{"id":8,"date":"2007-04-15T21:56:14","date_gmt":"2007-04-16T02:56:14","guid":{"rendered":"http:\/\/www.glaver.org\/blog\/?p=8"},"modified":"2015-10-08T23:08:47","modified_gmt":"2015-10-09T03:08:47","slug":"inside-the-linksys-nss4000","status":"publish","type":"post","link":"https:\/\/www.glaver.org\/blog\/?p=8","title":{"rendered":"Inside the Linksys NSS4000"},"content":{"rendered":"

UPDATED May 4th, 2007<\/strong><\/p>\n

Today we’ll take a look inside the Linksys NSS4000. This is the entry-level unit in the Linksys One network storage family. You can read the official Linksys literature\u00a0\u00a0here<\/a>, but technical info is rather lacking there (they don’t even say how much RAM is in the unit).<\/p>\n

\u00a0First, let’s take a look at the mainboard (click the image to enlarge):<\/p>\n

\"image\"<\/a><\/p>\n

The processor is a PMC-Sierra RM7035C, part of the MIPS family, running at 600MHz. A PM8172 system controller provides the interface for most other peripheral controllers\u00a0on the board, as well as being the attachment point for the system’s 128KB of Hynix SDRAM. Other notable\u00a0components are an ITE IT8712 Super\u00a0I\/O controller and IT8907E\u00a0USB flash controller, connected to a 512MB Samsung\u00a0flash chip; Promise PDC40518 SATA controller; NEC UPD720101 USB 2.0 controller;\u00a0\u00a0SafeXcel 1741 security co-processor; two Marvell Yukon Lite 10\/100\/1000 Ethernet controllers (under heat sinks), and a MX 29LV800CBTC 1MB boot flash.<\/p>\n

Upon initial observation, there is a 4-pin connector labeled “J29 CONSOLE” near the back edge of the board:<\/p>\n

\"image\"<\/a><\/p>\n

It turns out that this connector has the exact same pinout as the Linksys NSLU2’s serial port, as described here<\/a>. Linksys was even nice enough to pre-install a connector for us. I made a cable out of an old Sound Blaster cable (connectors \/ pins) and a piece of USB cable (wire). There is just enough room to snake the cable into the chassis via the RPS (Redundant Power System) connector opening on the rear:<\/p>\n

\"image\"<\/a><\/p>\n

This was enough to get a serial console working, to observe the bootstrap procedure. Here is a complete log of the boot process, from PMON start through the Linux login prompt:<\/p>\n

PMON2000 MIPS Initializing. Standby...ERRORPC=80102c4c CONFIG=404664b0 STATUS=00410000 \r\nCPU PRID 00002753 \r\nInitializing SDRAM controller \r\nClearing first 1MB of memory...done \r\nSizing caches... \r\nInitializing L1 cache...done \r\nInitializing L2 cache...enabling...done \r\nTesting first MB of RAM... \r\nWlk-1 OK! Wlk-0 OK! OwnAddr OK! Copy PMON to execute location...done \r\nBooting compressed image. \r\nWlk-1 OK! Wlk-0 OK! OwnAddr OK! mainbus0 (root) \r\npcibr0 at mainbus0 \r\npci0 at pcibr0 bus 0 \r\nvendor \"ITExpress\", unknown product 0x0801 rev 0xb1 at pci0 dev 1 function 0 not configured \r\nvendor \"ITExpress\", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 1 not configured \r\nohci0 at pci0 dev 1 function 3 vendor \"ITExpress\", unknown product 0x1234 rev 0x07: generic poll, version 1.0, legacy support \r\nusb1 at ohci0: USB revision 1.0 \r\nuhub1 at usb1 \r\nuhub1: class 9\/0 rev 1.00\/1.00, addr 1 \r\nuhub1: 2 ports with 2 removable, self powered \r\nvendor \"ITExpress\", unknown product 0x8172 rev 0x11 at pci0 dev 1 function 4 not configured \r\nvendor \"ITExpress\", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 6 not configured \r\n\"SafeNet SafeXcel\" rev 0x01 at pci0 dev 16 function 0 not configured \r\nohci1 at pci0 dev 17 function 0 \"NEC USB\" rev 0x43: generic poll, version 1.0 \r\nusb2 at ohci1: USB revision 1.0 \r\nuhub2 at usb2 \r\nuhub2: class 9\/0 rev 1.00\/1.00, addr 1 \r\nuhub2: 3 ports with 3 removable, self powered \r\nohci2 at pci0 dev 17 function 1 \"NEC USB\" rev 0x43: generic poll, version 1.0 \r\nusb3 at ohci2: USB revision 1.0 \r\nuhub3 at usb3 \r\nuhub3: class 9\/0 rev 1.00\/1.00, addr 1 \r\nuhub3: 2 ports with 2 removable, self powered \r\nehci0 at pci0 dev 17 function 2 \"NEC USB\" rev 0x04: generic poll \r\nehci0: EHCI version 1.0 \r\nehci0: companion controllers, 3 ports each: ohci1 ohci2 \r\nusb0 at ehci0: USB revision 2.0 \r\nuhub0 at usb0 \r\nuhub0: class 9\/0 rev 2.00\/1.00, addr 1 \r\nuhub0: 5 ports with 5 removable, self powered \r\nskc0 at pci0 dev 18 function 0 \"Marvell Yukon 88E8001\/8003\/8010\" rev 0x10, Marvell Yukon Lite (0x9): generic poll \r\nsk0 at skc0 port A, address aa:bb:cc:dd:ee:ff \r\neephy0 at sk0 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 \r\nvendor \"Promise\", unknown product 0x3d18 rev 0x02 at pci0 dev 19 function 0 not configured \r\nskc1 at pci0 dev 20 function 0 \"Marvell Yukon 88E8001\/8003\/8010\" rev 0x10, Marvell Yukon Lite (0x9): generic poll \r\nsk1 at skc1 port A, address aa:bb:cc:dd:ee:ff \r\neephy1 at sk1 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 \r\numass0 at uhub0 port 1 configuration 1 interface 0 \r\numass0: rev 2.00\/2.00, addr 2 using umass0 over SCSI \r\nscsibus0 at umass0: 2 targets \r\nsd0 at scsibus0 targ 1 lun 0: <\/ite> SCSI2 0\/direct removable \r\nsd0: 499MB, 499 cyl, 64 head, 32 sec, 512 bytes\/sec, 1022976 sec total \r\nSystem init done.Configuration [PM74101,EL,NET,SCSI] \r\nVersion: PMON2000 3.1.17-B019 (PM74101) #0: Mon Jan  8 12:24:25 PST 2007. \r\nSupported loaders [srec, elf, bin] \r\nSupported filesystems [net, fat, disk, tty, ram] \r\nThis software may be redistributed under the BSD copyright. \r\nCopyright 2005, PMC-Sierra, Inc. \r\nCPU RM7000 @ 601.28 MHz \/ Bus @ 100.21 MHz \r\nMemory size 128 MB. \r\nPrimary Instruction cache size 16KB (32 line, 4 way) \r\nPrimary Data cache size 16KB (32 line, 4 way) \r\nSecondary cache size 256KB \r\nDiagnostic Test Started \r\n=============================================================== \r\nPCI test started .................. \r\nTesting PCI Device NEC USB Controller \r\nTesting PCI Device Promise SATA Controller \r\nTesting PCI Device Marvell Gigabit Ethernet Controller \r\nTesting PCI Device Safenet SafeXel encryptor \r\nPCI test finished .................  SUCCESS \r\nUSB test started .................. \r\nUSB test finished .................  SUCCESS \r\nLPC test started .................. \r\nTesting LPC Environment Controller \r\nTesting LPC GPIO Controller \r\nLPC: GPIO Controller Passed \r\nLPC test finished .................  SUCCESS \r\nRTC test started .................. \r\nSetting the time as Sun Jan  1 00:00:00 GMT 2006 \r\nRTC test finished .................  SUCCESS \r\nMfg  0, Id  0 \r\nCould not find Flash Area to write \r\n*************************************************************** \r\n*            Diagnostic Test Status of this device            * \r\n*************************************************************** \r\n* Memory Test                               -   SUCCESS       * \r\n* NEC USB Controller                        -   SUCCESS       * \r\n* Promise SATA Controller                   -   SUCCESS       * \r\n* Marvell Gigabit Ethernet Controller       -   SUCCESS       * \r\n* Safenet SafeXel encryptor                 -   SUCCESS       * \r\n* USB OnBoard FLASH                         -   SUCCESS       * \r\n* LPC Device                                -   SUCCESS       * \r\n* LPC: Environment Controller               -   SUCCESS       * \r\n* LPC: GPIO Controller                      -   SUCCESS       * \r\n* RTC setting                               -   SUCCESS       * \r\n* UDI Programming                           -   FAILED        * \r\n*************************************************************** \r\nDiagnostic test completed. Test Status - FAILURE \r\n=============================================================== \r\nHit any key to return to PMON prompt or power down. \r\n> \r\nAutoboot command: \"boot \/dev\/sd0@0x100 root=\/dev\/scsibd2 hwrev=3\" \r\nPress <\/enter> to execute now or any other key to abort. \r\n\u00a01 \r\nLoading file: \/dev\/sd0@0x100 [elf32] [mips4] [32bitmode] \r\nffffffff80100000\/53d085(5492869) + ffffffff8063d085\/22f9b(z) + ehci_shutdown: stopping the HC \r\nohci_shutdown: stopping the HC \r\nohci_shutdown: stopping the HC \r\nohci_shutdown: stopping the HC \r\nsetting pci bus 0 device 1 function 0 reg 10 to default: 0x14017001 \r\nsetting pci bus 0 device 1 function 5 reg 20 to default: 0x01401780 \r\nLinux version 2.6.18 (build@schnitzel) (gcc version 3.3.6) #1 Fri Jan 26 02:36:34 PST 2007 \r\nUDI: initializing \r\nUDI: found UDI at offset 0xa80ff000 \r\nUDI: V2 info format \r\nUDI: hardware revision is 3 \r\nUDI: available \r\nmemsize: 128 \r\nMemory size: 128MB \r\nCPU revision is: 00002753 \r\nFPU revision is: 00002750 \r\nFound IT8712 Super IO \r\nDetermined physical RAM map: \r\n\u00a0memory: 08000000 @ 00000000 (usable) \r\nBuilt 1 zonelists.  Total pages: 32768 \r\nKernel command line: root=\/dev\/scsibd2 hwrev=3 console=ttyS0,115200 \r\nPrimary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes. \r\nPrimary data cache 16kB, 4-way, linesize 32 bytes. \r\nSecondary cache size 256K, linesize 32 bytes. \r\nSynthesized TLB refill handler (23 instructions). \r\nSynthesized TLB load handler fastpath (35 instructions). \r\nSynthesized TLB store handler fastpath (35 instructions). \r\nSynthesized TLB modify handler fastpath (34 instructions). \r\nPID hash table entries: 1024 (order: 10, 4096 bytes) \r\ncalculating r4koff... 0012597e(1202558) \r\nCPU frequency 601.28 MHz \r\nUsing 300.640 MHz high precision timer. \r\nDentry cache hash table entries: 16384 (order: 4, 65536 bytes) \r\nInode-cache hash table entries: 8192 (order: 3, 32768 bytes) \r\nMemory: 123264k\/131072k available (4092k kernel code, 7664k reserved, 1107k data , 164k init, 0k highmem) \r\nMount-cache hash table entries: 512 \r\nChecking for 'wait' instruction...  available. \r\nNET: Registered protocol family 16 \r\nSCSI subsystem initialized \r\nusbcore: registered new driver usbfs \r\nusbcore: registered new driver hub \r\nNET: Registered protocol family 2 \r\nIP route cache hash table entries: 1024 (order: 0, 4096 bytes) \r\nTCP established hash table entries: 4096 (order: 2, 16384 bytes) \r\nTCP bind hash table entries: 2048 (order: 1, 8192 bytes) \r\nTCP: Hash tables configured (established 4096 bind 2048) \r\nTCP reno registered \r\nUDI: created \"\/proc\/manuinfo\" entry \r\nVFS: Disk quotas dquot_6.5.1 \r\nDquot-cache hash table entries: 1024 (order 0, 4096 bytes) \r\nsquashfs: version 3.1 (2006\/08\/19) Phillip Lougher \r\nInstalling knfsd (copyright (C) 1996 okir@monad.swb.de). \r\nNTFS driver 2.1.27 [Flags: R\/O]. \r\nJFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. \r\nSGI XFS with ACLs, large block numbers, no debug enabled \r\nSGI XFS Quota Management subsystem \r\nInitializing Cryptographic API \r\nio scheduler noop registered \r\nio scheduler anticipatory registered \r\nio scheduler deadline registered \r\nio scheduler cfq registered (default) \r\nit8172 fixup: Configuring Audio adapter 0000:00:01.0 \r\nGeneric RTC Driver v1.07 \r\nGPIO poller thread started. \r\nGPIO at 0x14013800 (irq = 20) \r\npowerdn: pwdnInit \r\nWatchdog Timer (ITE 8712) Initialized \r\nis_watchdog_running()(0x0), WDT Timeout Value (0x0)... \r\nwatchdog_init(): Did not spawn it8712_wdt_ctrl_kthread... \r\nSerial: 8250\/16550 driver $Revision: 1.6 $ 4 ports, IRQ sharing disabled \r\nserial8250: ttyS0 at I\/O 0x14011800 (irq = 23) is a 16550A \r\nserial8250: ttyS1 at I\/O 0x140003f8 (irq = 4) is a 16550A \r\nserial8250: ttyS2 at I\/O 0x14012000 (irq = 24) is a 16550A \r\nserial8250: ttyS3 at I\/O 0x14012800 (irq = 25) is a 16550A \r\nloop: loaded (max 8 devices) \r\nskge 1.6 addr 0x10104000 irq 39 chip Yukon-Lite rev 9 \r\nskge eth0: addr aa:bb:cc:dd:ee:ff \r\nskge 1.6 addr 0x10108000 irq 40 chip Yukon-Lite rev 9 \r\nskge eth1: addr aa:bb:cc:dd:ee:ff \r\ntun: Universal TUN\/TAP device driver, 1.6 \r\ntun: (C) 1999-2004 Max Krasnyansky <\/maxk@qualcomm.com> \r\nBoard Hardware Revision: 3 \r\nlibata: Powering drive 1 (gpio 19) \r\nlibata: Powering drive 2 (gpio 18) \r\nlibata: Powering drive 3 (gpio 17) \r\nlibata: Powering drive 4 (gpio 16) \r\nata1: SATA max UDMA\/133 cmd 0xB010E200 ctl 0xB010E238 bmdma 0x0 irq 41 \r\nata2: SATA max UDMA\/133 cmd 0xB010E280 ctl 0xB010E2B8 bmdma 0x0 irq 41 \r\nata3: SATA max UDMA\/133 cmd 0xB010E300 ctl 0xB010E338 bmdma 0x0 irq 41 \r\nata4: SATA max UDMA\/133 cmd 0xB010E380 ctl 0xB010E3B8 bmdma 0x0 irq 41 \r\nscsi0 : sata_promise \r\nata1: SRST failed (status 0xFF) \r\nata1: SRST failed (err_mask=0x100) \r\nata1: softreset failed, retrying in 5 secs \r\nata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) \r\nata1.00: ATA-7, max UDMA\/133, 781422768 sectors: LBA48 NCQ (depth 0\/32) \r\nata1.00: configured for UDMA\/133 \r\nscsi1 : sata_promise \r\nata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300) \r\nata2.00: ATA-7, max UDMA\/133, 781422768 sectors: LBA48 NCQ (depth 0\/32) \r\nata2.00: configured for UDMA\/133 \r\nscsi2 : sata_promise \r\nata3: SATA link up 1.5 Gbps (SStatus 113 SControl 300) \r\nata3.00: ATA-7, max UDMA\/133, 781422768 sectors: LBA48 NCQ (depth 0\/32) \r\nata3.00: configured for UDMA\/133 \r\nscsi3 : sata_promise \r\nata4: SATA link up 1.5 Gbps (SStatus 113 SControl 300) \r\nata4.00: ATA-7, max UDMA\/133, 781422768 sectors: LBA48 NCQ (depth 0\/32) \r\nata4.00: configured for UDMA\/133 \r\n\u00a0 Vendor: ATA       Model: ST3400832AS       Rev: 3.01 \r\n\u00a0 Type:   Direct-Access                      ANSI SCSI revision: 05 \r\n\u00a0 Vendor: ATA       Model: ST3400832AS       Rev: 3.01 \r\n\u00a0 Type:   Direct-Access                      ANSI SCSI revision: 05 \r\n\u00a0 Vendor: ATA       Model: ST3400832AS       Rev: 3.01 \r\n\u00a0 Type:   Direct-Access                      ANSI SCSI revision: 05 \r\n\u00a0 Vendor: ATA       Model: ST3400832AS       Rev: 3.01 \r\n\u00a0 Type:   Direct-Access                      ANSI SCSI revision: 05 \r\nSCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) \r\nsda: Write Protect is off \r\nSCSI device sda: drive cache: write back \r\nSCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) \r\nsda: Write Protect is off \r\nSCSI device sda: drive cache: write back \r\n\u00a0sda: \r\nsd 0:0:0:0: Attached scsi disk sda \r\nSCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdb: Write Protect is off \r\nSCSI device sdb: drive cache: write back \r\nSCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdb: Write Protect is off \r\nSCSI device sdb: drive cache: write back \r\n\u00a0sdb: \r\nsd 1:0:0:0: Attached scsi disk sdb \r\nSCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdc: Write Protect is off \r\nSCSI device sdc: drive cache: write back \r\nSCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdc: Write Protect is off \r\nSCSI device sdc: drive cache: write back \r\n\u00a0sdc: \r\nsd 2:0:0:0: Attached scsi disk sdc \r\nSCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdd: Write Protect is off \r\nSCSI device sdd: drive cache: write back \r\nSCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) \r\nsdd: Write Protect is off \r\nSCSI device sdd: drive cache: write back \r\n\u00a0sdd: \r\nsd 3:0:0:0: Attached scsi disk sdd \r\nsd 0:0:0:0: Attached scsi generic sg0 type 0 \r\nsd 1:0:0:0: Attached scsi generic sg1 type 0 \r\nsd 2:0:0:0: Attached scsi generic sg2 type 0 \r\nsd 3:0:0:0: Attached scsi generic sg3 type 0 \r\nphysmap-flash.0: failed to claim resource 0 \r\nehci_hcd 0000:00:11.2: EHCI Host Controller \r\nehci_hcd 0000:00:11.2: new USB bus registered, assigned bus number 1 \r\nehci_hcd 0000:00:11.2: irq 40, io mem 0x1010f000 \r\nehci_hcd 0000:00:11.2: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 \r\nusb usb1: configuration #1 chosen from 1 choice \r\nhub 1-0:1.0: USB hub found \r\nhub 1-0:1.0: 5 ports detected \r\nohci_hcd 0000:00:01.3: Itentionally disabling ITE USB controller. \r\nohci_hcd 0000:00:01.3: init 0000:00:01.3 fail, -19 \r\nohci_hcd 0000:00:11.0: OHCI Host Controller \r\nohci_hcd 0000:00:11.0: new USB bus registered, assigned bus number 2 \r\nohci_hcd 0000:00:11.0: irq 38, io mem 0x1010c000 \r\nusb usb2: configuration #1 chosen from 1 choice \r\nhub 2-0:1.0: USB hub found \r\nhub 2-0:1.0: 3 ports detected \r\nohci_hcd 0000:00:11.1: OHCI Host Controller \r\nohci_hcd 0000:00:11.1: new USB bus registered, assigned bus number 3 \r\nohci_hcd 0000:00:11.1: irq 39, io mem 0x1010d000 \r\nusb 1-1: new high speed USB device using ehci_hcd and address 2 \r\nusb usb3: configuration #1 chosen from 1 choice \r\nhub 3-0:1.0: USB hub found \r\nhub 3-0:1.0: 2 ports detected \r\nusb 1-1: configuration #1 chosen from 1 choice \r\nInitializing USB Mass Storage driver... \r\nscsi4 : SCSI emulation for USB Mass Storage devices \r\n\u00a0 Vendor: ITE TECH  Model:  PEN DRIVE Flash  Rev: 2.20 \r\n\u00a0 Type:   Direct-Access                      ANSI SCSI revision: 02 \r\nHooray! Discovered SCSI boot device! \r\nhost_no [4], channel [0], id [0], lun [0] \r\nSCSI device sde: 1022976 512-byte hdwr sectors (524 MB) \r\nsde: Write Protect is off \r\nsde: assuming drive cache: write through \r\nSCSI device sde: 1022976 512-byte hdwr sectors (524 MB) \r\nsde: Write Protect is off \r\nsde: assuming drive cache: write through \r\n\u00a0sde: sde1 sde2 sde3 sde4 \r\nSCSI device scsibd: 1022976 512-byte hdwr sectors (524 MB) \r\nscsibd: Write Protect is off \r\nscsibd: assuming drive cache: write through \r\n\u00a0scsibd: scsibd1 scsibd2 scsibd3 scsibd4 \r\nsd 4:0:0:0: Attached scsi removable disk scsibd \r\nsd 4:0:0:0: Attached scsi generic sg4 type 0 \r\nusbcore: registered new driver usb-storage \r\nUSB Mass Storage support registered. \r\nusbcore: registered new driver hiddev \r\nusbcore: registered new driver usbhid \r\ndrivers\/usb\/input\/hid-core.c: v2.6:USB HID core driver \r\nNon-volatile memory driver v1.0 \r\ni2c \/dev entries driver \r\nInitialize ITE IIC adapter module \r\n\u00a0found device at 0x14014030 irq 0. \r\nITE iic (i2c) algorithm module \r\nit87: Device not activated, enabling \r\nit87: Found IT8712F chip at 0x290, revision 8 \r\nhwmon-vid: Unknown VRM version of your CPU \r\nmd: linear personality registered for level -1 \r\nmd: raid0 personality registered for level 0 \r\nmd: raid1 personality registered for level 1 \r\nmd: raid10 personality registered for level 10 \r\nraid6: int32x1    129 MB\/s \r\nraid6: int32x2    152 MB\/s \r\nraid6: int32x4    217 MB\/s \r\nraid6: int32x8    170 MB\/s \r\nraid6: using algorithm int32x4 (217 MB\/s) \r\nmd: raid6 personality registered for level 6 \r\nmd: raid5 personality registered for level 5 \r\nmd: raid4 personality registered for level 4 \r\nraid5: measuring checksumming speed \r\n\u00a0  8regs     :   550.000 MB\/sec \r\n\u00a0  8regs_prefetch:   519.000 MB\/sec \r\n\u00a0  32regs    :   643.000 MB\/sec \r\n\u00a0  32regs_prefetch:   602.000 MB\/sec \r\nraid5: using function: 32regs (643.000 MB\/sec) \r\nmd: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27 \r\nmd: bitmap version 4.39 \r\ndevice-mapper: ioctl: 4.7.0-ioctl (2006-06-24) initialised: dm-devel@redhat.com \r\nip_tables: (C) 2000-2006 Netfilter Core Team \r\nTCP bic registered \r\nNET: Registered protocol family 1 \r\nNET: Registered protocol family 17 \r\n802.1Q VLAN Support v1.8 Ben Greear <\/greearb@candelatech.com> \r\nAll bugs added by David S. Miller <\/davem@redhat.com> \r\ndrivers\/rtc\/hctosys.c: unable to open rtc device (rtc0) \r\nmd: Autodetecting RAID arrays. \r\nmd: autorun ... \r\nmd: ... autorun DONE.\r\nRoot device (\"\/dev\/scsibd2\") is now online. \r\nVFS: Mounted root (squashfs filesystem) readonly. \r\nFreeing unused kernel memory: 164k freed \r\nDoing sysinit \r\nMounting procfs \r\nMounting sysfs \r\nStarting udev \r\nMounting nfsd \r\nMounting tmpfs on \/var (limited to [5242880] bytes) \r\nMounting tmpfs on \/tmp \r\nMounting tmpfs on \/mnt (limited to [131072] bytes) \r\nCreating dev entries for mtdblock devices... \r\nBoot device was \/dev\/scsibd, making partitions and \r\nmounting linuxrtconfig on \/linuxrwfs (jffs2)... \r\ntrying to mount jffs2 as rw partition... \r\nblock2mtd: version $Revision: 1.1.1.3 $ \r\nactual jffs2 partition erase size will be [0x20000]... \r\nblock2mtd: default erase size is [4096] \r\nblock2mtd: mtd0: [d: \/dev\/scsibd1] erase_size = 128KiB [131072] \r\nblock2mtd module loaded successfully. \r\njffs2 will use mtdblock0 \r\nTrying to mount jffs2 on \/linuxrwfs... \r\nblock2mtd: Overrun end of disk in cache readahead \r\njffs2 mounted on \/linuxrwfs \r\nStarting udevd... \r\nStarting udevtrigger... \r\nStarting udevsettle... \r\nMaking useful softlinks... \r\nRemoving hotplug... \r\nMounting devpts... \r\nStart executing startup scripts... \r\n\/etc\/init.d\/S01sysinit(start): doing some sysinit stuff... \r\nDirty shutdown counter looks good... \r\nDirty shutdown count is [3] \r\nPrevious shutdown was dirty, message to user set... \r\nChecking the sanity of the rw file system... \r\nSoftlinking \/dev\/sd0 to \/dev\/scsibd (bootenv may need it)... \r\n\/etc\/init.d\/S01sysinit(start): OK \r\n\/etc\/init.d\/S02checkroot(start): OK \r\n\/etc\/init.d\/S02hwdep(start): Fixing gpio.conf files... \r\nBoard hardware revision is [3]. \r\ngpio.conf already exists (OK) \r\n\/etc\/init.d\/S03modules(start): OK \r\n\/etc\/init.d\/S04raid(start): Starting up raids... \r\nMaking additional md devices... \r\nUpdating exports... \r\nfound \/etc\/nas\/spindown -- setting new spindown timeout... \r\nSATA spindown timeout set to 86400 seconds... \r\nDefault RAID metadata version is 1.2 . \r\nThere is no \/etc\/nas\/uuids_stopped file -- starting all available arrays... \r\nmd: md0 stopped. \r\nmd: bind<\/sdb> \r\nmd: bind<\/sdc> \r\nmd: bind<\/sdd> \r\nmd: bind<\/sda> \r\nmd: md0: raid array is not clean -- starting background reconstruction \r\nraid5: device sda operational as raid disk 0\r\nraid5: device sdd operational as raid disk 3 \r\nraid5: device sdc operational as raid disk 2 \r\nraid5: device sdb operational as raid disk 1 \r\nraid5: allocated 4212kB for md0 \r\nraid5: raid level 5 set md0 active with 4 out of 4 devices, algorithm 2 \r\nRAID5 conf printout: \r\n\u00a0--- rd:4 wd:4 fd:0 \r\n\u00a0disk 0, o:1, dev:sda \r\n\u00a0disk 1, o:1, dev:sdb \r\n\u00a0disk 2, o:1, dev:sdc \r\n\u00a0disk 3, o:1, dev:sdd \r\nmd: syncing RAID array md0 \r\nmd: minimum _guaranteed_ reconstruction speed: 1000 KB\/sec\/disc. \r\nmd: using maximum available idle IO bandwidth (but not more than 7000 KB\/sec) for reconstruction. \r\nmd: using 128k window, over a total of 390711232 blocks. \r\nmd: resuming recovery of md0 from checkpoint. \r\nmdadm: \/dev\/md\/0 has been started with 4 drives. \r\n1853 \r\n\/etc\/init.d\/S04raid(start): OK \r\n\/etc\/init.d\/S05lvm(start): Starting up lvm... \r\n\u00a0 Reading all physical volumes.  This may take a while... \r\n\u00a0 Found volume group \"RAIDA\" using metadata type lvm2 \r\n\u00a0 WARNING: This metadata update is NOT backed up \r\n\u00a0 WARNING: This metadata update is NOT backed up \r\n\u00a0 1 logical volume(s) in volume group \"RAIDA\" now active \r\n\/etc\/init.d\/S05lvm(start): OK \r\n\/etc\/init.d\/S06mount(start): Mounting file systems... \r\nRunning 70's disco mount... \r\n\u00a0 Reading all physical volumes.  This may take a while... \r\n\u00a0 Found volume group \"RAIDA\" using metadata type lvm2 \r\n\u00a0 WARNING: This metadata update is NOT backed up \r\n\u00a0 WARNING: This metadata update is NOT backed up \r\n\u00a0 1 logical volume(s) in volume group \"RAIDA\" now active \r\nChecking for RAIDA - TEST \r\nUpdated Fstab...[\/dev\/RAIDA\/TEST        \/mnt\/RAIDA\/TEST] \r\nCheck mount point for \/mnt\/RAIDA\/TEST \r\nMount point DOES NOT exist \r\nFilesystem \"dm-0\": Disabling barriers, not supported by the underlying device \r\nXFS mounting filesystem dm-0 \r\nStarting XFS recovery on filesystem: dm-0 (logdev: internal) \r\nEnding XFS recovery on filesystem: dm-0 (logdev: internal) \r\nAdding include path \/mnt\/RAIDA\/TEST\/.config\/smb.conf \r\nUpdated Fstab...[\/mnt\/RAIDA\/TEST\/share1 \/mnt\/ftp_dir\/share1] \r\n\u00a0 Reading all physical volumes.  This may take a while... \r\n\u00a0 Found volume group \"RAIDA\" using metadata type lvm2 \r\n\u00a0 WARNING: This metadata update is NOT backed up \r\n\/etc\/init.d\/S06mount(start): OK \r\n\/etc\/init.d\/S07mtd(start): Making read-only mtd character devices... \r\n\/etc\/init.d\/S07mtd(start): OK \r\n\/etc\/init.d\/S08tmpfs(start): Preparing tmpfs directories... \r\nMaking directories in \/var: \r\n+run... \r\n+log directories and files (httpd, messages, wtmp, lastlog, cups, samba)... \r\n+cache... \r\n+empty... \r\n+ftp... \r\n+spool directories (cups, cron)... \r\n+tmp... \r\n+lock directories (apache, lvm, subsys, samba)... \r\n+lib directories (nfs, snmp)... \r\n+state directories... \r\n+yp directories... \r\n+samba private dir... \r\nDone making \/var directories. \r\nMaking anon ftp user dir... \r\n\/etc\/init.d\/S08tmpfs(start): OK \r\n\/etc\/init.d\/S09sensors(start): Setting up sensors ... \r\n\/etc\/init.d\/S09sensors(start): OK \r\nInitializing random number generator... done. \r\n\/etc\/init.d\/S21fixrandom(start): Fixing random devices... \r\n\/etc\/init.d\/S21fixrandom(start): OK \r\n\/etc\/init.d\/S25safenet(start): Starting crypto (loading aes)... \r\n\/etc\/init.d\/S25safenet(start): OK \r\n\/etc\/init.d\/S30certs(start): Generating self-signing certs (if necessary)... \r\n\/etc\/init.d\/S30certs(start): OK \r\nFlushing all current rules and user defined chains: SUCCESS: \r\nClearing all current rules and user defined chains: SUCCESS: \r\nApplying iptables firewall rules:  SUCCESS: \r\nSetting hostname:  NAS0018f804fa07 \r\nStarting network... \r\n+starting loopback interface \r\nDynamic network was not running lo \r\nudhcpc was not running for lo \r\nAutoipd was not running for lo \r\nNo bonding device present. \r\nDevice lo is present and available \r\nThis is not a slave device \r\n\u00a0DHCP not used on device lo \r\n\u00a0Bringing up lo \r\narping: Interface lo is not ARPable \r\nUpdating ARP cache of other devices on this subnet. Please wait 2 sec. \r\narping: Interface lo is not ARPable \r\nARP tables updated successfully. \r\nAdding route add 127.0.0.0\/8 dev lo \r\n+starting ifplugd... \r\nStarting Network Interface Plugging Daemon:No bonding device present. \r\nbond0 \r\nDoing insmode for bonding module... \r\nEthernet Channel Bonding Driver: v3.0.3 (March 23, 2006) \r\nbonding: MII link monitoring set to 100 ms \r\nDevice bond0 is present and available \r\nThis is a master device. Bringing link down and then up. \r\nBringing up master link for bond. \r\nDynamic network was not running eth0 \r\nudhcpc was not running for eth0 \r\nAutoipd was not running for eth0 \r\nNo bonding device present. \r\nDevice eth0 is present and available \r\nEnslaving eth0 to bond0 \r\nbonding: bond0: enslaving eth0 as a backup interface with a down link. \r\nDynamic network was not running eth1 \r\nudhcpc was not running for eth1 \r\nAutoipd was not running for eth1 \r\nNo bonding device present. \r\nDevice eth1 is present and available \r\nEnslaving eth1 to bond0 \r\nbonding: bond0: enslaving eth1 as a backup interface with a down link. \r\nRestarting vblade service \r\nStopping \/sbin\/nas_vblade...OK \r\nRestoring raw socket buffer sizes...OK \r\nskge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx \r\nbonding: bond0: link status up for interface eth0, enabling it in 200 ms. \r\nbonding: bond0: link status definitely up for interface eth0. \r\nbonding: bond0: making interface eth0 the new active one. \r\nbonding: bond0: first active interface up! \r\nStopping \/sbin\/nas_vblade...OK \r\nudhcpc[2175]: udhcpc (v0.9.9-pre) started \r\nskge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx \r\nudhcpc[2175]: Sending discover... \r\n. \r\nWaiting for network (60 second max): \r\n\u00a0+ (try#1\/12) Currently 1 active interfaces: \r\n\u00a0  + bond0 : IP address not set \r\nudhcpc[2175]: Sending discover... \r\nudhcpc[2175]: Sending select for 10.20.30.40... \r\nudhcpc[2175]: Lease of 10.20.30.40 obtained, lease time 86400 \r\n\u00a0+ (try#2\/12) Currently 1 active interfaces: \r\n\u00a0  + bond0 : 10.20.30.40 \r\nNET OK: All active interfaces are online. \r\nStarting Disk Aggregation Server... \r\nStopping \/sbin\/nas_vblade...OK \r\nStarting ntpd: syncing (timeout in 20 seconds): OK \r\nStarting \/sbin\/portmap: OK \r\nStarting dropbear (from tcpserver): OK \r\nStarting \/sbin\/rpc.statd: OK \r\nStarting nfs services: \r\nStarting nfs quotas: \r\nStarting nfs daemon: \r\nStarting nfs mountd: \r\n\/etc\/init.d\/S60vsftpd: setting maximum 2 connections \r\n\/etc\/init.d\/S60vsftpd: setting maximum 2 connections per IP \r\nStarting vsftpd (from tcpserver): OK \r\n\/etc\/init.d\/S82httpdswiw: setting maximum 99 connections \r\n\/etc\/init.d\/S82httpdswiw: setting maximum 99 connections per IP \r\nStarting httpdswiw (from tcpserver): OK \r\nStarting httpdsl1 (from tcpserver): OK \r\n\/etc\/init.d\/S84httpds: setting maximum 99 connections \r\n\/etc\/init.d\/S84httpds: setting maximum 99 connections per IP \r\nStarting httpds (from tcpserver): OK \r\n\/etc\/init.d\/S85httpd: setting maximum 99 connections \r\n\/etc\/init.d\/S85httpd: setting maximum 99 connections per IP \r\nStarting httpd (from tcpserver): OK \r\nStarting UPnP daemon: OK \r\n\/etc\/init.d\/S90samba: setting maximum 15 connections \r\nStarting samba: secrets.tdb : 1 records \r\nOK \r\nStarting winbind daemon: OK \r\nStarting CRON daemon: OK \r\nStarting auto nice daemon:\/usr\/sbin\/and[2500]: Configuration file is: \/etc\/and.conf \r\n\/usr\/sbin\/and[2500]: Priority database is: \/etc\/and.priorities \r\n\/usr\/sbin\/and[2500]: AND ready. \r\n\u00a0done \r\nStarting Discovery Agent daemon: OK \r\nStarting mDNSPosix daemon: \r\n\u00a0+Writing \/tmp\/mDNSPosix.conf...OK \r\n\/etc\/init.d\/S99local(start): Finalizing system startup... \r\nwatchdog not started (userland have to keep it that way). \r\n\u00a0 +starting gpio_poller --disable-watchdog (watchdog is disabled)... \r\nIndicating that boot was OK... \r\nSetting bootstate to A0... \r\nUnsetting bootcount... \r\nbootcount: No matching variable to unset \r\nWarning: couldn't unset bootcount. \r\n\/etc\/init.d\/S99local(start): OK<\/pre>\n
My next task was to determine a working login username and password. Fortunately, the same username and password that is used for the NSS4000’s web interface will work (as an unprivileged user) on the serial console. Unfortunately, attempts to guess the root password failed, so I resorted to restarting the system and interrupting the boot process. The standard boot string is:<\/p>\n
boot \/dev\/sd0@0x100 root=\/dev\/scsibd2 hwrev=3<\/p>\n
to which\u00a0I added “single” to get the box to stop in single-user mode:<\/p>\n
boot \/dev\/sd0@0x100 root=\/dev\/scsibd2 hwrev=3 single<\/p>\n
At that point, I did a ^D to continue with the startup process (necessary to mount the filesystems on from the USB flash drive) and then did a “passwd root” to change the root password.<\/p>\n
After that, I was able to read all files on the system, including one named “gpio.config” which described a “diagnostic jumper” that would enable the Dropbear SSH server (needed if I wanted to remotely connect to the box instead of using the serial console). After tracing out some wiring, I found that J34 is the jumper in question, located here:<\/p>\n
\"image\"<\/a><\/p>\n
A quick scrounge through the parts box yielded an appropriate jumper:<\/p>\n
\"image\"<\/a><\/p>\n
And I had my SSH console working.<\/p>\n
That’s it for now – in a subsequent article I will discuss building the NSS4000 software from the Linksys GPL distribution, as well as adding additional utilities.<\/p>\n
UPDATE:<\/strong> The diag jumper also causes additional testing while in the PMON2000 monitor, as well as preventing unattended booting (since one of the PMON diagnostics fails, autoboot is disabled). A better way to enable the dropbear SSH server is to leave the diag jumper off and to edit line 26 of the file \/linuxrwfs\/etc\/init.d\/S02hwdep to read \/usr\/sbin\/dropbear_start.sh instead of \/usr\/sbin\/dropbear_stop.sh.<\/p>\n","protected":false},"excerpt":{"rendered":"
UPDATED May 4th, 2007 Today we’ll take a look inside the Linksys NSS4000. This is the entry-level unit in the Linksys One network storage family. You can read the official Linksys literature\u00a0\u00a0here, but technical info is rather lacking there (they don’t even say how much RAM is in the unit). \u00a0First, let’s take a look […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8"}],"collection":[{"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8"}],"version-history":[{"count":3,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8\/revisions"}],"predecessor-version":[{"id":830,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8\/revisions\/830"}],"wp:attachment":[{"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.glaver.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}