Terri's Random Ramblings

Inside the Linksys NSS4000

UPDATED May 4th, 2007

Today we’ll take a look inside the Linksys NSS4000. This is the entry-level unit in the Linksys One network storage family. You can read the official Linksys literature here, but technical info is rather lacking there (they don’t even say how much RAM is in the unit).

First, let’s take a look at the mainboard (click the image to enlarge):

The processor is a PMC-Sierra RM7035C, part of the MIPS family, running at 600MHz. A PM8172 system controller provides the interface for most other peripheral controllers on the board, as well as being the attachment point for the system’s 128KB of Hynix SDRAM. Other notable components are an ITE IT8712 Super I/O controller and IT8907E USB flash controller, connected to a 512MB Samsung flash chip; Promise PDC40518 SATA controller; NEC UPD720101 USB 2.0 controller; SafeXcel 1741 security co-processor; two Marvell Yukon Lite 10/100/1000 Ethernet controllers (under heat sinks), and a MX 29LV800CBTC 1MB boot flash.

Upon initial observation, there is a 4-pin connector labeled “J29 CONSOLE” near the back edge of the board:

It turns out that this connector has the exact same pinout as the Linksys NSLU2’s serial port, as described here. Linksys was even nice enough to pre-install a connector for us. I made a cable out of an old Sound Blaster cable (connectors / pins) and a piece of USB cable (wire). There is just enough room to snake the cable into the chassis via the RPS (Redundant Power System) connector opening on the rear:

This was enough to get a serial console working, to observe the bootstrap procedure. Here is a complete log of the boot process, from PMON start through the Linux login prompt:

PMON2000 MIPS Initializing. Standby...ERRORPC=80102c4c CONFIG=404664b0 STATUS=00410000 
CPU PRID 00002753 
Initializing SDRAM controller 
Clearing first 1MB of memory...done 
Sizing caches... 
Initializing L1 cache...done 
Initializing L2 cache...enabling...done 
Testing first MB of RAM... 
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! Copy PMON to execute location...done 
Booting compressed image. 
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! mainbus0 (root) 
pcibr0 at mainbus0 
pci0 at pcibr0 bus 0 
vendor "ITExpress", unknown product 0x0801 rev 0xb1 at pci0 dev 1 function 0 not configured 
vendor "ITExpress", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 1 not configured 
ohci0 at pci0 dev 1 function 3 vendor "ITExpress", unknown product 0x1234 rev 0x07: generic poll, version 1.0, legacy support 
usb1 at ohci0: USB revision 1.0 
uhub1 at usb1 
uhub1: class 9/0 rev 1.00/1.00, addr 1 
uhub1: 2 ports with 2 removable, self powered 
vendor "ITExpress", unknown product 0x8172 rev 0x11 at pci0 dev 1 function 4 not configured 
vendor "ITExpress", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 6 not configured 
"SafeNet SafeXcel" rev 0x01 at pci0 dev 16 function 0 not configured 
ohci1 at pci0 dev 17 function 0 "NEC USB" rev 0x43: generic poll, version 1.0 
usb2 at ohci1: USB revision 1.0 
uhub2 at usb2 
uhub2: class 9/0 rev 1.00/1.00, addr 1 
uhub2: 3 ports with 3 removable, self powered 
ohci2 at pci0 dev 17 function 1 "NEC USB" rev 0x43: generic poll, version 1.0 
usb3 at ohci2: USB revision 1.0 
uhub3 at usb3 
uhub3: class 9/0 rev 1.00/1.00, addr 1 
uhub3: 2 ports with 2 removable, self powered 
ehci0 at pci0 dev 17 function 2 "NEC USB" rev 0x04: generic poll 
ehci0: EHCI version 1.0 
ehci0: companion controllers, 3 ports each: ohci1 ohci2 
usb0 at ehci0: USB revision 2.0 
uhub0 at usb0 
uhub0: class 9/0 rev 2.00/1.00, addr 1 
uhub0: 5 ports with 5 removable, self powered 
skc0 at pci0 dev 18 function 0 "Marvell Yukon 88E8001/8003/8010" rev 0x10, Marvell Yukon Lite (0x9): generic poll 
sk0 at skc0 port A, address aa:bb:cc:dd:ee:ff 
eephy0 at sk0 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 
vendor "Promise", unknown product 0x3d18 rev 0x02 at pci0 dev 19 function 0 not configured 
skc1 at pci0 dev 20 function 0 "Marvell Yukon 88E8001/8003/8010" rev 0x10, Marvell Yukon Lite (0x9): generic poll 
sk1 at skc1 port A, address aa:bb:cc:dd:ee:ff 
eephy1 at sk1 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 
umass0 at uhub0 port 1 configuration 1 interface 0 
umass0: rev 2.00/2.00, addr 2 using umass0 over SCSI 
scsibus0 at umass0: 2 targets 
sd0 at scsibus0 targ 1 lun 0:  SCSI2 0/direct removable 
sd0: 499MB, 499 cyl, 64 head, 32 sec, 512 bytes/sec, 1022976 sec total 
System init done.Configuration [PM74101,EL,NET,SCSI] 
Version: PMON2000 3.1.17-B019 (PM74101) #0: Mon Jan  8 12:24:25 PST 2007. 
Supported loaders [srec, elf, bin] 
Supported filesystems [net, fat, disk, tty, ram] 
This software may be redistributed under the BSD copyright. 
Copyright 2005, PMC-Sierra, Inc. 
CPU RM7000 @ 601.28 MHz / Bus @ 100.21 MHz 
Memory size 128 MB. 
Primary Instruction cache size 16KB (32 line, 4 way) 
Primary Data cache size 16KB (32 line, 4 way) 
Secondary cache size 256KB 
Diagnostic Test Started 
=============================================================== 
PCI test started .................. 
Testing PCI Device NEC USB Controller 
Testing PCI Device Promise SATA Controller 
Testing PCI Device Marvell Gigabit Ethernet Controller 
Testing PCI Device Safenet SafeXel encryptor 
PCI test finished .................  SUCCESS 
USB test started .................. 
USB test finished .................  SUCCESS 
LPC test started .................. 
Testing LPC Environment Controller 
Testing LPC GPIO Controller 
LPC: GPIO Controller Passed 
LPC test finished .................  SUCCESS 
RTC test started .................. 
Setting the time as Sun Jan  1 00:00:00 GMT 2006 
RTC test finished .................  SUCCESS 
Mfg  0, Id  0 
Could not find Flash Area to write 
*************************************************************** 
*            Diagnostic Test Status of this device            * 
*************************************************************** 
* Memory Test                               -   SUCCESS       * 
* NEC USB Controller                        -   SUCCESS       * 
* Promise SATA Controller                   -   SUCCESS       * 
* Marvell Gigabit Ethernet Controller       -   SUCCESS       * 
* Safenet SafeXel encryptor                 -   SUCCESS       * 
* USB OnBoard FLASH                         -   SUCCESS       * 
* LPC Device                                -   SUCCESS       * 
* LPC: Environment Controller               -   SUCCESS       * 
* LPC: GPIO Controller                      -   SUCCESS       * 
* RTC setting                               -   SUCCESS       * 
* UDI Programming                           -   FAILED        * 
*************************************************************** 
Diagnostic test completed. Test Status - FAILURE 
=============================================================== 
Hit any key to return to PMON prompt or power down. 
> 
Autoboot command: "boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3" 
Press  to execute now or any other key to abort. 
 1 
Loading file: /dev/sd0@0x100 [elf32] [mips4] [32bitmode] 
ffffffff80100000/53d085(5492869) + ffffffff8063d085/22f9b(z) + ehci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
setting pci bus 0 device 1 function 0 reg 10 to default: 0x14017001 
setting pci bus 0 device 1 function 5 reg 20 to default: 0x01401780 
Linux version 2.6.18 (build@schnitzel) (gcc version 3.3.6) #1 Fri Jan 26 02:36:34 PST 2007 
UDI: initializing 
UDI: found UDI at offset 0xa80ff000 
UDI: V2 info format 
UDI: hardware revision is 3 
UDI: available 
memsize: 128 
Memory size: 128MB 
CPU revision is: 00002753 
FPU revision is: 00002750 
Found IT8712 Super IO 
Determined physical RAM map: 
 memory: 08000000 @ 00000000 (usable) 
Built 1 zonelists.  Total pages: 32768 
Kernel command line: root=/dev/scsibd2 hwrev=3 console=ttyS0,115200 
Primary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes. 
Primary data cache 16kB, 4-way, linesize 32 bytes. 
Secondary cache size 256K, linesize 32 bytes. 
Synthesized TLB refill handler (23 instructions). 
Synthesized TLB load handler fastpath (35 instructions). 
Synthesized TLB store handler fastpath (35 instructions). 
Synthesized TLB modify handler fastpath (34 instructions). 
PID hash table entries: 1024 (order: 10, 4096 bytes) 
calculating r4koff... 0012597e(1202558) 
CPU frequency 601.28 MHz 
Using 300.640 MHz high precision timer. 
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) 
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) 
Memory: 123264k/131072k available (4092k kernel code, 7664k reserved, 1107k data , 164k init, 0k highmem) 
Mount-cache hash table entries: 512 
Checking for 'wait' instruction...  available. 
NET: Registered protocol family 16 
SCSI subsystem initialized 
usbcore: registered new driver usbfs 
usbcore: registered new driver hub 
NET: Registered protocol family 2 
IP route cache hash table entries: 1024 (order: 0, 4096 bytes) 
TCP established hash table entries: 4096 (order: 2, 16384 bytes) 
TCP bind hash table entries: 2048 (order: 1, 8192 bytes) 
TCP: Hash tables configured (established 4096 bind 2048) 
TCP reno registered 
UDI: created "/proc/manuinfo" entry 
VFS: Disk quotas dquot_6.5.1 
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) 
squashfs: version 3.1 (2006/08/19) Phillip Lougher 
Installing knfsd (copyright (C) 1996 okir@monad.swb.de). 
NTFS driver 2.1.27 [Flags: R/O]. 
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. 
SGI XFS with ACLs, large block numbers, no debug enabled 
SGI XFS Quota Management subsystem 
Initializing Cryptographic API 
io scheduler noop registered 
io scheduler anticipatory registered 
io scheduler deadline registered 
io scheduler cfq registered (default) 
it8172 fixup: Configuring Audio adapter 0000:00:01.0 
Generic RTC Driver v1.07 
GPIO poller thread started. 
GPIO at 0x14013800 (irq = 20) 
powerdn: pwdnInit 
Watchdog Timer (ITE 8712) Initialized 
is_watchdog_running()(0x0), WDT Timeout Value (0x0)... 
watchdog_init(): Did not spawn it8712_wdt_ctrl_kthread... 
Serial: 8250/16550 driver $Revision: 1.6 $ 4 ports, IRQ sharing disabled 
serial8250: ttyS0 at I/O 0x14011800 (irq = 23) is a 16550A 
serial8250: ttyS1 at I/O 0x140003f8 (irq = 4) is a 16550A 
serial8250: ttyS2 at I/O 0x14012000 (irq = 24) is a 16550A 
serial8250: ttyS3 at I/O 0x14012800 (irq = 25) is a 16550A 
loop: loaded (max 8 devices) 
skge 1.6 addr 0x10104000 irq 39 chip Yukon-Lite rev 9 
skge eth0: addr aa:bb:cc:dd:ee:ff 
skge 1.6 addr 0x10108000 irq 40 chip Yukon-Lite rev 9 
skge eth1: addr aa:bb:cc:dd:ee:ff 
tun: Universal TUN/TAP device driver, 1.6 
tun: (C) 1999-2004 Max Krasnyansky  
Board Hardware Revision: 3 
libata: Powering drive 1 (gpio 19) 
libata: Powering drive 2 (gpio 18) 
libata: Powering drive 3 (gpio 17) 
libata: Powering drive 4 (gpio 16) 
ata1: SATA max UDMA/133 cmd 0xB010E200 ctl 0xB010E238 bmdma 0x0 irq 41 
ata2: SATA max UDMA/133 cmd 0xB010E280 ctl 0xB010E2B8 bmdma 0x0 irq 41 
ata3: SATA max UDMA/133 cmd 0xB010E300 ctl 0xB010E338 bmdma 0x0 irq 41 
ata4: SATA max UDMA/133 cmd 0xB010E380 ctl 0xB010E3B8 bmdma 0x0 irq 41 
scsi0 : sata_promise 
ata1: SRST failed (status 0xFF) 
ata1: SRST failed (err_mask=0x100) 
ata1: softreset failed, retrying in 5 secs 
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata1.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata1.00: configured for UDMA/133 
scsi1 : sata_promise 
ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata2.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata2.00: configured for UDMA/133 
scsi2 : sata_promise 
ata3: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata3.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata3.00: configured for UDMA/133 
scsi3 : sata_promise 
ata4: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata4.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata4.00: configured for UDMA/133 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
SCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) 
sda: Write Protect is off 
SCSI device sda: drive cache: write back 
SCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) 
sda: Write Protect is off 
SCSI device sda: drive cache: write back 
 sda: 
sd 0:0:0:0: Attached scsi disk sda 
SCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) 
sdb: Write Protect is off 
SCSI device sdb: drive cache: write back 
SCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) 
sdb: Write Protect is off 
SCSI device sdb: drive cache: write back 
 sdb: 
sd 1:0:0:0: Attached scsi disk sdb 
SCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) 
sdc: Write Protect is off 
SCSI device sdc: drive cache: write back 
SCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) 
sdc: Write Protect is off 
SCSI device sdc: drive cache: write back 
 sdc: 
sd 2:0:0:0: Attached scsi disk sdc 
SCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) 
sdd: Write Protect is off 
SCSI device sdd: drive cache: write back 
SCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) 
sdd: Write Protect is off 
SCSI device sdd: drive cache: write back 
 sdd: 
sd 3:0:0:0: Attached scsi disk sdd 
sd 0:0:0:0: Attached scsi generic sg0 type 0 
sd 1:0:0:0: Attached scsi generic sg1 type 0 
sd 2:0:0:0: Attached scsi generic sg2 type 0 
sd 3:0:0:0: Attached scsi generic sg3 type 0 
physmap-flash.0: failed to claim resource 0 
ehci_hcd 0000:00:11.2: EHCI Host Controller 
ehci_hcd 0000:00:11.2: new USB bus registered, assigned bus number 1 
ehci_hcd 0000:00:11.2: irq 40, io mem 0x1010f000 
ehci_hcd 0000:00:11.2: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 
usb usb1: configuration #1 chosen from 1 choice 
hub 1-0:1.0: USB hub found 
hub 1-0:1.0: 5 ports detected 
ohci_hcd 0000:00:01.3: Itentionally disabling ITE USB controller. 
ohci_hcd 0000:00:01.3: init 0000:00:01.3 fail, -19 
ohci_hcd 0000:00:11.0: OHCI Host Controller 
ohci_hcd 0000:00:11.0: new USB bus registered, assigned bus number 2 
ohci_hcd 0000:00:11.0: irq 38, io mem 0x1010c000 
usb usb2: configuration #1 chosen from 1 choice 
hub 2-0:1.0: USB hub found 
hub 2-0:1.0: 3 ports detected 
ohci_hcd 0000:00:11.1: OHCI Host Controller 
ohci_hcd 0000:00:11.1: new USB bus registered, assigned bus number 3 
ohci_hcd 0000:00:11.1: irq 39, io mem 0x1010d000 
usb 1-1: new high speed USB device using ehci_hcd and address 2 
usb usb3: configuration #1 chosen from 1 choice 
hub 3-0:1.0: USB hub found 
hub 3-0:1.0: 2 ports detected 
usb 1-1: configuration #1 chosen from 1 choice 
Initializing USB Mass Storage driver... 
scsi4 : SCSI emulation for USB Mass Storage devices 
  Vendor: ITE TECH  Model:  PEN DRIVE Flash  Rev: 2.20 
  Type:   Direct-Access                      ANSI SCSI revision: 02 
Hooray! Discovered SCSI boot device! 
host_no [4], channel [0], id [0], lun [0] 
SCSI device sde: 1022976 512-byte hdwr sectors (524 MB) 
sde: Write Protect is off 
sde: assuming drive cache: write through 
SCSI device sde: 1022976 512-byte hdwr sectors (524 MB) 
sde: Write Protect is off 
sde: assuming drive cache: write through 
 sde: sde1 sde2 sde3 sde4 
SCSI device scsibd: 1022976 512-byte hdwr sectors (524 MB) 
scsibd: Write Protect is off 
scsibd: assuming drive cache: write through 
 scsibd: scsibd1 scsibd2 scsibd3 scsibd4 
sd 4:0:0:0: Attached scsi removable disk scsibd 
sd 4:0:0:0: Attached scsi generic sg4 type 0 
usbcore: registered new driver usb-storage 
USB Mass Storage support registered. 
usbcore: registered new driver hiddev 
usbcore: registered new driver usbhid 
drivers/usb/input/hid-core.c: v2.6:USB HID core driver 
Non-volatile memory driver v1.0 
i2c /dev entries driver 
Initialize ITE IIC adapter module 
 found device at 0x14014030 irq 0. 
ITE iic (i2c) algorithm module 
it87: Device not activated, enabling 
it87: Found IT8712F chip at 0x290, revision 8 
hwmon-vid: Unknown VRM version of your CPU 
md: linear personality registered for level -1 
md: raid0 personality registered for level 0 
md: raid1 personality registered for level 1 
md: raid10 personality registered for level 10 
raid6: int32x1    129 MB/s 
raid6: int32x2    152 MB/s 
raid6: int32x4    217 MB/s 
raid6: int32x8    170 MB/s 
raid6: using algorithm int32x4 (217 MB/s) 
md: raid6 personality registered for level 6 
md: raid5 personality registered for level 5 
md: raid4 personality registered for level 4 
raid5: measuring checksumming speed 
   8regs     :   550.000 MB/sec 
   8regs_prefetch:   519.000 MB/sec 
   32regs    :   643.000 MB/sec 
   32regs_prefetch:   602.000 MB/sec 
raid5: using function: 32regs (643.000 MB/sec) 
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27 
md: bitmap version 4.39 
device-mapper: ioctl: 4.7.0-ioctl (2006-06-24) initialised: dm-devel@redhat.com 
ip_tables: (C) 2000-2006 Netfilter Core Team 
TCP bic registered 
NET: Registered protocol family 1 
NET: Registered protocol family 17 
802.1Q VLAN Support v1.8 Ben Greear  
All bugs added by David S. Miller  
drivers/rtc/hctosys.c: unable to open rtc device (rtc0) 
md: Autodetecting RAID arrays. 
md: autorun ... 
md: ... autorun DONE.
Root device ("/dev/scsibd2") is now online. 
VFS: Mounted root (squashfs filesystem) readonly. 
Freeing unused kernel memory: 164k freed 
Doing sysinit 
Mounting procfs 
Mounting sysfs 
Starting udev 
Mounting nfsd 
Mounting tmpfs on /var (limited to [5242880] bytes) 
Mounting tmpfs on /tmp 
Mounting tmpfs on /mnt (limited to [131072] bytes) 
Creating dev entries for mtdblock devices... 
Boot device was /dev/scsibd, making partitions and 
mounting linuxrtconfig on /linuxrwfs (jffs2)... 
trying to mount jffs2 as rw partition... 
block2mtd: version $Revision: 1.1.1.3 $ 
actual jffs2 partition erase size will be [0x20000]... 
block2mtd: default erase size is [4096] 
block2mtd: mtd0: [d: /dev/scsibd1] erase_size = 128KiB [131072] 
block2mtd module loaded successfully. 
jffs2 will use mtdblock0 
Trying to mount jffs2 on /linuxrwfs... 
block2mtd: Overrun end of disk in cache readahead 
jffs2 mounted on /linuxrwfs 
Starting udevd... 
Starting udevtrigger... 
Starting udevsettle... 
Making useful softlinks... 
Removing hotplug... 
Mounting devpts... 
Start executing startup scripts... 
/etc/init.d/S01sysinit(start): doing some sysinit stuff... 
Dirty shutdown counter looks good... 
Dirty shutdown count is [3] 
Previous shutdown was dirty, message to user set... 
Checking the sanity of the rw file system... 
Softlinking /dev/sd0 to /dev/scsibd (bootenv may need it)... 
/etc/init.d/S01sysinit(start): OK 
/etc/init.d/S02checkroot(start): OK 
/etc/init.d/S02hwdep(start): Fixing gpio.conf files... 
Board hardware revision is [3]. 
gpio.conf already exists (OK) 
/etc/init.d/S03modules(start): OK 
/etc/init.d/S04raid(start): Starting up raids... 
Making additional md devices... 
Updating exports... 
found /etc/nas/spindown -- setting new spindown timeout... 
SATA spindown timeout set to 86400 seconds... 
Default RAID metadata version is 1.2 . 
There is no /etc/nas/uuids_stopped file -- starting all available arrays... 
md: md0 stopped. 
md: bind 
md: bind 
md: bind 
md: bind 
md: md0: raid array is not clean -- starting background reconstruction 
raid5: device sda operational as raid disk 0
raid5: device sdd operational as raid disk 3 
raid5: device sdc operational as raid disk 2 
raid5: device sdb operational as raid disk 1 
raid5: allocated 4212kB for md0 
raid5: raid level 5 set md0 active with 4 out of 4 devices, algorithm 2 
RAID5 conf printout: 
 --- rd:4 wd:4 fd:0 
 disk 0, o:1, dev:sda 
 disk 1, o:1, dev:sdb 
 disk 2, o:1, dev:sdc 
 disk 3, o:1, dev:sdd 
md: syncing RAID array md0 
md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc. 
md: using maximum available idle IO bandwidth (but not more than 7000 KB/sec) for reconstruction. 
md: using 128k window, over a total of 390711232 blocks. 
md: resuming recovery of md0 from checkpoint. 
mdadm: /dev/md/0 has been started with 4 drives. 
1853 
/etc/init.d/S04raid(start): OK 
/etc/init.d/S05lvm(start): Starting up lvm... 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
  WARNING: This metadata update is NOT backed up 
  1 logical volume(s) in volume group "RAIDA" now active 
/etc/init.d/S05lvm(start): OK 
/etc/init.d/S06mount(start): Mounting file systems... 
Running 70's disco mount... 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
  WARNING: This metadata update is NOT backed up 
  1 logical volume(s) in volume group "RAIDA" now active 
Checking for RAIDA - TEST 
Updated Fstab...[/dev/RAIDA/TEST        /mnt/RAIDA/TEST] 
Check mount point for /mnt/RAIDA/TEST 
Mount point DOES NOT exist 
Filesystem "dm-0": Disabling barriers, not supported by the underlying device 
XFS mounting filesystem dm-0 
Starting XFS recovery on filesystem: dm-0 (logdev: internal) 
Ending XFS recovery on filesystem: dm-0 (logdev: internal) 
Adding include path /mnt/RAIDA/TEST/.config/smb.conf 
Updated Fstab...[/mnt/RAIDA/TEST/share1 /mnt/ftp_dir/share1] 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
/etc/init.d/S06mount(start): OK 
/etc/init.d/S07mtd(start): Making read-only mtd character devices... 
/etc/init.d/S07mtd(start): OK 
/etc/init.d/S08tmpfs(start): Preparing tmpfs directories... 
Making directories in /var: 
+run... 
+log directories and files (httpd, messages, wtmp, lastlog, cups, samba)... 
+cache... 
+empty... 
+ftp... 
+spool directories (cups, cron)... 
+tmp... 
+lock directories (apache, lvm, subsys, samba)... 
+lib directories (nfs, snmp)... 
+state directories... 
+yp directories... 
+samba private dir... 
Done making /var directories. 
Making anon ftp user dir... 
/etc/init.d/S08tmpfs(start): OK 
/etc/init.d/S09sensors(start): Setting up sensors ... 
/etc/init.d/S09sensors(start): OK 
Initializing random number generator... done. 
/etc/init.d/S21fixrandom(start): Fixing random devices... 
/etc/init.d/S21fixrandom(start): OK 
/etc/init.d/S25safenet(start): Starting crypto (loading aes)... 
/etc/init.d/S25safenet(start): OK 
/etc/init.d/S30certs(start): Generating self-signing certs (if necessary)... 
/etc/init.d/S30certs(start): OK 
Flushing all current rules and user defined chains: SUCCESS: 
Clearing all current rules and user defined chains: SUCCESS: 
Applying iptables firewall rules:  SUCCESS: 
Setting hostname:  NAS0018f804fa07 
Starting network... 
+starting loopback interface 
Dynamic network was not running lo 
udhcpc was not running for lo 
Autoipd was not running for lo 
No bonding device present. 
Device lo is present and available 
This is not a slave device 
 DHCP not used on device lo 
 Bringing up lo 
arping: Interface lo is not ARPable 
Updating ARP cache of other devices on this subnet. Please wait 2 sec. 
arping: Interface lo is not ARPable 
ARP tables updated successfully. 
Adding route add 127.0.0.0/8 dev lo 
+starting ifplugd... 
Starting Network Interface Plugging Daemon:No bonding device present. 
bond0 
Doing insmode for bonding module... 
Ethernet Channel Bonding Driver: v3.0.3 (March 23, 2006) 
bonding: MII link monitoring set to 100 ms 
Device bond0 is present and available 
This is a master device. Bringing link down and then up. 
Bringing up master link for bond. 
Dynamic network was not running eth0 
udhcpc was not running for eth0 
Autoipd was not running for eth0 
No bonding device present. 
Device eth0 is present and available 
Enslaving eth0 to bond0 
bonding: bond0: enslaving eth0 as a backup interface with a down link. 
Dynamic network was not running eth1 
udhcpc was not running for eth1 
Autoipd was not running for eth1 
No bonding device present. 
Device eth1 is present and available 
Enslaving eth1 to bond0 
bonding: bond0: enslaving eth1 as a backup interface with a down link. 
Restarting vblade service 
Stopping /sbin/nas_vblade...OK 
Restoring raw socket buffer sizes...OK 
skge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx 
bonding: bond0: link status up for interface eth0, enabling it in 200 ms. 
bonding: bond0: link status definitely up for interface eth0. 
bonding: bond0: making interface eth0 the new active one. 
bonding: bond0: first active interface up! 
Stopping /sbin/nas_vblade...OK 
udhcpc[2175]: udhcpc (v0.9.9-pre) started 
skge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx 
udhcpc[2175]: Sending discover... 
. 
Waiting for network (60 second max): 
 + (try#1/12) Currently 1 active interfaces: 
   + bond0 : IP address not set 
udhcpc[2175]: Sending discover... 
udhcpc[2175]: Sending select for 10.20.30.40... 
udhcpc[2175]: Lease of 10.20.30.40 obtained, lease time 86400 
 + (try#2/12) Currently 1 active interfaces: 
   + bond0 : 10.20.30.40 
NET OK: All active interfaces are online. 
Starting Disk Aggregation Server... 
Stopping /sbin/nas_vblade...OK 
Starting ntpd: syncing (timeout in 20 seconds): OK 
Starting /sbin/portmap: OK 
Starting dropbear (from tcpserver): OK 
Starting /sbin/rpc.statd: OK 
Starting nfs services: 
Starting nfs quotas: 
Starting nfs daemon: 
Starting nfs mountd: 
/etc/init.d/S60vsftpd: setting maximum 2 connections 
/etc/init.d/S60vsftpd: setting maximum 2 connections per IP 
Starting vsftpd (from tcpserver): OK 
/etc/init.d/S82httpdswiw: setting maximum 99 connections 
/etc/init.d/S82httpdswiw: setting maximum 99 connections per IP 
Starting httpdswiw (from tcpserver): OK 
Starting httpdsl1 (from tcpserver): OK 
/etc/init.d/S84httpds: setting maximum 99 connections 
/etc/init.d/S84httpds: setting maximum 99 connections per IP 
Starting httpds (from tcpserver): OK 
/etc/init.d/S85httpd: setting maximum 99 connections 
/etc/init.d/S85httpd: setting maximum 99 connections per IP 
Starting httpd (from tcpserver): OK 
Starting UPnP daemon: OK 
/etc/init.d/S90samba: setting maximum 15 connections 
Starting samba: secrets.tdb : 1 records 
OK 
Starting winbind daemon: OK 
Starting CRON daemon: OK 
Starting auto nice daemon:/usr/sbin/and[2500]: Configuration file is: /etc/and.conf 
/usr/sbin/and[2500]: Priority database is: /etc/and.priorities 
/usr/sbin/and[2500]: AND ready. 
 done 
Starting Discovery Agent daemon: OK 
Starting mDNSPosix daemon: 
 +Writing /tmp/mDNSPosix.conf...OK 
/etc/init.d/S99local(start): Finalizing system startup... 
watchdog not started (userland have to keep it that way). 
  +starting gpio_poller --disable-watchdog (watchdog is disabled)... 
Indicating that boot was OK... 
Setting bootstate to A0... 
Unsetting bootcount... 
bootcount: No matching variable to unset 
Warning: couldn't unset bootcount. 
/etc/init.d/S99local(start): OK

My next task was to determine a working login username and password. Fortunately, the same username and password that is used for the NSS4000’s web interface will work (as an unprivileged user) on the serial console. Unfortunately, attempts to guess the root password failed, so I resorted to restarting the system and interrupting the boot process. The standard boot string is:

boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3

to which I added “single” to get the box to stop in single-user mode:

boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3 single

At that point, I did a ^D to continue with the startup process (necessary to mount the filesystems on from the USB flash drive) and then did a “passwd root” to change the root password.

After that, I was able to read all files on the system, including one named “gpio.config” which described a “diagnostic jumper” that would enable the Dropbear SSH server (needed if I wanted to remotely connect to the box instead of using the serial console). After tracing out some wiring, I found that J34 is the jumper in question, located here:

A quick scrounge through the parts box yielded an appropriate jumper:

And I had my SSH console working.

That’s it for now – in a subsequent article I will discuss building the NSS4000 software from the Linksys GPL distribution, as well as adding additional utilities.

UPDATE: The diag jumper also causes additional testing while in the PMON2000 monitor, as well as preventing unattended booting (since one of the PMON diagnostics fails, autoboot is disabled). A better way to enable the dropbear SSH server is to leave the diag jumper off and to edit line 26 of the file /linuxrwfs/etc/init.d/S02hwdep to read /usr/sbin/dropbear_start.sh instead of /usr/sbin/dropbear_stop.sh.

This entry was posted on Sunday, April 15th, 2007 at 9:56 pm and is filed under Computers. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

41 Responses to “Inside the Linksys NSS4000”

1
SunDown
September 10th, 2007 06:14
Nice stuff!
Do you know what pin 1 is for the console connector ?
2
polskikrol
January 8th, 2008 07:19
From your research with the NSS4000 were you able to determine what software is used for encrypting the volumes? Meaning, what would be the command line utilities / options to mount an encrypted volume by hand for this device given a know plaintext password?
3
Terri Kennedy
January 19th, 2008 18:10
I haven’t really looked into the encryption setup. However, there’s an industry-standard encryption accelerator in the NSS, either as a separate chip (NSS4000) or as part of the CPU chip (NSS6000). If you get to the console on the NSS, you should be able to look at the various startup scripts to see how the NSS does the mounting of encrypted volumes.
4
keendog
May 6th, 2008 11:06
This was useful information. Based on it I found another way to change the root password and start sshd. It involves using the feature on the web interface that stores and retrieves the configuration information.

One of the things that gets stored is a the crontab for root. So from there you can run /usr/sbin/chpasswd and run /usr/sbin/dropbear_start.sh as root.

The benefit of this is that you do not need hardware and you do not need to open the case.
5
atomek
May 20th, 2008 14:07
keendog, please write more about your metod.
6
rudy
May 22nd, 2008 08:12
great idea keendog, quick and “not dirty”

tomorrow i will finally have a working nss4000

thanks again
7
rlavigne
August 3rd, 2008 10:43
keendog, Thanks! That was really helpful.

Just a side note, the passwd & shadow files are also in the config. I was able to just copy and paste the encrypted password from my other user into root’s account in shadow, so no need for another cron job to change it.

Now, anyone know of a way to get a compiler on this thing, or how to setup a cross complier for it?
8
Lanlogic
August 19th, 2008 03:10
HI,

I’m able to view the console. And able to change the boot string. but after you wrote you start from a usb flash disk. What kind of image did you put on the flash disk? I’v got a nss6000.

I’m now in the Read-Only console….
9
Lanlogic
August 19th, 2008 04:43
Oke other solutions on NSS6000:

1. Start the nas in single mode.
2. Find rcS and run it ./rcS
3. Edit password with passwd root
4. Reboot
10
sumunod
November 11th, 2008 10:58
Ok I could really use some help with this. We have a ton of files that are all locked down on our NSS4000 (ghost images to be exact) and I can’t copy, move, rename, or change permissions on any of these files. That’s why I would like root access via SSH. I was able to cron the SSH server but none of the other solutions provided here regarding changing the root password have worked. I’ve tried cron’ing the root password change and I’ve tried copying the encrypted password text in the shadow file from a user I created and pasting it over top root’s password and no matter what I try when I attempt to login via SSH its telling me Access Denied. I’ve even tried changing the group permissions for my user created account to have root level access and I still can’t login SSH. PLEASE feel free to email me or post here sumunod AT gmail DOT com
11
Fishy
December 15th, 2008 10:59
Hi,
great solution Terri & keendog!

i successfully startet the ssh dameon on the nss4000, but can’t change the rootpw? have tried it as described above copy & paste in the shadowfile, nothing.
any ideas?

pls support
12
lunchboxfl
January 28th, 2009 11:49
Can someone explain to me keendog’s method. I have a nss4000. I do not see where to run the commands to enable ssh so that I can fix these permissions issues. Thanks for any help.
13
elwood
February 7th, 2009 03:22
Hello *,

what is the correct settings for the terminal program to connect the NSS6000 (or NSS4000?) over the console port?

Has someone information about the jumper (J28, J29, J31) on the NSS6000 Mainboard?

Many thanks!
14
vorgos
May 10th, 2009 22:47
Anyone know how to install a full blown distribution on the NSS6000? We are really unhappy with the restrictions/performace and general quality of the Linksys/Cisco version of the OS. They appear to be MIPS based and debian has builds for the MIPS architecture so it should be that hard…..
15
Terri Kennedy
May 10th, 2009 23:04
It probably wouldn’t be that difficult. The PMON2000 bootstrap will load from USB storage devices (in fact, that’s how the “red light recovery fix” works, which might provide some hints). You might take a look at the way alternative distributions were loaded on the Linksys NSLU2 for more info.
16
daniellysy
May 14th, 2009 02:16
Could you help me with NSS6000 ? I’ve used my NSS6000 almost 2 years,and suddenly when I reboot device 2 days ago all my shares disappears. I see that array is not empty in webgui but I can’t see any of my data (60 GB). Linksys support can’t help me. All I need is connect to device with eg. Winscp to copy my data to safe location. I am not Linux spec so could you create ready to use firmware for NSS6000 with workin ssh server, plaease?
17
Terri Kennedy
May 14th, 2009 02:29
I’m sorry, but the changes I made to the system were on a running NSS6000. I’ve never tried building a custom firmware update with the changes pre-applied and I don’t know if it is possible.

Even if you enable SSH, you’ll want root access which you won’t get without either a serial console or by doing some tricks with backing up / restoring the config from a USB drive.

I would *STRONGLY* advise you to not try changing any settings on the NSS until you have recovered your data.

If you can’t get support from Linksys (I thought they offered premium pay-per-case support) I think your best bet would be to set up the serial console as described in my post. You don’t need to change any software settings to boot in single-user mode as root. You should then be able to mount the filesystem(s) with your data (if they are un-damaged) and (for example) FTP the data to another system.

It sounds like you don’t have the in-house experience to do this – perhaps there is someone in your area that could assist you? As the hardware serial port is similar to that on the Linksys NSLU2, you might try asking in that community if there is someone near you who could assist: http://www.nslu2-linux.org
18
daniellysy
May 14th, 2009 03:18
Thanks very much, your feedback is important to me. Unfortunatly Linksys not offers pay-per-case support in Poland, there is only call center. And nobody in Linksys don’t have any tools to connect to device in other way than by share. I don’t believe in this. You shuld teach this guys :). So I will try to restore to factory defaults my NSS6000 and see is this change something.
19
Terri Kennedy
May 14th, 2009 03:27
I’ve sent you an email with some other ideas. As I said above and in that email, I’d recommend against making any config changes to the NSS until you are able to recover your data.
20
michel2k
July 10th, 2009 11:26
Hi Terri. My NSS4000 won’t work after a recovery of config files. I builded the console cable to read the messages from the startup:

/etc/init.d/S84httpds: line 18: /etc/global.conf: No such file or directory
/etc/init.d/S85httpd: line 18: /etc/global.conf: No such file or directory
/etc/init.d/S90samba: line 32: /etc/global.conf: No such file or directory

/etc/global.conf is a symbolic link to Global-NSS4000.conf. Global-NSS4000.conf does not exist anymore. I tried booting the kernel in single mode but it does not mount /dev and /etc. It is impossible for me to change to root password, since i cannot boot additional drives. (

Any ideas?
21
Terri Kennedy
July 10th, 2009 12:01
It sounds as though this problem should be covered by Linksys support as it would seem to be caused by a bug in their software.

Depending on whether you have your data backed up somewhere else, you could try updating the firmware (I’m not sure that does anything if you’re already at the latest version).

Unfortunately, it doesn’t seem as though the NSS has a “reset to factory defaults” that will help you – the front-panel reset button only resets the networking configuration, and the web interface allows resetting everything else. But from what you say, the web interface probably isn’t running.

There is a factorydefaults.tar.gz file in /factorydefaults on the NSS, which does contain a copy of the file you’re looking for. There are also various backup files (all ending in .nasbak) in /linusrwfs/etc, though I don’t think they’ll help in this case.

I’m sending some additional information to you via email.
22
ghesoide
July 27th, 2009 13:32
hi! one of my customer has the same problem of daniellysy from Poland (shares on NSS6000 disappeared); I would like to know if there’s a workaround to this issue and if daniellysy have fixed it! thanks
23
hobbes
February 20th, 2010 08:00
I have experienced the same symptoms on my NSS 6000 as daniellysy – after reboot, all shares on one of 2 volumes did not appear again, even after a fresh reboot. A very simple action solved the problem for me: After creating a new, empty share on the same volume, all the other shared reappeared, were accessible from clients and contained all the data. Firmware is 1.16.
24
ldillon
April 22nd, 2010 16:45
I believe I have a way to gain root access without opening the case.
If you backup the config to a USB drive, you get access to many critical system files in /etc

From here you can:
1. add a UID 0 account to passwd and shadow
2. edit exports to share / writeable (no_root_squash)
3. do basically the same thing to smb.conf
4. edit iptables to allow ssh
5. edit root’s crontab to run arbitrary commands

Not sure home to start ssh yet, but should be doable once you can browse the filesystem.

You need to do this with a “8 bit clean” editor (not notepad). I use vim under Windows.

Then remake the config.NAS._blah_.tar.gz and restore.

I haven’t tried this yet, but I can’t see why it wouldn’t work. If the above technique doesn’t make sense to you, I wouldn’t recommend trying it.
25
ldillon
April 23rd, 2010 10:49
There seems to be some checking going on — I was unable to export / via NFS.
26
jake@voipcitadel.com
September 4th, 2010 18:17
I wonder if this could be turned into an asterisk appliance box for a local storage system/low use PBX.

Interesting….
27
mem-nss
January 6th, 2011 08:17
I purchased and have been using a NSS6000 as my home storage for about a year now. Had to resign to the slow transfer rate, which for home its not much of a problem but certainly annoying waiting times.

Has a tweak/fix been released by anyone to address the Transfer rate “lock-down”?

Thanks, Mem./
28
Terri Kennedy
January 6th, 2011 18:33
@mem-nss – I don’t think it is a lockdown, more that the NSS4000/6000 boxes are just slow. Even when they were new, they didn’t benchmark as well as their competitors – for example, see this SmallNetBuilder review of the NSS4000 from 3.5 years ago. Frankly, if you don’t need the enterprise RAID / backup / etc. features, pretty much any current product (including a router with a portable HDD plugged in via USB) will probably out-perform it. If you look at the SmallNetBuilder review I linked above, there’s a link in there to their benchmark database. You can see how any new unit will perform, and at what price.

The NSS6000 has a “kitchen sink” MIPS CPU, the MSP8520 operating at 900MHz. It has to handle just about all of the work – it includes the CPU, memory controller, Ethernet controllers, security co-processor, etc.) and do it all in 512MB of main memory. That just isn’t going to be fast, no matter how you slice it. Just be glad that Linksys never introduced the 3rd model in this line-up (below the NSS4000). It was incredibly slow. [Note: The current Cisco-branded NSS boxes aren’t related to the Linksys ones other than by sharing the “NSS” designation.]

The fileservers I’m building for myself these days have plenty of firepower – the most recent ones use a pair of Xeon E5520 CPUs and have 48GB of RAM, with 32TB disk. Continuous throughput (measured over a 24-hour interval) is greater than 500Mbyte/sec. Burst throughput (10 seconds or less) is > 3Gbyte/sec. Look for an article about the design and build of my new servers in the future. In the meanwhile, here’s 2 teaser pics for you:
29
MGyHardSoft
March 26th, 2011 13:30
Hi All,

I found a perfect way to overcome the poor performance, something similar to Terri. Fortunately (really!) the power supply of my NSS6000 started to send diagnostic messages just before the end of the warranty period, so I gave back the unit and got back the money. I bought immediately a HP DL180G6 with a hardware RAID controller card, put the 4 x 2 TB HDD-s into it, installed openSUSE and now I can get some 100 MB/s throughput from it.
There are several drawbacks of this solution: the DL180 is MUCH more noisy so I had to put the whole thing to the loft. And it consumes remarkably more power so my electricity bill went higher.
BTW, Terri, I am very much interested in about your new fileservers design! If you have a spare time for the article, please publish it!

Thanks – M. Gy.
30
ldillon
April 15th, 2011 13:19
I know this thread is really old, but has anyone tried putting FreeNAS, Openfiler of just plain old command-line Linux on this? It’s starting to sound like the best way to overcome the (many) limitations, beyond hardware.
31
Terri Kennedy
April 17th, 2011 23:54
@ldillon – Underneath the web interface is a stripped-down Linux. If you contact Cisco via these instructions (PDF), they will send you a URL to download the complete open source tarball for the NSS4000/6000 (they are built from a common source). I don’t know if that tarball includes the toolchain or not.

You’ll also need a Linux cross-development environment for the MIPS target – even if you could compile natively on the NSS, it would take approximately forever.

The only “gotcha” is that you have the “recovery bootloader” between the normal bootstrap and whatever you’re trying to load. One of the early firmware updates trashed the flash-based bootloader, and the “quick fix” solution of the USB stick recovery bootloader was never improved on. That slows booting down by an unbelievable amount – if you connect a console cable, you’ll see the box flailing around for something like 5 minutes before it manages to load the actual OS.
32
jonathan
June 8th, 2011 11:00
Just in case someone, like me, is an unlucky owner of a NSS6000, here is how to start ssh daemon:
Use a USB stick to save the configuration
Explode the tarball and edit etc/sysconfig/iptables: modify the following lines:
-A DropSSH -p tcp -m tcp –dport 22 -j DROP
-A RejectSSH -p tcp -m tcp –dport 22 -j REJECT –reject-with icmp-port-unreachable
changing them into something useless (22 into 23, i.e.)
Add this line to etc/cron.d/root
*/10 * * * * /etc/udev/rules.d/dropbear_start.sh
Re-create the tarball-ed configuration and restore it to the NSS6000 through the web interface.
After few minutes, the restarted NSS6000 will magically open its ssh port…
33
m477
July 12th, 2011 21:18
hey guys, found a way to gain root access on the NSS4000.

Plug a usb stick in to the nas, backup the config and throw it in to your desktop.

You need to add the line to start the SSH daemon. Create a sudoers file in /etc/sudoers giving your nas user sudoers access to all.

Add another line to the cron to give the sudoers file 0440 permissions

SSH in, type sudo -s, enter password again and you have root access.

Happy rooting
34
ksmedts
August 17th, 2011 10:23
jonathan,

Hope you are still reading here!? I have troubles with my nss6000 (shares and folders dissapear!!!). So i need access to this this device through ssh with root and hopefully i can fix it!!!

I changed the files you mention above but i still can’t get into the device with putty!? What are the settings i need!? I’m using firmware NSS6000_FW_1.21.0

thx
35
Terri Kennedy
August 17th, 2011 14:14
@ksmedts – Yes, I’m still here. But I gave away my NSS’s quite a few years ago, so I don’t have any suggestions for you. You might try some of the techniques posted by others in the comments section.
36
an4linu
August 18th, 2011 10:24
Terri you are such a nice hacker. Thanx for the article.

For the information of all unlucky soles who own a NSS6000 . I was able to run debian mips on these box. I am able to see much better performance with a home grown RFS.

I was able to get console with steps mentioned in the article and found it is running a MIPS RM9K based processor in BE mode ( opposed to NSS4000 which is having RM7K in LE) .

root@nas05527b ~]# cat /proc/cpuinfo
system type : PMC-Sierra PM74100
Hardware Revision : 3
processor : 0
cpu model : RM9000 V12.1 FPU V2.0
BogoMIPS : 899.07
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : no
hardware watchpoint : yes
ASEs implemented :
VCED exceptions : not available
VCEI exceptions : not available

Following debian mips how to (http://wiki.debian.org/EmDebian/DeBootstrap ) I have created simple rootfile system.

and booted using nfs ( RFS in external USB also worked)

For the time being I am using kernel flashed in onboard storage. I am working on creting custom kernel from GPL sources from cisco website.

Here is the command I used to boot.

boot -n -x /dev/sd0@0x100 root=/dev/nfs nfsroot=:/tmp/root ip=dhcp

If you want to boot from external USB connected.

install MIPS RFS in USB stick. Plug-in to any of the usb slot.

boot with following command

boot -n -x /dev/sd0@0x100 root=/dev/sdb1 ( or whatever node your USB disk is getting detected )

Enjoy!!!!
37
an4linu
August 18th, 2011 10:29
BTW can be used to break default execution

Autoboot command: “boot -n -x -w30 /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3”
Press to execute now or any other key to abort.
5
PMON>

Thanks
38
an4linu
August 18th, 2011 10:33
I mean “SPACE KEY” can be used . ( not sure who ate it when I wrote ” ” )
39
an4linu
August 18th, 2011 11:52
PMON2000 MIPS Initializing. Standby…
ERRORPC=801015fc CONFIG=0042e4bb STATUS=00000000
CPU PRID 000034c1, MaskID 00001220
Initializing caches…done (CONFIG=0042e4bb)
Switching to runtime address map…done
Setting up SDRAM controller: sdram config 0x80010000
master clock 100 Mhz, MulFundBIU 0x02, DivXSDRAM 0x02
sdram freq 0x09ef21aa hz, sdram period: 0x06 nsec
dimm0: density 512Mbit, width 8, single-sided, unbuffered, size 0x20000000
supported CAS latency: 2.5 2, using 2.5 cycles, byte18=0x0c
RAS to CAS delay (tRCD) 0x12 nsec, byte29=0x48
setting bank timing tRCD to 0x03 cycles
precharge to bank activation delay (tRP) 0x12 nsec, byte27=0x48
setting bank timing tRP to 0x03 cycles
bank activation delay and refresh recovery (tRC) 0x3c nsec, byte41=0x00
setting bank timing tRC to 0x0a cycles
minimum auto-refresh to active/auto-refresh (tRFC) 0x48 nsec, byte42=0x00
setting bank timing tRFC to 0x0c cycles
reduced refresh rate of 7800 nsec, byte12=0x82
setting bank timing tREF to 0x0050 cycles
bank1: base 0x00000000 size 0x20000000 timing 0x6050a486 cfg 0x00000031
LKB1 0x00000001 LKM1 0x01ffff00
dimm1: not present
SDRAM setup complete
Testing first MB of RAM…
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! Clearing first 1MB of memory…done
Copy PMON to execute location…done
PMON stack at 8000f800
Booting compressed image

PMON2000 MIPS Initializing (RAM loaded, compressed). Standby…
Copy PMON to execute location…done
PMON stack at 8000f800
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! mainbus0 (root)
localbus0 at mainbus0
rme: found device 0x9155, version 1
rme0 at localbus0: adr 00:18:f8:05:52:7b
rme0: descriptors in SDRAM
rme0: 64 tx descriptors at 0x9fc07000 size 0x800
rme0: 64 rx descriptors at 0x9fc89800 size 0x800
eephy0 at rme0 phy 1: Marvell 88E1111 Gigabit PHY, rev. 2
rme0: enabling pad mode
rme1 at localbus0: adr 00:18:f8:05:52:7c
rme1: descriptors in SDRAM
rme1: 64 tx descriptors at 0x9fc89000 size 0x800
rme1: 64 rx descriptors at 0x9fcca800 size 0x800
eephy1 at rme1 phy 2: Marvell 88E1111 Gigabit PHY, rev. 2
rme1: enabling pad mode
pcibr0 at mainbus0
pci0 at pcibr0 bus 0
vendor “Promise”, unknown product 0x3d18 rev 0x02 at pci0 dev 2 function 0 not configured
pcibr1 at mainbus0
pci1 at pcibr1 bus 1
ohci0 at pci1 dev 2 function 0 “NEC USB” rev 0x43: generic poll, version 1.0
usb1 at ohci0: USB revision 1.0
uhub1 at usb1
uhub1: class 9/0 rev 1.00/1.00, addr 1
uhub1: 3 ports with 3 removable, self powered
ohci1 at pci1 dev 2 function 1 “NEC USB” rev 0x43: generic poll, version 1.0
usb2 at ohci1: USB revision 1.0
uhub2 at usb2
uhub2: class 9/0 rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ehci0 at pci1 dev 2 function 2 “NEC USB” rev 0x04: generic poll
ehci0: EHCI version 1.0
ehci0: companion controllers, 3 ports each: ohci0 ohci1
usb0 at ehci0: USB revision 2.0
uhub0 at usb0
uhub0: class 9/0 rev 2.00/1.00, addr 1
uhub0: 5 ports with 5 removable, self powered
pcibr2 at mainbus0
pci2 at pcibr2 bus 2
umass0 at uhub1 port 1 configuration 1 interface 0
umass0: rev 2.00/2.00, addr 2 using umass0 over SCSI
scsibus0 at umass0: 2 targets
sd0 at scsibus0 targ 1 lun 0: SCSI2 0/direct removable
sd0: 499MB, 499 cyl, 64 head, 32 sec, 512 bytes/sec, 1022976 sec total
System init done.

Configuration [PM74100,EB,NET,SCSI]
Version: PMON2000 3.1.22-B024 (PM74100) #1: Wed Sep 26 11:11:24 PDT 2007.
Supported loaders [srec, elf, bin]
Supported filesystems [net, fat, disk, tty, ram]
This software may be redistributed under the BSD copyright.
BSP Copyright 2004, PMC-Sierra, Inc.
CPU E9000 @ 899.78 MHz
Memory size 512 MB.
Primary Instruction cache size 16KB (32 line, 4 way)
Primary Data cache size 16KB (32 line, 4 way)
Secondary cache size 256KB

Diagnostic Test Started
===============================================================
PCI test started ………………
Testing PCI device NEC USB Controller… OK
Testing PCI device Promise SATA Controller… OK
PCI test finished …………….. SUCCESS
USB test started ………………
USB test finished …………….. SUCCESS
MDI test started ………………
Testing MDIO PHY_ADDR 0x1
MDI test finished …………….. SUCCESS
MDI test started ………………
Testing MDIO PHY_ADDR 0x2
MDI test finished …………….. SUCCESS
I2C test started ………………
Testing LM96000 device 0x2c
I2C test finished …………….. SUCCESS
I2C test started ………………
Testing LM96000 device 0x2c
I2C test finished …………….. SUCCESS
RTC test started ………………
Setting the time as Sun Jan 1 00:00:00 GMT 2006
RTC test finished …………….. SUCCESS
Mfg 40, Id 80
Could not find Flash Area to write
***************************************************************
* Diagnostic Test Status of this device *
***************************************************************
* Memory – 512MB *
* Memory Test – SUCCESS *
* PCI Device – SUCCESS *
* NEC USB Controller – SUCCESS *
* Promise SATA Controller – SUCCESS *
* USB OnBaord FLASH – SUCCESS *
* MDIO PHY1 – SUCCESS *
* MDIO PHY2 – SUCCESS *
* LM96000-1 – SUCCESS *
* LM96000-2 – SUCCESS *
* RTC setting – SUCCESS *
* UDI Programming – FAILED *
***************************************************************

Diagnostic test completed. Test Status – FAILURE

===============================================================
Hit any key to return to PMON prompt or power down.
>
Autoboot command: “boot -n -x -w30 /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3”
Press to execute now or any other key to abort.
4
PMON> boot -n -x /dev/sd0@0x100 root=/dev/nfs nfsroot=172.16.48.51:/mnt/mips ip=dhcp
Loading file: /dev/sd0@0x100 [elf32] [mips4] [32bitmode]
ffffffff80100000/461098(4591768) + ffffffff80561098/22f74(z) ehci_shutdown: stopping the HC
ohci_shutdown: stopping the HC
ohci_shutdown: stopping the HC
Halting rme1
Halting rme0
Linux version 2.6.18 (paanoop1@blr-lab03) (gcc version 4.3.5 (GCC) ) #1 Sat Aug 13 06:39:56 IST 2011
memory size 512MB
cpu_clock set to 899780000
CPU revision is: 000034c1
FPU revision is: 00003420
PMC-Sierra PM74100 Board Setup
32-bit support
Determined physical RAM map:
memory: 20000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 131072
Kernel command line: root=/dev/nfs nfsroot=172.16.48.51:/mnt/mips ip=dhcp
Primary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Secondary cache size 256K, linesize 32 bytes.
Synthesized TLB refill handler (27 instructions).
Synthesized TLB load handler fastpath (39 instructions).
Synthesized TLB store handler fastpath (39 instructions).
Synthesized TLB modify handler fastpath (38 instructions).
PID hash table entries: 4096 (order: 12, 16384 bytes)
Using 449.890 MHz high precision timer.
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 513920k/524288k available (3362k kernel code, 10160k reserved, 977k data, 144k init, 0k highmem)
Internal UART Support for PMC-Sierra Sequoia
You are using the Dallas DS1501 RTC.
UDI: initializing
UDI: found UDI at offset 0xc0012000
UDI: V2 info format
UDI: hardware revision is 3
UDI: available
Mount-cache hash table entries: 512
Checking for ‘wait’ instruction… available.
powerdn: pwdnInit
powerdn: pwdnSetupHandler-using IRQ 10
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
PCI: Failed to allocate mem resource #2:20000000@e0000000 for 0000:00:01.0
PCI: Failed to allocate mem resource #2:20000000@e8000000 for 0000:01:01.0
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 6, 262144 bytes)
TCP bind hash table entries: 32768 (order: 5, 131072 bytes)
TCP: Hash tables configured (established 65536 bind 32768)
TCP reno registered
UDI: created “/proc/manuinfo” entry
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.1 (2006/08/19) Phillip Lougher
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
NTFS driver 2.1.27 [Flags: R/O].
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
SGI XFS with ACLs, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Blinking the green power LED (32).
Generic RTC Driver v1.07
pmc: starting kernel kthread
Watchdog Timer (Sequoia) Initialized
is_watchdog_running()(0x0), decrement_bit (0x1), WDT_0 Timeout Value (0x0)…
watchdog_init(): Did not spawn sequoia_wdt_ctrl_kthread…
Serial: 8250/16550 driver $Revision: 1.6 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xc0000000 (irq = 0) is a 16550A
serial8250: ttyS1 at MMIO 0xc0000030 (irq = 0) is a 16550A
loop: loaded (max 8 devices)
PMC-Sierra MSP85x0 10/100/1000 Ethernet Driver
Device Id : 206014, Version : 0
MSP85x0 GE Driver version 1.4
PHY OUI: 3 Model: c Rev: 2
Rx NAPI supported, Tx Coalescing ON
eth0: port 0 with MAC address 00:18:f8:05:52:7b
PHY OUI: 3 Model: c Rev: 2
Rx NAPI supported, Tx Coalescing ON
eth1: port 1 with MAC address 00:18:f8:05:52:7c
Board Hardware Revision: 3
libata: Powering drive 1 (gpio 8)
libata: Powering drive 2 (gpio 9)
libata: Powering drive 3 (gpio 10)
libata: Powering drive 4 (gpio 11)
ata1: SATA max UDMA/133 cmd 0xC001E200 ctl 0xC001E238 bmdma 0x0 irq 11
ata2: SATA max UDMA/133 cmd 0xC001E280 ctl 0xC001E2B8 bmdma 0x0 irq 11
ata3: SATA max UDMA/133 cmd 0xC001E300 ctl 0xC001E338 bmdma 0x0 irq 11
ata4: SATA max UDMA/133 cmd 0xC001E380 ctl 0xC001E3B8 bmdma 0x0 irq 11
scsi0 : sata_promise
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
ata1.00: ATA-7, max UDMA/133, 490234752 sectors: LBA48 NCQ (depth 0/32)
ata1.00: ata1: dev 0 multi count 0
ata1.00: configured for UDMA/133
scsi1 : sata_promise
ata2: SATA link down (SStatus 0 SControl 300)
scsi2 : sata_promise
ata3: SATA link down (SStatus 0 SControl 300)
scsi3 : sata_promise
ata4: SATA link down (SStatus 0 SControl 300)
Vendor: ATA Model: WDC WD2500YS-01S Rev: 20.0
Type: Direct-Access ANSI SCSI revision: 05
SCSI device sda: 490234752 512-byte hdwr sectors (251000 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
SCSI device sda: 490234752 512-byte hdwr sectors (251000 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
sda:
sd 0:0:0:0: Attached scsi disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
ehci_hcd 0000:01:02.2: EHCI Host Controller
ehci_hcd 0000:01:02.2: new USB bus registered, assigned bus number 1
ehci_hcd 0000:01:02.2: irq 13, io mem 0xe8802000
ehci_hcd 0000:01:02.2: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 5 ports detected
ohci_hcd 0000:01:02.0: OHCI Host Controller
ohci_hcd 0000:01:02.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:01:02.0: irq 13, io mem 0xe8800000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 3 ports detected
ohci_hcd 0000:01:02.1: OHCI Host Controller
ohci_hcd 0000:01:02.1: new USB bus registered, assigned bus number 3
ohci_hcd 0000:01:02.1: irq 13, io mem 0xe8801000
usb 1-1: new high speed USB device using ehci_hcd and address 2
usb usb3: configuration #1 chosen from 1 choice
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 2 ports detected
Initializing USB Mass Storage driver…
usb 2-1: new full speed USB device using ohci_hcd and address 2
usb 2-1: not running at top speed; connect to a high speed hub
usb 2-1: configuration #1 chosen from 1 choice
scsi4 : SCSI emulation for USB Mass Storage devices
Vendor: ITE TECH Model: PEN DRIVE Flash Rev: 2.20
Type: Direct-Access ANSI SCSI revision: 02
scsiglue: Trying to match USB boot device params:
Parent device number: [1]
Parent device port: [0]
Device bus number: [2]
Device state: [7]
Device speed: [2]
scsiglue: Got USB boot device match!
Device name: USB FLASH STORAGE
Device manufacturer: ITE TEC. INC.
Device serial: 000000000005002
Device bus: 2
Device bus name: [0000:01:02.0]
sd: Hooray! Discovered SCSI boot device!
host_no [4], channel [0], id [0], lun [0]
SCSI device sdb: 1022976 512-byte hdwr sectors (524 MB)
sdb: Write Protect is off
sdb: assuming drive cache: write through
SCSI device sdb: 1022976 512-byte hdwr sectors (524 MB)
sdb: Write Protect is off
sdb: assuming drive cache: write through
sdb: sdb1 sdb2 sdb3 sdb4
SCSI device scsibd: 1022976 512-byte hdwr sectors (524 MB)
scsibd: Write Protect is off
scsibd: assuming drive cache: write through
scsibd: scsibd1 scsibd2 scsibd3 scsibd4
sd 4:0:0:0: Attached scsi removable disk scsibd
sd 4:0:0:0: Attached scsi generic sg1 type 0
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver hiddev
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.6:USB HID core driver
DS15x1 NVRAM driver v1.0
i2c /dev entries driver
hwmon-vid: Unknown VRM version of your CPU
hwmon-vid: Unknown VRM version of your CPU
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid10 personality registered for level 10
raid6: int32x1 152 MB/s
raid6: int32x2 190 MB/s
raid6: int32x4 248 MB/s
raid6: int32x8 149 MB/s
raid6: using algorithm int32x4 (248 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
8regs : 483.000 MB/sec
8regs_prefetch: 467.000 MB/sec
32regs : 1116.000 MB/sec
32regs_prefetch: 1034.000 MB/sec
raid5: using function: 32regs (1116.000 MB/sec)
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: bitmap version 4.39
device-mapper: ioctl: 4.7.0-ioctl (2006-06-24) initialised: dm-devel@redhat.com
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
Station MAC : 7b 52 05 f8 18 00
: 1000 Mbps : Full Duplex
Station MAC : 7c 52 05 f8 18 00
Not able to resolve the link status
Sending DHCP requests ., OK
IP-Config: Got DHCP answer from 172.16.48.50, my address is 172.16.48.140
IP-Config: Complete:
device=eth0, addr=172.16.48.140, mask=255.255.255.0, gw=172.16.48.1,
host=172.16.48.140, domain=pmc-sierra.bc.ca, nis-domain=(none),
bootserver=172.16.48.50, rootserver=172.16.48.51, rootpath=
md: Skipping autodetection of RAID arrays.
md: md0 stopped.
Looking up port of RPC 100003/2 on 172.16.48.51
Looking up port of RPC 100005/1 on 172.16.48.51
VFS: Mounted root (nfs filesystem) readonly.
Freeing unused kernel memory: 144k freed
INIT: version 2.86 booting
Starting the hotplug events dispatcher: udevd.
Synthesizing the initial hotplug events…done.
Waiting for /dev to be fully populated…done.
Activating swap…done.
Cleaning up ifupdown….
Loading kernel modules…done.
Assembling MD arrays…done (disabled in /etc/default/mdadm).
Checking file systems…fsck 1.41.3 (12-Oct-2008)
done.
Setting kernel variables (/etc/sysctl.conf)…done.
Mounting local filesystems…done.
Activating swapfile swap…done.
Setting up networking….
Configuring network interfaces…done.
Starting portmap daemon….
Starting NFS common utilities: statd failed!
INIT: Entering runlevel: 2
Starting enhanced syslogd: rsyslogd.
Starting OpenBSD Secure Shell server: sshd.
Starting MTA: exim4.
Starting network benchmark server.
Starting NFS common utilities: statd failed!
Exporting directories for NFS kernel daemon…exportfs: Warning: /mnt/mips does not support NFS export.
.
Starting NFS kernel daemon: nfsd
Starting MD monitoring service: mdadm –monitor.
Starting periodic command scheduler: crond.

Debian GNU/Linux 5.0 an4linu-desktop ttyS0

an4linu-desktop login:
40
mem-nss
November 13th, 2013 04:38
@ KeenDog (or anyone that can help)

Can we expand on what files I need to modify, there locations in the Backup, and what lines need to be modified how precisely? To gain root access via remote ssh shell, after a restore of the modified backup config…

I need access to shell, to run file permission repairs, as some shares have become “crazy”.

Thanks in advance.
mem-nss

================
keendog
May 6th, 2008 11:06
This was useful information. Based on it I found another way to change the root password and start sshd. It involves using the feature on the web interface that stores and retrieves the configuration information.

One of the things that gets stored is a the crontab for root. So from there you can run /usr/sbin/chpasswd and run /usr/sbin/dropbear_start.sh as root.

The benefit of this is that you do not need hardware and you do not need to open the case.
41
jagarciam
January 20th, 2016 13:55
Hi, an4linu, could you please update your progress on nss4000/nss6000 firmware creation?

You must be logged in to post a comment.

Inside the Linksys NSS4000

41 Responses to “Inside the Linksys NSS4000”

Leave a Reply

Random thoughts from the mind of Terri Kennedy

Pages

Category

Search

Archives

Most Viewed

Recent Posts

Recent Comments

LINKS

Info

Meta