Symmetricom S200 Teardown/upgrade to S250

[smgvbest]

its possible the zip file is not getting updated.  make sure to exit out of the zip file so it saves then come back in and verify the change is still there.
a backup made will include all changes to /etc so this would be in the backup

[SoundTech-LG]

Hi, thank you for your reply. I have checked the backup file after modification. All changes are there. After uploading it, it gives the Invalid command after trying the first line in the list of commands you provided. Additionally...  if I make a new backup file, none of the changes are there... it reverts back to the defaults.  I am using version 1.36 on the CF card, if that may make a difference. What version are you using?

[smgvbest]

I'm on 1.36

[smgvbest]

To enable sftp
edit /etc/ssh/sshd-config
change
Subsystem      sftp    /usr/lib/openssh/sftp-server
to
Subsystem       sftp    /usr/libexec/sftp-server

next

edit /etc/services
change
sftp           115/tcp
to
#sftp           115/tcp

restart sshd thru GUI or
/etc/init.d/ssh restart

[SoundTech-LG]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

[SoundTech-LG]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

[SoundTech-LG]

and here is the main screen just in case it looks different...

[smgvbest]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

The software on many of these older time servers have many vulnerabilities
1.3.6 has these versions of some of the most visible packages

inux SyncServer 2.4.20_mvl31-pc_target.chronos.1.670.15.1061924 #2 Thu Apr 16 19:26:14 PDT 2015 i686 unknown
MontaVista linux


ntpd - NTP daemon program - Ver. 4.2.4p8
Server version: Apache/2.0.63
OpenSSH_5.5p1, OpenSSL 1.0.0 29 Mar 2010

[smgvbest]

and here is the main screen just in case it looks different...

For reference here's mine

[smgvbest]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

Just for reference, i did the SFTP changes after I had already made the SSH changes for ROOT.   while it should work editing the zip file and loading the back up i did not test that
I've actually restored mine to a point prior to the changes and did my steps again and it worked fine.

 

[SoundTech-LG]

The main difference is the older model processor Samuel. I have a few of those units too, but I somehow doubt that would change anything...

[SoundTech-LG]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

[smgvbest]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

Can you PM me and send me your file? 
if you can put on a google or other drive where I can grab it I'll take a look

[SoundTech-LG]

Hi Sandra,

Left you the link via PM.

Thanks!
Martin

[smgvbest]

Has anyone looked at upgrading a S250 to a S350?
some of the items I note.
1. different CPU board
2. 2x CF Cards
3. U36/U37 Populated
4. Gigabit Eth Port
5. Alarm Relays
6. Back up Radio
sure theres more.

does anyone have a dump of the 2 CF Cards is the S350?
anyone have teardown photo's?

[8bit]

While upgrading my S200 to a S250/OCXO I also worked on the CF cards and the OS and looked at some of the differences to the S350.

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO. The S3xx also has a different power supply (looks better). The S3xx also includes the Gig-E chip and the connector for the T1/E1 timing card. It looks like the S2xx could support the alarm relay card and the modem card (but never did). There are also some extra options for military use.

They both support the same 32-bit X86 PC controllers but the S3xx uses a faster CPU with more memory. Even the oldest system with only 128MB RAM should be fine. The newer S2xx came with 256MB RAM and the S3xx have at least 512MB RAM. While the RAM is a standard SODIMM and upgradable, there's little point in doing so. Upgrading the CPU (or PC card) would not change the timing performance as that is handled by the FPGA hardware and not the CPU. A faster CPU would help system response and NTP performance. The S2xx systems are not very fast. The S3xx systems are not much faster.

While the S2xx and S3xx seem to use the same FPGA setup they run different code and seem to be connected a little differently.

It seems they (symmetricom) were working on a unified code release and set of system options for the S2xx/S3xx. I would guess they gave up as it was good enough and then soldout to Microsemi who ended the product development in favor of newer systems (the S600/S650 modeler).

The S2xx software does not require the OPTIONS or OPTEXT to be set (they are just 0) and the web page uses the model number (S200 or S250) to set some features. All the circuitry seems to be the same for the S200 and S250 except for the extra 6 BNC connectors. The oscillator hardware (TCXO/OCXO/RB) seems to be the only real option in the eeprom.

The S3xx use the OPTIONS and OPTEXT to set the hardware/software options present in the system (including hidden features). You can set ALL options from the "root eng" menu including oscillator and model number. No need for root shell.

For the S2xx there is only one 512MB flash card. On the S3xx there are two 512MB flash cards but they are not mirrored. In the S3xx, the first card (hda) has the same setup as the S2xx and the 2nd card (hdc) is just for the database storage unique to the S3xx software.

The stock S3xx software does run on the S2xx system basically unmodified and includes the provision to use a single 1GB flash card with an extra partition for the database storage (or just don't start the DB). I'll have to test the different FPGA code, currently I'm still running the S250 FPGA code. You can reflash between the versions from the root shell.

I loaded the S3xx software on a 1G CF card and setup the 8th extended partition as the rest of the storage (Linux EXT3) and the system is happy. I set the hardware options so it shows working features (also added the easy/cheap OCXO upgrade and BNC connectors to the S200):
 MODELNUMBER S350
 OPTEXT 0x00000027
 OPTIONS 0x000019C9

The S3xx software is a little newer with some extra features. It uses the 2.6 kernel rather than 2.4 but NTP is the same old version.

As for a new working CompactFlash card.... It needs to be NON-REMOVABLE/IDE-MODE AND NON-DMA (and large enough to hold the partitions). Using the wrong type of card should not damage the system but it won't boot. Using a removable CF card generally won't boot at all. Using a non-removable (hard disk) but DMA card will generate errors and won't finish booting. Some cards claim to support full auto-detection of all options but don't count on it working. You can connect the serial console to watch the system boot (9600-8-N-1).

Apacer makes several cards that work. The 512MB or 1G cards from the CFIII or CF5 line work (I am using them). Speed is not important as the system tops out at about 1.6MBytes/sec (extra slow PIO speed). You can get the cards new from DigiKey or Mouser. The CFIII have a better write endurance but are slower (not that it matters). The S2xx and the S3xx boot cards are not written to a lot. The secondary S3xx card is mounted read-write.

The Apacer CF5 cards are obsolete and may be hard to find new. The Apacer CFIII cards are older but still seem to be available new. The newer Apacer CF6 cards should work but I have not tested them.

Extended Temp 512MB CF5: AP-CF512MR9NS-ETNDNRB ($34)
Extended Temp 1G CF5: AP-CF001GR9NS-ETNDNRB
Standard Temp 512MB CF5: AP-CF512MR9NS-NDNRB
Standard Temp 1G CF5: AP-CF001GR9NS-NDNRB

Extended Temp 512MB CFIII: AP-CF512ME3NR-ETNDNRQ ($33)
Extended Temp 1GB CFIII: AP-CF001GE3NR-ETNDNRQ ($47)
Standard Temp 512MB CFIII: AP-CF512ME3NR-NDNRQ ($26)
Standard Temp 1GB CFIII: AP-CF001GE3NR-NDNRQ ($35)

DigiKey has a good number of the Apacer CFIII 1GB ET cards (AP-CF001GE3NR-ETNDNRQ). You can use the 1GB card as a direct replacement for the 512MB card and just not use the extra space. As the card is formatted for Linux you can change the partition size but not the layout (partition numbers) and it will still work correctly. The partitions just need to be large enough to hold the data. I copied a S350 card to the new 1G CF card and booted it in the S250. Then using a root shell and cfdisk I added the 8th partition with EXT3 format and it's a happy box.

[notfaded1]

Would you post a link to the 1G image you are using on your S200 series that works?  I've also spent a lot of time working on this and I'm interested in seeing the S350 code run on an S200 1G card.

Bill

[SoundTech-LG]

wow, great work, great info!!! 

If you have an image for the 1gB CF for the the S250 I would love a copy.

Thanks!

[timenuttie123]

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO

I have a follow up question to 8bit's comment about the S3XX being different from S2XX. Does the S300 have the precut holes in the chassis for the 3 BNC connectors and the corresponding circuit traces on the board for soldering them?

I am considering getting a used S300, and I'd like to make sure I can at least use PPS OUT (timing inputs would be nice too, but I don't care as much).

TIA!

[8bit]

I only have the original TS2100, S350, S200, and S250 units but not an original S300. Most have had power supply failures (some sparks and smoke).

I would think the S300 and S350 would have the same metal chassis and so the S300 should have all the punched holes but a different sticker covering them.
From a manufacturing perspective it's cheaper to have one or two versions rather than different ones for every single variation (there are many).

This PDF shows the S300 with the holes as you want:
 https://www.microsemi.com/document-portal/doc_download/133336-syncserver-s300-datasheet

It's also an interesting photo as it shows a different S3xx main board that does include on-board space of the OCXO unlike the ones I have. It does have the T1 header, the 2nd CF slot, GigE, and different RB connector so it's definitely a S3xx board. I don't know if they made any S200/S300 without the electronics needed for the S250/S350 connections.

I used a heat gun to soften (not melt) the plastic and then a sharp thin knife to cut the plastic to match the holes. Others have used a drill. Without heating the plastic a drill seems better...the plastic sticker is rather thick and strong.

[notfaded1]

I just bought one of the last 512M cards from mouser... both Digikey and Mouser say they are now backordered.  I was going to order two from mouser but it said an item is backordered so I reduced it to 1.

[notfaded1]

Thanks for the tip 8bit... my problem has always been finding cards that will boot correctly or be big enough.  I've had lots of trials that failed... many of us have.

[timenuttie123]

I just got two of these from Amazon (I have S300):

https://www.amazon.com/gp/product/B00J8SS9M6/ref=ppx_yo_dt_b_asin_title_o03_s00?ie=UTF8&psc=1

I used "dd" on Linux to copy the original 512MB cards onto the new ones, then installed them back and everything worked right the first shot.

Next: root hack & sftp hack.

[AlexJackson]

I had posted to this earlier but deleted it for not having anything major to contribute.

I also have a base s200 device that Ive had for a few years. I was able to get mine to work on a Transcend 1GB 80x card I had from my old Watchguard XTM 5 firewall. I've also tried the 1.36 disk image linked earlier in the thread and while it worked, it had a number of bugs in the VFD. First was a strange flickering between various bits of text "invalid address" and blank spaces on the hardware clock status "page" on the VFD. Also, when it finally synced/locked over GPS (I have the symmetricom 12v antenna), I got either "REF:    " or "REF: Pkt Err". Further testing shown that even without an antenna or network link, it would lock and sync and show Stratum 1. Loading the image on the factory card also yields very strange intermittent errors in the admin pages. I have since rolled back to 1.10. I did ask around if there other versions available, but I haven't found anything or heard back.

However what I'm really after ultimately is the more advancing timing oscillators and outputs that are lacking on the s200. So I've decided to probe around my s200 with my "new" scope (ds1054z) Ive only used a couple times and see if adding the jacks would even work (especially at 15 bucks each). Gives me a reason to probe something. And yes, I found the signals, 10MHz signal, PPS & IRIG. I have a few other items that can use PPS.

With that said, mine only has the TCXO, and I've ordered a Vectron MC597X4-040W that was shown fitted to an OCXO version earlier in the post as well. Regarding installing R121, to me it looks like its just a jumper and not so much a resistor. To my old eyes the pictures look like the value is "000" but I can barely read/do smd stuff to begin with.

I still have yet to dive into mine much more than some probing and CF card testing. I have several other 512MB cards that don't work either because they're too small. I also havent ordered the bnc connectors at this time, that will probably come next week.

[AlexJackson]

I know I'm totally late to this show. My Vectron OCXO showed up today. It wasn't supposed to be here until Friday. I might have me a nice little project for later tonight or even the long weekend (if I have one). I dont yet have the bnc connectors, but im going to go ahead and drill for them.

From what I seen from the pictures @NA5WH, It appears that R121 is labelled "000" so I'm going to say this is a jumper. So I'm pretty much going to be following in the footsteps of @8bit with the s200 to s250 mod. Sadly, I'm stuck on v1.10 because I couldn't get any of the shell hacks to take, but ill try it with the linked v1.36 to run the seeprom program then ill probably have to go back to 1.10 unless it fixes my VFD issues on 1.36 (not likely).