ...

Now quit your terminal program and launch kermit cmdfile. When you are already running kermit, enter the command mode by typing CTRL-\ followed by C. Then send altboot.bin. Reconnect when the transfer is finished.

C-Kermit 8.0.211, 10 Apr 2004, for NetBSD 1.6
 Copyright (C) 1985, 2004,
  Trustees of Columbia University in the City of New York.
Type ? or HELP for help.
(/tmp/) C-Kermit>send path_to/altboot.bin

Now you can use altboot to launch the netbsd-INSTALL kernel for installing NetBSD. You may choose to load it with TFTP or from NFS. For TFTP you have to enable tftpd(8) in /etc/inetd.conf, and for NFS there is a documentation at The Network File System. But in both cases you have to set up a DHCP server, which is explained in the DHCP Howto . An appropriate dhcpd.conf entry could look like this:

        host ds101g {
                hardware ethernet 00:11:32:xx:xx:xx;
                fixed-address 192.168.0.101;
                next-server 192.168.0.1;
                option root-path "/export/ds101g/root";
        }

The root-path option is only needed when using NFS and should match your exported NFS directory. Uncompress netbsd-INSTALL.gz from the NetBSD/sandpoint distribution and copy it into the NFS or TFTP directory. Then start the DHCP, NFS or TFTP server and boot the installation kernel from the firmware either with

_MPC824X > go 1000000 tftp:netbsd-INSTALL

or from NFS:

_MPC824X > go 1000000 nfs:netbsd-INSTALL

Our bootloader configures the hardware, determines the IP address, loads the kernel via network and launches it:

## Starting application at 0x01000000 ...

>> NetBSD/sandpoint altboot, revision 1.5 (Fri Feb 18 23:21:15 CET 2011)
>> Synology DS, cpu 265 MHz, bus 132 MHz, 64MB SDRAM
channel 0 present
wd0: <SAMSUNG HD502HI> DMA LBA LBA48 476940 MB
wd0: no disklabel
MAC address 00:11:32:xx:xx:xx
100Mbps-FDX
loading "netbsd-INSTALL" 5089380+110916=0x4f5d6c
entry=0x00090000, ssym=0x005859a8, esym=0x00585d6c
ksyms: Symbol table not found
ksyms: String table not found
ksyms: Perhaps the kernel is stripped?
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 5.99.43 (INSTALL) #5: Mon Jan 10 10:58:12 CET 2011
	frank@compaq.owl.de:/home/frank/netbsd/current/src/sys/arch/sandpoint/compile/obj/INSTALL
total memory = 65536 KB
avail memory = 58028 KB
OpenPIC Version 1.2: Supports 1 CPUs and 26 interrupt sources.
mainbus0 (root)
cpu0 at mainbus0: 8245 (Revision 0.4), ID 0 (primary)
cpu0: HID0 0x90c000<DOZE,DPM,ICE,DCE>, powersave: 1
eumb0 at mainbus0
com0 at eumb0 unit 0: ns16550a, working fifo
com0: console
ociic0 at eumb0
iic0 at ociic0: I2C bus
rs5c372rtc0 at iic0 addr 0x32: RICOH RS5C372[AB] Real-time Clock
satmgr0 at eumb0 unit 1: button manager (synology)
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0
pchb0: vendor 0x1057 product 0x0006 (rev. 0x14)
satalink0 at pci0 dev 13 function 0: Silicon Image SATALink 3512 (rev. 0x01)
satalink0: using irq 16 for native-PCI interrupt
atabus0 at satalink0 channel 0
atabus1 at satalink0 channel 1
ohci0 at pci0 dev 14 function 0: vendor 0x1033 product 0x0035 (rev. 0x43)
ohci0: interrupting at irq 17
ohci0: OHCI version 1.0
usb0 at ohci0: USB revision 1.0
ohci1 at pci0 dev 14 function 1: vendor 0x1033 product 0x0035 (rev. 0x43)
ohci1: interrupting at irq 17
ohci1: OHCI version 1.0
usb1 at ohci1: USB revision 1.0
ehci0 at pci0 dev 14 function 2: vendor 0x1033 product 0x00e0 (rev. 0x04)
ehci0: interrupting at irq 17
ehci0: companion controllers, 3 ports each: ohci0 ohci1
usb2 at ehci0: USB revision 2.0
skc0 at pci0 dev 15 function 0: irq 18
skc0: Marvell Yukon Lite Gigabit Ethernet rev. (0x9)
sk0 at skc0 port A: Ethernet address 00:11:32:xx:xx:xx
makphy0 at sk0 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5
makphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FDX, auto
biomask 8000038 netmask 8000038 ttymask 8000038
satalink0: port 0: device present, speed: 1.5Gb/s
wd0 at atabus0 drive 0: <SAMSUNG HD502HI>
wd0: 465 GB, 969021 cyl, 16 head, 63 sec, 512 bytes/sect x 976773168 sectors
uhub0 at usb0: vendor 0x1033 OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1 at usb1: vendor 0x1033 OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2 at usb2: vendor 0x1033 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
boot device: sk0
root on md0a dumps on md0b
root file system type: ffs
erase ^H, werase ^W, kill ^U, intr ^C, status ^T
Terminal type? [vt100]

Just follow the usual procedure to install a NetBSD system.

When you have an old firmware you just have to modify the bootcmd setting in PPCBoot's environment and write the altboot.bin binary to any free location of the Flash ROM.

To find a suitable place on the flash you can use the flinfo command and look out for empty sectors (E). On my Synology box I have chosen 0xff400000. Replace that in all the following commands if you have chosen a different address.

Load altboot.bin into memory at 0x1000000 again, as explained above. Then execute the following commands to write it to Flash ROM:

_MPC824X > protect off ff400000 ff41ffff
Un-Protect Flash Bank # 1
_MPC824X > erase ff400000 ff41ffff
Erase Flash from 0xff400000 to 0xff41ffff 
. done
Erased 1 sectors
_MPC824X > cp.b 1000000 ff400000 18000
Copy to Flash... done
_MPC824X > protect on ff400000 ff41ffff
Protect Flash Bank # 1

Finally adapt the bootcmd environment string to auto-boot altboot and start the netbsd kernel (which is the default name) from wd0 on each reboot:

_MPC824X > setenv bootcmd cp.b ff400000 1000000 18000\; go 1000000 wd0:
_MPC824X > saveenv
Saving Environment to Flash...
unProtect FFF40000 ... FFF5FFFF
Un-Protected 1 sectors
Erasing Flash...
. done
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors

The \ is important for setenv not to misinterpret the ; as the end of the command.

Without a working saveenv command the only way to make your system automatically boot NetBSD is to replace the Linux kernel on flash by altboot.img, which is our bootloader in PPCBoot image format, faking a Linux kernel.

When viewing the environment variables with printenv you can see that the bootcmd is calling bootm to load the Linux kernel. The first address is the location which we have to overwrite with altboot.img. Here it is 0xffc00000, which you have to replace in all the following commands, in case your bootcmd differs.

bootcmd=bootm FFC00000 FFE00000

Load altboot.img into memory, for example at 0x1000000 again, as explained above. You might want to backup the Linux kernel image first. Then execute the following commands to overwrite it with altboot.img:

_MPC824X > protect off ffc00000 ffc1ffff
Un-Protect Flash Bank # 1
_MPC824X > erase ffc00000 ffc1ffff
Erase Flash from 0xffc00000 to 0xffc1ffff 
. done
Erased 1 sectors
_MPC824X > cp.b 1000000 ffc00000 18000
Copy to Flash... done
_MPC824X > protect on ffc00000 ffc1ffff
Protect Flash Bank # 1

Optionally you may think about replacing the Linux RAM disk image at the second address (0xffe00000 in the example above) by an empty PPCBoot image, like this one (do not forget to uncompress it with gunzip(1)). Or use mkubootimage to make your own dummy. Write it to flash as shown above. This will speed up the boot process, but is not really required.