UPDATED May 4th, 2007

Today we’ll take a look inside the Linksys NSS4000. This is the entry-level unit in the Linksys One network storage family. You can read the official Linksys literature  here, but technical info is rather lacking there (they don’t even say how much RAM is in the unit).

 First, let’s take a look at the mainboard (click the image to enlarge):

The processor is a PMC-Sierra RM7035C, part of the MIPS family, running at 600MHz. A PM8172 system controller provides the interface for most other peripheral controllers on the board, as well as being the attachment point for the system’s 128KB of Hynix SDRAM. Other notable components are an ITE IT8712 Super I/O controller and IT8907E USB flash controller, connected to a 512MB Samsung flash chip; Promise PDC40518 SATA controller; NEC UPD720101 USB 2.0 controller;  SafeXcel 1741 security co-processor; two Marvell Yukon Lite 10/100/1000 Ethernet controllers (under heat sinks), and a MX 29LV800CBTC 1MB boot flash.

Upon initial observation, there is a 4-pin connector labeled “J29 CONSOLE” near the back edge of the board:

It turns out that this connector has the exact same pinout as the Linksys NSLU2’s serial port, as described here. Linksys was even nice enough to pre-install a connector for us. I made a cable out of an old Sound Blaster cable (connectors / pins) and a piece of USB cable (wire). There is just enough room to snake the cable into the chassis via the RPS (Redundant Power System) connector opening on the rear:

This was enough to get a serial console working, to observe the bootstrap procedure. Here is a complete log of the boot process, from PMON start through the Linux login prompt:

PMON2000 MIPS Initializing. Standby...ERRORPC=80102c4c CONFIG=404664b0 STATUS=00410000 
CPU PRID 00002753 
Initializing SDRAM controller 
Clearing first 1MB of memory...done 
Sizing caches... 
Initializing L1 cache...done 
Initializing L2 cache...enabling...done 
Testing first MB of RAM... 
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! Copy PMON to execute location...done 
Booting compressed image. 
Wlk-1 OK! Wlk-0 OK! OwnAddr OK! mainbus0 (root) 
pcibr0 at mainbus0 
pci0 at pcibr0 bus 0 
vendor "ITExpress", unknown product 0x0801 rev 0xb1 at pci0 dev 1 function 0 not configured 
vendor "ITExpress", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 1 not configured 
ohci0 at pci0 dev 1 function 3 vendor "ITExpress", unknown product 0x1234 rev 0x07: generic poll, version 1.0, legacy support 
usb1 at ohci0: USB revision 1.0 
uhub1 at usb1 
uhub1: class 9/0 rev 1.00/1.00, addr 1 
uhub1: 2 ports with 2 removable, self powered 
vendor "ITExpress", unknown product 0x8172 rev 0x11 at pci0 dev 1 function 4 not configured 
vendor "ITExpress", unknown product 0x8172 rev 0x10 at pci0 dev 1 function 6 not configured 
"SafeNet SafeXcel" rev 0x01 at pci0 dev 16 function 0 not configured 
ohci1 at pci0 dev 17 function 0 "NEC USB" rev 0x43: generic poll, version 1.0 
usb2 at ohci1: USB revision 1.0 
uhub2 at usb2 
uhub2: class 9/0 rev 1.00/1.00, addr 1 
uhub2: 3 ports with 3 removable, self powered 
ohci2 at pci0 dev 17 function 1 "NEC USB" rev 0x43: generic poll, version 1.0 
usb3 at ohci2: USB revision 1.0 
uhub3 at usb3 
uhub3: class 9/0 rev 1.00/1.00, addr 1 
uhub3: 2 ports with 2 removable, self powered 
ehci0 at pci0 dev 17 function 2 "NEC USB" rev 0x04: generic poll 
ehci0: EHCI version 1.0 
ehci0: companion controllers, 3 ports each: ohci1 ohci2 
usb0 at ehci0: USB revision 2.0 
uhub0 at usb0 
uhub0: class 9/0 rev 2.00/1.00, addr 1 
uhub0: 5 ports with 5 removable, self powered 
skc0 at pci0 dev 18 function 0 "Marvell Yukon 88E8001/8003/8010" rev 0x10, Marvell Yukon Lite (0x9): generic poll 
sk0 at skc0 port A, address aa:bb:cc:dd:ee:ff 
eephy0 at sk0 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 
vendor "Promise", unknown product 0x3d18 rev 0x02 at pci0 dev 19 function 0 not configured 
skc1 at pci0 dev 20 function 0 "Marvell Yukon 88E8001/8003/8010" rev 0x10, Marvell Yukon Lite (0x9): generic poll 
sk1 at skc1 port A, address aa:bb:cc:dd:ee:ff 
eephy1 at sk1 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5 
umass0 at uhub0 port 1 configuration 1 interface 0 
umass0: rev 2.00/2.00, addr 2 using umass0 over SCSI 
scsibus0 at umass0: 2 targets 
sd0 at scsibus0 targ 1 lun 0:  SCSI2 0/direct removable 
sd0: 499MB, 499 cyl, 64 head, 32 sec, 512 bytes/sec, 1022976 sec total 
System init done.Configuration [PM74101,EL,NET,SCSI] 
Version: PMON2000 3.1.17-B019 (PM74101) #0: Mon Jan  8 12:24:25 PST 2007. 
Supported loaders [srec, elf, bin] 
Supported filesystems [net, fat, disk, tty, ram] 
This software may be redistributed under the BSD copyright. 
Copyright 2005, PMC-Sierra, Inc. 
CPU RM7000 @ 601.28 MHz / Bus @ 100.21 MHz 
Memory size 128 MB. 
Primary Instruction cache size 16KB (32 line, 4 way) 
Primary Data cache size 16KB (32 line, 4 way) 
Secondary cache size 256KB 
Diagnostic Test Started 
=============================================================== 
PCI test started .................. 
Testing PCI Device NEC USB Controller 
Testing PCI Device Promise SATA Controller 
Testing PCI Device Marvell Gigabit Ethernet Controller 
Testing PCI Device Safenet SafeXel encryptor 
PCI test finished .................  SUCCESS 
USB test started .................. 
USB test finished .................  SUCCESS 
LPC test started .................. 
Testing LPC Environment Controller 
Testing LPC GPIO Controller 
LPC: GPIO Controller Passed 
LPC test finished .................  SUCCESS 
RTC test started .................. 
Setting the time as Sun Jan  1 00:00:00 GMT 2006 
RTC test finished .................  SUCCESS 
Mfg  0, Id  0 
Could not find Flash Area to write 
*************************************************************** 
*            Diagnostic Test Status of this device            * 
*************************************************************** 
* Memory Test                               -   SUCCESS       * 
* NEC USB Controller                        -   SUCCESS       * 
* Promise SATA Controller                   -   SUCCESS       * 
* Marvell Gigabit Ethernet Controller       -   SUCCESS       * 
* Safenet SafeXel encryptor                 -   SUCCESS       * 
* USB OnBoard FLASH                         -   SUCCESS       * 
* LPC Device                                -   SUCCESS       * 
* LPC: Environment Controller               -   SUCCESS       * 
* LPC: GPIO Controller                      -   SUCCESS       * 
* RTC setting                               -   SUCCESS       * 
* UDI Programming                           -   FAILED        * 
*************************************************************** 
Diagnostic test completed. Test Status - FAILURE 
=============================================================== 
Hit any key to return to PMON prompt or power down. 
> 
Autoboot command: "boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3" 
Press  to execute now or any other key to abort. 
 1 
Loading file: /dev/sd0@0x100 [elf32] [mips4] [32bitmode] 
ffffffff80100000/53d085(5492869) + ffffffff8063d085/22f9b(z) + ehci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
ohci_shutdown: stopping the HC 
setting pci bus 0 device 1 function 0 reg 10 to default: 0x14017001 
setting pci bus 0 device 1 function 5 reg 20 to default: 0x01401780 
Linux version 2.6.18 (build@schnitzel) (gcc version 3.3.6) #1 Fri Jan 26 02:36:34 PST 2007 
UDI: initializing 
UDI: found UDI at offset 0xa80ff000 
UDI: V2 info format 
UDI: hardware revision is 3 
UDI: available 
memsize: 128 
Memory size: 128MB 
CPU revision is: 00002753 
FPU revision is: 00002750 
Found IT8712 Super IO 
Determined physical RAM map: 
 memory: 08000000 @ 00000000 (usable) 
Built 1 zonelists.  Total pages: 32768 
Kernel command line: root=/dev/scsibd2 hwrev=3 console=ttyS0,115200 
Primary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes. 
Primary data cache 16kB, 4-way, linesize 32 bytes. 
Secondary cache size 256K, linesize 32 bytes. 
Synthesized TLB refill handler (23 instructions). 
Synthesized TLB load handler fastpath (35 instructions). 
Synthesized TLB store handler fastpath (35 instructions). 
Synthesized TLB modify handler fastpath (34 instructions). 
PID hash table entries: 1024 (order: 10, 4096 bytes) 
calculating r4koff... 0012597e(1202558) 
CPU frequency 601.28 MHz 
Using 300.640 MHz high precision timer. 
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) 
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) 
Memory: 123264k/131072k available (4092k kernel code, 7664k reserved, 1107k data , 164k init, 0k highmem) 
Mount-cache hash table entries: 512 
Checking for 'wait' instruction...  available. 
NET: Registered protocol family 16 
SCSI subsystem initialized 
usbcore: registered new driver usbfs 
usbcore: registered new driver hub 
NET: Registered protocol family 2 
IP route cache hash table entries: 1024 (order: 0, 4096 bytes) 
TCP established hash table entries: 4096 (order: 2, 16384 bytes) 
TCP bind hash table entries: 2048 (order: 1, 8192 bytes) 
TCP: Hash tables configured (established 4096 bind 2048) 
TCP reno registered 
UDI: created "/proc/manuinfo" entry 
VFS: Disk quotas dquot_6.5.1 
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) 
squashfs: version 3.1 (2006/08/19) Phillip Lougher 
Installing knfsd (copyright (C) 1996 okir@monad.swb.de). 
NTFS driver 2.1.27 [Flags: R/O]. 
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. 
SGI XFS with ACLs, large block numbers, no debug enabled 
SGI XFS Quota Management subsystem 
Initializing Cryptographic API 
io scheduler noop registered 
io scheduler anticipatory registered 
io scheduler deadline registered 
io scheduler cfq registered (default) 
it8172 fixup: Configuring Audio adapter 0000:00:01.0 
Generic RTC Driver v1.07 
GPIO poller thread started. 
GPIO at 0x14013800 (irq = 20) 
powerdn: pwdnInit 
Watchdog Timer (ITE 8712) Initialized 
is_watchdog_running()(0x0), WDT Timeout Value (0x0)... 
watchdog_init(): Did not spawn it8712_wdt_ctrl_kthread... 
Serial: 8250/16550 driver $Revision: 1.6 $ 4 ports, IRQ sharing disabled 
serial8250: ttyS0 at I/O 0x14011800 (irq = 23) is a 16550A 
serial8250: ttyS1 at I/O 0x140003f8 (irq = 4) is a 16550A 
serial8250: ttyS2 at I/O 0x14012000 (irq = 24) is a 16550A 
serial8250: ttyS3 at I/O 0x14012800 (irq = 25) is a 16550A 
loop: loaded (max 8 devices) 
skge 1.6 addr 0x10104000 irq 39 chip Yukon-Lite rev 9 
skge eth0: addr aa:bb:cc:dd:ee:ff 
skge 1.6 addr 0x10108000 irq 40 chip Yukon-Lite rev 9 
skge eth1: addr aa:bb:cc:dd:ee:ff 
tun: Universal TUN/TAP device driver, 1.6 
tun: (C) 1999-2004 Max Krasnyansky  
Board Hardware Revision: 3 
libata: Powering drive 1 (gpio 19) 
libata: Powering drive 2 (gpio 18) 
libata: Powering drive 3 (gpio 17) 
libata: Powering drive 4 (gpio 16) 
ata1: SATA max UDMA/133 cmd 0xB010E200 ctl 0xB010E238 bmdma 0x0 irq 41 
ata2: SATA max UDMA/133 cmd 0xB010E280 ctl 0xB010E2B8 bmdma 0x0 irq 41 
ata3: SATA max UDMA/133 cmd 0xB010E300 ctl 0xB010E338 bmdma 0x0 irq 41 
ata4: SATA max UDMA/133 cmd 0xB010E380 ctl 0xB010E3B8 bmdma 0x0 irq 41 
scsi0 : sata_promise 
ata1: SRST failed (status 0xFF) 
ata1: SRST failed (err_mask=0x100) 
ata1: softreset failed, retrying in 5 secs 
ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata1.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata1.00: configured for UDMA/133 
scsi1 : sata_promise 
ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata2.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata2.00: configured for UDMA/133 
scsi2 : sata_promise 
ata3: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata3.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata3.00: configured for UDMA/133 
scsi3 : sata_promise 
ata4: SATA link up 1.5 Gbps (SStatus 113 SControl 300) 
ata4.00: ATA-7, max UDMA/133, 781422768 sectors: LBA48 NCQ (depth 0/32) 
ata4.00: configured for UDMA/133 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
  Vendor: ATA       Model: ST3400832AS       Rev: 3.01 
  Type:   Direct-Access                      ANSI SCSI revision: 05 
SCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) 
sda: Write Protect is off 
SCSI device sda: drive cache: write back 
SCSI device sda: 781422768 512-byte hdwr sectors (400088 MB) 
sda: Write Protect is off 
SCSI device sda: drive cache: write back 
 sda: 
sd 0:0:0:0: Attached scsi disk sda 
SCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) 
sdb: Write Protect is off 
SCSI device sdb: drive cache: write back 
SCSI device sdb: 781422768 512-byte hdwr sectors (400088 MB) 
sdb: Write Protect is off 
SCSI device sdb: drive cache: write back 
 sdb: 
sd 1:0:0:0: Attached scsi disk sdb 
SCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) 
sdc: Write Protect is off 
SCSI device sdc: drive cache: write back 
SCSI device sdc: 781422768 512-byte hdwr sectors (400088 MB) 
sdc: Write Protect is off 
SCSI device sdc: drive cache: write back 
 sdc: 
sd 2:0:0:0: Attached scsi disk sdc 
SCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) 
sdd: Write Protect is off 
SCSI device sdd: drive cache: write back 
SCSI device sdd: 781422768 512-byte hdwr sectors (400088 MB) 
sdd: Write Protect is off 
SCSI device sdd: drive cache: write back 
 sdd: 
sd 3:0:0:0: Attached scsi disk sdd 
sd 0:0:0:0: Attached scsi generic sg0 type 0 
sd 1:0:0:0: Attached scsi generic sg1 type 0 
sd 2:0:0:0: Attached scsi generic sg2 type 0 
sd 3:0:0:0: Attached scsi generic sg3 type 0 
physmap-flash.0: failed to claim resource 0 
ehci_hcd 0000:00:11.2: EHCI Host Controller 
ehci_hcd 0000:00:11.2: new USB bus registered, assigned bus number 1 
ehci_hcd 0000:00:11.2: irq 40, io mem 0x1010f000 
ehci_hcd 0000:00:11.2: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 
usb usb1: configuration #1 chosen from 1 choice 
hub 1-0:1.0: USB hub found 
hub 1-0:1.0: 5 ports detected 
ohci_hcd 0000:00:01.3: Itentionally disabling ITE USB controller. 
ohci_hcd 0000:00:01.3: init 0000:00:01.3 fail, -19 
ohci_hcd 0000:00:11.0: OHCI Host Controller 
ohci_hcd 0000:00:11.0: new USB bus registered, assigned bus number 2 
ohci_hcd 0000:00:11.0: irq 38, io mem 0x1010c000 
usb usb2: configuration #1 chosen from 1 choice 
hub 2-0:1.0: USB hub found 
hub 2-0:1.0: 3 ports detected 
ohci_hcd 0000:00:11.1: OHCI Host Controller 
ohci_hcd 0000:00:11.1: new USB bus registered, assigned bus number 3 
ohci_hcd 0000:00:11.1: irq 39, io mem 0x1010d000 
usb 1-1: new high speed USB device using ehci_hcd and address 2 
usb usb3: configuration #1 chosen from 1 choice 
hub 3-0:1.0: USB hub found 
hub 3-0:1.0: 2 ports detected 
usb 1-1: configuration #1 chosen from 1 choice 
Initializing USB Mass Storage driver... 
scsi4 : SCSI emulation for USB Mass Storage devices 
  Vendor: ITE TECH  Model:  PEN DRIVE Flash  Rev: 2.20 
  Type:   Direct-Access                      ANSI SCSI revision: 02 
Hooray! Discovered SCSI boot device! 
host_no [4], channel [0], id [0], lun [0] 
SCSI device sde: 1022976 512-byte hdwr sectors (524 MB) 
sde: Write Protect is off 
sde: assuming drive cache: write through 
SCSI device sde: 1022976 512-byte hdwr sectors (524 MB) 
sde: Write Protect is off 
sde: assuming drive cache: write through 
 sde: sde1 sde2 sde3 sde4 
SCSI device scsibd: 1022976 512-byte hdwr sectors (524 MB) 
scsibd: Write Protect is off 
scsibd: assuming drive cache: write through 
 scsibd: scsibd1 scsibd2 scsibd3 scsibd4 
sd 4:0:0:0: Attached scsi removable disk scsibd 
sd 4:0:0:0: Attached scsi generic sg4 type 0 
usbcore: registered new driver usb-storage 
USB Mass Storage support registered. 
usbcore: registered new driver hiddev 
usbcore: registered new driver usbhid 
drivers/usb/input/hid-core.c: v2.6:USB HID core driver 
Non-volatile memory driver v1.0 
i2c /dev entries driver 
Initialize ITE IIC adapter module 
 found device at 0x14014030 irq 0. 
ITE iic (i2c) algorithm module 
it87: Device not activated, enabling 
it87: Found IT8712F chip at 0x290, revision 8 
hwmon-vid: Unknown VRM version of your CPU 
md: linear personality registered for level -1 
md: raid0 personality registered for level 0 
md: raid1 personality registered for level 1 
md: raid10 personality registered for level 10 
raid6: int32x1    129 MB/s 
raid6: int32x2    152 MB/s 
raid6: int32x4    217 MB/s 
raid6: int32x8    170 MB/s 
raid6: using algorithm int32x4 (217 MB/s) 
md: raid6 personality registered for level 6 
md: raid5 personality registered for level 5 
md: raid4 personality registered for level 4 
raid5: measuring checksumming speed 
   8regs     :   550.000 MB/sec 
   8regs_prefetch:   519.000 MB/sec 
   32regs    :   643.000 MB/sec 
   32regs_prefetch:   602.000 MB/sec 
raid5: using function: 32regs (643.000 MB/sec) 
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27 
md: bitmap version 4.39 
device-mapper: ioctl: 4.7.0-ioctl (2006-06-24) initialised: dm-devel@redhat.com 
ip_tables: (C) 2000-2006 Netfilter Core Team 
TCP bic registered 
NET: Registered protocol family 1 
NET: Registered protocol family 17 
802.1Q VLAN Support v1.8 Ben Greear  
All bugs added by David S. Miller  
drivers/rtc/hctosys.c: unable to open rtc device (rtc0) 
md: Autodetecting RAID arrays. 
md: autorun ... 
md: ... autorun DONE.
Root device ("/dev/scsibd2") is now online. 
VFS: Mounted root (squashfs filesystem) readonly. 
Freeing unused kernel memory: 164k freed 
Doing sysinit 
Mounting procfs 
Mounting sysfs 
Starting udev 
Mounting nfsd 
Mounting tmpfs on /var (limited to [5242880] bytes) 
Mounting tmpfs on /tmp 
Mounting tmpfs on /mnt (limited to [131072] bytes) 
Creating dev entries for mtdblock devices... 
Boot device was /dev/scsibd, making partitions and 
mounting linuxrtconfig on /linuxrwfs (jffs2)... 
trying to mount jffs2 as rw partition... 
block2mtd: version $Revision: 1.1.1.3 $ 
actual jffs2 partition erase size will be [0x20000]... 
block2mtd: default erase size is [4096] 
block2mtd: mtd0: [d: /dev/scsibd1] erase_size = 128KiB [131072] 
block2mtd module loaded successfully. 
jffs2 will use mtdblock0 
Trying to mount jffs2 on /linuxrwfs... 
block2mtd: Overrun end of disk in cache readahead 
jffs2 mounted on /linuxrwfs 
Starting udevd... 
Starting udevtrigger... 
Starting udevsettle... 
Making useful softlinks... 
Removing hotplug... 
Mounting devpts... 
Start executing startup scripts... 
/etc/init.d/S01sysinit(start): doing some sysinit stuff... 
Dirty shutdown counter looks good... 
Dirty shutdown count is [3] 
Previous shutdown was dirty, message to user set... 
Checking the sanity of the rw file system... 
Softlinking /dev/sd0 to /dev/scsibd (bootenv may need it)... 
/etc/init.d/S01sysinit(start): OK 
/etc/init.d/S02checkroot(start): OK 
/etc/init.d/S02hwdep(start): Fixing gpio.conf files... 
Board hardware revision is [3]. 
gpio.conf already exists (OK) 
/etc/init.d/S03modules(start): OK 
/etc/init.d/S04raid(start): Starting up raids... 
Making additional md devices... 
Updating exports... 
found /etc/nas/spindown -- setting new spindown timeout... 
SATA spindown timeout set to 86400 seconds... 
Default RAID metadata version is 1.2 . 
There is no /etc/nas/uuids_stopped file -- starting all available arrays... 
md: md0 stopped. 
md: bind 
md: bind 
md: bind 
md: bind 
md: md0: raid array is not clean -- starting background reconstruction 
raid5: device sda operational as raid disk 0
raid5: device sdd operational as raid disk 3 
raid5: device sdc operational as raid disk 2 
raid5: device sdb operational as raid disk 1 
raid5: allocated 4212kB for md0 
raid5: raid level 5 set md0 active with 4 out of 4 devices, algorithm 2 
RAID5 conf printout: 
 --- rd:4 wd:4 fd:0 
 disk 0, o:1, dev:sda 
 disk 1, o:1, dev:sdb 
 disk 2, o:1, dev:sdc 
 disk 3, o:1, dev:sdd 
md: syncing RAID array md0 
md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc. 
md: using maximum available idle IO bandwidth (but not more than 7000 KB/sec) for reconstruction. 
md: using 128k window, over a total of 390711232 blocks. 
md: resuming recovery of md0 from checkpoint. 
mdadm: /dev/md/0 has been started with 4 drives. 
1853 
/etc/init.d/S04raid(start): OK 
/etc/init.d/S05lvm(start): Starting up lvm... 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
  WARNING: This metadata update is NOT backed up 
  1 logical volume(s) in volume group "RAIDA" now active 
/etc/init.d/S05lvm(start): OK 
/etc/init.d/S06mount(start): Mounting file systems... 
Running 70's disco mount... 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
  WARNING: This metadata update is NOT backed up 
  1 logical volume(s) in volume group "RAIDA" now active 
Checking for RAIDA - TEST 
Updated Fstab...[/dev/RAIDA/TEST        /mnt/RAIDA/TEST] 
Check mount point for /mnt/RAIDA/TEST 
Mount point DOES NOT exist 
Filesystem "dm-0": Disabling barriers, not supported by the underlying device 
XFS mounting filesystem dm-0 
Starting XFS recovery on filesystem: dm-0 (logdev: internal) 
Ending XFS recovery on filesystem: dm-0 (logdev: internal) 
Adding include path /mnt/RAIDA/TEST/.config/smb.conf 
Updated Fstab...[/mnt/RAIDA/TEST/share1 /mnt/ftp_dir/share1] 
  Reading all physical volumes.  This may take a while... 
  Found volume group "RAIDA" using metadata type lvm2 
  WARNING: This metadata update is NOT backed up 
/etc/init.d/S06mount(start): OK 
/etc/init.d/S07mtd(start): Making read-only mtd character devices... 
/etc/init.d/S07mtd(start): OK 
/etc/init.d/S08tmpfs(start): Preparing tmpfs directories... 
Making directories in /var: 
+run... 
+log directories and files (httpd, messages, wtmp, lastlog, cups, samba)... 
+cache... 
+empty... 
+ftp... 
+spool directories (cups, cron)... 
+tmp... 
+lock directories (apache, lvm, subsys, samba)... 
+lib directories (nfs, snmp)... 
+state directories... 
+yp directories... 
+samba private dir... 
Done making /var directories. 
Making anon ftp user dir... 
/etc/init.d/S08tmpfs(start): OK 
/etc/init.d/S09sensors(start): Setting up sensors ... 
/etc/init.d/S09sensors(start): OK 
Initializing random number generator... done. 
/etc/init.d/S21fixrandom(start): Fixing random devices... 
/etc/init.d/S21fixrandom(start): OK 
/etc/init.d/S25safenet(start): Starting crypto (loading aes)... 
/etc/init.d/S25safenet(start): OK 
/etc/init.d/S30certs(start): Generating self-signing certs (if necessary)... 
/etc/init.d/S30certs(start): OK 
Flushing all current rules and user defined chains: SUCCESS: 
Clearing all current rules and user defined chains: SUCCESS: 
Applying iptables firewall rules:  SUCCESS: 
Setting hostname:  NAS0018f804fa07 
Starting network... 
+starting loopback interface 
Dynamic network was not running lo 
udhcpc was not running for lo 
Autoipd was not running for lo 
No bonding device present. 
Device lo is present and available 
This is not a slave device 
 DHCP not used on device lo 
 Bringing up lo 
arping: Interface lo is not ARPable 
Updating ARP cache of other devices on this subnet. Please wait 2 sec. 
arping: Interface lo is not ARPable 
ARP tables updated successfully. 
Adding route add 127.0.0.0/8 dev lo 
+starting ifplugd... 
Starting Network Interface Plugging Daemon:No bonding device present. 
bond0 
Doing insmode for bonding module... 
Ethernet Channel Bonding Driver: v3.0.3 (March 23, 2006) 
bonding: MII link monitoring set to 100 ms 
Device bond0 is present and available 
This is a master device. Bringing link down and then up. 
Bringing up master link for bond. 
Dynamic network was not running eth0 
udhcpc was not running for eth0 
Autoipd was not running for eth0 
No bonding device present. 
Device eth0 is present and available 
Enslaving eth0 to bond0 
bonding: bond0: enslaving eth0 as a backup interface with a down link. 
Dynamic network was not running eth1 
udhcpc was not running for eth1 
Autoipd was not running for eth1 
No bonding device present. 
Device eth1 is present and available 
Enslaving eth1 to bond0 
bonding: bond0: enslaving eth1 as a backup interface with a down link. 
Restarting vblade service 
Stopping /sbin/nas_vblade...OK 
Restoring raw socket buffer sizes...OK 
skge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx 
bonding: bond0: link status up for interface eth0, enabling it in 200 ms. 
bonding: bond0: link status definitely up for interface eth0. 
bonding: bond0: making interface eth0 the new active one. 
bonding: bond0: first active interface up! 
Stopping /sbin/nas_vblade...OK 
udhcpc[2175]: udhcpc (v0.9.9-pre) started 
skge eth0: Link is up at 1000 Mbps, full duplex, flow control tx and rx 
udhcpc[2175]: Sending discover... 
. 
Waiting for network (60 second max): 
 + (try#1/12) Currently 1 active interfaces: 
   + bond0 : IP address not set 
udhcpc[2175]: Sending discover... 
udhcpc[2175]: Sending select for 10.20.30.40... 
udhcpc[2175]: Lease of 10.20.30.40 obtained, lease time 86400 
 + (try#2/12) Currently 1 active interfaces: 
   + bond0 : 10.20.30.40 
NET OK: All active interfaces are online. 
Starting Disk Aggregation Server... 
Stopping /sbin/nas_vblade...OK 
Starting ntpd: syncing (timeout in 20 seconds): OK 
Starting /sbin/portmap: OK 
Starting dropbear (from tcpserver): OK 
Starting /sbin/rpc.statd: OK 
Starting nfs services: 
Starting nfs quotas: 
Starting nfs daemon: 
Starting nfs mountd: 
/etc/init.d/S60vsftpd: setting maximum 2 connections 
/etc/init.d/S60vsftpd: setting maximum 2 connections per IP 
Starting vsftpd (from tcpserver): OK 
/etc/init.d/S82httpdswiw: setting maximum 99 connections 
/etc/init.d/S82httpdswiw: setting maximum 99 connections per IP 
Starting httpdswiw (from tcpserver): OK 
Starting httpdsl1 (from tcpserver): OK 
/etc/init.d/S84httpds: setting maximum 99 connections 
/etc/init.d/S84httpds: setting maximum 99 connections per IP 
Starting httpds (from tcpserver): OK 
/etc/init.d/S85httpd: setting maximum 99 connections 
/etc/init.d/S85httpd: setting maximum 99 connections per IP 
Starting httpd (from tcpserver): OK 
Starting UPnP daemon: OK 
/etc/init.d/S90samba: setting maximum 15 connections 
Starting samba: secrets.tdb : 1 records 
OK 
Starting winbind daemon: OK 
Starting CRON daemon: OK 
Starting auto nice daemon:/usr/sbin/and[2500]: Configuration file is: /etc/and.conf 
/usr/sbin/and[2500]: Priority database is: /etc/and.priorities 
/usr/sbin/and[2500]: AND ready. 
 done 
Starting Discovery Agent daemon: OK 
Starting mDNSPosix daemon: 
 +Writing /tmp/mDNSPosix.conf...OK 
/etc/init.d/S99local(start): Finalizing system startup... 
watchdog not started (userland have to keep it that way). 
  +starting gpio_poller --disable-watchdog (watchdog is disabled)... 
Indicating that boot was OK... 
Setting bootstate to A0... 
Unsetting bootcount... 
bootcount: No matching variable to unset 
Warning: couldn't unset bootcount. 
/etc/init.d/S99local(start): OK

My next task was to determine a working login username and password. Fortunately, the same username and password that is used for the NSS4000’s web interface will work (as an unprivileged user) on the serial console. Unfortunately, attempts to guess the root password failed, so I resorted to restarting the system and interrupting the boot process. The standard boot string is:

boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3

to which I added “single” to get the box to stop in single-user mode:

boot /dev/sd0@0x100 root=/dev/scsibd2 hwrev=3 single

At that point, I did a ^D to continue with the startup process (necessary to mount the filesystems on from the USB flash drive) and then did a “passwd root” to change the root password.

After that, I was able to read all files on the system, including one named “gpio.config” which described a “diagnostic jumper” that would enable the Dropbear SSH server (needed if I wanted to remotely connect to the box instead of using the serial console). After tracing out some wiring, I found that J34 is the jumper in question, located here:

A quick scrounge through the parts box yielded an appropriate jumper:

And I had my SSH console working.

That’s it for now – in a subsequent article I will discuss building the NSS4000 software from the Linksys GPL distribution, as well as adding additional utilities.

UPDATE: The diag jumper also causes additional testing while in the PMON2000 monitor, as well as preventing unattended booting (since one of the PMON diagnostics fails, autoboot is disabled). A better way to enable the dropbear SSH server is to leave the diag jumper off and to edit line 26 of the file /linuxrwfs/etc/init.d/S02hwdep to read /usr/sbin/dropbear_start.sh instead of /usr/sbin/dropbear_stop.sh.