OpenWrt Forum Archive

Topic: Crap my pants! IDE + USB 2.0 + WiFi G + 1GB Ethernet for $150!! Linux!

The content of this topic has been archived on 24 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Ok, why are we not all over this device like crazy?


DLink DSM-G600 NAS device. http://www.dlink.com/products/?pid=377&sec=0

* Use with an internal 3.5" ATA/IDE hard drive to create extra network storage (not included)
* 1 10/100/1000 Gigabit Ethernet Port
* 2 USB 2.0 ports let you expand your storage capabilities by adding more external hard drives
* Also functions as a wireless access point to create or expand your 802.11g wireless network


Three weeks ago they released GPL files for it:

http://support.dlink.com/faq/view.asp?p … estion=GPL


Price
=========
In the USA, Best Buy is selling these right now for $150 and there is even 2 rebates for $20 + $10... so $120 after rebate.  http://www.bestbuy.com/site/olspage.jsp … 4432576118


The uses!
==========
I mean you could use this as a 3 way wireless router (built in plus 2 USB WiFi adapters), you could use it for USB cameras... this device has huge potential.


Can someone study the GPL files for download... what do we need to do to build our own firmware sets?

(Last edited by RoundSparrow on 19 Jan 2006, 07:31)

Sounds cool. Does anybody know what processor, flash, memory, wireless chipset it has?

Cheers, Paul.

This is a NAS, no routing functions as far as I can see.  Not finding a lot in the way of serious specifications or reviews of this device. If you buy one, an autopsy with digital photos of the board would be very welcomed!

The GPL release directory indicates that it's PPC based and uses the uClibc toolchain. No build system or image building tools, though sad

I just picked one up at BB.

FCC ID: RRK20040603056

FCC filings:

https://gullfoss2.fcc.gov/prod/oet/cf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=515372&fcc_id='RRK20040603056'



You can open it without voiding the warranty. Raylink RT2560 mini pci card. http://www.ralinktech.com/prod-07.htm

Processor specs: http://www.digchip.com/datasheets/parts … ZP200B.php

Looks like it's got 2-3 serial ports and a JTAG connector internally.

(Last edited by whm3 on 19 Jan 2006, 19:57)

Looks like those FCC regs are only for the raylink card. I'll play with it more tonight to see if i can get serial console.

I'll also take pictures of the board. If I can't get serial console I'll probably return it. I do have a spare atheros minipci card to throw in it tho.....

(Last edited by whm3 on 19 Jan 2006, 20:39)

nbd wrote:

The GPL release directory indicates that it's PPC based and uses the uClibc toolchain. No build system or image building tools, though sad

Nothing in the packaging referencing the GPL either. At least with the wgt634u it came with a printed GPL in the packaging.

Going through the GPL stuff a little bit, looks like they just dumped some developer's old homedir or something... (whoever wilsonc is)
Another note, this is old code.  Also keep in mind, I havn't looked at a regular ppc sourcetree, so this might be generic stuff.

[whm@megatron ppclinux]$ cat NOTE
2003-04-03 21:56
1.Fix the calibrate timer problem(divisor 4)
2.Mark out the useless comment and code.
3.Makr out the CPU_CAN_DOZE to prevent panic

[TODO]
1.Pull out the MTD!

[whm@megatron ppclinux]$

MTD memory mapping:

[whm@megatron ppclinux]$ cat mtd_map.txt
Total 0x400000 MB
----------------------------------------------------------------------
Phy Addr        Offset-Name                     Size
----------------------------------------------------------------------
FFC0:0000       0000:0000
                MTD0                            =       64KB

FFC1:0000       0001:0000
                Linux Ramdisk           =       2.936MB

FFF0:0000       0030:0000
                UBoot Boot Loader       =       64KB

FFF1:0000       0031:0000
                Linux Kernel            =       936KB

[whm@megatron ppclinux]$

The dev log...

[whm@megatron ppclinux]$ cat REX_LOG
20030417:
1.From 0411, I have correct the IRQ layout of 2 miniPCI slots.
2.Strip the net support of U-boot, thus size reduces below 128k.
3.Strip the net support to avoid reboot "Bad trap 0x800" bug.

20030411:
1.continue snmpd, brctl, and openssl, and ebtable.
2.WARNING!!! Change the kernel Ramdisk setting to 6144 instead of 4096

20030410:
1.Add linux-wlan-ng userspace code(old rootfsdir is in backup)

20030409:
1. Add bridge support in user and kernel
2. Add snmpd
3. eb-tables

20030408:
1. Added QoS kernel support
2. Added all library-user space
3. MTD is OK to upgrade firmware
4. Orinoco modules work
5. downgrade tinylogin to 0.8
6. port tinylogin successfully
7. May resolve the Oops problem
8. Cancel the flash space for Uboot ENV
9. Uboot can autoboot now
10.Reduce the Uboot size for 6kb

20030407:
1.Add MTD support
[whm@megatron ppclinux]$

The stock kernel config:

[whm@megatron ppclinux]$ cat .config|grep -v ^#
CONFIG_RWSEM_XCHGADD_ALGORITHM=y
CONFIG_HAVE_DEC_LOCK=y
CONFIG_EXPERIMENTAL=y
CONFIG_MODULES=y
CONFIG_KMOD=y
CONFIG_PPC=y
CONFIG_PPC32=y
CONFIG_6xx=y
CONFIG_PPC_STD_MMU=y
CONFIG_SANDPOINT=y
CONFIG_PPC_ISATIMER=y
CONFIG_PCI=y
CONFIG_NET=y
CONFIG_SYSCTL=y
CONFIG_SYSVIPC=y
CONFIG_KCORE_ELF=y
CONFIG_BINFMT_ELF=y
CONFIG_KERNEL_ELF=y
CONFIG_HOTPLUG=y
CONFIG_MTD=y
CONFIG_MTD_PARTITIONS=y
CONFIG_MTD_CHAR=y
CONFIG_MTD_BLOCK=y
CONFIG_MTD_CFI=y
CONFIG_MTD_GEN_PROBE=y
CONFIG_MTD_CFI_AMDSTD=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_SIZE=6144
CONFIG_BLK_DEV_INITRD=y
CONFIG_PACKET=y
CONFIG_INET=y
CONFIG_BRIDGE=m
CONFIG_SCSI=y
CONFIG_BLK_DEV_SD=y
CONFIG_SD_EXTRA_DEVS=40
CONFIG_BLK_DEV_SR=y
CONFIG_BLK_DEV_SR_VENDOR=y
CONFIG_SR_EXTRA_DEVS=2
CONFIG_CHR_DEV_SG=y
CONFIG_SCSI_DEBUG_QUEUES=y
CONFIG_SCSI_MULTI_LUN=y
CONFIG_SCSI_ACARD=y
CONFIG_NETDEVICES=y
CONFIG_BONDING=m
CONFIG_NET_ETHERNET=y
CONFIG_NET_PCI=y
CONFIG_TULIP=y
CONFIG_IP1000A=y
CONFIG_NET_RADIO=y
CONFIG_HERMES=m
CONFIG_PCI_HERMES=m
CONFIG_NET_WIRELESS=y
CONFIG_SERIAL=y
CONFIG_SERIAL_CONSOLE=y
CONFIG_AUTOFS4_FS=y
CONFIG_EXT3_FS=y
CONFIG_JBD=y
CONFIG_FAT_FS=y
CONFIG_MSDOS_FS=y
CONFIG_VFAT_FS=y
CONFIG_CRAMFS=y
CONFIG_RAMFS=y
CONFIG_ISO9660_FS=y
CONFIG_JOLIET=y
CONFIG_ZISOFS=y
CONFIG_MINIX_FS=y
CONFIG_NTFS_FS=y
CONFIG_NTFS_RW=y
CONFIG_PROC_FS=y
CONFIG_EXT2_FS=y
CONFIG_UDF_FS=y
CONFIG_UDF_RW=y
CONFIG_NFS_FS=y
CONFIG_NFS_V3=y
CONFIG_SUNRPC=y
CONFIG_LOCKD=y
CONFIG_LOCKD_V4=y
CONFIG_ZISOFS_FS=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_MSDOS_PARTITION=y
CONFIG_NLS=y
CONFIG_NLS_DEFAULT="iso8859-1"
CONFIG_NLS_CODEPAGE_950=y
CONFIG_USB=y
CONFIG_USB_EHCI_HCD=m
CONFIG_USB_OHCI=m
CONFIG_USB_STORAGE=m
CONFIG_USB_PRINTER=m
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y

[whm@megatron ppclinux]$

Board Detail

http://img456.imageshack.us/img456/26/boarddetail0tb.th.jpg

Possible Serial and JTAG connections

http://img456.imageshack.us/img456/7246/jtagserialmaybe9mu.th.jpg

IDE and other Stuff.

http://img203.imageshack.us/img203/2894/ide9ht.th.jpg

Extra Pads:

http://img203.imageshack.us/img203/811/frontpads4iu.th.jpg

http://img203.imageshack.us/img203/1434/frontpads22ay.th.jpg

Some quick notes -

The firmware starts off with several 4 byte integers, following a pattern of <offset><size>

hexdump -Cv
00000000  00 00 00 40 00 0d 04 da  00 0d 05 1a 00 2d e0 93  |...@.........-..|
00000010  00 3a e5 ad 00 00 07 42  3d 7b 02 8f ed f1 8c c4  |.:.....B={......|

So, we end up with:

offset   size
00000040  000D04DA = kernel "vmlinux" (gzipped)
000D051A  002DE093 = ramdisk "ramdisk_el" (gzipped ext2)
003AE5AD  00000742 = tar.gz archive

The kernel and the ramdisk both have a 0x40 byte header before the file begins; I'm not terribly concerned with what's in the headers, although the filename and sizes are pretty obvious. The files begin with the sequence 1F 8B 08 08, which everyone should memorize since it's the magic sequence to start a gzip file.

Mounting the ramdisk gives you the root filesystem which somewhat surprisingly contains yet more data on a cramfs filesystem image contained within. On startup it'll run /etc/rc.sh which will mount the various filesystems and initialize the drive before running /usr/sbin/chk_fun_plug .. (what an interesting name, what does it do? oh, it checks for file called fun_plug on the disk and then executes it) or in other words it's a backdoor.

Not much else of interest on the firmware, and I didn't even bother grabbing the gpl'd sources.

Wow. This thing is going to be easy to hack. No serial console needed. Thanks to [mbm] for helping break up the firmware filesystem images.

filesystem images available here.

Loopback mount them, and they're good to go.

Let the router format the disk, throw it in another system, create a file called "fun_plug" at the root of that disk with execute perms, and your're set. That file is shared on the default samba share from the router, so if you smbmount it you can edit to your heart's content to make it do all kinds of stuff, like:

#!/bin/sh

dmesg > /mnt/HD_a2/dmesg.out

Which produces:

[root@optimus sdc1]# more dmesg.out
Total memory 33554432 MB.
Memory BAT mapping: BAT2=32Mb, BAT3=0Mb, residual: 0Mb
Total memory is 33554432.
CPU = 82xx
Linux version 2.4.21-pre4 (ffna@swtest2) (gcc version 2.95.4 20010319 (prereleas
e)) #480 ¥| 8¤ë 25 17:39:08 CST 2005
OpenPIC_Addr in mpc10x_bridge_init function is fc040000
Motorola SPS Sandpoint Test Platform
Port by MontaVista Software, Inc. (source@mvista.com)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=ttyS0,9600
OpenPIC Version 1.2 (1 CPUs and 123 IRQ sources) at fc040000
Calibrating delay loop... 133.12 BogoMIPS
Memory: 27312k available (1560k kernel code, 508k data, 60k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
PCI fixup irq: (PCI device 1814:0201) got 0
PCI fixup irq: (PCI device 1033:0035) got 1
PCI fixup irq: (PCI device 1033:0035) got -1
PCI fixup irq: (PCI device 1033:00e0) got 2
PCI fixup irq: (PCI device 13f0:1023) got 3
PCI fixup irq: (PCI device 1191:0008) got 4
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
NTFS driver v1.1.22 [Flags: R/W]
udf: registering filesystem
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled
ttyS00 at 0xfc004500 (IOMEM)(irq = 121) is a ST16650
ttyS01 at 0xfc004600 (IOMEM)(irq = 122) is a ST16650
RAMDISK driver initialized: 16 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
ipg : v0.36 10/31/01  Written by Craig Rich, www.sundanceti.com
IC PLUS IP1000 1000/100/10 based NIC found.
Ethernet device registered as: eth0
IPG module loaded.
SCSI subsystem driver Revision: 1.00
atp86x_detect:
   ACARD ATP-865 PCI ATA133 2-Channels Host Adapter: 0    IO:FEBFFEF8, IRQ:4.
         ID:  0  Maxtor 53073H4                   UDMA5 (100)
scsi0 : ACARD ATP86X PCI ATA133 Adapter Driver Ver: 0.78  Date: 2004/01/15

  Vendor: Maxtor 5  Model: 3073H4            Rev:
  Type:   Direct-Access                      ANSI SCSI revision: 02
Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 60030431 512-byte hdwr sectors (15368 MB)
Partition check:
 sda1 sda2
USI AMD/FUJITSU flash: probing 8-bit flash bus
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Creating 5 MTD partitions on "USI Intel flash":
0x00000000-0x00010000 : "Linux mtd1"
0x00010000-0x00020000 : "Linux mtd2"
0x00020000-0x00300000 : "Linux Ramdisk"
0x00300000-0x00310000 : "U-BOOT BOOT LOADER"
0x00310000-0x00400000 : "Linux Kernel"
usb.c: registered new driver hub
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2936k freed
VFS: Mounted root (ext2 filesystem) readonly.
Freeing unused kernel memory: 60k init
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
bonding.c:v2.4.20-20021210 (December 10, 2002)
br0 registered with MII link monitoring set to 100 ms, in fault-tolerance (activ
e-backup) mode.
br0 registered without ARP monitoring
br0: released all slaves
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: link status definitely up for interface eth0.
 and making interface eth0 the active one.
br0: releasing active interface eth0 but could not find any backup interface.
br0: now running without any active interface !
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
br0: releasing backup interface eth0.
br0: now running without any active interface !
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
Adding Swap: 530104k swap-space (priority -1)
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: link status definitely up for interface eth0.
 and making interface eth0 the active one.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on sd(8,2), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
ehci_hcd 00:0e.2: PCI device 1033:00e0
ehci_hcd 00:0e.2: irq 2, pci mem c306af00
usb.c: new USB bus registered, assigned bus number 1
ehci_hcd 00:0e.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 5 ports detected
usb-ohci.c: USB OHCI at membase 0xc3073000, IRQ 1
usb-ohci.c: usb-00:0e.0, PCI device 1033:0035
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 3 ports detected
usb-ohci.c: USB OHCI at membase 0xc3075000, IRQ -1
usb-ohci.c: usb-00:0e.1, PCI device 1033:0035
usb.c: new USB bus registered, assigned bus number 3
request_irq irq >= NR_IRQS fail
usb-ohci.c: request interrupt -1 failed
usb.c: USB bus 3 deregistered
Trying to vfree() nonexistent vm area (c3075000)
Initializing USB Mass Storage driver...
my_host_number = 1
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
ra0: at 0xbfffe000, VA 0xc30ab000, IRQ 0.
ra0: RT2500_open() irq 0. MAC = 00:13:46:d9:a4:6f
pAdapter->PortCfg.StaWithEtherBridge.Enable = FALSE
bond_enslave(): MII and ETHTOOL support not available for interface ra0, and arp
_interval/arp_ip_target module parameters not specified, thus bonding will not d
etect link failures! see bonding.txt for details.
br0: enslaving ra0 as a backup interface with an up link.
br0: releasing active interface eth0 and making interface eth0 the active one.
br0: releasing backup interface ra0.
br0: now running without any active interface !
br0: released all slaves
NET4: Ethernet Bridge 008 for NET4.0
device eth0 entered promiscuous mode
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: port 1(eth0) entering listening state
device ra0 entered promiscuous mode
Current Tx Antenna = Antenna B
Current Rx Antenna = Antenna B
br0: port 2(ra0) entering listening state
br0: port 1(eth0) entering learning state
br0: port 2(ra0) entering learning state
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected

Anyone got a static elf dropbear for ppc handy?

(Last edited by whm3 on 20 Jan 2006, 05:01)

http://img456.imageshack.us/img456/7246/jtagserialmaybe9mu.th.jpg
Serial perhaps, but that array of pads looks nothing like a JTAG pinout.  On a JTAG there are six pins in a row connected directly to ground. Do any signals show up on those 4-pin connectors?
http://img203.imageshack.us/img203/811/frontpads4iu.th.jpg
Definitely a USB port.  Probably rerouted from some other form factor.

http://img203.imageshack.us/img203/1434/frontpads22ay.th.jpg
Place for a hardware switch (possibly an exposed GPIO) and an LED (another GPIO).

(Last edited by NateTrue on 20 Jan 2006, 04:51)

NateTrue wrote:

http://img456.imageshack.us/img456/7246 … 9mu.th.jpg
Serial perhaps, but that array of pads looks nothing like a JTAG pinout.  On a JTAG there are six pins in a row connected directly to ground. Do any signals show up on those 4-pin connectors?
http://img203.imageshack.us/img203/811/ … 4iu.th.jpg
Definitely a USB port.  Probably rerouted from some other form factor.

http://img203.imageshack.us/img203/1434 … 2ay.th.jpg
Place for a hardware switch (possibly an exposed GPIO) and an LED (another GPIO).

There's another vendor (can't remember who, stumbled across it today) who has a nas only, (No WLAN) board with an extra USB out in the front, same LED placement, except 1 more. Looks like its a common board indeed.

(Last edited by whm3 on 20 Jan 2006, 04:53)

Any ideas if you can turn the DSM-G600 into a USB print server? Also, would anybody share any of their fun_plug files? I just want to see what kind of cool things people are doing with this cool little box.  Thank you.

sharing is good
kevin:~/dsm-g600b# cat fun_plug
#!/bin/sh
dmesg > /mnt/HD_a2/dmesg.out
/mnt/HD_a2/busybox nc -l -p 10023 -e /bin/sh &

(you will need to cross compile busybox or nc to do that, of course, as the busybox in the firmware does not have nc)  if you want to use it for some reason, you have have mine

So i grabbed a revB board at circuitcity  for $99 this weekend. Anyone have a how2 on getting your own kernel compiled and working on these devices? My NSLU2 is getting alittle slow for me.

Was able to share the root of the file system via the fun_plug workaround

Heres how:

   
1. create a fun_plug file in the root of the disk

#!/bin/sh
sleep 20
# kill samba
/bin/smb stop
# Start samba and read the conf file on the hd
/usr/sbin/samba/smbd -D -s /mnt/HD_a2/smb.conf
/usr/sbin/samba/nmbd -D -s /mnt/HD_a2/smb.conf




2. create a smb.conf file in the root of the disk


[ global ]
client code page = 850
character set = 850
workgroup = WORKGROUP
netbios name = DSM-G600
server string = NAS
hosts allow =
hosts deny =
security = SHARE
encrypt passwords = yes
max log size = 0
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=8192 SO_SNDBUF=8192
max xmit = 65535
create mask = 0777
directory mask  = 0777
force create mode = 0777
force directory mode = 0777

[ root ]
comment = root
path = /
valid users =
read only = no
guest ok = yes

[ web_page ]
comment = Enter Our Web Page Setting
path = /mnt/web_page
valid users =
read only = yes
guest ok = yes

[ HDD_a ]
comment = Hard Drive / Flash Drive / Single Function CardReader
path = /mnt/HD_a2
valid users =
read only = no
guest ok = yes

loki wrote:

So i grabbed a revB board at circuitcity  for $99 this weekend. Anyone have a how2 on getting your own kernel compiled and working on these devices?

First you should setup ppc toolchain smile If you are going to use the one provided by d-link, then you are going to face some problems:

./ppc-instructions: In function `convert_to_integer':
./ppc-instructions:1221: error: label at end of compound statement

and here is patch for this problem:
http://mail-index.netbsd.org/pkgsrc-bug … /0001.html

I also did get

gdbtypes.c: In function `recursive_dump_type':
gdbtypes.c:3059: error: invalid lvalue in increment

and here are some workarounds:
http://gcc.gnu.org/ml/gcc-bugs/2004-02/msg02522.html
http://gcc.gnu.org/ml/gcc-patches/2003-10/msg02027.html

For testing I did build ctorrent-dnh2 binary for DSM-G600. I cant test them myself because my DSM-G600 is still on the way to Estonia.
http://www2.msn.ee/dsm-g600-bin/

(Last edited by sala on 11 Jul 2006, 15:05)

Is there any possibility to add/replace the uPnP Server with a custom made firmware? The one used by Dlink seems to have problems with long filenames/directory structures.
Best Regards, Bateman

A zombie just ate my brain.

The discussion might have continued from here.